Stored HTML injection in The Post Grid WordPress plugin before version 7.9.5 lets authenticated users with at least the Contributor role persist iframe, style and input elements that WordPress normally strips, because the plugin widens the site-wide allowed-HTML (kses) list instead of limiting the expansion to its own shortcodes. The saved markup renders for every visitor to the affected post and for administrators previewing it, enabling phishing frames, CSS defacement and spoofed input forms, though it stops short of script execution. Publicly available exploit code exists (reported via WPScan), but there is no confirmed active exploitation according to the CISA SSVC record (exploitation: none), and this is a low-to-moderate severity issue rather than a critical priority.
Authenticated information disclosure in the WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.26 lets any account with contributor-level access or higher read the stored campaign configuration and execution logs belonging to other users, including administrators. The endpoint returns campaign objects without verifying ownership or authorization (CWE-639), so a low-privilege author can enumerate campaign identifiers and retrieve settings and run logs they should never see; the effect is read-only, with no modification, privilege escalation, or denial of service. Publicly available exploit code exists (referenced by WPScan), but CISA's SSVC assessment records no observed exploitation and rates the issue as non-automatable with partial technical impact - consistent with our independent assessment that this is a low-severity information-disclosure issue and not a real prioritization concern.
Improper authorization in the Events Manager WordPress plugin before 7.4.5 allows an authenticated user who can manage tickets for at least one event to overwrite and reassign any ticket on the site - including tickets belonging to events they do not control - because the ticket-update handler authorizes the request against one ticket but then applies the change to client-supplied identifiers without re-verifying ownership. Publicly available exploit code exists, but exploitation is gated by the privileged event-management role required (CVSS 3.1 PR:H) and impact is confined to the integrity of ticket records, with no data disclosure or availability loss. Scoring CVSS 3.1 2.7 and assessed by CISA SSVC as non-automatable with partial technical impact, this is a genuinely low-priority vulnerability despite being real and patched.
Volume restriction bypass in copyparty's SFTP front end allows authenticated SFTP users to create, delete, or truncate files outside their authorized volumes by abusing three handlers (_mkdir, _rmdir, _chattr) that canonicalize destination paths via symlink traversal without invoking the xvol/chk_ap access check. Publicly available exploit code exists and the issue has been reported by VulnCheck, but CISA KEV does not list this CVE, so confirmed active exploitation is not established. The independent assessment rates this as a moderate-severity authorization-boundary flaw (CVSS 3.1: 5.3, AV:N/AC:H/PR:L/UI:N/C:N/I:H/A:N) with integrity-only impact and no read/exfiltration primitive; the vendor CVSS 4.0 score is 6.0.
OS command injection in jhen0409's React Native Debugger up to 0.14.0 allows remote, unauthenticated attackers to run arbitrary shell commands on a developer workstation by supplying a crafted host value that reaches the openDevTools function in electron/window.js when the victim uses the 'Open in Editor' feature against an attacker-controlled debug target. Publicly available exploit code exists (the GitHub gist referenced by VulDB), but there is no confirmed active exploitation (CISA KEV) and the vendor was contacted and did not respond, so no vendor-released patch is identified. Scoring is moderate and consistent with a developer-targeted issue rather than a mass-exploitation priority: the vendor-supplied CVSS 4.0 score is 5.3 (UI:P, E:P) and our independent CVSS 3.1 assessment is 7.8 with high confidentiality, integrity and availability impact, reflecting that a successful injection executes with the privileges of the developer's account but requires the developer to connect the debugger to an attacker-influenced host and to trigger the editor/dev-tools launch.
Open redirect in the Edimax BR-6428nC router firmware (1.16) allows a remote, unauthenticated attacker to steer a victim's browser to an arbitrary external site by crafting a malicious submit-url value, because the websRedirect function in the goform handler fails to validate the redirect target (CWE-601); multiple endpoints in that handler are affected. Exploitation is not server-side - it requires a victim to click a crafted link and follow the redirect (CVSS v4 UI:P, PR:N), and impact is limited to phishing/social-engineering enablement (VI:L, no confidentiality or availability impact), matching the assessed CVSS:3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. Publicly available exploit code exists (published proof-of-concept with a Notion write-up), and no CISA KEV listing or EPSS score was provided in the available intelligence; the vendor was contacted early but did not respond, so no vendor-released patch was identified at time of analysis.
