TREK, a collaborative travel-planning web application, authorizes the DELETE /api/trips/:tripId/collab/notes/:noteId/files/:fileId endpoint against the caller-supplied tripId but then deletes the attachment resolved solely by noteId and fileId, so an authenticated user with edit rights on any single trip can permanently destroy note-file attachments belonging to other users' trips. Exploitation requires only a low-privileged authenticated account with edit access to at least one trip (CVSS:3.1/AV:N/AC:L/PR:L/UI:N, 7.1) and is made practical by sequential, enumerable identifiers, though impact is confined to integrity and availability of attachments - read paths remain trip-scoped, so no data disclosure is possible. All TREK deployments prior to 3.3.0 in a multi-user configuration are affected; no public exploit code has been identified and there is no evidence of active exploitation at time of analysis.
Cache lock takeover in the MongoDB integration for Laravel (mongodb/laravel-mongodb) before 5.11.0 lets an authenticated user who can influence the lock 'owner' value hijack or prematurely expire a lock held by another process, producing duplicated or conflicting operations. The root cause is a NoSQL/aggregation-expression injection (CWE-943) in the MongoLock implementation, where a dollar-prefixed owner string such as '$owner', '$literal' or '$$ROOT' is evaluated by MongoDB as an aggregation expression instead of being treated as a literal value. CVSS 7.1 (VI:H, VA:L, no confidentiality or scope impact) places this as a genuine but moderate integrity-focused flaw: it only affects deployments using the MongoDB cache-lock backend on pre-5.11.0 versions, exploitability depends on the application deriving lock owner values from user-influenced input (not the standard usage pattern), and no public exploit code has been identified at time of analysis.
Credential disclosure in PRTG Network Monitor before 26.2.120.1449 allows an authenticated user who is not restricted to read-only access to expose the configured Windows or domain password through sensor error output. The flaw is in a demo VBScript EXE/Script sensor that multiplies two integer parameters; when a non-numeric value is supplied, cscript.exe returns a Type mismatch error that echoes the supplied value, and the documented %windowspassword placeholder resolves to the stored credential. No public exploit identified at time of analysis; the vendor has released a patch in version 26.2.120.1449.
A double fput() in the Linux kernel's cachefiles_create_tmpfile() error-handling path drops the struct file reference count twice, producing a double-free/reference-underflow that is crash-dominant and can corrupt kernel memory or panic the host. Only systems that actually enable the fscache/cachefiles caching backend with cachefilesd running are exposed; the assessed vector is local-only (AV:L) with some existing privilege (PR:L) and high complexity (AC:H), because the attacker cannot reliably force the internal tmpfile-creation failure that triggers the flaw. Vendor patches are available for the stable branches (6.12.111, 6.18.53) and the 7.2 mainline fix; no public exploit code has been identified at time of analysis and the CVE is not in CISA KEV.
Uninitialized stack memory in the Linux kernel's cifs/SMB client can leave fields of the stack-allocated cifs_open_info_data structure holding stale values, so a client that mounts and operates on an SMB share whose server responses fail to populate those fields may act on incorrect metadata. Exploitation requires a local user with the ability to trigger the affected file operations on a mounted share (CVSS vector AV:L/AC:H/PR:L/UI:N, consistent with our independent assessment of C:L/I:L/A:N rather than the higher-scored 7.0 record) and is realistically driven by a malicious or misbehaving SMB server, not by remote unauthenticated attackers. Only kernels prior to 6.12.111, prior to 6.18.53, and prior to 7.2 are affected; vendor fixes are available and no public exploit has been identified at time of analysis.
The Linux kernel's iwlwifi PCIe transport driver can leave dangling RX pointers (rx_pool, global_table, rxq and alloc_page) on the live transport object after iwl_pcie_rx_free() runs while unwinding a failed iwl_pcie_tx_init(), so a subsequent teardown or driver re-init/retry can touch already-freed RX state. Only systems with Intel WiFi hardware running kernels before 6.12.111, 6.18.53 or 7.2 are affected, and the trigger is an internal nic-init failure path rather than a directly attacker-controlled input, meaning exploitation is local with high complexity and existing low privileges (AV:L/AC:H/PR:L per the assessed vector). There is no public exploit identified at time of analysis and no KEV confirmation of active exploitation, and while the vendor/NVD score is 7.0 (High), the independent assessment rates this at roughly 3.6 (Low) because only integrity and availability of the device's own error/cleanup path are at stake.
