Authentication bypass in BusyBox httpd occurs when the server is configured with HTTP Basic Authentication backed by yescrypt ($y$-prefixed) password hashes, which the daemon fails to recognize as hashes and instead compares literally as plaintext - inverting the auth check so the stored hash string itself becomes a usable credential. The flaw is network-reachable and requires no prior authentication (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N, 6.5), with high attack complexity reflecting the dependency on the non-universal yescrypt configuration and the attacker's need to know or obtain the stored hash; impact skews to confidentiality (C:H) with limited integrity effect (I:L). Exposure is concentrated in Red Hat Hardened Images and other deployments where BusyBox httpd actually fronts authentication; there is no public exploit identified at time of analysis and no CISA KEV listing, so this is a configuration-gated weakness rather than a demonstrated in-the-wild attack.
Content-Disposition enforcement bypass in Apache Sling Security Bundle before 1.3.12 allows remote attackers to circumvent the ContentDispositionFilter by accessing attacker-influenced resources through an alternate URL/API shape not mediated by the filter, potentially causing resources to be served inline rather than as attachments. This protection-mechanism failure (CWE-693) can lead to low confidentiality and integrity impacts, such as information disclosure or client-side script execution, and requires user interaction to open a crafted link. Deployments that rely on this filter for content-disposition protection are affected; no public exploit identified at time of analysis.
Unauthenticated attackers can capture another buyer's approved-but-uncaptured PayPal payment against a WooCommerce order of their own choosing in Payment Plugins for PayPal WooCommerce versions before 2.0.27. The plugin fails to confirm that the PayPal order supplied in a payment request actually belongs to the WooCommerce order being paid unless that PayPal order is already completed, so any store running the vulnerable plugin with the PayPal gateway active is exposed. Exploitation is remote and unauthenticated (CVSS:3.1/AV:N/AC:H/PR:N/UI:N) but gated by a timing prerequisite - a different buyer must have an approved, not-yet-captured PayPal order whose identifier the attacker can supply - yielding a conditional integrity impact (C:L/I:H/A:N, CVSS 6.5) rather than a high-urgency emergency; no public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (not in CISA KEV). A vendor patch is available in 2.0.27.
Authenticated attackers with nothing more than a Subscriber-level account can delete arbitrary business listings - including listings owned by other users - on WordPress sites running the Directorist directory/classifieds plugin from version 3.1.0 up to (but not including) 8.9.5. The root cause is a listing-deletion code path that does not verify ownership, a route that the earlier fixes for CVE-2023-1889 and CVE-2023-35052 failed to close, making this an incomplete-fix regression rather than a novel bug class. Scoring 6.5 under CVSS 3.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N), the issue is purely an integrity problem with no confidentiality loss and no availability impact, and no public exploit code has been identified at time of analysis. Exposure is highest on directory and classified-ad sites that leave WordPress 'Anyone can register' enabled, since a self-registered Subscriber is sufficient to weaponize the flaw.
Unauthenticated attackers can read and overwrite any subscriber's personal data - including changing their email address - on WordPress sites running the Newsletters plugin at any version before 4.18.1. Because the plugin hands out a management session to unauthenticated visitors on request and then omits an ownership check on several subscriber-management actions, no credentials, user interaction, or non-default configuration are needed; the attacker simply requests a session and then references another subscriber's record directly. The impact is bounded to the plugin's subscriber dataset (PII disclosure plus record/email tampering) rather than full WordPress takeover, and this is a moderate-priority issue: no public exploit code has been identified at time of analysis and CISA's SSVC assessment rates exploitation as none while marking the flaw automatable, so mass scanning should be expected even without a published PoC. A vendor patch is available in 4.18.1; EPSS data was not provided in the source set.
