Unauthenticated enumeration of document metadata in LaSuite Doc (suitenumerique/docs) versions 4.8.2 up to but not including 5.4.0, via the GET /api/v1.0/documents/search/ endpoint that accepts a predictable seven-digit 'path' value to scope descendant searches. Because the endpoint does not require the caller to know a document's public UUID, a remote unauthenticated attacker can submit an empty search query and iterate path values to harvest document identifiers, titles, creator data, timestamps and tree metadata for public documents, then feed the disclosed identifiers into normal public-document endpoints to read the content; authenticated users can likewise reach documents shared via authenticated links, while restricted documents remain protected. Severity is moderate and confidentiality-only (assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), exploitation requires no special conditions or authentication (CVSS vector PR:N), no public exploit code was identified at time of analysis, and the issue is fixed in version 5.4.0. This is a genuine but moderate-severity information-disclosure issue, not a critical one.
libXi before 1.8.4 contains an out-of-bounds read in the XI2 device-class parsing helpers size_classes() and copy_classes(), which a malicious or compromised X server can trigger to crash a connecting X client. The issue inverts the usual X11 trust model: the server attacks the client, so exposure is limited to users who connect an affected client to an untrusted display - a remote/forwarded X session or a hostile server - and requires user interaction to establish that connection (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, 6.5). Impact is confined to client-side denial of service with no code execution, data disclosure, or integrity loss; there is no public exploit identified at time of analysis and no CISA KEV listing, and a vendor fix is available (libXi 1.8.4, upstream commit f499944a).
Out-of-bounds read in libXi before 1.8.4 allows a malicious X server to crash an attached X client by sending a crafted reply to an XI2 XIQueryDevice request. This is a denial-of-service issue affecting systems where the X client communicates with an untrusted or compromised X server, such as via SSH X11 forwarding to a hostile host or a man-in-the-middle on the X protocol stream. The CVSS vector indicates unauthenticated remote exploitation requiring user interaction (UI:R), with no impact to confidentiality or integrity and only availability impact; no public exploit code has been identified, and the vendor has released a patch fixing the flaw in version 1.8.4.
Out-of-bounds reads in libXi before 1.8.4 can crash X11 client applications when they process a crafted XQueryDeviceState() reply, producing a denial-of-service condition with no code execution or confirmed data disclosure. Exploitation requires the victim to initiate a connection to an attacker-controlled or compromised X server, or an attacker able to tamper with an unauthenticated X protocol stream, matching the UI:R requirement; clients limited to trusted local X servers are effectively not exposed. No public exploit code has been identified at time of analysis, and a vendor fix is available.
Cross-team secret disclosure in the HashiCorp Vault secrets backend for Apache Airflow lets an authenticated Dag author scoped to one team read Vault secrets belonging to a different team in multi-team deployments. The flaw (CWE-639, authorization bypass through a user-controlled key) triggers when the team-scoped lookup misses and the backend falls back to a team-agnostic path concatenated from the unvalidated Variable key; because the Execution API Variables route accepts a path-shaped key, the traversal is reachable from ordinary Dag code. The vendor assigned no CVSS score (CVSS: N/A), while the independent assessment rates it CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N - read-only disclosure with scope change and no integrity or availability impact; single-team deployments are unaffected, no public exploit code has been identified at time of analysis, and the vendor-released fix is apache-airflow-providers-hashicorp 4.8.0.
Denial of service in libXi before 1.8.4 allows a malicious or compromised X server to crash an attached X client by returning crafted input-device class data that triggers an out-of-bounds read inside XListInputDevices(). This is a client-side, inverted-trust flaw (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, base 6.5): exploitation requires the victim application to connect to an attacker-controlled display and call the device-enumeration path, and the assessed effect is limited to an availability impact - no confidentiality or integrity loss - despite the CWE-125 classification and the 'Information Disclosure' tag. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the flaw is not reachable when clients talk only to trusted local X servers.
A malicious X server can crash X clients that use libXi before 1.8.4 by returning a crafted reply to the XListInputDevices() call, triggering an out-of-bounds read (CWE-125). The flaw is purely availability-impacting (CVSS 3.1 base 6.5: AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) and requires the victim to connect to the attacker-controlled X server - for example via X11 forwarding to an untrusted host - and invoke XListInputDevices(). No public exploit code has been identified at time of analysis, and there is no indication of active exploitation (CISA KEV).
