Volume restriction bypass in copyparty's SFTP front end allows authenticated SFTP users to create, delete, or truncate files outside their authorized volumes by abusing three handlers (_mkdir, _rmdir, _chattr) that canonicalize destination paths via symlink traversal without invoking the xvol/chk_ap access check. Publicly available exploit code exists and the issue has been reported by VulnCheck, but CISA KEV does not list this CVE, so confirmed active exploitation is not established. The independent assessment rates this as a moderate-severity authorization-boundary flaw (CVSS 3.1: 5.3, AV:N/AC:H/PR:L/UI:N/C:N/I:H/A:N) with integrity-only impact and no read/exfiltration primitive; the vendor CVSS 4.0 score is 6.0.
Server-side request forgery in TREK (versions prior to 3.4.0) allows an authenticated user to reach internal services or cloud metadata by supplying a URL whose DNS AAAA answer is a NAT64, 6to4, or Teredo IPv6 transition address that encodes a private, loopback, or link-local IPv4 target, bypassing the checkSsrf guard in server/src/utils/ssrfGuard.ts. Exploitation is conditional rather than automatic: it requires a valid TREK account, attacker control of a DNS record, a feature that performs server-side egress (imports, webhooks, integrations, or plugin egress), and a hosting environment that actually routes the chosen transition format - the reason the assessed CVSS is 6.3 (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N) with high attack complexity and confidentiality-only impact. No public exploit code has been identified at time of analysis, and TREK 3.4.0 fixes the flaw.
OS command injection in jhen0409's React Native Debugger up to 0.14.0 allows remote, unauthenticated attackers to run arbitrary shell commands on a developer workstation by supplying a crafted host value that reaches the openDevTools function in electron/window.js when the victim uses the 'Open in Editor' feature against an attacker-controlled debug target. Publicly available exploit code exists (the GitHub gist referenced by VulDB), but there is no confirmed active exploitation (CISA KEV) and the vendor was contacted and did not respond, so no vendor-released patch is identified. Scoring is moderate and consistent with a developer-targeted issue rather than a mass-exploitation priority: the vendor-supplied CVSS 4.0 score is 5.3 (UI:P, E:P) and our independent CVSS 3.1 assessment is 7.8 with high confidentiality, integrity and availability impact, reflecting that a successful injection executes with the privileges of the developer's account but requires the developer to connect the debugger to an attacker-influenced host and to trigger the editor/dev-tools launch.
Deserialization of untrusted document content in the MongoDB PHP Driver (CWE-502) lets class names embedded in a field such as __pclass be honored when the driver constructs command-monitoring event objects, so an unauthenticated party who controls data flowing into a database operation can cause an application class implementing the driver's persistable interface to be instantiated and have its unserialization method invoked. The flaw only bites applications that (1) register a command monitoring subscriber and (2) pass attacker-controlled data into an operation reflected in monitoring events; impact ranges from benign to severe depending on which gadget classes exist in the deployment, which is why the vendor rates it 6.3 (CVSS 4.0, AV:N/AC:H/PR:N/UI:N/VC:L/VI:L/VA:L) and our independent assessment lands at CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L. No public exploit code or confirmed active exploitation has been identified at time of analysis; vendor-released patches are available in driver versions 1.21.10, 2.1.10 and 2.5.3.
Incorrect type casting in the Perl DBI module's internal DBI::sql_type_cast routine can cause incorrect conversion results, a crash, or a limited memory over-read when an affected application invokes that routine on a Perl scalar holding an internal integer (IV) or numeric/double (NV) value that an attacker can influence. The independently assessed vector (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L) indicates a local, high-complexity attack requiring low privileges and no user interaction, with only low confidentiality, integrity and availability impact, and no public exploit code was identified at time of analysis. The entry is extremely data-sparse - no CVSS score or vector, no CWE, no EPSS, no CISA KEV listing and no POC were supplied - so the only substantive artifacts are a commit-message-style fix title ('Fix DBI::sql_type_cast on IV/NV') and a vendor report from Ubuntu, meaning exploitability depends entirely on whether a specific DBD driver or application actually reaches the affected code path with attacker-controlled input.