Broken access control in Cinnamon's Kotaemon (all versions up to and including v0.12.0) allows any authenticated user on a shared, multi-user deployment to read, rename, delete, or overwrite the chat suggestion list of another user's conversations simply by supplying a victim's conversation ID, because four handler methods in libs/ktem/ktem/pages/chat/control.py load Conversation records without comparing the requester's user_id to Conversation.user. Exploitation requires a valid account on a multi-user instance where tenants share the same conversation store, needs no victim interaction, and is limited to accounts that can supply or enumerate valid conversation IDs (independent assessment: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, a moderate-priority broken-access-control/IDOR issue). There is no public exploit identified at time of analysis, EPSS is low at 0.14% (3rd percentile), and CISA SSVC records Exploitation: none with partial technical impact.
Apache Tomcat's OpenSSL and OpenSSL-FFM TLS connectors ignore certificate revocation lists when the certificate is loaded from a keystore, so a client certificate that has already been revoked can still be accepted for mutual-TLS authentication. Affected releases are 11.0.0-M1 through 11.0.25, 10.1.0-M1 through 10.1.58, and 9.0.0-M1 through 9.0.121, with end-of-life 8.5.0 through 8.5.100 also known to be affected; fixed versions are 11.0.26, 10.1.59, and 9.0.122. No vendor CVSS score, EPSS value, CISA KEV entry, or public proof-of-concept was supplied, and our internal assessment rates the issue CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N, reachable unauthenticated but only in the non-default combination of an OpenSSL or OpenSSL-FFM TLS connector, keystore-based certificates, mutual-TLS client-certificate authentication, and CRL-based revocation checking; no public exploit identified at time of analysis.
Authorization bypass through a user-controlled key (CWE-639 IDOR) in the YITH WooCommerce Request A Quote plugin for WordPress allows remote attackers to act on quote-request objects they should not control, on any site running a version before 4.46.1. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) confirms exploitation is remote, low complexity, unauthenticated and requires no user interaction, though damage is bounded to low integrity impact with no confidentiality or availability effect stated. No public exploit code identified at time of analysis, with no KEV or EPSS signals supplied, but the vendor has released a fixed version (4.46.1) and the issue was reported by Patchstack, so sites exposing the request-a-quote endpoints should treat patching as urgent housekeeping rather than a theoretical concern.
Stored cross-site scripting in Ultimate Addons for Contact Form 7 (all versions through 3.5.50) allows an authenticated user with Contributor-level access to inject script into plugin-rendered content that later executes in the browser of a higher-privileged user such as an administrator or editor who views that content. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, base 6.5 per the vendor score) requires both a low-privileged account and victim interaction, so realistic exposure is limited to WordPress sites that grant Contributor accounts to untrusted parties; there is no identified pre-authentication path. No public exploit code and no CISA KEV entry were identified at time of analysis, making this a moderate-priority rather than high-priority issue, though the scope-change characteristic means injected script can act outside the plugin's own origin context within the site.
Authenticated Subscriber-level cross-site scripting in PixelYourSite - Your smart PIXEL (TAG) Manager versions 11.4.1 and earlier allows a user with a WordPress Subscriber account or higher to inject script that executes in the browser of a privileged administrator when the injected content is viewed. Exploitation requires two conditions: the attacker must be able to register or obtain a Subscriber-level account (PR:L per the assessed vector), and a victim administrator must interact with the page rendering the payload (UI:R); there is no unauthenticated or fully automated path against a default configuration. No public exploit identified at time of analysis, and the independent assessment rates this as a genuine but moderate-priority issue rather than an inflated high-CVSS finding.
Unauthenticated broken access control in the Conekta Payment Gateway WordPress plugin (all versions up to and including 6.2.4) lets a remote attacker reach a plugin endpoint that is missing a proper authorization check and perform a limited integrity-impacting action without logging in and without any victim interaction. Per the assessed CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), the consequence is confined to tampering - no confidentiality loss and no availability impact - and no public exploit has been identified at time of analysis, so real-world priority is moderate at best. The exposure is further limited by the plugin's niche footprint as a regional (Latin American) payment gateway rather than a broadly deployed platform component.