A one-byte heap out-of-bounds read in simdjson 4.6.1 lets remote, unauthenticated attackers crash any application that parses attacker-supplied JSON through the unpadded DOM API (dom::parser::parse_unpadded). The flaw is a CWE-125 out-of-bounds read in which json_iterator::walk_document() dereferences buf[len] after the input buffer has been exhausted, causing process termination and a denial-of-service condition with no confidentiality or integrity impact (CVSS: 6.5, AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H). Per available intelligence there is no public exploit code and no confirmed active exploitation (not in CISA KEV), and EPSS is only 0.17% (6th percentile); exploitation further requires user interaction and, critically, that the target deployment has chosen the unpadded parsing path rather than the standard padded parse API.
Memory exhaustion in Apache Qpid Broker-J through 10.1.0 allows authenticated message producers to degrade or disrupt broker availability by submitting compressed AMQP payloads that the shared GZIP decompressor processes without a decompressed-output cap, affecting message delivery, message conversion, and HTTP management JSON rendering. The assessed CVSS:3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, confirming a network-reachable, low-privileged availability-only condition rather than code execution or data compromise. No public exploit code, CISA KEV entry, or EPSS score is available at time of analysis, so active exploitation is not indicated; users should upgrade to Qpid Broker-J 10.1.1.
Memory exhaustion denial of service in Mini-XML (mxml) 4.0.5 allows unauthenticated remote attackers to degrade a long-running service that parses untrusted XML through mxml_load_data(). Malformed XML that creates a text/value node via mxmlNewText() and then fails parsing before the node is linked to a parent routes execution to the error cleanup path, which frees the parse tree but not the orphaned node; each malformed request therefore leaks a small allocation that accumulates until the process exhausts memory. No public exploit code identified at time of analysis, EPSS is low at 0.15% (4th percentile), and the issue is not in CISA KEV; upstream addressed the root cause in commit 83ef80ae3c5413b73f501edb59ee74e31ce399d0 targeting the unreleased v4.0.6.
Stack exhaustion in libfyaml 0.9.6 allows a crafted YAML document to crash the process that parses it, producing a denial of service. When fy_atom_iter_format() formats a literal or folded block scalar containing a long run of blank lines, it repeatedly calls alloca() inside a per-line loop; because alloca() memory is only reclaimed when the function returns, the stack grows cumulatively until the process stack limit is exceeded and SIGSEGV occurs. Exploitation is unauthenticated but requires user/application interaction (UI:R) - the target application must actually parse attacker-influenced YAML - and impact is limited to the single parsing process. No public exploit code has been identified at time of analysis, EPSS is low at 0.15% (4th percentile), and the upstream project has published fixing commits referenced from issue #315.
The CVE-2026-91767 record currently carries no description, no CVSS score or vector, no CWE mapping, and no CPE data; the only intelligence available is that the report originates from the Ubuntu vendor channel. As a result, the affected package, deployment mode, attack vector, and required privileges are all unknown, and no public exploit code has been identified at time of analysis. Risk cannot be meaningfully assessed from the available data, and the assessment must be repeated once the corresponding Ubuntu Security Notice (USN) or NVD record is published.
NanoSVG (memononen/nanosvg, revision 239e102ec) can be crashed by an SVG document whose stroke-width is large enough that floating-point rounding collapses the subdivision angle computed in nsvg__curveDivs() to zero, producing an infinite arc-division value that is converted to int without range validation (CWE-681). The result is undefined behavior that reliably terminates the process on hardening or trap-on-overflow builds, so applications that stroke-rasterize untrusted SVGs suffer a denial of service; the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H (6.5 Medium) means no authentication is required but the victim must open and render the crafted file. Exploitation signals are weak: EPSS is only 0.15% (3rd percentile), no CISA KEV entry exists, and no public exploit code has been identified at time of analysis, and impact is confined to a crash of the embedding process rather than code execution or data compromise.