Parsing attacker-controlled iCalendar data containing a parameterized property in libical 4.0.6 can terminate the consuming process, because icalparameter_string_to_kind() passes an incompatibly-cast comparator to bsearch(); the same defect exists in the libicalvcard path via vcardparameter_string_to_kind(). No authentication is required (CVSS PR:N) and no user interaction is encoded (UI:N), but exploitation hinges on the target being built with Control Flow Integrity enforcement or a function-pointer-type sanitizer, since type-confusion callbacks usually execute without aborting on ordinary non-hardened distro builds, and in practice a library needs to be fed untrusted calendar content by an application that parses it automatically or on user action. Independent assessment scores this CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H (input data lists 6.2 at AV:L), EPSS is only 0.17% (5th percentile), and no public exploit code has been identified at time of analysis; the issue is best characterized as a low-priority, high-noise type-confusion defect rather than a broadly exploitable denial-of-service vector.
Denial of service in Bento4 1.6.0.0 arises when the MP4 parser processes a crafted H.264/AVC or H.265/HEVC configuration atom (avcC or hvcC) whose declared atom size is smaller than AP4_ATOM_HEADER_SIZE. The size calculation underflows, AP4_AvccAtom::Create() or AP4_HvccAtom::Create() then passes an invalid or NULL pointer into the AP4_DataBuffer copy path, and the hosting application terminates. The CVSS vector is AV:L/PR:N/UI:N with only availability impact, so exploitation requires the malicious file to reach a local parsing path; no public exploit identified at time of analysis, CISA KEV status is not indicated in the supplied data, and EPSS is 0.15% (3rd percentile).
IBM Concert 1.0.0 through 3.0.0 contains a local information disclosure flaw in its recursive directory-copy functionality, where a lack of proper access controls can lead to the unintentional inclusion of sensitive or unnecessary files, increasing the attack surface. The vulnerability requires local access to the host and is modeled as unauthenticated (PR:N) with no user interaction (UI:N), but its impact is bounded to confidentiality loss (C:H) with no integrity or availability impact. No public exploit code has been identified, and the vendor has released a patch via IBM support.
Open redirect in the Edimax BR-6428nC router firmware (1.16) allows a remote, unauthenticated attacker to steer a victim's browser to an arbitrary external site by crafting a malicious submit-url value, because the websRedirect function in the goform handler fails to validate the redirect target (CWE-601); multiple endpoints in that handler are affected. Exploitation is not server-side - it requires a victim to click a crafted link and follow the redirect (CVSS v4 UI:P, PR:N), and impact is limited to phishing/social-engineering enablement (VI:L, no confidentiality or availability impact), matching the assessed CVSS:3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. Publicly available exploit code exists (published proof-of-concept with a Notion write-up), and no CISA KEV listing or EPSS score was provided in the available intelligence; the vendor was contacted early but did not respond, so no vendor-released patch was identified at time of analysis.
Path traversal in MantisZip 0.4.5 and earlier lets an attacker cause files to be read or written outside the intended archive-extraction directory when a victim opens a crafted archive and triggers the Preview component, which passes untrusted entry paths into Path.Combine in MainWindow.UI.cs. The attack is remote in the sense of file delivery but entirely client-side: exploitation requires the victim to open the attacker-supplied archive (UI:P) and no authentication is involved (PR:N), so success depends on social engineering. Publicly available exploit code exists, but there is no confirmed actively exploited (CISA KEV) status; the project has not responded to the issue report and no vendor-released patch is identified, with the independent CVSS:3.1 assessment of 5.3 (low-to-moderate risk) reflecting confined impact on the host running the tool.
Uncontrolled resource allocation in the MasterService::GetReplicaListByRegex handler of kvcache-ai Mooncake (all versions up to and including 0.3.12, and 0.3.14-rc1) allows a remote low-privilege client that can reach the MasterService RPC endpoint to exhaust server memory or CPU by submitting a crafted regular expression to the Regular Expression Handler. The impact is availability-only and partial (CVSS 4.0 5.3, VA:L; assessed CVSS 3.1 5.3 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L), so this is a denial-of-service concern rather than a confidentiality or integrity compromise. Publicly available exploit code exists (a proof-of-concept gist is referenced via VulDB), and the affected project has a small deployment footprint; no CISA KEV entry exists and no vendor patch was released because the vendor did not respond to the disclosure.