PaperCut MF/NG's report-generation functionality can be reached without valid credentials, letting an unauthenticated remote attacker trigger report generation and read the sensitive information those reports expose. The defect is an authentication/authorization bypass (CWE-639) that needs only network reachability to the application server - no credentials and no user interaction (PR:N/UI:N) - and is scoped to confidentiality loss (VC:L/SC:L, with no integrity or availability impact), which keeps overall risk moderate and bounded at a CVSS score of 6.9. No public exploit code has been identified at time of analysis and the issue has not been confirmed as actively exploited (not in CISA KEV).
Improper identifier resolution in Brocade/Broadcom management software's Java cache-key handling can let an authenticated attacker on an adjacent network trigger identity mismatches, producing high integrity impact without confidentiality or availability loss. The flaw is a moderate-severity object-comparison logic issue that requires a low-privilege account and specific user-account structures, making it realistically LOW priority for most organizations. No public exploit identified at time of analysis; apply the vendor fix described in Broadcom support advisory 39000.
The CVE-2026-17545 record is effectively empty: it ships with no description, no CVSS vector, no CWE mapping, and no CPE data, and the only intelligence attached to it is that it was reported through the Ubuntu vendor coordination channel. Because the affected package, the vulnerable component, and the required attacker position are all unknown, the risk to any specific Ubuntu deployment cannot be meaningfully assessed from the available data and no impact statement should be issued yet. No public exploit code has been identified at time of analysis, and no EPSS score, KEV listing, or proof-of-concept reference accompanies the record, so there is currently no signal of exploitation activity. The immediate action is intelligence collection rather than mitigation: retrieve the corresponding Ubuntu Security Notice and CVE tracker entry to learn which package and version range are involved before assigning severity or exposure.
Unauthenticated information disclosure in the SPON Communications IP Network Audio Device XC-9603 (firmware 1.2.3_20181106 Build 107) allows remote attackers to retrieve sensitive configuration data, including the contents of /ini/sys_cfg.txt, because the loadCfg configuration-download function does not enforce authorization. Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), exploitation requires only network reachability to the device's HTTP/configuration service; no credentials or user interaction are needed, and the real-world impact depends on whether the served configuration file contains credentials or other secrets. There is no vendor-released patch: the vendor was contacted about the disclosure and did not respond, and no public exploit code or confirmed active exploitation was identified at time of analysis. This is a genuine but low-to-moderate priority issue that is most relevant to organizations exposing these audio/PA endpoints on internal or campus networks.
Unauthenticated remote access to system logs in ezGlobal's GPM LIGHT lets anyone who can reach the product's log-serving endpoint read sensitive operational data without credentials, user interaction, or special configuration (CVSS:4.0 AV:N/AC:L/AT:N/PR:N/UI:N, 6.9; independently assessed as CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). Impact is confined to confidentiality (C:L) - the attacker reads logs rather than altering or disrupting the service - so real-world severity hinges on whether those logs contain credentials, session tokens, internal hostnames, or PII instead of benign operational messages. Affected versions are unspecified (wildcard CPE), meaning every deployment should be treated as potentially vulnerable, and no public exploit code has been identified at time of analysis; the issue is not listed in CISA KEV.
Cleartext credential exposure in the job scheduling component of Brocade SANnav causes external server passwords and archive protection keys to be written unmasked into application logs and generated support bundles whenever scheduled support-save or related operational jobs execute. An authenticated, low-privileged user who already has read access to those logs or bundles can harvest the credentials and potentially reuse them against remote backup targets or protected archives. This is a confidentiality-only defect rooted in improper log masking (CWE-532), with no public exploit identified at time of analysis; practical impact is LOW-priority because the attacker must already hold log access and the secrets are only exposed after an affected job has actually run.