Arbitrary file deletion in WP User Frontend (weDevs) versions up to and including 4.3.11 allows an authenticated Subscriber-level user to delete arbitrary files on the server via a path traversal flaw (CWE-22), degrading availability. The vulnerability is network-reachable with low complexity (CVSS 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), and because the plugin is commonly deployed on sites with open self-registration, an attacker can typically obtain the required low-privilege account themselves. No public exploit code has been identified at time of analysis, and there is no confirmed active exploitation (CISA KEV).
WP User Frontend versions up to and including 4.3.11 contain an authentication bypass by spoofing that allows an authenticated Subscriber-level user to exceed their intended authorization and modify protected data (CVSS 6.5, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N). Exploitation is remote, low-complexity, and requires no user interaction, but the attacker must first hold a valid low-privilege account; this is realistic on WordPress sites that enable open self-registration for the plugin. No public exploit identified at time of analysis and no CISA KEV active exploitation is reported in the supplied data, and the exact vulnerable endpoint should be confirmed against the Patchstack advisory.
Stored cross-site scripting in the WordPress plugin Podcast Importer SecondLine affects versions up to and including 1.5.6, allowing an authenticated user with Contributor-level access or higher to inject script content that executes in a higher-privileged user's browser. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) reflects a cross-privilege, moderate-severity issue rated 6.5: the attacker needs a Contributor foothold (self-registration or granted authorship) and an administrator must subsequently view the poisoned content in the dashboard, so there is no anonymous or drive-by execution against default visitors. No public exploit code has been identified at time of analysis and the plugin is not listed as confirmed actively exploited (CISA KEV); Patchstack is credited with the report and the ENISA EUVD entry (EUVD-2026-85486) tracks it as well.
Stored cross-site scripting in the WordPress plugin The Post Grid (RadiusTheme), affecting all versions through 7.9.5, allows an authenticated attacker holding Contributor-level access to persist malicious script that executes in a higher-privileged user's session. The independent assessment confirms a CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N vector: exploitation requires a Contributor account and additionally depends on an administrator or editor subsequently viewing the attacker-supplied content, and no unauthenticated path exists. No public exploit identified at time of analysis, and the vendor-supplied vector's availability component (A:L) is not corroborated by the assessed vector, which reports A:N. Risk is moderate in practice because sites that do not grant Contributor-or-higher roles to untrusted users are not exposed.
Stored cross-site scripting in The Post Grid WordPress plugin (RadiusTheme) affects versions up to and including 7.9.5, allowing an authenticated user with Contributor-level access to inject script content that executes in the browser of a higher-privileged user - typically an administrator or editor reviewing the submission in wp-admin. The issue is rated 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N per our assessment), and exploitation requires both an authenticated Contributor account and subsequent victim interaction, so this is a moderate-severity, low-real-world-priority issue rather than a mass-exploitation threat. No confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; the vulnerability was reported through Patchstack and is tracked as EUVD-2026-85483.
ElementsKit Elementor addons Lite through version 4.0.5 contains a Cross-Site Scripting flaw (CWE-79) that lets a low-privileged user plant script content which executes in a higher-privileged user's browser session. Exploitation requires an authenticated WordPress account with at least Contributor-level privileges (CVSS vector PR:L), and the payload only fires when an administrator or other privileged user views the attacker-controlled content, making victim interaction a hard prerequisite (UI:R). The scope is rated Changed because the injected script runs in the victim's session rather than the attacker's own context, so it can act with the victim's privileges; no KEV listing or public exploit code was identified at time of analysis, and Patchstack is the reporting source. Impact is bounded to low confidentiality, integrity, and availability effects under the assessed vector, but the Changed scope means an administrator session could be abused for further actions inside the WordPress dashboard.