An open redirect in the Subrion CMS login flow (front/login.php, iaUsers::authorize) through unvalidated use of the $_SERVER['HTTP_REFERER'] value lets remote, unauthenticated attackers send a crafted link that, once the victim follows it and interacts with the login page, redirects the browser to an attacker-controlled destination. Affected deployments are Intelliants Subrion CMS releases up to and including 4.2.1; the vendor was contacted early but did not respond, and publicly available exploit code exists, so the technique is trivially reproducible. The impact is deliberately narrow - no data disclosure, code execution, or denial of service - and the flaw only amplifies phishing and social-engineering campaigns, which is consistent with the low vendor CVSS 4.0 base score of 2.1; there is no indication of confirmed active exploitation (no CISA KEV listing).
Improper access control in kvcache-ai Mooncake up to versions 0.3.12, 0.3.13.post1, and 0.3.14-rc1 allows remote attackers to manipulate the ScopedSegmentAccess::MountSegment routine in segment.cpp so that a client can mount segments outside its intended scope, degrading the integrity and availability of segment state. Per the CVSS vector (PR:N) the attack requires no authentication, and impact is bounded to low integrity and availability loss with no confidentiality exposure and no code execution. Publicly available exploit code exists (a public gist is cited in the disclosure), and because the vendor was contacted early but did not respond, no vendor-released patch has been identified at time of analysis.
Cross-site scripting in Mailspring's attachment quick-preview (all versions prior to 1.17.0) allows a remote, unauthenticated sender to execute script in the recipient's preview renderer by delivering a crafted Markdown, DOCX, or XLSX attachment that the victim opens in quick preview. Exploitation requires the recipient to actively open the preview (UI:R), and the injected script runs in a renderer that has no direct Node or Electron access, so it can reach the IPC surface exposed to the quick-preview renderer but cannot by itself achieve host-level code execution - Mailspring's advisory notes that persistent code execution requires chaining this bug with separate path-traversal and renderer-controlled file-write issues. The flaw is rated CVSS 6.1 and is fixed in Mailspring 1.17.0; no public exploit code or confirmed active exploitation was identified at time of analysis.
SQL injection in Forma LMS up to and including version 4.1.43 allows an attacker with an authenticated session on the administrative back end to manipulate the 'Name' argument handled by UserselectorAdmController::getData in /appCore/ajax.adm_server.php?r=adm/userselector/getData, injecting arbitrary SQL against the underlying database. Exploitation is remote and requires no user interaction, but the vulnerable endpoint is admin-scoped (CVSS vector PR:L), so valid low-privileged/admin-panel credentials are a prerequisite; publicly available exploit code exists and the vendor was contacted without responding. This is a moderate, not top-tier, priority issue: the primary limiting factors are the authentication requirement and Forma LMS's comparatively limited deployment base, which constrain real-world exposure.
Authorization bypass in SpringBlade through 5.0.2 lets attackers read other users' account information by supplying an arbitrary userId to the user-auth-info endpoint backed by UserServiceImpl.userInfo, because the application never verifies that the requested user object belongs to the caller. Publicly available exploit code exists, and the vendor was contacted about the disclosure but did not respond, so no official fix is available. Although the supplied CVSS 4.0 vector lists PR:N, the endpoint is a user/auth-info API that in practice requires at least a low-privileged authenticated session, and the realistic impact is limited to read-only disclosure of user profile data (no modification or code execution).
Path traversal in volotat Anagnorisis through 0.4.2 allows an authenticated remote attacker to use the get_file_content, save_file_content, move_files, and start_streaming handlers in page.html to escape the intended media directory, enabling limited file disclosure and arbitrary file modification or relocation. The vendor was contacted but did not respond, no fixed version is identified, and publicly available exploit code exists. This is a medium-severity issue (VulDB CVSS 4.0 5.3; independent CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) affecting self-hosted instances where an attacker can obtain valid credentials.
Information disclosure in O2OA (up to and including 9.5.3 and 10.0.2) lets an authenticated remote attacker read data they should not be able to access by supplying a manipulated fileUrl argument to the list function of the Cipher Connection Handler (CipherConnectionAction.java). The flaw is a CWE-200 exposure of sensitive information rated CVSS 5.3 (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/E:P), mapped independently to CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - confidentiality-only, low impact, requiring a valid session but no user interaction. Publicly available exploit code exists (a public GitHub issue demonstrates the technique) and the issue is not listed in CISA KEV, so it is not confirmed as actively exploited; the vendor was contacted but did not respond, and no vendor-released patch has been identified.