Ansible Automation Platform 2's gateway permits an authenticated gateway administrator (CVSS PR:H) to create a new service key for the Controller service cluster through the API, even though service-key creation is supposed to occur only via the installer-provisioned path; the resulting key is cryptographically indistinguishable from a legitimate one, so it can be used to mint a service-authentication token that impersonates the Controller service. When the non-default gateway OIDC workload-identity endpoint is enabled (FEATURE_OIDC_WORKLOAD_IDENTITY_ENABLED) and a downstream resource server such as HashiCorp Vault trusts the gateway's OIDC signing key, the attacker can induce the gateway to sign Workload Identity Tokens for arbitrary Controller workloads and retrieve the AAP credentials bound to that workload, crossing the administrator's authorization boundary to disclose secrets (C:H, no integrity or availability impact). Exploitation requires admin privileges plus that specific non-default trust configuration, and no public exploit has been identified at time of analysis; the defect is access-gated rather than broadly exploitable.
Weakly protected storage of remote-server credentials in Araxis Merge for Windows (versions 2011.4074 through 2026.0) allows an authenticated, non-administrative local user on the same host to recover and decrypt every credential the target user has saved in the product, because the credentials are kept in the Windows registry without sufficient cryptographic protection (CWE-522). The exposure is local-only (CVSS 4.0 6.8, AV:L/PR:L, confidentiality-only with no integrity or availability impact), so it is a moderate, locally-scoped credential-disclosure issue rather than a remotely exploitable flaw, and its real-world value depends on the attacker already holding an interactive account and on the victim having stored credentials. The issue is not listed in CISA KEV (no confirmed active exploitation); publicly available exploit code exists, and a researcher write-up plus a GitHub repository published under the grepstrength handle accompany the vendor advisory referenced in the CVE record.
Opening a crafted MOBI e-book in SumatraPDF versions before 3.6 can crash the application because the MOBI header decoder trusts an attacker-controlled header length and reads past a short heap buffer; the bug is limited to the MOBI parser and requires local file delivery plus the user actively opening the document. It is a memory-safety issue (CWE-125) fixed in 3.6, with no confirmed active exploitation, no public exploit identified at time of analysis, and low real-world priority per available signals despite a 6.8 CVSS 4.0 base score. In CVSS terms the vector is AV:L/PR:N/UI:P, so the attacker is unauthenticated but must get the victim to open a malicious file locally, and the assessed impact is only a client crash (no confidentiality, integrity, or scope impact).
Hard-coded credentials embedded in the Eufy Omni C20 robot vacuum (all versions per CPE cpe:2.3:a:eufy:omni_c20) let an attacker who can already read the device's log files recover those credentials and reuse them to reach information such as mapping data, resulting in a confidentiality-only exposure of the device's stored floor-plan content. The attack is strictly local and requires low privileges (CVSS 4.0 AV:L/PR:L/UI:N, assessed as CVSS 3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5), so there is no network attack path and no user interaction is needed once log access exists. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV not applicable); the real-world risk is LOW-to-MODERATE and this is not a broad remote-exploitation priority, because the prerequisite of prior local log-read access is the primary limiting factor.
Privilege escalation in TÜBİTAK ULAKBİM UlakPDF (all versions through 09092026) allows an authenticated, low-privileged user to reach data and functionality that should be reserved for higher-privileged roles, driven by an incorrect authorization check in the application's access-control logic. The issue carries a CVSS 3.1 base score of 6.8 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N), meaning it is network-reachable but requires a pre-existing valid low-privileged account plus a non-trivial precondition that the public description does not name, and requires no user interaction; confidentiality and integrity impacts are high while availability is unaffected. Reported by TR-CERT via siberguvenlik.gov.tr, the flaw is constrained in real-world priority by the credential prerequisite, the elevated attack complexity, and UlakPDF's narrow academic and government deployment footprint - no public exploit identified at time of analysis.
Authenticated information disclosure in the WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.26 lets any account with contributor-level access or higher read the stored campaign configuration and execution logs belonging to other users, including administrators. The endpoint returns campaign objects without verifying ownership or authorization (CWE-639), so a low-privilege author can enumerate campaign identifiers and retrieve settings and run logs they should never see; the effect is read-only, with no modification, privilege escalation, or denial of service. Publicly available exploit code exists (referenced by WPScan), but CISA's SSVC assessment records no observed exploitation and rates the issue as non-automatable with partial technical impact - consistent with our independent assessment that this is a low-severity information-disclosure issue and not a real prioritization concern.
