Account impersonation in Python Social Auth (social-core) before version 5.0.0 allows an authenticated Vend user from one shop to be authenticated as a pre-existing local account that was linked to a user from a different shop sharing the same numeric Vend user_id. Only applications that use the Vend OAuth2 backend and authenticate users from more than one Vend shop are affected; the numeric-ID collision is not attacker-controlled and may be uncommon, but successful exploitation yields full compromise of the colliding local account (CVSS 6.8, AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N) with no victim interaction required. No public exploit identified at time of analysis.
Stored cross-site scripting in the WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.26 allows authenticated users holding the Contributor role or higher to inject script into a campaign configuration field, which is rendered unescaped when a specific plugin feature is enabled, and the payload then executes in the browser session of any higher-privileged user (Editor or Administrator) who later views that campaign in wp-admin. Publicly available exploit code demonstrating the flaw exists, though there is no confirmed active exploitation and CISA's SSVC decision framework rates the issue as not automatable. The combination of authenticated low-privilege access, a non-default feature toggle and required victim interaction makes this a moderate rather than urgent priority.
Stored cross-site scripting in the WPeMatico RSS Feed Fetcher WordPress plugin before version 2.8.26 allows authenticated users with contributor-level privileges to inject malicious scripts via a crafted RSS feed, which then execute in the browser of a higher-privileged user (editor or administrator) who reviews the campaign. Exploitation requires user interaction and is not automatable; publicly available exploit code exists, but no active exploitation has been observed (CISA SSVC exploitation: none). This is a genuine but conditional risk that primarily affects multi-author WordPress sites where untrusted contributors can create campaigns, and it does not affect default single-admin installs.
Unauthenticated attackers can force full refunds and immediate subscription cancellations on WordPress sites running the WPForms plugin before 2.0.2 by submitting a Stripe payment object that actually belongs to a different application sharing the same Stripe account. Because the plugin never verifies that the referenced Stripe object was created by WPForms (CWE-284, improper access control), any public form submission carrying a known, valid payment or subscription identifier is acted upon directly against the site owner's Stripe account. Exploitation is remote and unauthenticated per the assessed vector (PR:N/UI:N) but is constrained by high attack complexity (AC:H): Stripe identifiers cannot be enumerated through the flaw, so an attacker must already possess a legitimate reference. Publicly available exploit code exists; no active exploitation has been confirmed (CISA SSVC Exploitation: none), and impact is limited to integrity - refunds and cancellations - with no data disclosure.
Sites running the CMB2 WordPress plugin before 2.13.0 can have arbitrary WordPress options created or overwritten by any authenticated user holding a Subscriber-level account, because one of the plugin's AJAX actions performs no capability check; this can corrupt core site settings and render the site unusable. Exploitation is conditional: the site must have declared an oEmbed field - either through CMB2 itself or, far more commonly, through another plugin or theme built on CMB2 - since CMB2 registers no oEmbed fields of its own, and publicly available exploit code exists, though CISA SSVC records no known exploitation. The stored value is never attacker-controlled, so the impact is confined to integrity and availability (CVSS 6.8) with no confidentiality loss and no privilege escalation, and the vendor has released CMB2 2.13.0 as the fix.
Missing authorization in the 10Web Booster WordPress plugin before 2.34.0 exposes an unauthenticated routine that issues the plugin's cloud-connection shared secret, allowing any anonymous visitor to read that secret and then repeatedly delete it. The practical impact is limited to confidentiality of the cloud credential and availability of the legitimate administrator's cloud connection: an attacker cannot achieve code execution or broader site compromise, but they can disclose the secret and block an administrator from completing a valid 10Web connection. Exploitation requires no authentication or user interaction per the assessed vector (AV:N/AC:L/PR:N/UI:N), publicly available exploit code exists, and no confirmed active exploitation has been reported (CISA SSVC Exploitation: none); this is a moderate-priority issue whose real-world ceiling sits well below its 6.5 base score.
SAML account association in python-social-auth (social-core) before 5.0.0 lets an attacker who already holds a valid account on an identity provider trusted by the target application link that SAML identity to a logged-in victim's local account, after which the attacker can authenticate through SAML and access the victim's account. The flaw only reaches deployments that use the SAML backend and enable authenticated account association, and it requires the victim to be logged in and driven through the association flow while the unsolicited SAML response is timed to that session, which is why the assessed vector is network-reachable but high-complexity with user interaction (CVSS:3.1/AV:N/AC:H/PR:L/UI:R, base 6.4). This is a conditional integrity and authentication problem rather than a mass-exploitable emergency; no public exploit identified at time of analysis, and version 5.0.0 resolves it by validating SAML responses against stored AuthnRequest IDs.