Unauthenticated broken access control in the AppMySite WordPress plugin (all versions up to and including 3.15.4) lets remote attackers trigger privileged plugin functionality without any credentials or user interaction, degrading site integrity. Reported by Patchstack and mirrored as EUVD-2026-85481, the issue carries a published CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L (base 6.5); our independent assessment agrees the attack path is remote, low-complexity, and unauthenticated, but caps the impact at low integrity (C:N/I:L/A:N) because no confidentiality or availability impact was demonstrated. The attack surface is limited to sites where the plugin is installed and active, and no public exploit code or confirmed active exploitation has been identified at time of analysis, although the trivial attack complexity means exploitation is straightforward once the specific unprotected endpoint is located.
Stored cross-site scripting in the Ditty WordPress plugin (versions through 3.1.69) allows an authenticated attacker holding at least Contributor-level privileges on a site to plant script that later executes in the browser of a higher-privileged user, such as an administrator, who views the affected content. Exploitation requires both a low-privileged foothold account and victim interaction, which keeps this a modest-priority issue (CVSS 6.5, AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), and no public exploit code or confirmed active exploitation was identified at time of analysis.
Stored cross-site scripting in the WordPress plugin Ultimate FAQ through version 2.4.14 allows an authenticated attacker with Contributor-level access to inject script content that executes when a higher-privileged user views the affected FAQ. The supplied CVSS 3.1 base score is 6.5 with CWE-79, but the independent assessment treats availability impact as none and frames real-world urgency as moderate because the attacker needs a Contributor account and a privileged victim must interact with the poisoned content. No public exploit code or confirmed active exploitation was identified in the available intelligence.
Authenticated cross-site scripting in Premium Addons for Elementor, affecting versions up to and including 4.11.105, allows a WordPress user with Contributor-level access to inject script into widget content that executes in the browser of a higher-privileged user (administrator or editor) who views or previews the affected content. Because exploitation requires PR:L and UI:R with a scope-changing (S:C) impact, exposure is meaningfully narrowed to sites that grant Contributor accounts to untrusted parties and whose privileged users render the untrusted content; the affected population is further limited to WordPress installs that also run Elementor. Reported severity is moderate (CVSS 6.5), and no public exploit code has been identified at time of analysis.
Stored cross-site scripting in the Premium Blocks - Gutenberg Blocks for WordPress plugin (versions up to and including 2.3.17) lets an authenticated Contributor-level user inject persistent JavaScript into block content that executes when a higher-privileged editor or administrator later views or previews that content in wp-admin. Exploitation requires a foothold account with Contributor privileges and victim interaction (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, 6.5), with low confidentiality and integrity impact and no availability impact; sites that do not accept untrusted author accounts are largely insulated. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no vendor-released patch version is specified in the available intelligence.
Stored cross-site scripting in wpForo Forum 3.1.5 and earlier lets an authenticated Subscriber-level user inject script that runs in a moderator or administrator's browser when they view the crafted forum content. Exploitation requires a registered account on a WordPress site with the plugin and open registration, plus victim interaction; it does not provide direct server access or unauthenticated code execution. Patchstack rates it CVSS 6.5, and no public exploit code or confirmed active exploitation is identified in the provided data.
Unauthenticated broken access control in the PayPlus Payment Gateway WordPress plugin (versions 8.2.5 and earlier) lets remote attackers reach plugin functionality that lacks proper authorization checks, yielding partial confidentiality and integrity impact. Per the vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, 6.5 Medium), exploitation requires no authentication, no user interaction, and no non-default configuration, so any WordPress site running this niche payment plugin at a vulnerable version is exposed over the network. Exposure is limited to sites with the plugin installed and active, availability is unaffected, and no public exploit code or confirmed active exploitation was identified at time of analysis; Patchstack is credited with the report.
Stored cross-site scripting in the JetTricks WordPress plugin through version 2.0.1 lets an authenticated attacker with low-privilege content-contribution rights (PR:L) inject persistent script that executes in the browser of any user - typically an administrator - who later views the affected page (UI:R). The assessed CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N for a base score of 6.5, a moderate rather than high priority, and the scope-change component reflects that the payload runs in the viewing user's session context, which may carry more privileges than the injector. No public exploit code was identified at the time of analysis and the issue is not listed in CISA KEV, so the main practical barrier for an attacker is the need for an authenticated account rather than anonymous access.