Improper authorization in the Events Manager WordPress plugin before 7.4.5 allows an authenticated user who can manage tickets for at least one event to overwrite and reassign any ticket on the site - including tickets belonging to events they do not control - because the ticket-update handler authorizes the request against one ticket but then applies the change to client-supplied identifiers without re-verifying ownership. Publicly available exploit code exists, but exploitation is gated by the privileged event-management role required (CVSS 3.1 PR:H) and impact is confined to the integrity of ticket records, with no data disclosure or availability loss. Scoring CVSS 3.1 2.7 and assessed by CISA SSVC as non-automatable with partial technical impact, this is a genuinely low-priority vulnerability despite being real and patched.
Command injection in Termix's SSH key deployment flow affects versions 1.7.0 through 2.5.0 and lets an authenticated user with high privileges execute arbitrary commands with the selected remote account's privileges by supplying a crafted public-key token that breaks out of a double-quoted grep -F shell command. The independent assessment rates confidentiality, integrity, and availability impact as high with scope changed because code runs on the target host, not merely the Termix server; no public exploit has been identified at time of analysis, and the flaw is fixed in version 2.5.1.
Authenticated delegated administrators in Keycloak can reset other users' passwords and take over their accounts when Fine-Grained Admin Permissions (FGAP) are enabled, because the Admin REST API's general user-update path skips the password-reset authorization check that the dedicated credential-reset flow enforces. Red Hat Build of Keycloak and Red Hat Single Sign-On 7 are the affected downstream products, and the flaw is rated 6.6 (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H, CWE-862). Exploitation is conditionally gated rather than internet-facing: it requires a non-default FGAP configuration and an already-provisioned semi-trusted admin holding user-profile edit rights but deliberately denied password-reset rights, making this an insider or lateral privilege-escalation issue; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
Risk assessment is currently not possible for CVE-2026-91768, an Ubuntu-tracked identifier that arrives with no description, no CVSS score, no CVSS vector, no CWE classification, and no CPE data; the only signal available is that the record was reported by the Ubuntu vendor source. Because attack vector, privileges required, user interaction, and affected package or deployment mode are all unspecified, no meaningful statement can be made about what an attacker could do or who is exposed. Exploitation status is unconfirmed: no public exploit identified at time of analysis, and there is no KEV listing, no EPSS score, and no proof-of-concept reference in the supplied intelligence. Security teams should treat this identifier as un-triageable and hold it in a watch state until the Ubuntu CVE tracker or the NVD/MITRE record supplies a description and affected package.
Improper access control in Delta Electronics DIAEnergie before 1.11.00.022 allows a low-privileged authenticated user to read sensitive data that should be restricted to higher-privilege roles, with network-reachable, low-complexity exploitation that requires no user interaction. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, 6.5 Medium) shows the impact is confined to confidentiality - no integrity or availability effect - and the PR:L component means an attacker must already hold at least a valid low-privilege account on the web application rather than being a fully anonymous internet scanner. No public exploit code was identified at time of analysis and the vulnerability is not confirmed as actively exploited (not listed in CISA KEV), so risk is highest for environments where DIAEnergie is network-exposed and accounts are broadly provisioned.
Recursive XML attribute parsing in Wazuh (src/os_xml/os_xml.c) can exhaust the analysisd worker-thread stack, causing a segmentation fault that halts log ingestion on the affected manager. An attacker who controls a legitimately enrolled Wazuh agent (authenticated, PR:L) can trigger this by having that agent forward a Windows EventChannel event containing a single XML element with a very large number of attributes, which analysisd then parses. All Wazuh versions from 3.8.0 through 4.14.6 are affected; the issue is fixed in 4.14.7, there is no indication of confirmed active exploitation (not in CISA KEV), and no public exploit code has been identified at time of analysis. Impact is availability-only - the worker crashes and ingestion stops, but no data is read, modified, or exposed.
CVE-2025-14181 currently has no usable detail: the record contains no description, no CVSS score, no CVSS vector, and no CWE, and the only supplied attribution is the vendor source "ubuntu". Because the affected component, the impact class, and the attack vector are all undefined, it is not possible to state who is affected beyond the Ubuntu distribution packaging channel, nor what an attacker could achieve; authentication requirements are not confirmed from available data, and no public exploit identified at time of analysis and no CISA KEV entry is present. Risk cannot be meaningfully assessed from the available data, so this identifier should be triaged as unresolved rather than as a confirmed threat until the Ubuntu security advisory and NVD entry are populated.