RabbitMQ's shovel management resource fails to enforce a policymaker-level check on DELETE operations, so an authenticated user holding the low-privileged 'monitoring' tag - nominally read-only - can delete or restart any dynamic shovel in any vhost visible to that account. The flaw (CWE-862 missing authorization) is reachable over the network with no user interaction and yields high integrity impact against shovel configuration state, though it is bounded by a non-default configuration requiring both the rabbitmq_shovel and rabbitmq_shovel_management plugins to be enabled and by the attacker needing pre-existing credentials plus vhost-scoped visibility. Patches are released in RabbitMQ 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1; no public exploit code has been identified and there is no confirmed active exploitation (no CISA KEV listing) at time of analysis.
Stored cross-site scripting in huanzi-qch base-admin lets a low-privileged authenticated user inject script through the Username argument of the Add User handler (CommonController.java Save), which then executes in the browser of any user - typically an administrator - who later views the tainted page. Exploitation requires a valid low-privileged account plus victim interaction (viewing the rendered username), and publicly available exploit code exists; no confirmed active exploitation is indicated (no CISA KEV listing). Because the project ships via continuous rolling releases, no fixed version has been published and the vendor did not respond to the disclosure.
Cross-site scripting (XSS) in volotat Anagnorisis up to 0.4.11 allows an authenticated low-privilege attacker to inject script through a crafted media filename or file_path argument processed by the PlaylistManager.js html function, with execution occurring when a victim views the affected playlist or media entry. Publicly available exploit code exists, and the vendor was contacted but did not respond, so no vendor-released patch has been identified. The CVSS 4.0 base score is 5.1 (MEDIUM) with PR:L and UI:P, limiting impact to same-origin actions and low integrity manipulation.
Ubuntu Linux packages are implicated by a security defect reported through Canonical's coordinated disclosure process, but the intelligence set contains no description, CVSS vector, CWE classification, affected package name, version range, or reference links. Because neither the vulnerable component nor the attack surface can be identified, it is not possible to state whether the issue is remotely or locally exploitable, what privileges an attacker would need, or what level of impact (code execution, privilege escalation, denial of service, information disclosure) would result. No public exploit code and no CISA KEV entry are indicated in the available data, and no vendor patch version is identified at time of analysis; treat this record as unresolved pending retrieval of the corresponding Ubuntu Security Notice (USN) and NVD entry.
CVE-2025-1218 is attributed solely to Ubuntu in the available intelligence, with no published description, CVSS vector, CWE classification, CPE data, or reference links, so the concrete security impact cannot be established from the supplied data. Because no affected package, version range, or vulnerable component is identified, neither the attack surface nor the prerequisites (authentication level, network exposure, user interaction) can be scoped for any Ubuntu release. No public exploit code was identified and there is no evidence of active exploitation (no CISA KEV entry) at time of analysis, but the identifier should be treated as unscored rather than low risk until the Ubuntu Security Notice and NVD entry are retrieved.
Out-of-bounds read in the Huawei HarmonyOS graphics module allows an attacker who can already run code locally on the device - or deliver crafted graphics content for local processing - to read past the end of an allocated buffer and crash the graphics component. The assessed vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L) confirms local-only reachability with no privileges or user interaction required, and bounds the impact to limited memory disclosure plus availability degradation; there is no demonstrated path to code execution or privilege escalation. No public exploit code was identified and the CVE is not listed in CISA KEV, so no confirmed active exploitation at time of analysis.
Improper TLS certificate validation in HAVELSAN Liman Render Engine (versions from 1.0 up to but not including 1.2-75) lets a network-positioned adversary conduct an adversary-in-the-middle attack, causing the engine to accept forged or otherwise invalid certificates so that intercepted traffic can be decrypted and sensitive data disclosed. The assessed vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N, base 5.9) shows no authentication or user-interaction prerequisite, but exploitation hinges on the attacker first occupying a man-in-the-middle position on the path between an engine endpoint and its peer, which is why the attack is scored high-complexity and the impact is confidentiality-only with no integrity or availability effect. No public exploit code has been identified at time of analysis, CISA SSVC records exploitation as 'none' with automatable 'no' and partial technical impact, and the issue was reported by TR-CERT.
Interception of the key exchange in HAVELSAN Liman Render Engine (versions 1.0 up to but not including 1.2-75) allows an on-path attacker to decrypt or meddle with traffic, because keys are agreed without authenticating the peer entity (CWE-322). Exploitation requires the attacker to already hold a position on the network path between the victim client and the Render Engine - through ARP spoofing, a rogue access point, or a compromised router - which is why the issue carries HIGH attack complexity even though no credentials (PR:N) and no user interaction (UI:N) are needed. The impact is confined to confidentiality (CVSS 3.1 base 5.9, C:H/I:N/A:N); no public exploit code and no active exploitation have been identified at time of analysis, and the CISA SSVC assessment rates exploitation as none, automatable as no, and technical impact as partial, making this a moderate, situational risk rather than a broad-exploitation priority.