Path traversal in MantisZip 0.4.5 and earlier lets an attacker cause files to be read or written outside the intended archive-extraction directory when a victim opens a crafted archive and triggers the Preview component, which passes untrusted entry paths into Path.Combine in MainWindow.UI.cs. The attack is remote in the sense of file delivery but entirely client-side: exploitation requires the victim to open the attacker-supplied archive (UI:P) and no authentication is involved (PR:N), so success depends on social engineering. Publicly available exploit code exists, but there is no confirmed actively exploited (CISA KEV) status; the project has not responded to the issue report and no vendor-released patch is identified, with the independent CVSS:3.1 assessment of 5.3 (low-to-moderate risk) reflecting confined impact on the host running the tool.
Uncontrolled resource allocation in the MasterService::GetReplicaListByRegex handler of kvcache-ai Mooncake (all versions up to and including 0.3.12, and 0.3.14-rc1) allows a remote low-privilege client that can reach the MasterService RPC endpoint to exhaust server memory or CPU by submitting a crafted regular expression to the Regular Expression Handler. The impact is availability-only and partial (CVSS 4.0 5.3, VA:L; assessed CVSS 3.1 5.3 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L), so this is a denial-of-service concern rather than a confidentiality or integrity compromise. Publicly available exploit code exists (a proof-of-concept gist is referenced via VulDB), and the affected project has a small deployment footprint; no CISA KEV entry exists and no vendor patch was released because the vendor did not respond to the disclosure.
An open redirect in the Subrion CMS login flow (front/login.php, iaUsers::authorize) through unvalidated use of the $_SERVER['HTTP_REFERER'] value lets remote, unauthenticated attackers send a crafted link that, once the victim follows it and interacts with the login page, redirects the browser to an attacker-controlled destination. Affected deployments are Intelliants Subrion CMS releases up to and including 4.2.1; the vendor was contacted early but did not respond, and publicly available exploit code exists, so the technique is trivially reproducible. The impact is deliberately narrow - no data disclosure, code execution, or denial of service - and the flaw only amplifies phishing and social-engineering campaigns, which is consistent with the low vendor CVSS 4.0 base score of 2.1; there is no indication of confirmed active exploitation (no CISA KEV listing).
Improper access control in kvcache-ai Mooncake up to versions 0.3.12, 0.3.13.post1, and 0.3.14-rc1 allows remote attackers to manipulate the ScopedSegmentAccess::MountSegment routine in segment.cpp so that a client can mount segments outside its intended scope, degrading the integrity and availability of segment state. Per the CVSS vector (PR:N) the attack requires no authentication, and impact is bounded to low integrity and availability loss with no confidentiality exposure and no code execution. Publicly available exploit code exists (a public gist is cited in the disclosure), and because the vendor was contacted early but did not respond, no vendor-released patch has been identified at time of analysis.
SQL injection in Forma LMS up to and including version 4.1.43 allows an attacker with an authenticated session on the administrative back end to manipulate the 'Name' argument handled by UserselectorAdmController::getData in /appCore/ajax.adm_server.php?r=adm/userselector/getData, injecting arbitrary SQL against the underlying database. Exploitation is remote and requires no user interaction, but the vulnerable endpoint is admin-scoped (CVSS vector PR:L), so valid low-privileged/admin-panel credentials are a prerequisite; publicly available exploit code exists and the vendor was contacted without responding. This is a moderate, not top-tier, priority issue: the primary limiting factors are the authentication requirement and Forma LMS's comparatively limited deployment base, which constrain real-world exposure.
Authorization bypass in SpringBlade through 5.0.2 lets attackers read other users' account information by supplying an arbitrary userId to the user-auth-info endpoint backed by UserServiceImpl.userInfo, because the application never verifies that the requested user object belongs to the caller. Publicly available exploit code exists, and the vendor was contacted about the disclosure but did not respond, so no official fix is available. Although the supplied CVSS 4.0 vector lists PR:N, the endpoint is a user/auth-info API that in practice requires at least a low-privileged authenticated session, and the realistic impact is limited to read-only disclosure of user profile data (no modification or code execution).
Path traversal in volotat Anagnorisis through 0.4.2 allows an authenticated remote attacker to use the get_file_content, save_file_content, move_files, and start_streaming handlers in page.html to escape the intended media directory, enabling limited file disclosure and arbitrary file modification or relocation. The vendor was contacted but did not respond, no fixed version is identified, and publicly available exploit code exists. This is a medium-severity issue (VulDB CVSS 4.0 5.3; independent CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) affecting self-hosted instances where an attacker can obtain valid credentials.