A regular expression denial of service in Habitica's group member-search endpoint allows an authenticated user to send a crafted `search` query parameter to GET /api/v3/groups/:groupId/members that is compiled directly into a JavaScript RegExp, causing catastrophic backtracking that degrades application response times or halts Node.js worker processes. The flaw affects Habitica versions 4.172.1 through 5.48.1 in default configurations; both self-hosted instances and the shared hosted service are exposed, with the hosted instance allowing a single account to degrade service for all users. Exploitation requires only a valid account and membership in a group (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 6.5), and no public exploit code was identified at time of analysis. The issue is fixed in version 5.48.2.
The security impact of CVE-2026-95811 cannot be established from the available intelligence: the record carries no description, no CVSS score or vector, and no CWE classification, and the only confirmed signal is that Ubuntu is the reporting vendor, which indicates a flaw in a package distributed through Ubuntu rather than identifying which package. Because the affected component, attack surface, and prerequisites are all unknown, no defensible claim about confidentiality, integrity, or availability impact can be made, and no public exploit code or CISA KEV entry has been identified at time of analysis. This should be treated as an intelligence gap to close - retrieve the associated Ubuntu Security Notice (USN) and the NVD entry - rather than as a basis for a triage or risk-acceptance decision.
Unauthenticated enumeration of document metadata in LaSuite Doc (suitenumerique/docs) versions 4.8.2 up to but not including 5.4.0, via the GET /api/v1.0/documents/search/ endpoint that accepts a predictable seven-digit 'path' value to scope descendant searches. Because the endpoint does not require the caller to know a document's public UUID, a remote unauthenticated attacker can submit an empty search query and iterate path values to harvest document identifiers, titles, creator data, timestamps and tree metadata for public documents, then feed the disclosed identifiers into normal public-document endpoints to read the content; authenticated users can likewise reach documents shared via authenticated links, while restricted documents remain protected. Severity is moderate and confidentiality-only (assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), exploitation requires no special conditions or authentication (CVSS vector PR:N), no public exploit code was identified at time of analysis, and the issue is fixed in version 5.4.0. This is a genuine but moderate-severity information-disclosure issue, not a critical one.
libXi before 1.8.4 contains an out-of-bounds read in the XI2 device-class parsing helpers size_classes() and copy_classes(), which a malicious or compromised X server can trigger to crash a connecting X client. The issue inverts the usual X11 trust model: the server attacks the client, so exposure is limited to users who connect an affected client to an untrusted display - a remote/forwarded X session or a hostile server - and requires user interaction to establish that connection (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, 6.5). Impact is confined to client-side denial of service with no code execution, data disclosure, or integrity loss; there is no public exploit identified at time of analysis and no CISA KEV listing, and a vendor fix is available (libXi 1.8.4, upstream commit f499944a).
Out-of-bounds read in libXi before 1.8.4 allows a malicious X server to crash an attached X client by sending a crafted reply to an XI2 XIQueryDevice request. This is a denial-of-service issue affecting systems where the X client communicates with an untrusted or compromised X server, such as via SSH X11 forwarding to a hostile host or a man-in-the-middle on the X protocol stream. The CVSS vector indicates unauthenticated remote exploitation requiring user interaction (UI:R), with no impact to confidentiality or integrity and only availability impact; no public exploit code has been identified, and the vendor has released a patch fixing the flaw in version 1.8.4.
Out-of-bounds reads in libXi before 1.8.4 can crash X11 client applications when they process a crafted XQueryDeviceState() reply, producing a denial-of-service condition with no code execution or confirmed data disclosure. Exploitation requires the victim to initiate a connection to an attacker-controlled or compromised X server, or an attacker able to tamper with an unauthenticated X protocol stream, matching the UI:R requirement; clients limited to trusted local X servers are effectively not exposed. No public exploit code has been identified at time of analysis, and a vendor fix is available.