Risk cannot be meaningfully assessed from the provided data: CVE-2026-93682 is associated only with the Ubuntu security tracker (reported by vendor:ubuntu) and arrives with no description, no CVSS vector, no CWE classification, and no CPE mapping, so the affected Ubuntu source package, the exposed component, and the attack surface are all unidentified. Because no vulnerability class, privilege requirement, or user-interaction condition can be established, it is impossible to state whether this is remote code execution, privilege escalation, denial of service, or information disclosure. No public exploit code exists at time of analysis and no EPSS score or CISA KEV entry was supplied, but that silence reflects missing intelligence rather than a confirmed low risk, and no patch information was included in the input.
Malformed syslog packets can crash the log collector in ManageEngine EventLog Analyzer and Log360 builds prior to 13071, causing a denial of service against the log ingestion pipeline. The issue is remotely reachable without authentication or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, base 5.3) because syslog reception is a default, always-on function of both products; there is no public exploit identified at time of analysis, and impact is confined to availability (A:L) with no confidentiality, integrity, or code-execution effect. Exposure is greatest where the syslog listener is reachable from an untrusted network segment, while collectors restricted to trusted internal sources carry substantially lower risk.
Authorization bypass in kvcache-ai's Mooncake KV-cache store (versions through 0.3.12 and 0.3.13.post1) lets any client that can reach the RPC service call the UnmountSegment handler and tear down storage segments belonging to other clients by supplying their client_id and segment_id. The attack is unauthenticated and needs no user interaction according to the CVSS vector (PR:N/UI:N), so the practical gate is network exposure of the RPC endpoint plus the ability to know or enumerate valid identifiers; impact is limited to integrity and availability of the distributed cache (C:N/I:L/A:L under CVSS 3.1, base 5.5 in the published CVSS 4.0 score). Publicly available exploit code exists in the form of a disclosure gist, but there is no evidence of active exploitation (no CISA KEV listing), and the vendor was contacted without responding, so no fixed release has been identified.
Improper authorization in the yudao-module-pay component of ruoyi-vue-pro (YunaiV / zhijiantianya) lets an attacker manipulate the ID argument passed to updateDemoOrderPaid in PayDemoOrderController.java, modifying demo payment-order records the caller is not authorized to touch; CWE-285 classifies this as an IDOR-style broken access control, and the attack is remote with no user interaction. The affected surface is the DEMO order payment-callback handler of the pay module, so direct impact is confined to demo order data rather than live production payments, and exploitation requires the pay demo module to be enabled and the endpoint reachable. Publicly available exploit code exists, but there is no evidence of confirmed active exploitation (not listed in CISA KEV), and the vendor was contacted early about the disclosure but did not respond, so no vendor-released patch has been identified at time of analysis.
SQL injection in the pmTicket project-management web application allows remote attackers to inject arbitrary SQL through the conn_settings argument processed by the setSync function in /ajax/add_project.php, giving at least read and modification access to database content (our assessment rates confidentiality and integrity impact as High, availability as None). Exploitation requires network reachability to that AJAX endpoint plus the ability to supply conn_settings, and publicly available exploit code exists (a proof-of-concept demonstration is referenced at asciinema.org); there is no KEV listing or other evidence of confirmed active exploitation. Access prerequisites are disputed: the published CVSS v4 vector states PR:N (no authentication), whereas our independent assessment assumes PR:L because add_project is a project-creation action that most plausibly runs behind an authenticated session, so treat pre-auth exploitability as unverified. The product is delivered on a rolling-release basis with no versioned builds, and the vendor did not respond to disclosure, so no patched release is available.
Denial of service in LibRaw 0.22.0: opening a crafted RAW, TIFF or DNG file whose TIFF tag 0x00fe (NewSubfileType) carries a value outside signed-int range drives an unchecked narrowing conversion in LibRaw::parse_tiff_ifd(), triggering undefined behavior that terminates the process. The issue is availability-only (CVSS 3.1 5.5, AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) and requires user interaction - a victim or an automated pipeline must open the malicious file - with no privilege requirement, no data exposure and no code execution. There is no evidence of active exploitation (no CISA KEV listing) and EPSS is low at 0.15% (4th percentile), although the upstream fix PR contains a regression harness with a minimal crafted TIFF that reproduces the out-of-range value, so a public crash reproducer exists.