Broken access control in the WordPress plugin WSP MCP - AI Agents Connector (versions up to and including 2.7.0) allows any authenticated user holding a Contributor-level account or higher to invoke a plugin action that lacks a proper capability check, modifying plugin state or configuration without authorization. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, base 6.5) confirms this is network-reachable, low complexity, requires low privileges, and needs no user interaction, with high integrity impact but no loss of confidentiality or availability. Exploitation depends on the site running this niche AI-agent connector plugin and permitting Contributor-level registration or account access; no public exploit code has been identified at time of analysis, and the flaw is not listed in CISA KEV.
Server-side request forgery (SSRF) in the Weoll collaboration platform (Global IT Informatics Technology Services Inc.) allows remote attackers to coerce the server into making crafted outbound requests against internal or back-end resources. Only deployments running Weoll before 3.2.45.44 are affected; the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) places the flaw at 6.5 with a high confidentiality impact but no integrity or availability effect and no scope change. Exploitation requires the application to expose a server-side URL-fetching or resource-retrieval feature and, per UI:R, depends on a user being induced to trigger the crafted request rather than fully autonomous attacker action; there is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis.
Google Chrome (desktop stable channel) is affected by a security defect for which the vendor has published a fix as part of its September 2026 Stable Channel Update, the single reference attached to this CVE. The record contains no description, no CVSS vector, and no CWE, so the specific vulnerable component, the attack vector, and any required user interaction are undetermined from the available data; based only on the product identity, the most plausible exploitation path would be a victim rendering attacker-controlled web content in the browser, but that is an inference rather than a stated condition. Authentication requirements are not confirmed from available data, and no public exploit identified at time of analysis; the vendor patch is available and Chrome's auto-update mechanism deploys it without user action.
Google Chrome desktop (stable channel) installations are affected by CVE-2026-95327, a security defect for which Google has published a stable-channel update and a patch is available from the vendor. Because no description, CVSS score or vector, or CWE was supplied with this CVE, the precise impact, attack vector, and affected version range cannot be established from the available intelligence; the only concrete signal is that a vendor fix exists, so residual exposure is confined to unpatched installations. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS score or CISA KEV entry was provided to indicate elevated real-world risk.
Google Chrome on desktop is the confirmed affected product, with the fix delivered through the September 2026 stable-channel update documented on the Chrome Releases blog, yet the underlying flaw cannot be characterized from the available record because no description, CVSS vector, or CWE was provided. Exploitation status is unconfirmed: there is no CISA KEV listing and no public exploit code identified at time of analysis, and no EPSS signal was supplied, so no public exploit identified at time of analysis. Because the affected component, version range, and any required user interaction or sandbox-escaping prerequisites are unknown, severity remains unquantified and defenders should treat the vendor advisory as the authoritative source rather than inferring impact from this entry.
Google Chrome desktop builds are affected by a security weakness corrected in a Chrome Releases stable-channel update, but the vulnerability's description, CVSS score, CVSS vector, and CWE are all absent from the available intelligence, so the precise impact class (for example memory corruption, type confusion, or a sandbox escape) cannot be confirmed from this dataset. Consistent with the affected product and the referenced advisory, the most plausible exploitation path requires a victim to run an unpatched Chrome desktop build and load attacker-controlled web content, with user interaction via visiting a malicious or compromised page; authentication requirements are not confirmed from available data. No public exploit identified at time of analysis and no CISA KEV entry is present, while a vendor patch is available, which confines practical risk to installations that have not yet applied the stable-channel update.
Stored cross-site scripting in the Getwid - Gutenberg Blocks WordPress plugin (all versions up to and including 2.1.3) allows authenticated attackers holding Contributor-level privileges or higher to inject arbitrary JavaScript through the Google Maps block's 'customStyle' attribute, because the frontend mapStyles() function passes that user-controlled value to eval(). The injected script is persisted in the post/block content and executes automatically in the browser of any visitor who renders the affected page, enabling session theft, content injection, or redirection under the site's origin (CVSS 6.4, Medium, with a Scope-Changed vector reflecting code execution outside the plugin's intended boundary). Exploitation requires a posting-capable account and no special non-default configuration; no public exploit code has been identified at time of analysis, and the issue is documented in a public Wordfence advisory.