Cross-team secret disclosure in the HashiCorp Vault secrets backend for Apache Airflow lets an authenticated Dag author scoped to one team read Vault secrets belonging to a different team in multi-team deployments. The flaw (CWE-639, authorization bypass through a user-controlled key) triggers when the team-scoped lookup misses and the backend falls back to a team-agnostic path concatenated from the unvalidated Variable key; because the Execution API Variables route accepts a path-shaped key, the traversal is reachable from ordinary Dag code. The vendor assigned no CVSS score (CVSS: N/A), while the independent assessment rates it CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N - read-only disclosure with scope change and no integrity or availability impact; single-team deployments are unaffected, no public exploit code has been identified at time of analysis, and the vendor-released fix is apache-airflow-providers-hashicorp 4.8.0.
Denial of service in libXi before 1.8.4 allows a malicious or compromised X server to crash an attached X client by returning crafted input-device class data that triggers an out-of-bounds read inside XListInputDevices(). This is a client-side, inverted-trust flaw (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, base 6.5): exploitation requires the victim application to connect to an attacker-controlled display and call the device-enumeration path, and the assessed effect is limited to an availability impact - no confidentiality or integrity loss - despite the CWE-125 classification and the 'Information Disclosure' tag. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the flaw is not reachable when clients talk only to trusted local X servers.
A malicious X server can crash X clients that use libXi before 1.8.4 by returning a crafted reply to the XListInputDevices() call, triggering an out-of-bounds read (CWE-125). The flaw is purely availability-impacting (CVSS 3.1 base 6.5: AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) and requires the victim to connect to the attacker-controlled X server - for example via X11 forwarding to an untrusted host - and invoke XListInputDevices(). No public exploit code has been identified at time of analysis, and there is no indication of active exploitation (CISA KEV).
A one-byte heap out-of-bounds read in simdjson 4.6.1 lets remote, unauthenticated attackers crash any application that parses attacker-supplied JSON through the unpadded DOM API (dom::parser::parse_unpadded). The flaw is a CWE-125 out-of-bounds read in which json_iterator::walk_document() dereferences buf[len] after the input buffer has been exhausted, causing process termination and a denial-of-service condition with no confidentiality or integrity impact (CVSS: 6.5, AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H). Per available intelligence there is no public exploit code and no confirmed active exploitation (not in CISA KEV), and EPSS is only 0.17% (6th percentile); exploitation further requires user interaction and, critically, that the target deployment has chosen the unpadded parsing path rather than the standard padded parse API.
Memory exhaustion in Apache Qpid Broker-J through 10.1.0 allows authenticated message producers to degrade or disrupt broker availability by submitting compressed AMQP payloads that the shared GZIP decompressor processes without a decompressed-output cap, affecting message delivery, message conversion, and HTTP management JSON rendering. The assessed CVSS:3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, confirming a network-reachable, low-privileged availability-only condition rather than code execution or data compromise. No public exploit code, CISA KEV entry, or EPSS score is available at time of analysis, so active exploitation is not indicated; users should upgrade to Qpid Broker-J 10.1.1.
Memory exhaustion denial of service in Mini-XML (mxml) 4.0.5 allows unauthenticated remote attackers to degrade a long-running service that parses untrusted XML through mxml_load_data(). Malformed XML that creates a text/value node via mxmlNewText() and then fails parsing before the node is linked to a parent routes execution to the error cleanup path, which frees the parse tree but not the orphaned node; each malformed request therefore leaks a small allocation that accumulates until the process exhausts memory. No public exploit code identified at time of analysis, EPSS is low at 0.15% (4th percentile), and the issue is not in CISA KEV; upstream addressed the root cause in commit 83ef80ae3c5413b73f501edb59ee74e31ce399d0 targeting the unreleased v4.0.6.
Stack exhaustion in libfyaml 0.9.6 allows a crafted YAML document to crash the process that parses it, producing a denial of service. When fy_atom_iter_format() formats a literal or folded block scalar containing a long run of blank lines, it repeatedly calls alloca() inside a per-line loop; because alloca() memory is only reclaimed when the function returns, the stack grows cumulatively until the process stack limit is exceeded and SIGSEGV occurs. Exploitation is unauthenticated but requires user/application interaction (UI:R) - the target application must actually parse attacker-influenced YAML - and impact is limited to the single parsing process. No public exploit code has been identified at time of analysis, EPSS is low at 0.15% (4th percentile), and the upstream project has published fixing commits referenced from issue #315.