Unauthenticated web origins can invoke local Fabasoft Folio Client functions on any Windows machine where both the Folio Client (builds before 26.0.0.10, or 26.x before the 26.4.0.76 April Release) and its companion browser extension are installed and the registry value VALIDDOMAINS is left unset - which is the shipped default, so every website is trusted. Because the client validates no calling origin, any page a user simply visits can trigger client operations such as downloading documents, opening documents, and synchronizing files, giving an attacker a drive-by means to influence document handling and file synchronization without any credentials (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N per the CVE record; our assessment scores it slightly lower at C:L/I:L/A:N given the functional scope observed). Exploitation requires the victim to browse attacker-controlled or compromised content, and there is no public exploit code identified at time of analysis - this is a moderate, opportunistic-risk issue rather than an urgent priority, and organizations that had already populated VALIDDOMAINS with an origin allowlist, or that upgrade to the fixed builds, are not exposed.
Uncontrolled archive extraction in Docmost 0.21.0 through 0.95.0 lets any authenticated workspace member who holds edit rights to at least one space upload a crafted ZIP to the page-import feature and exhaust server disk space, crashing the import worker and degrading or taking down the instance for all tenants. The extractor imposes no cap on total uncompressed size, per-entry size, or entry count, and it automatically unwraps one nested ZIP, so an outer archive that fits inside the default 200 MB upload limit can expand to multiple gigabytes. This is a genuine but bounded availability-only risk (CVSS 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H): confidentiality and integrity are unaffected, anonymous exploitation is not possible, and the most severe cross-tenant impact applies to shared or multi-tenant deployments, while a single-tenant self-hosted install only harms itself. No public exploit code was identified at time of analysis and the flaw is not listed in CISA KEV; EPSS data was not provided.
Authenticated users on Discourse forums running versions prior to 2026.1.8, 2026.6.3, 2026.7.2, or 2026.8.0 can read upload metadata they are not authorized to see - including original filenames and secure-upload paths - by submitting unescaped SQL LIKE wildcard characters where the application expects a literal upload identifier. The flaw (CWE-943) causes upload-metadata lookups, URL lookups, and cooked-video-placeholder resolution to match unrelated upload records instead of the intended one, leaking restricted information without modifying any records. Exploitation requires an authenticated account (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) and works against default configurations, so instances that allow self-registration or host many low-trust members carry the most exposure; there is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV not applicable). Vendor-released patches exist in 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.
An authorization bypass in the Media Gateway API of Genetec Security Center lets an authenticated account that has been explicitly denied playback and video-viewing privileges still generate video thumbnails, exposing a limited slice of video imagery to users who should not see it. The flaw is reachable remotely by any account holding valid credentials (CVSS vector shows PR:L, so authentication is required), but the exposure is bounded to thumbnail frames rather than full live or recorded streams, and it requires no user interaction and no special non-default configuration. No public exploit code has been identified at time of analysis, CISA's SSVC assessment rates exploitation as none, and the issue is resolved in Security Center 5.14.1.2, making this a genuine but modest-severity authorization defect rather than a top-tier priority.
Authenticated users of Rapid7 Velociraptor can trigger a server-side deadlock in the platform's user-management module, hanging server operations and causing a denial of service (CVSS 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Exploitation requires only a valid low-privileged account that can reach the user-management code path over the network - no user interaction, no elevated role, and no special configuration - but it offers no data read, modification, or code execution, so it cannot be used for initial access or lateral escalation. Impact is availability-only (CWE-833, lock management bug); no public exploit identified at time of analysis, no CISA KEV listing, and the vendor advisory is the authoritative source for version-specific guidance.
Unauthenticated remote attackers can export or wipe the configuration of the Custom Thank You Page for WooCommerce WordPress plugin in all versions up to and including 1.1.2, because the save_option() function is reachable without any capability or nonce check. The issue is rated CVSS 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) and is bounded to the plugin's own settings - order data and the wider WordPress site are not directly at risk - which keeps it a genuine but moderate-priority finding rather than a site-takeover bug. No public exploit code has been identified at time of analysis, and the plugin's Trac changeset suggests an upstream fix has been committed.
Server-side request forgery in Termix 2.5.0 lets authenticated users make the Termix server issue outbound HTTP requests to arbitrary destinations, including internal services that are normally unreachable from outside the host network. An attacker with a low-privileged account can register a webhook or ntfy notification channel pointing at an internal address and then trigger it through the notification-channel test endpoint, which reaches the request-sending code in src/backend/utils/notification-sender.ts without any destination allowlisting or private-address blocking. Because webhook mode also honors attacker-chosen HTTP methods and headers, the requests are blind but not strictly read-only: an internal service that accepts the fixed notification body may still change state, though response bodies are never returned to the attacker. No public exploit code has been identified at time of analysis and the issue is fixed in version 2.5.1.