Server-side request forgery in Red Hat Ansible Automation Platform 2's automation-controller email notification backend lets an authenticated user holding organization notification-admin permission point an email notification template's SMTP host and port at arbitrary internal, loopback, link-local or reserved addresses; the controller task process then opens a raw TCP connection to that target when the notification test is triggered. Because the resulting connection error is surfaced through the notification record, an attacker gains a three-state internal port-scan oracle (open, closed, filtered) over the control-plane cluster network, including the in-cluster Kubernetes API, and if a shared organization template stores an SMTP password, redirecting the host can leak that credential to an attacker-controlled server. Impact is moderate (vendor CVSS 6.4, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) and requires a privileged, already-authenticated role rather than anonymous access; no public exploit code has been identified at time of analysis and CISA KEV does not list this CVE.
Privilege escalation in Dell Secure Connect Gateway (SCG) Policy Manager allows a low-privileged attacker positioned on the adjacent network to reuse a session token that the application fails to expire, bypassing protection mechanisms and gaining unauthorized access to resources beyond their authorization level. Exploitation is constrained: it requires adjacent-network access rather than internet reachability, an existing low-privileged account, victim user interaction, and high attack complexity, which limits reliability. Affected are versions prior to 5.34.00.16 per the Dell advisory (EUVD lists the boundary as <5.36.00.16, a discrepancy that should be verified against the vendor document). There is no public exploit identified at time of analysis and the issue is not confirmed actively exploited; at a vendor CVSS of 6.4 the real-world urgency is low, though the confidentiality and integrity impact of a successful session-reuse attack is high.
Unauthenticated file disclosure in Caddy 2.11.3 and earlier allows remote attackers to bypass the file_server `hide` directive by requesting case variants of hidden files. This affects deployments on case-insensitive filesystems (Windows, default macOS/APFS) or where mixed-case path variants coexist; standard case-sensitive Linux filesystems (ext4/xfs) are not affected. Impact is limited to information disclosure of files intended to be hidden, with no integrity or availability impact. Caddy 2.11.4 contains the fix. No public exploit code or active exploitation has been identified at time of analysis.
Weak, reversible password encoding in Dell Secure Connect Gateway (SCG) Policy Manager lets a local, low-privileged user who already holds an account on the host recover stored credentials and abuse them for information disclosure, information tampering, protection-mechanism bypass and unauthorized access. The flaw affects versions prior to 5.34.00.16 and prior to 5.36 and is scored CVSS 6.3 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N) - it is not remotely reachable and requires no user interaction, but it does require local access to the host plus a pre-existing low-privileged account, with the high attack complexity reflecting the work needed to locate and reverse the weak encoding. No public exploit identified at time of analysis, and this is a moderate, defense-in-depth issue rather than a front-line priority.
Any Bluetooth device within radio range of a Reachy Mini robot can send CMD_ commands by piggybacking on another operator's completed PIN authentication, because the Bluetooth service keeps its authenticated state in a single shared flag on the service instance rather than binding it to the calling device - the WriteValue handler ignores the BlueZ options argument that carries the caller's identity. The CVSS 3.1 vector AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L (6.3, Medium) reflects that Bluetooth proximity and a genuine user completing the PIN exchange are both required, and that standalone impact is limited to command access; root code execution only follows from chaining with CVE-2026-55419 (unrestricted file upload) and CVE-2026-62661 (path traversal in the Bluetooth command handler). No CISA KEV listing, no EPSS score, and no independently published standalone exploit code were identified at time of analysis - the only public documentation is JFrog's description of this as the second step in a three-step attack chain, with no public exploit identified at time of analysis for this issue alone.