A crafted Code 128 barcode can abort ZBar (commit 2ea2ca58) with SIGILL when the library is built with trap-mode UndefinedBehaviorSanitizer, because decode_e() returns -1 for an invalid edge pattern and decode6() then left-shifts that negative signed value while assembling the edge signature. The issue is local and requires the victim to feed attacker-supplied barcode input into a ZBar-embedding application (UI:R), and the deterministic crash only occurs in non-default sanitizer builds typically used for development, testing, or fuzzing; production binaries compiled without trap-mode UBSan are not expected to terminate reproducibly. With an EPSS score of only 0.15% (3rd percentile), no KEV listing, and no publicly available exploit code identified at time of analysis, this is a low-priority, sanitizer-configuration-dependent robustness bug rather than a broadly exploitable denial-of-service flaw.
Opening a specially crafted WAV file with libsndfile 1.2.2 can cause a denial of service when the library's header parser performs an unaligned 4-byte store through a cast unsigned int pointer, which faults on strict-alignment CPU architectures. The flaw is reachable by remote attackers who can get a victim to process the malicious file, but requires user interaction and results in single-process crash only, with no code execution, data disclosure, or integrity impact. There is no public exploit code and no evidence of active exploitation; EPSS is 0.14% (3rd percentile) and the CVE is not in CISA KEV, so despite the medium 5.5 CVSS score this is a low real-world priority. Additionally, because x86/x86-64 tolerates misaligned access, the crash is largely limited to ARM, SPARC, MIPS and sanitizer-instrumented builds.
Offline recovery of stored SSH secrets is possible in Termix 1.7.0 through 2.5.0 because the keys that wrap OIDC and WebAuthn users' Data Encryption Keys are derived from committed default strings rather than operator-supplied secrets. An attacker who obtains a copy of the SQLite database - through an exposed or stolen backup, filesystem access, or a separate exfiltration bug - can recompute the wrapping key from the static default value plus the public userId salt, unwrap each affected user's DEK, and decrypt stored SSH passwords, private keys, and key passphrases; password-authenticated users are not affected by this derivation path. Vendor-released patch: 2.5.1. No public exploit code has been identified at time of analysis, and because the attacker must already hold the database file, this is an access-gated local data-confidentiality flaw (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) rather than a network-facing issue.
Reflected cross-site scripting (XSS) in the MediaWiki CirrusSearch extension through version 1.46.0 allows remote attackers to inject malicious scripts into search pages via crafted links, requiring a victim to click the link. The vulnerability carries moderate severity (CVSS 4.0 score 5.5) because exploitation is client-side only, with low confidentiality impact and no integrity or availability impact. Publicly available proof-of-concept exploit code exists, but there is no indication of active exploitation (not in CISA KEV). Only wikis that have installed the CirrusSearch extension, typically Elasticsearch-backed deployments, are affected.
Parsing a malformed OpenEXR image can terminate the host application: OpenEXR 3.4.14's C++ attribute parser constructs an OpaqueAttribute with a NULL packed_data pointer when an EXR file declares an unknown attribute type with dataSize set to zero, and the constructor forwards that NULL pointer to memcpy() without checking the zero-length case, triggering undefined behavior and a crash. The issue is local in vector terms (AV:L) and requires user interaction (UI:R) - an attacker must get the victim or an automated pipeline to open or otherwise ingest the crafted .exr file - and its impact is limited to availability (C:N/I:N/A:H, CVSS 5.5), with no code execution or data disclosure demonstrated. There is no KEV listing and no public exploit identified at time of analysis; the upstream fix is a guard in pull request #2615 rather than a confirmed tagged release.
Blind server-side request forgery in the Kirki - Freeform Page Builder, Website Builder & Customizer plugin for WordPress, affecting all versions up to and including 6.2.0, allows unauthenticated remote attackers to make the WordPress server issue HTTP requests to arbitrary locations by supplying an attacker-controlled URL in the 'kirki_data' parameter. Because the SSRF is blind (no response body is returned to the attacker), exploitation is assessed as high-complexity: the attacker must already know or correctly guess reachable internal hosts or services, so the practical impact is limited to internal service enumeration, state-changing requests against unauthenticated internal endpoints, and access to cloud instance-metadata addresses that the host can reach. There is no public exploit identified at time of analysis and the vulnerability is not confirmed actively exploited (CISA KEV), making this a moderate-risk, not top-priority, issue for most deployments - though it becomes materially more serious on hosts with broad outbound network reachability or attached cloud IAM roles.