Stored cross-site scripting in the WP Multilang translation and multilingual plugin for WordPress (all versions up to and including 2.4.31) lets an authenticated attacker holding Contributor-level capabilities or higher inject arbitrary JavaScript into post content, which then executes in the browser of any user - including administrators - who views the affected page. The flaw is rated moderate severity at CVSS 3.1 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) and stems from insufficient input sanitization and output escaping (CWE-79); no public exploit code and no confirmed active exploitation were identified at time of analysis, though the low attack complexity and automatic trigger on page view make it attractive for privilege-escalation and session-theft chains. Sites that do not grant untrusted users Contributor access or that have upgraded beyond 2.4.31 are not exposed.
Stored HTML injection in Discourse's topic small-action and nested-activity-log components lets an authenticated user with a crafted display name break out of the mention-link href attribute and inject arbitrary markup into the trusted page for anyone who later views the affected topic action or activity log. Attackers need only an account and a quote-bearing name (or any attacker-influenced action_code_who value); the victim requires no interaction beyond loading the topic, and the payload persists in stored topic history. The issue is limited to Unicode-encoded href paths in versions before 2026.1.8, 2026.6.3, 2026.7.2 and 2026.8.0, and no public exploit code or confirmed active exploitation was identified at time of analysis; Discourse's default Content-Security-Policy means full script execution is realistic mainly on instances that weaken or disable CSP, so the practical impact is moderate rather than critical.
Incorrect authorization in OpenWA before 0.23.5 lets any caller holding a valid VIEWER-role API key retrieve a group's active invite code through the GET /api/sessions/{sessionId}/groups/{groupId}/invite-code REST endpoint or the equivalent GroupGetInviteCode MCP tool, which enforce no OPERATOR role requirement. Because a WhatsApp invite code is a transferable bearer capability rather than plain read data, an external account can use the leaked code to join a group administered by the session, obtain read and post access, and keep that membership even after the VIEWER key is revoked. The flaw (CWE-863) is a broken-authorization issue rather than a remote-code-execution bug, CVSS 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), requires the victim session to have a started engine and an administered group with an existing invite code, and is only practically dangerous in deployments that hand VIEWER keys to parties who should not be able to add accounts to those groups. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis; the vendor released a patch in version 0.23.5.
Server-side request forgery in TREK (versions prior to 3.4.0) allows an authenticated user to reach internal services or cloud metadata by supplying a URL whose DNS AAAA answer is a NAT64, 6to4, or Teredo IPv6 transition address that encodes a private, loopback, or link-local IPv4 target, bypassing the checkSsrf guard in server/src/utils/ssrfGuard.ts. Exploitation is conditional rather than automatic: it requires a valid TREK account, attacker control of a DNS record, a feature that performs server-side egress (imports, webhooks, integrations, or plugin egress), and a hosting environment that actually routes the chosen transition format - the reason the assessed CVSS is 6.3 (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N) with high attack complexity and confidentiality-only impact. No public exploit code has been identified at time of analysis, and TREK 3.4.0 fixes the flaw.
Deserialization of untrusted document content in the MongoDB PHP Driver (CWE-502) lets class names embedded in a field such as __pclass be honored when the driver constructs command-monitoring event objects, so an unauthenticated party who controls data flowing into a database operation can cause an application class implementing the driver's persistable interface to be instantiated and have its unserialization method invoked. The flaw only bites applications that (1) register a command monitoring subscriber and (2) pass attacker-controlled data into an operation reflected in monitoring events; impact ranges from benign to severe depending on which gadget classes exist in the deployment, which is why the vendor rates it 6.3 (CVSS 4.0, AV:N/AC:H/PR:N/UI:N/VC:L/VI:L/VA:L) and our independent assessment lands at CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L. No public exploit code or confirmed active exploitation has been identified at time of analysis; vendor-released patches are available in driver versions 1.21.10, 2.1.10 and 2.5.3.