The CVE-2026-91767 record currently carries no description, no CVSS score or vector, no CWE mapping, and no CPE data; the only intelligence available is that the report originates from the Ubuntu vendor channel. As a result, the affected package, deployment mode, attack vector, and required privileges are all unknown, and no public exploit code has been identified at time of analysis. Risk cannot be meaningfully assessed from the available data, and the assessment must be repeated once the corresponding Ubuntu Security Notice (USN) or NVD record is published.
NanoSVG (memononen/nanosvg, revision 239e102ec) can be crashed by an SVG document whose stroke-width is large enough that floating-point rounding collapses the subdivision angle computed in nsvg__curveDivs() to zero, producing an infinite arc-division value that is converted to int without range validation (CWE-681). The result is undefined behavior that reliably terminates the process on hardening or trap-on-overflow builds, so applications that stroke-rasterize untrusted SVGs suffer a denial of service; the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H (6.5 Medium) means no authentication is required but the victim must open and render the crafted file. Exploitation signals are weak: EPSS is only 0.15% (3rd percentile), no CISA KEV entry exists, and no public exploit code has been identified at time of analysis, and impact is confined to a crash of the embedding process rather than code execution or data compromise.
Unauthenticated web origins can invoke local Fabasoft Folio Client functions on any Windows machine where both the Folio Client (builds before 26.0.0.10, or 26.x before the 26.4.0.76 April Release) and its companion browser extension are installed and the registry value VALIDDOMAINS is left unset - which is the shipped default, so every website is trusted. Because the client validates no calling origin, any page a user simply visits can trigger client operations such as downloading documents, opening documents, and synchronizing files, giving an attacker a drive-by means to influence document handling and file synchronization without any credentials (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N per the CVE record; our assessment scores it slightly lower at C:L/I:L/A:N given the functional scope observed). Exploitation requires the victim to browse attacker-controlled or compromised content, and there is no public exploit code identified at time of analysis - this is a moderate, opportunistic-risk issue rather than an urgent priority, and organizations that had already populated VALIDDOMAINS with an origin allowlist, or that upgrade to the fixed builds, are not exposed.
Uncontrolled archive extraction in Docmost 0.21.0 through 0.95.0 lets any authenticated workspace member who holds edit rights to at least one space upload a crafted ZIP to the page-import feature and exhaust server disk space, crashing the import worker and degrading or taking down the instance for all tenants. The extractor imposes no cap on total uncompressed size, per-entry size, or entry count, and it automatically unwraps one nested ZIP, so an outer archive that fits inside the default 200 MB upload limit can expand to multiple gigabytes. This is a genuine but bounded availability-only risk (CVSS 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H): confidentiality and integrity are unaffected, anonymous exploitation is not possible, and the most severe cross-tenant impact applies to shared or multi-tenant deployments, while a single-tenant self-hosted install only harms itself. No public exploit code was identified at time of analysis and the flaw is not listed in CISA KEV; EPSS data was not provided.
Authenticated users on Discourse forums running versions prior to 2026.1.8, 2026.6.3, 2026.7.2, or 2026.8.0 can read upload metadata they are not authorized to see - including original filenames and secure-upload paths - by submitting unescaped SQL LIKE wildcard characters where the application expects a literal upload identifier. The flaw (CWE-943) causes upload-metadata lookups, URL lookups, and cooked-video-placeholder resolution to match unrelated upload records instead of the intended one, leaking restricted information without modifying any records. Exploitation requires an authenticated account (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) and works against default configurations, so instances that allow self-registration or host many low-trust members carry the most exposure; there is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV not applicable). Vendor-released patches exist in 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.
An authorization bypass in the Media Gateway API of Genetec Security Center lets an authenticated account that has been explicitly denied playback and video-viewing privileges still generate video thumbnails, exposing a limited slice of video imagery to users who should not see it. The flaw is reachable remotely by any account holding valid credentials (CVSS vector shows PR:L, so authentication is required), but the exposure is bounded to thumbnail frames rather than full live or recorded streams, and it requires no user interaction and no special non-default configuration. No public exploit code has been identified at time of analysis, CISA's SSVC assessment rates exploitation as none, and the issue is resolved in Security Center 5.14.1.2, making this a genuine but modest-severity authorization defect rather than a top-tier priority.