Information disclosure in O2OA (up to and including 9.5.3 and 10.0.2) lets an authenticated remote attacker read data they should not be able to access by supplying a manipulated fileUrl argument to the list function of the Cipher Connection Handler (CipherConnectionAction.java). The flaw is a CWE-200 exposure of sensitive information rated CVSS 5.3 (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/E:P), mapped independently to CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - confidentiality-only, low impact, requiring a valid session but no user interaction. Publicly available exploit code exists (a public GitHub issue demonstrates the technique) and the issue is not listed in CISA KEV, so it is not confirmed as actively exploited; the vendor was contacted but did not respond, and no vendor-released patch has been identified.
Stored cross-site scripting in huanzi-qch base-admin lets a low-privileged authenticated user inject script through the Username argument of the Add User handler (CommonController.java Save), which then executes in the browser of any user - typically an administrator - who later views the tainted page. Exploitation requires a valid low-privileged account plus victim interaction (viewing the rendered username), and publicly available exploit code exists; no confirmed active exploitation is indicated (no CISA KEV listing). Because the project ships via continuous rolling releases, no fixed version has been published and the vendor did not respond to the disclosure.
Cross-site scripting (XSS) in volotat Anagnorisis up to 0.4.11 allows an authenticated low-privilege attacker to inject script through a crafted media filename or file_path argument processed by the PlaylistManager.js html function, with execution occurring when a victim views the affected playlist or media entry. Publicly available exploit code exists, and the vendor was contacted but did not respond, so no vendor-released patch has been identified. The CVSS 4.0 base score is 5.1 (MEDIUM) with PR:L and UI:P, limiting impact to same-origin actions and low integrity manipulation.
A specially crafted NFC card or NFC emulator can feed unsanitized data into the web view used by the PaperCut Hive embedded application on Ricoh devices, allowing an attacker with physical access to the device panel to execute code within the application's UI context and potentially trigger unauthorized actions or disclose information. Exploitation requires hands-on physical access to an NFC-enabled device that is configured to use NFC card authentication, and the resulting execution is confined to the embedded app's web view rather than the underlying Ricoh firmware or OS. No public exploit code has been identified at time of analysis and the flaw is not in CISA KEV; with a CVSS 4.0 base score of 3.8 (assessed CVSS 3.1 AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N), real-world risk is LOW despite the 'arbitrary code execution' phrasing in the vendor description.
Parsing a malformed Windows prefetch file through Velociraptor's bundled prefetch library (Velocidex/go-prefetch) can trigger an out-of-bounds condition and crash the parsing operation, an availability-only impact with no data disclosure or code execution. The issue is local and interaction-dependent: exploitation requires that an attacker-supplied or corrupted .pf artifact reach a location the parser processes and that a user or agent run the parse, consistent with the assessed CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L (the vendor-facing score of 3.6 rates it slightly higher with scope change and low integrity impact). No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), so this is a genuinely low-priority defect that should be handled through routine dependency-update hygiene rather than emergency response.
BentoPDF 2.8.6 and earlier ships its Timestamp workflow node with an unvalidated TimeStamp Authority URL, so importing a crafted workflow JSON causes the tool to send the SHA-256 message imprint of a user's PDF to an attacker-chosen endpoint. Exploitation requires the victim to import the malicious workflow and actively run its Timestamp node against a document (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N, score 3.4), and it is only effective in the default self-hosted deployment where VITE_CORS_PROXY_URL is unset and the request bypasses the ALLOWED_TSA_HOSTS proxy check. The leaked digest is metadata only - it can confirm a document matches a known file or correlate the same document across users, but never reveals document contents, and no public exploit has been identified at time of analysis; this is a low-real-risk information disclosure.
Improper handling of sensitive data in the IBM PowerVM Hypervisor partition resource dump interface allows an authenticated administrator on the Hardware Management Console (HMC) or the Power service processor to obtain a limited snapshot of partition processor state, resulting in a confidentiality exposure on the managed system. Affected firmware spans the FW1120.00-FW1120.01, FW1110.00-FW1110.31, FW1060.00-FW1060.81 and FW950.00-FW950.H3 branches. Exploitation requires administrator-level credentials and adjacent-network reachability to the management plane (CVSS 3.1 base score 3.4, vector AV:A/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N); there is no public exploit identified at time of analysis, and the practical risk is low because the prerequisite privileged management access is itself a strong barrier and the disclosure is limited in scope.