Incorrect type casting in the Perl DBI module's internal DBI::sql_type_cast routine can cause incorrect conversion results, a crash, or a limited memory over-read when an affected application invokes that routine on a Perl scalar holding an internal integer (IV) or numeric/double (NV) value that an attacker can influence. The independently assessed vector (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L) indicates a local, high-complexity attack requiring low privileges and no user interaction, with only low confidentiality, integrity and availability impact, and no public exploit code was identified at time of analysis. The entry is extremely data-sparse - no CVSS score or vector, no CWE, no EPSS, no CISA KEV listing and no POC were supplied - so the only substantive artifacts are a commit-message-style fix title ('Fix DBI::sql_type_cast on IV/NV') and a vendor report from Ubuntu, meaning exploitability depends entirely on whether a specific DBD driver or application actually reaches the affected code path with attacker-controlled input.
Parsing attacker-controlled iCalendar data containing a parameterized property in libical 4.0.6 can terminate the consuming process, because icalparameter_string_to_kind() passes an incompatibly-cast comparator to bsearch(); the same defect exists in the libicalvcard path via vcardparameter_string_to_kind(). No authentication is required (CVSS PR:N) and no user interaction is encoded (UI:N), but exploitation hinges on the target being built with Control Flow Integrity enforcement or a function-pointer-type sanitizer, since type-confusion callbacks usually execute without aborting on ordinary non-hardened distro builds, and in practice a library needs to be fed untrusted calendar content by an application that parses it automatically or on user action. Independent assessment scores this CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H (input data lists 6.2 at AV:L), EPSS is only 0.17% (5th percentile), and no public exploit code has been identified at time of analysis; the issue is best characterized as a low-priority, high-noise type-confusion defect rather than a broadly exploitable denial-of-service vector.
Denial of service in Bento4 1.6.0.0 arises when the MP4 parser processes a crafted H.264/AVC or H.265/HEVC configuration atom (avcC or hvcC) whose declared atom size is smaller than AP4_ATOM_HEADER_SIZE. The size calculation underflows, AP4_AvccAtom::Create() or AP4_HvccAtom::Create() then passes an invalid or NULL pointer into the AP4_DataBuffer copy path, and the hosting application terminates. The CVSS vector is AV:L/PR:N/UI:N with only availability impact, so exploitation requires the malicious file to reach a local parsing path; no public exploit identified at time of analysis, CISA KEV status is not indicated in the supplied data, and EPSS is 0.15% (3rd percentile).
IBM Concert 1.0.0 through 3.0.0 contains a local information disclosure flaw in its recursive directory-copy functionality, where a lack of proper access controls can lead to the unintentional inclusion of sensitive or unnecessary files, increasing the attack surface. The vulnerability requires local access to the host and is modeled as unauthenticated (PR:N) with no user interaction (UI:N), but its impact is bounded to confidentiality loss (C:H) with no integrity or availability impact. No public exploit code has been identified, and the vendor has released a patch via IBM support.
Cross-site scripting in Mailspring's attachment quick-preview (all versions prior to 1.17.0) allows a remote, unauthenticated sender to execute script in the recipient's preview renderer by delivering a crafted Markdown, DOCX, or XLSX attachment that the victim opens in quick preview. Exploitation requires the recipient to actively open the preview (UI:R), and the injected script runs in a renderer that has no direct Node or Electron access, so it can reach the IPC surface exposed to the quick-preview renderer but cannot by itself achieve host-level code execution - Mailspring's advisory notes that persistent code execution requires chaining this bug with separate path-traversal and renderer-controlled file-write issues. The flaw is rated CVSS 6.1 and is fixed in Mailspring 1.17.0; no public exploit code or confirmed active exploitation was identified at time of analysis.
RabbitMQ's shovel management resource fails to enforce a policymaker-level check on DELETE operations, so an authenticated user holding the low-privileged 'monitoring' tag - nominally read-only - can delete or restart any dynamic shovel in any vhost visible to that account. The flaw (CWE-862 missing authorization) is reachable over the network with no user interaction and yields high integrity impact against shovel configuration state, though it is bounded by a non-default configuration requiring both the rabbitmq_shovel and rabbitmq_shovel_management plugins to be enabled and by the attacker needing pre-existing credentials plus vhost-scoped visibility. Patches are released in RabbitMQ 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1; no public exploit code has been identified and there is no confirmed active exploitation (no CISA KEV listing) at time of analysis.
Ubuntu Linux packages are implicated by a security defect reported through Canonical's coordinated disclosure process, but the intelligence set contains no description, CVSS vector, CWE classification, affected package name, version range, or reference links. Because neither the vulnerable component nor the attack surface can be identified, it is not possible to state whether the issue is remotely or locally exploitable, what privileges an attacker would need, or what level of impact (code execution, privilege escalation, denial of service, information disclosure) would result. No public exploit code and no CISA KEV entry are indicated in the available data, and no vendor patch version is identified at time of analysis; treat this record as unresolved pending retrieval of the corresponding Ubuntu Security Notice (USN) and NVD entry.