Stored cross-origin iframe injection in Discourse allows an authenticated user with posting privileges to bypass the allowed_iframes prefix policy by embedding an iframe whose src contains encoded userinfo, so the sanitizer's decoded validation passes while the browser resolves an attacker-controlled host. Affected releases are those prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0; the assessed CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N (5.4), reflecting limited confidentiality and integrity impact and no availability loss. Exploitation requires a valid posting account and a site where at least one iframe host prefix is permitted, and there is no public exploit identified at time of analysis; the risk is genuine but moderate rather than an emergency.
Stored cross-site scripting in Discourse's notification email and chat-summary rendering paths allows an authenticated user with standard posting privileges to inject markup into messages generated for other users. In versions prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, a post referencing a video from an enabled provider (YouTube, Vimeo, or TikTok) whose provider-side title contains markup is reparsed as HTML when the notification email or chat summary is built, so recipients reading those messages in an HTML-capable email client may render injected content, potentially including event handlers; impact is confined to the email/chat rendering context and does not reach the Discourse browser session or the forum page itself. Lazy video embeds must be enabled (the default configuration) for exploitation, authentication requirements are confirmed as low-privileged (CVSS vector PR:L), no public exploit code has been identified at time of analysis, and this is assessed as a genuine but low-priority issue.
Termix versions 1.8.0 through 2.5.1 expose server-stats API routes that lack per-host authorization, allowing any authenticated user to read host online/offline state and lastChecked timestamps for hosts they cannot access and to clear the instance-wide SSH connection pool. Because GET /status/:id accepts an attacker-supplied numeric host identifier, a low-privileged account can enumerate host IDs (IDOR), while POST /clear-connections disrupts other users' active sessions and pooled connections. Unauthenticated requests remain blocked and no public exploit code has been identified at time of analysis; CVSS is 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L) and the vendor fixed the issue in 2.5.1.
Code injection in DbGate (a web-based database GUI) versions up to 7.2.5-beta.5 lets an authenticated user who can create or edit a JSON Runner or scheduled script inject text into the comment.text or script.schedule fields that escapes the generator's `//` comment wrapper and reconstitutes a `// @require <module>` or `// @schedule` directive, causing the server to load and execute attacker-supplied code. The flaw is remote, requires low privileges (PR:L) and no user interaction, and is limited to unpatched releases; it is fixed by upgrading to 7.2.5-beta.6 (upstream commit 70e7b6b58e464d7a015ba16e8d7574b420ee4877, PR #1527). There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, though the EPSS-style exposure is mitigated mainly by the requirement for an authenticated account with runner-editing rights. This issue is explicitly distinct from CVE-2026-47668.
TREK, a self-hosted collaborative travel planner, returns complete trip itinerary data - day plans, assignments, notes, place names, coordinates, addresses, descriptions and prices - from GET /api/shared/:token even when the trip owner has turned off the share_map setting. The server-side getSharedTripData function in server/src/services/shareService.ts never enforces that toggle; only the web client hides the map, so anyone who queries the JSON endpoint directly with the valid random share token can read the location and route information the owner explicitly chose to withhold. The exposure is read-only (no data modification is possible), affects all versions prior to 3.3.0, and requires possession of the unguessable token rather than anonymous scanning; a vendor patch is available in 3.3.0, and no public exploit code has been identified at time of analysis.
Information disclosure in OpenStack Swift deployments that run the shipped default proxy pipeline: the tempurl middleware does not reject an attacker-supplied X-Copy-From header on signed PUT requests, so anyone holding a valid, unexpired PUT TempURL for a single object can make the copy middleware pull another object from the same account into the destination path and then read that data back using a GET TempURL for the destination. The impact is bounded rather than systemic - copies across account boundaries are rejected, deployments without the copy middleware in the pipeline are unaffected, and the CVSS score is 5.3 with a PR:L vector reflecting the need to hold a legitimate signed TempURL capability. No public exploit code has been identified at time of analysis, and CVE-2026-97149 is not reported as confirmed actively exploited (CISA KEV).