Google Chrome desktop stable-channel builds are covered by a vendor security update that addresses CVE-2026-95375, a defect for which no description, CVSS score or vector, CWE mapping, EPSS probability, or CISA KEV entry is present in the available intelligence. Because the record is essentially a data void, the concrete attack impact, the prerequisite configuration, and the required user interaction cannot be confirmed from the supplied data; the only reliable signal is that Google published a Stable Channel update for Desktop (http://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0856730748.html) and that the Ubuntu security team is tracking the CVE against its Chromium packaging, which indicates a Linux distribution impact in addition to the upstream browser. No public exploit code exists in the provided data (no POC reference, no KEV listing), so exploitation status is assessed as no public exploit identified at time of analysis, and no EPSS-based likelihood estimate can be cited. Treat this entry as patch-now hygiene rather than as a demonstrated emergency until NVD and the Chrome Releases advisory are populated with the affected component and severity.
Risk cannot be meaningfully assessed for Ubuntu Linux security update CVE-2026-96281 because the affected package, vulnerability type, and impact are undisclosed. The CVE is reported by the Ubuntu vendor with a generic 'security update' description, but no CVSS score, CWE, CPE, or advisory details are available, leaving the attack vector, authentication requirements, and exploitation status unknown. No public exploit has been identified at time of analysis, and no KEV status is indicated.
Unauthenticated local invocation of the Business Rules Manager commands REST endpoint in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift lets an actor who already has a foothold in the hosting environment exhaust resources and halt business-rule management functions. The flaw is a missing authentication check (CWE-306) in CommandsResource.java:31; the CVSS 3.1 vector (AV:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 6.2) confirms that no credentials or user interaction are required, but also that the attack path is local and that the only impact is availability - there is no data disclosure or modification. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (not in CISA KEV); the local attack vector is the primary factor keeping this a low-to-moderate priority issue despite the 6.2 base score. A vendor patch is available per the IBM advisory.
Improper access control in IBM Concert 1.0.0 through 3.0.0 lets a local attacker who already has access to the host modify application files that should be protected, yielding an integrity-only impact with no data disclosure or denial of service. The vendor CVSS vector is 6.2 with AV:L/PR:N, while the independent assessment rates PR:L because exploiting this flaw in practice typically requires at least a local account or a compromised co-resident process; IBM has released a vendor patch. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and no EPSS score was supplied. This is a genuine integrity risk but not a top-priority emergency, given the local attack vector and the product's limited deployment.
Cross-site scripting in SourceCodester Smart Attendance System with QR Code Scanner 1.0 lets unauthenticated remote attackers inject arbitrary JavaScript through the full_name parameter of the Self-Registration page (student_signup.php), which then executes in the browser of any user or administrator who renders the affected name. Publicly available exploit code exists, but there is no confirmation of active exploitation. Impact is confined to the victim's browser context - session token theft, defacement, or redirection - with no server-side compromise, and the product is a niche hobby-grade PHP application with essentially no production deployment.
Reflected cross-site scripting in the public /forgotpasswd.html password-reset endpoint of onSite internet GmbH Auktion NG Auktionssoftware (versions up to 20260722) allows remote attackers to inject script into a victim's browser by manipulating the 'email' argument. The flaw is unauthenticated to deliver but requires user interaction - a victim must be lured into opening a crafted link - because the payload is reflected rather than stored and does not fire automatically for other users. Publicly available exploit code exists, but there is no confirmation of active exploitation (not in CISA KEV); impact is confined to low client-side integrity manipulation with no confidentiality or availability effect, making this a genuinely low-priority issue despite the medium 5.3 CVSS 4.0 score.
Path traversal in weiqingwen spring-boot-forum lets an authenticated forum user escape the intended avatar storage path by manipulating the Username argument processed in NewUserFormValidator.validate during avatar upload. The issue is remotely reachable and, per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N), requires a valid forum account while yielding only Low confidentiality and integrity impact because the traversal is scoped to the avatar file-handling path. Publicly available exploit code exists, the maintainer did not respond to the disclosure, and because the project ships rolling releases with no tagged versions there is no known fixed release to migrate to.