CVE-2025-1218 is attributed solely to Ubuntu in the available intelligence, with no published description, CVSS vector, CWE classification, CPE data, or reference links, so the concrete security impact cannot be established from the supplied data. Because no affected package, version range, or vulnerable component is identified, neither the attack surface nor the prerequisites (authentication level, network exposure, user interaction) can be scoped for any Ubuntu release. No public exploit code was identified and there is no evidence of active exploitation (no CISA KEV entry) at time of analysis, but the identifier should be treated as unscored rather than low risk until the Ubuntu Security Notice and NVD entry are retrieved.
Out-of-bounds read in the Huawei HarmonyOS graphics module allows an attacker who can already run code locally on the device - or deliver crafted graphics content for local processing - to read past the end of an allocated buffer and crash the graphics component. The assessed vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L) confirms local-only reachability with no privileges or user interaction required, and bounds the impact to limited memory disclosure plus availability degradation; there is no demonstrated path to code execution or privilege escalation. No public exploit code was identified and the CVE is not listed in CISA KEV, so no confirmed active exploitation at time of analysis.
Improper TLS certificate validation in HAVELSAN Liman Render Engine (versions from 1.0 up to but not including 1.2-75) lets a network-positioned adversary conduct an adversary-in-the-middle attack, causing the engine to accept forged or otherwise invalid certificates so that intercepted traffic can be decrypted and sensitive data disclosed. The assessed vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N, base 5.9) shows no authentication or user-interaction prerequisite, but exploitation hinges on the attacker first occupying a man-in-the-middle position on the path between an engine endpoint and its peer, which is why the attack is scored high-complexity and the impact is confidentiality-only with no integrity or availability effect. No public exploit code has been identified at time of analysis, CISA SSVC records exploitation as 'none' with automatable 'no' and partial technical impact, and the issue was reported by TR-CERT.
Interception of the key exchange in HAVELSAN Liman Render Engine (versions 1.0 up to but not including 1.2-75) allows an on-path attacker to decrypt or meddle with traffic, because keys are agreed without authenticating the peer entity (CWE-322). Exploitation requires the attacker to already hold a position on the network path between the victim client and the Render Engine - through ARP spoofing, a rogue access point, or a compromised router - which is why the issue carries HIGH attack complexity even though no credentials (PR:N) and no user interaction (UI:N) are needed. The impact is confined to confidentiality (CVSS 3.1 base 5.9, C:H/I:N/A:N); no public exploit code and no active exploitation have been identified at time of analysis, and the CISA SSVC assessment rates exploitation as none, automatable as no, and technical impact as partial, making this a moderate, situational risk rather than a broad-exploitation priority.
Risk cannot be meaningfully assessed from the provided data: CVE-2026-93682 is associated only with the Ubuntu security tracker (reported by vendor:ubuntu) and arrives with no description, no CVSS vector, no CWE classification, and no CPE mapping, so the affected Ubuntu source package, the exposed component, and the attack surface are all unidentified. Because no vulnerability class, privilege requirement, or user-interaction condition can be established, it is impossible to state whether this is remote code execution, privilege escalation, denial of service, or information disclosure. No public exploit code exists at time of analysis and no EPSS score or CISA KEV entry was supplied, but that silence reflects missing intelligence rather than a confirmed low risk, and no patch information was included in the input.
Malformed syslog packets can crash the log collector in ManageEngine EventLog Analyzer and Log360 builds prior to 13071, causing a denial of service against the log ingestion pipeline. The issue is remotely reachable without authentication or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, base 5.3) because syslog reception is a default, always-on function of both products; there is no public exploit identified at time of analysis, and impact is confined to availability (A:L) with no confidentiality, integrity, or code-execution effect. Exposure is greatest where the syslog listener is reachable from an untrusted network segment, while collectors restricted to trusted internal sources carry substantially lower risk.