A limited out-of-bounds memory read in the host-facing BMC firmware management service of IBM OpenBMC can be triggered by a host system to crash that service and read a small amount of BMC internal memory, producing low confidentiality and availability impact (CVSS 3.4). Only agents who already hold high-privileged control of the managed host can reach the vulnerable interface, since the flaw sits on the local host-to-BMC path (AV:L, PR:H) rather than on the network. Affected firmware levels are FW1060.00 through FW1060.81, FW1110.00 through FW1110.31, and FW1120.00 through FW1120.01; there is no public exploit code identified and no confirmed active exploitation (not in CISA KEV), so the practical risk is low and is largely contingent on the host already being compromised at a privileged level.
CVE-2026-6103 is an as-yet uncharacterized security issue in software distributed and maintained through Ubuntu, reported to this pipeline solely by the Ubuntu vendor feed with no accompanying description, CVSS vector, or CWE classification. Because the report carries no affected package name, no version range, and no attack-vector metadata, it is not possible to state who is affected beyond Ubuntu users of whatever component the Ubuntu Security Tracker assigns to this CVE, or what an attacker could achieve. No public exploit identified at time of analysis, no CISA KEV entry is present, and no EPSS score was supplied; risk cannot be meaningfully assessed from the available data until the Ubuntu Security Tracker entry (and the corresponding NVD record) is retrieved.
Local users with only low-level privileges on IBM i systems running Db2 Mirror for i 7.4, 7.5, or 7.6 can obtain partial sensitive information because the product encrypts data using AES in Electronic Codebook (ECB) mode, a deterministic cipher mode that leaks patterns in the underlying plaintext. The exposure is limited to confidentiality (C:L) with no integrity or availability impact, and exploitation requires local access plus the ability to observe data produced by the affected encryption code path, giving a low overall severity of 3.3. No public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited (CISA KEV); no EPSS probability was supplied, consistent with a low-priority informational-disclosure weakness.
Hypervisor memory disclosure in IBM PowerVM firmware (FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, and FW1060.00 through FW1060.81) allows an attacker who already holds root inside a guest partition to read a limited, non-attacker-controlled portion of uninitialized hypervisor memory through a hypervisor call interface, potentially exposing sensitive data belonging to the hypervisor or to co-resident guest partitions. According to the assessed CVSS vector (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N), exploitation requires local access and high privileges (root in a guest) and yields only a confidentiality impact of low severity, with no integrity or availability effect and no attacker control over which memory contents are returned. There is no public exploit code identified and no confirmed active exploitation (not listed in CISA KEV); the practical risk is concentrated in multi-tenant environments where untrusted parties run arbitrary guest OS images on shared Power hardware, while single-tenant systems face little exposure.
An entropy/random-generator failure on an Mbed TLS TLS 1.3 server (versions 3.2.0 through 3.6.6 and 4.0.0 through 4.1.0) can allow bytes to be removed from or injected into the beginning of the TLS stream, degrading integrity of the protected channel. The attack is not a normal network exploit: the prerequisite is that the attacker can first induce the server's entropy source to fail (for example via fault injection, RNG degradation, or resource exhaustion), which is why the issue is scored CVSS 2.9 (AV:L/AC:H) with integrity-only impact and no effect on confidentiality or availability. Only TLS 1.3 servers are affected - TLS 1.2 servers and client-side roles are out of scope - and no public exploit code or active exploitation has been identified at time of analysis.
Path traversal in the littrs Rust sandboxing library (versions 0.6.1 and 0.6.2) allows the `relative` argument passed to `Sandbox::mount` in crates/littrs/src/lib.rs to escape the intended sandbox mount point and reach files outside it. The flaw is not directly reachable by anonymous internet users: it requires an application built on littrs that routes attacker-influenced input into the mount path, and the independent assessment rates the attack vector as local with low privileges required (CVSS:3.1 AV:L/AC:L/PR:L/UI:N, C:L/I:L/A:L), even though the CNA's CVSS 4.0 vector (AV:N, CVSS 2.1) frames it as remotely performable. Publicly available exploit code exists, and the vendor was contacted but did not respond; no fixed release has been published, so risk is confined to deployments that actually feed untrusted values into `Sandbox::mount`.