SQL injection in the AdithyaYelloju Restaurant-Management-System allows attackers to manipulate the underlying database through the `s1` search parameter processed by mysqli_query in admin/display_menu.php. Exploitation is gated by the CVSS vector's PR:L rating, meaning an attacker needs at least low-privilege authenticated access to the application's admin area rather than acting as an anonymous internet user. Publicly available exploit code exists (referenced via the project's GitHub issue tracker), but there is no confirmed active exploitation (not in CISA KEV), and the niche, hobby-oriented nature of the software limits real-world exposure. Overall this is a genuine CWE-89 injection but a low-priority finding across every signal.
Arbitrary command execution in Acer NitroSense v5 (all versions up to and including 5.2.62) is reachable by any process already running on the laptop: the application's MQTT broker exposes an unauthenticated localhost WebSocket endpoint through which an attacker can invoke exposed ddsc RPC functions, including child_process.execSync(), and run commands in the application's context. Because the endpoint binds to localhost, this is a local-only escalation primitive - no network attack surface, no credentials and no user interaction required once a local foothold exists (CVSS 4.0 6.1; our assessed CVSS 3.1 7.8, AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). CISA KEV does not list this CVE and no public exploit code has been identified at time of analysis, so the flaw is a genuine code-execution issue with a self-limiting attack surface rather than an actively exploited one.
Cross-site scripting in SEMCMS up to 4.2 allows remote unauthenticated attackers to inject arbitrary script via the imgFile parameter in the KindEditor upload interface (/Edit/php/upload_json.php), requiring a victim to trigger the crafted request (user interaction). Publicly available exploit code exists, though there is no confirmed active exploitation. The vendor was contacted but did not respond, and no official patch is available; the real-world risk is low-to-moderate given the niche deployment and the interaction requirement.
Stack-based buffer overflow in the get_alias_name function of the uhttpd web management service on the Fast FAC1900R SOHO router allows a low-privilege authenticated remote attacker to overwrite stack memory with a crafted request, resulting in limited loss of confidentiality, integrity, and availability (CVSS 4.0 base 5.3; vendor vector PR:L). Publicly available exploit code exists and is referenced from a GitHub proof-of-concept repository targeting the device's devDiscoverNotify handling, so the flaw is straightforward to reproduce for anyone who can reach the management interface. The vendor was contacted but did not respond and no vendor-released patch has been identified, leaving exposure reduction as the practical mitigation.
Cross-site scripting in Apache Sling XSS before 2.4.12 allows remote attackers to inject script that executes in a victim's browser when an application relying on the library's output encoding and sanitization renders attacker-influenced input through a code path where neutralization is incomplete. Exploitation is conditional: it requires a reflected or stored injection point in the consuming application and victim interaction (loading the affected page) for script execution, and applications that apply their own independent output encoding are not exposed. The vendor-released fix is version 2.4.12; no public exploit code identified at time of analysis, no EPSS data was supplied, and no public CVSS score or vector (Apache and NVD both N/A) exists, so severity must be inferred from the independently assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.
Cross-site scripting in the Apache Sling XSS Protection API before version 2.4.12 allows unauthenticated remote attackers to have attacker-supplied script execute in a victim's browser session when an application built on the library routes untrusted, attacker-influenced input through the flawed sanitization/encoding routines and reflects it into an HTML response. Because the affected artifact is a shared library rather than a standalone server, exposure depends entirely on the consuming application - most commonly Apache Sling-based sites and Adobe Experience Manager - and exploitation requires the victim to load the crafted page or click a malicious link (user interaction). Neither NVD nor Apache published a CVSS score for this issue, so severity must be inferred from the library-level flaw and the deployed context; the assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N (unauthenticated, user-interaction dependent, scoped impact affecting the embedding application), and no public exploit identified at time of analysis.