Authorization bypass in kvcache-ai's Mooncake KV-cache store (versions through 0.3.12 and 0.3.13.post1) lets any client that can reach the RPC service call the UnmountSegment handler and tear down storage segments belonging to other clients by supplying their client_id and segment_id. The attack is unauthenticated and needs no user interaction according to the CVSS vector (PR:N/UI:N), so the practical gate is network exposure of the RPC endpoint plus the ability to know or enumerate valid identifiers; impact is limited to integrity and availability of the distributed cache (C:N/I:L/A:L under CVSS 3.1, base 5.5 in the published CVSS 4.0 score). Publicly available exploit code exists in the form of a disclosure gist, but there is no evidence of active exploitation (no CISA KEV listing), and the vendor was contacted without responding, so no fixed release has been identified.
Improper authorization in the yudao-module-pay component of ruoyi-vue-pro (YunaiV / zhijiantianya) lets an attacker manipulate the ID argument passed to updateDemoOrderPaid in PayDemoOrderController.java, modifying demo payment-order records the caller is not authorized to touch; CWE-285 classifies this as an IDOR-style broken access control, and the attack is remote with no user interaction. The affected surface is the DEMO order payment-callback handler of the pay module, so direct impact is confined to demo order data rather than live production payments, and exploitation requires the pay demo module to be enabled and the endpoint reachable. Publicly available exploit code exists, but there is no evidence of confirmed active exploitation (not listed in CISA KEV), and the vendor was contacted early about the disclosure but did not respond, so no vendor-released patch has been identified at time of analysis.
SQL injection in the pmTicket project-management web application allows remote attackers to inject arbitrary SQL through the conn_settings argument processed by the setSync function in /ajax/add_project.php, giving at least read and modification access to database content (our assessment rates confidentiality and integrity impact as High, availability as None). Exploitation requires network reachability to that AJAX endpoint plus the ability to supply conn_settings, and publicly available exploit code exists (a proof-of-concept demonstration is referenced at asciinema.org); there is no KEV listing or other evidence of confirmed active exploitation. Access prerequisites are disputed: the published CVSS v4 vector states PR:N (no authentication), whereas our independent assessment assumes PR:L because add_project is a project-creation action that most plausibly runs behind an authenticated session, so treat pre-auth exploitability as unverified. The product is delivered on a rolling-release basis with no versioned builds, and the vendor did not respond to disclosure, so no patched release is available.
Denial of service in LibRaw 0.22.0: opening a crafted RAW, TIFF or DNG file whose TIFF tag 0x00fe (NewSubfileType) carries a value outside signed-int range drives an unchecked narrowing conversion in LibRaw::parse_tiff_ifd(), triggering undefined behavior that terminates the process. The issue is availability-only (CVSS 3.1 5.5, AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) and requires user interaction - a victim or an automated pipeline must open the malicious file - with no privilege requirement, no data exposure and no code execution. There is no evidence of active exploitation (no CISA KEV listing) and EPSS is low at 0.15% (4th percentile), although the upstream fix PR contains a regression harness with a minimal crafted TIFF that reproduces the out-of-range value, so a public crash reproducer exists.
A crafted Code 128 barcode can abort ZBar (commit 2ea2ca58) with SIGILL when the library is built with trap-mode UndefinedBehaviorSanitizer, because decode_e() returns -1 for an invalid edge pattern and decode6() then left-shifts that negative signed value while assembling the edge signature. The issue is local and requires the victim to feed attacker-supplied barcode input into a ZBar-embedding application (UI:R), and the deterministic crash only occurs in non-default sanitizer builds typically used for development, testing, or fuzzing; production binaries compiled without trap-mode UBSan are not expected to terminate reproducibly. With an EPSS score of only 0.15% (3rd percentile), no KEV listing, and no publicly available exploit code identified at time of analysis, this is a low-priority, sanitizer-configuration-dependent robustness bug rather than a broadly exploitable denial-of-service flaw.
Opening a specially crafted WAV file with libsndfile 1.2.2 can cause a denial of service when the library's header parser performs an unaligned 4-byte store through a cast unsigned int pointer, which faults on strict-alignment CPU architectures. The flaw is reachable by remote attackers who can get a victim to process the malicious file, but requires user interaction and results in single-process crash only, with no code execution, data disclosure, or integrity impact. There is no public exploit code and no evidence of active exploitation; EPSS is 0.14% (3rd percentile) and the CVE is not in CISA KEV, so despite the medium 5.5 CVSS score this is a low real-world priority. Additionally, because x86/x86-64 tolerates misaligned access, the crash is largely limited to ARM, SPARC, MIPS and sanitizer-instrumented builds.