Cross-site scripting in RuoYi-Vue-Pro (all versions up to 2026.08) allows remote attackers to inject script through the File Upload component implemented in yudao-module-infra/src/main/java/cn/iocoder/yudao/module/infra/controller/admin/file/FileController.java, which is later rendered in the administrative interface without adequate output encoding. Publicly available exploit code exists and the vendor was contacted but did not respond, so no vendor patch is available at time of analysis. Exploitation requires a victim to view the malicious file content (UI:P) and, per our independent assessment, realistically also depends on access to the upload endpoint and an authenticated user viewing the affected admin pages, keeping the practical severity in line with the CVSS 5.3 base score.
Open redirect in the Yudao (ruoyi-vue-pro) OAuth2 client component, affecting releases up to 2026.08, lets remote attackers manipulate the redirect_uri argument handled by validOAuthClientFromCache in OAuth2ClientServiceImpl.java so that a victim is bounced to an attacker-controlled site after clearing the authorization flow. No authentication is required (CVSS:4.0 PR:N), but the attack is not autonomous - it needs a victim to click a crafted authorization link and complete the flow (UI:P), and impact is limited to integrity-only redirection with no data disclosure or code execution. Publicly available exploit code exists and the vendor was contacted but never responded, so no vendor patch is confirmed; the independent assessment rates this a genuine but modest issue (CVSS:3.1 5.3, AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N).
Server-side request forgery in the AI Knowledge Module of ruoyi-vue-pro (versions through 2026.08) allows an authenticated low-privilege user to coerce the application server into issuing arbitrary outbound HTTP requests via the AiKnowledgeDocumentServiceImpl.readUrl document-import function, which fetches a caller-supplied URL without adequate validation. Exploitation is remote and low-complexity and requires only a valid low-privilege account plus an enabled/reachable AI Knowledge feature; the practical impact is bounded by what the server can reach on the internal network, such as internal HTTP services, admin panels, or cloud instance-metadata endpoints, resulting in limited confidentiality and integrity exposure. Publicly available exploit code exists, no CISA KEV entry confirms active exploitation, and the vendor was contacted about the disclosure but did not respond, so an upstream patch is not available and this is a genuine but moderate-priority issue whose real-world severity depends on the operator's outbound egress controls.
Authenticated path traversal in the ruoyi-vue-pro (Yudao) WeChat MP material-upload component lets a low-privileged user write files outside the intended upload directory by embedding '../' sequences in a multipart filename passed to getOriginalFilename() in MpMaterialServiceImpl. Versions up to and including the 2026.08 release are affected whenever the yudao-module-mp module is deployed; the CVSS 4.0 base score is 2.1 (our independent assessment rates it CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, i.e. remote but requiring a valid account, with limited integrity impact only). Publicly available exploit code exists per the disclosing researcher, and the vendor was contacted but did not respond, so no vendor-released patch is identified at time of analysis.
SQL injection in the GoView data-visualization component of ruoyi-vue-pro (Yudao) lets an authenticated low-privilege user inject arbitrary SQL through the report data endpoint, exposing or altering backend database contents. The flaw sits in GoViewDataServiceImpl.getDataBySQL, which passes a user-controlled 'sql' argument into a query, and it affects deployments up through the 2026.08 release where the yudao-module-report / GoView module is enabled and reachable. Publicly available exploit code exists and the vendor was contacted but did not respond, so no vendor-released patch was identified at time of analysis; the base score is modest (5.3 under CVSS 4.0, PR:L, E:P) but the confidentiality impact is assessed as high, and there is no evidence of confirmed active exploitation (CISA KEV).
Cross-site scripting in Excalidraw 0.18.1 and earlier allows an attacker to embed an HTML/script payload in the customData.generationData.html field of a crafted scene file, which runs in the victim's browser origin when that file is imported through the restore.ts import handler. The issue is remotely reachable and unauthenticated (PR:N), but the attacker cannot trigger execution without the victim opening or importing the malicious file (UI:P), and publicly available exploit code exists with no indication of active exploitation in CISA KEV. Under the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N the impact is confined to client-side script execution with low confidentiality and integrity effects, making this a low-severity, high-caveat issue rather than a critical one.