Authenticated users of Rapid7 Velociraptor can trigger a server-side deadlock in the platform's user-management module, hanging server operations and causing a denial of service (CVSS 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Exploitation requires only a valid low-privileged account that can reach the user-management code path over the network - no user interaction, no elevated role, and no special configuration - but it offers no data read, modification, or code execution, so it cannot be used for initial access or lateral escalation. Impact is availability-only (CWE-833, lock management bug); no public exploit identified at time of analysis, no CISA KEV listing, and the vendor advisory is the authoritative source for version-specific guidance.
Unauthenticated remote attackers can export or wipe the configuration of the Custom Thank You Page for WooCommerce WordPress plugin in all versions up to and including 1.1.2, because the save_option() function is reachable without any capability or nonce check. The issue is rated CVSS 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) and is bounded to the plugin's own settings - order data and the wider WordPress site are not directly at risk - which keeps it a genuine but moderate-priority finding rather than a site-takeover bug. No public exploit code has been identified at time of analysis, and the plugin's Trac changeset suggests an upstream fix has been committed.
Server-side request forgery in Termix 2.5.0 lets authenticated users make the Termix server issue outbound HTTP requests to arbitrary destinations, including internal services that are normally unreachable from outside the host network. An attacker with a low-privileged account can register a webhook or ntfy notification channel pointing at an internal address and then trigger it through the notification-channel test endpoint, which reaches the request-sending code in src/backend/utils/notification-sender.ts without any destination allowlisting or private-address blocking. Because webhook mode also honors attacker-chosen HTTP methods and headers, the requests are blind but not strictly read-only: an internal service that accepts the fixed notification body may still change state, though response bodies are never returned to the attacker. No public exploit code has been identified at time of analysis and the issue is fixed in version 2.5.1.
Stored cross-site scripting in the WP Multilang translation and multilingual plugin for WordPress (all versions up to and including 2.4.31) lets an authenticated attacker holding Contributor-level capabilities or higher inject arbitrary JavaScript into post content, which then executes in the browser of any user - including administrators - who views the affected page. The flaw is rated moderate severity at CVSS 3.1 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) and stems from insufficient input sanitization and output escaping (CWE-79); no public exploit code and no confirmed active exploitation were identified at time of analysis, though the low attack complexity and automatic trigger on page view make it attractive for privilege-escalation and session-theft chains. Sites that do not grant untrusted users Contributor access or that have upgraded beyond 2.4.31 are not exposed.
Stored HTML injection in Discourse's topic small-action and nested-activity-log components lets an authenticated user with a crafted display name break out of the mention-link href attribute and inject arbitrary markup into the trusted page for anyone who later views the affected topic action or activity log. Attackers need only an account and a quote-bearing name (or any attacker-influenced action_code_who value); the victim requires no interaction beyond loading the topic, and the payload persists in stored topic history. The issue is limited to Unicode-encoded href paths in versions before 2026.1.8, 2026.6.3, 2026.7.2 and 2026.8.0, and no public exploit code or confirmed active exploitation was identified at time of analysis; Discourse's default Content-Security-Policy means full script execution is realistic mainly on instances that weaken or disable CSP, so the practical impact is moderate rather than critical.
Incorrect authorization in OpenWA before 0.23.5 lets any caller holding a valid VIEWER-role API key retrieve a group's active invite code through the GET /api/sessions/{sessionId}/groups/{groupId}/invite-code REST endpoint or the equivalent GroupGetInviteCode MCP tool, which enforce no OPERATOR role requirement. Because a WhatsApp invite code is a transferable bearer capability rather than plain read data, an external account can use the leaked code to join a group administered by the session, obtain read and post access, and keep that membership even after the VIEWER key is revoked. The flaw (CWE-863) is a broken-authorization issue rather than a remote-code-execution bug, CVSS 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), requires the victim session to have a started engine and an administered group with an existing invite code, and is only practically dangerous in deployments that hand VIEWER keys to parties who should not be able to add accounts to those groups. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis; the vendor released a patch in version 0.23.5.