Playlist enumeration in Black Candy through 3.2.1 allows any authenticated user to retrieve the names of every playlist hosted on the instance, including those belonging to other accounts. The playlist search code paths (SearchController and Search::PlaylistsController) do not scope results to the session user, so blank or targeted query parameters return cross-user playlist names; exploitation requires a valid account (CVSS 4.0 PR:L, independently assessed CVSS 3.1 5.3 with C:L/I:N/A:N) and network reachability to the web interface. Exposure is confined to playlist names - no playlist content, credentials, integrity, or availability impact - and no public exploit has been identified at time of analysis.
Heap out-of-bounds write in libconfini 1.16.4 causes deterministic denial of service in applications that follow the library's bundled load_ini_buffer.h allocation pattern, which sizes the INI buffer to exactly ini_length bytes while strip_ini_cache() unconditionally writes a NUL terminator at ini_source[ini_length]. Any non-empty INI input is sufficient to trigger the resulting single-byte heap corruption, so exploitation requires no special payload or timing. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, 5.3) frames the issue as unauthenticated and remotely reachable, but real-world network exposure depends entirely on whether the host application actually parses attacker-supplied INI content; no public exploit code was identified at time of analysis, there is no CISA KEV entry, and EPSS is only 0.15% (3rd percentile), supporting a low-priority availability assessment with no demonstrated code execution.
Unauthenticated path traversal in Docmost versions prior to 0.80.1 allows a remote attacker to read files from local storage by supplying attacker-controlled fileName path segments to the public avatar and logo image endpoint, which resolves them outside the intended image directory. Disclosure is constrained to local-storage objects whose final basename satisfies the route's UUID check, so arbitrary system files cannot be read; the assessed impact is confidentiality-only (CVSS 5.3) and the flaw requires a deployment using the local filesystem storage driver rather than external/object storage. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited, though the low attack complexity and lack of authentication make prompt upgrading to 0.80.1 advisable.
The MongoDB Python Driver (PyMongo) versions 3.9.0 through 4.18.1 can be induced to open connections to local Unix domain sockets on the application host when an attacker who already holds write access to the encryption key metadata in the database alters a key management (KMS) endpoint value so that it ends in '.sock' - a string the client-side field level encryption (CSFLE) code path mistakes for a local socket path instead of a remote host. Exploitation requires the opt-in, non-default CSFLE feature to be in use and an authenticated attacker with database-side write access to the key vault, and it is only reachable over the network in the sense that CVSS scores the vector AV:N/PR:L; the transmitted bytes are restricted to the beginning of a TLS handshake, so no attacker-chosen content reaches the socket and data exfiltration or arbitrary remote-host reachability is not achievable. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; despite the CWE-918 (SSRF) classification, this is a low-priority, low-impact defect. Vendor-released patch: 4.18.2.
Termix 2.4.0 through 2.5.0 permits an attacker who already holds a victim's authenticated session and knows the account password to disable TOTP two-factor authentication or regenerate (and thereby invalidate) the victim's backup codes through POST /users/totp/disable and POST /users/totp/backup-codes, degrading the account to single-factor authentication. The defect is a regression of the fix originally shipped for CVE-2026-45749: a 2.4.0 refactor made verifyTotpReauth accept a bcrypt-validated password as an interchangeable substitute for a TOTP code, so no authenticator or valid second factor is needed. Scored CVSS 5.3 (AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N) and tracked as EUVD-2026-86120, this is a conditional security-degradation flaw rather than a high-urgency issue - the attacker cannot reach the endpoints without an active authenticated session (PR:L) and must separately know the plaintext password (driving AC:H), and the outcome is a weakened authentication posture (integrity impact only) with no confidentiality or availability impact. Vendor-released patch: 2.5.1; no public exploit code or confirmed active exploitation was identified at time of analysis.
Authenticated path traversal in DbGate's files-style API endpoint lets a low-privileged remote user read files outside the intended data directory by manipulating the filePath/uri argument passed to fs.readFile. The issue affects self-hosted web/server deployments running versions up to 7.2.5 and 7.3.1-premium-beta.1 where the packages/api controller is network-reachable; single-user desktop/Electron installs without an exposed API are largely out of scope. No public exploit code has been identified at time of analysis and the flaw is not in CISA KEV, but the vendor was contacted during disclosure and did not respond, so no official fix is confirmed. Overall this is a moderate-risk information-disclosure bug (assessed CVSS 3.1 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) whose real impact depends on which files the DbGate process can read.