Offline recovery of stored SSH secrets is possible in Termix 1.7.0 through 2.5.0 because the keys that wrap OIDC and WebAuthn users' Data Encryption Keys are derived from committed default strings rather than operator-supplied secrets. An attacker who obtains a copy of the SQLite database - through an exposed or stolen backup, filesystem access, or a separate exfiltration bug - can recompute the wrapping key from the static default value plus the public userId salt, unwrap each affected user's DEK, and decrypt stored SSH passwords, private keys, and key passphrases; password-authenticated users are not affected by this derivation path. Vendor-released patch: 2.5.1. No public exploit code has been identified at time of analysis, and because the attacker must already hold the database file, this is an access-gated local data-confidentiality flaw (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) rather than a network-facing issue.
Reflected cross-site scripting (XSS) in the MediaWiki CirrusSearch extension through version 1.46.0 allows remote attackers to inject malicious scripts into search pages via crafted links, requiring a victim to click the link. The vulnerability carries moderate severity (CVSS 4.0 score 5.5) because exploitation is client-side only, with low confidentiality impact and no integrity or availability impact. Publicly available proof-of-concept exploit code exists, but there is no indication of active exploitation (not in CISA KEV). Only wikis that have installed the CirrusSearch extension, typically Elasticsearch-backed deployments, are affected.
Parsing a malformed OpenEXR image can terminate the host application: OpenEXR 3.4.14's C++ attribute parser constructs an OpaqueAttribute with a NULL packed_data pointer when an EXR file declares an unknown attribute type with dataSize set to zero, and the constructor forwards that NULL pointer to memcpy() without checking the zero-length case, triggering undefined behavior and a crash. The issue is local in vector terms (AV:L) and requires user interaction (UI:R) - an attacker must get the victim or an automated pipeline to open or otherwise ingest the crafted .exr file - and its impact is limited to availability (C:N/I:N/A:H, CVSS 5.5), with no code execution or data disclosure demonstrated. There is no KEV listing and no public exploit identified at time of analysis; the upstream fix is a guard in pull request #2615 rather than a confirmed tagged release.
Blind server-side request forgery in the Kirki - Freeform Page Builder, Website Builder & Customizer plugin for WordPress, affecting all versions up to and including 6.2.0, allows unauthenticated remote attackers to make the WordPress server issue HTTP requests to arbitrary locations by supplying an attacker-controlled URL in the 'kirki_data' parameter. Because the SSRF is blind (no response body is returned to the attacker), exploitation is assessed as high-complexity: the attacker must already know or correctly guess reachable internal hosts or services, so the practical impact is limited to internal service enumeration, state-changing requests against unauthenticated internal endpoints, and access to cloud instance-metadata addresses that the host can reach. There is no public exploit identified at time of analysis and the vulnerability is not confirmed actively exploited (CISA KEV), making this a moderate-risk, not top-priority, issue for most deployments - though it becomes materially more serious on hosts with broad outbound network reachability or attached cloud IAM roles.
Stored cross-origin iframe injection in Discourse allows an authenticated user with posting privileges to bypass the allowed_iframes prefix policy by embedding an iframe whose src contains encoded userinfo, so the sanitizer's decoded validation passes while the browser resolves an attacker-controlled host. Affected releases are those prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0; the assessed CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N (5.4), reflecting limited confidentiality and integrity impact and no availability loss. Exploitation requires a valid posting account and a site where at least one iframe host prefix is permitted, and there is no public exploit identified at time of analysis; the risk is genuine but moderate rather than an emergency.
Stored cross-site scripting in Discourse's notification email and chat-summary rendering paths allows an authenticated user with standard posting privileges to inject markup into messages generated for other users. In versions prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, a post referencing a video from an enabled provider (YouTube, Vimeo, or TikTok) whose provider-side title contains markup is reparsed as HTML when the notification email or chat summary is built, so recipients reading those messages in an HTML-capable email client may render injected content, potentially including event handlers; impact is confined to the email/chat rendering context and does not reach the Discourse browser session or the forum page itself. Lazy video embeds must be enabled (the default configuration) for exploitation, authentication requirements are confirmed as low-privileged (CVSS vector PR:L), no public exploit code has been identified at time of analysis, and this is assessed as a genuine but low-priority issue.