Attribute-injection cross-site scripting in xhtml-purifier (npm package node-xhtml-purifier) before 0.4.3 lets an attacker who can supply HTML to the sanitizer smuggle a JavaScript event handler - for example onmouseover or onerror - past purification so that it executes when the purified output is rendered in a browser. The serializer in XHTMLPurifier.js writes each attribute value straight into a double-quoted attribute without HTML-entity encoding, so a double quote inside any allowed attribute (class, style, title, alt, src, href) terminates the attribute and starts a new one, converting data into markup. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, score 6.1) indicates no authentication requirement but a user-interaction prerequisite, since the victim must render the output and, for handlers like onmouseover, trigger the element; this is a genuine sanitizer bypass but a moderate-priority issue overall, and exploitation is contingent on an application actually passing attacker-controlled HTML through this niche library. No public exploit code and no confirmed active exploitation were identified at time of analysis.
CVE-2026-91766 is referenced only through a vendor-originated report from Ubuntu (vendor:ubuntu), and the identifier arrives with no description, no CVSS score or vector, no CWE classification, no CPE data, and no version information. Because the affected component, attack vector, and required privileges are all undefined, the concrete impact on Ubuntu systems cannot be stated, and risk cannot be meaningfully assessed from the available data. No public exploit has been identified at time of analysis, and patch availability could not be determined from the provided data; analysts must retrieve the corresponding Ubuntu Security Notice or the Ubuntu CVE tracker entry to establish the affected source package, supported releases at risk, and any prerequisites.
Path traversal in the UEditor upload interface of ShopXO (yhx070424/shopxo) through version 2.2.7 lets remote attackers manipulate the path_type argument in config/ueditor.php to write or access files outside the intended upload directory. The CVSS v4.0 vector (AV:N/AC:L/PR:N/UI:N, E:P) indicates the attack is network-reachable with no authentication or user interaction required, and publicly available exploit code exists; there is no confirmed evidence of active exploitation (not listed in CISA KEV). The vendor was notified via an issue report but has not responded, so no vendor-released patch has been identified at time of analysis, and the realistic impact is bounded to Low confidentiality and integrity effects rather than full system compromise.
Missing authentication in the volotat Anagnorisis Socket.IO Connect interface exposed through app.py lets any remote party able to reach the service interact with the endpoint without credentials, producing limited confidentiality, integrity and availability impact. The issue affects versions up to 0.3.1/0.4.0, requires no user interaction or privileges (PR:N/UI:N in both the CVSS 4.0 and the independently assessed CVSS 3.1 vectors), and publicly available exploit code exists, though there is no confirmation of active exploitation (CISA KEV). Risk is best described as low-to-moderate in practice: the project is a niche, typically self-hosted application, the endpoint must be network-reachable, and the assessed impact is capped at Low across C/I/A.
Information disclosure in Intelliants Subrion CMS up to 4.2.1 lets remote attackers retrieve owner/user information through a manipulated q parameter in the /actions.json?action=assign-owner endpoint. Publicly available exploit code exists, but there is no confirmed active exploitation such as a CISA KEV entry. The CVSS 4.0 score is 5.5, while the independent assessment rates real-world risk as LOW-to-MODERATE because impact is partial confidentiality only and the administrative nature of assign-owner may in practice require a valid authenticated session even though the published vector lists PR:N; authentication requirements should be verified against the deployed instance.
Unauthorized read access to book records in TaleLin lin-cms-spring-boot 0.2.1 and earlier is possible through the searchBook function in BookController.java; remote unauthenticated attackers can reach the book endpoint and retrieve records without proper authorization. A publicly available exploit exists, but there is no confirmed active exploitation (CISA KEV) and no vendor patch identified. The 6.9 CVSS 4.0 score reflects a confidentiality-only impact; our assessment is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, making real-world risk low-to-moderate and dependent on whether the book endpoint is network-exposed.
Improper authorization in TaleLin lin-cms-spring-boot through 0.2.1 lets unauthenticated remote attackers read book records by invoking the getBooks function in BookController.java; the CVSS v4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L) confirms no privileges or user interaction are required, and impact is limited to confidentiality. Publicly available exploit code exists, and the vendor did not respond to early disclosure, so no vendor-released patch was identified at time of analysis. This is a real but low-severity issue that should be triaged as low-to-moderate priority, with the primary limiting factors being the product's rarity and the read-only scope of the exposure.
Improper authorization in TaleLin lin-cms-spring-boot 0.2.1 and earlier lets remote unauthenticated attackers read book records they are not entitled to by manipulating the ID argument supplied to the BookController.getBook endpoint (CWE-285, an object-level authorization gap equivalent to an IDOR). Exploitation requires no authentication, no user interaction and no non-default configuration, and publicly available exploit code exists, though the impact ceiling is low - read-only disclosure of book data with no integrity or availability effect. The issue is not listed in CISA KEV, and the maintainer did not respond to the VulDB disclosure, so no patched version has been identified.
Server-side request forgery in the chat-server component of songxinjianqwe Chat (ChatServer.java) allows remote, unauthenticated attackers to coerce the server into issuing HTTP requests to attacker-chosen URLs. The flaw is reachable over the network with low complexity and no user interaction (CVSS:4.0 AV:N/AC:L/PR:N/UI:N), but all impact metrics are rated Low (VC:L/VI:L/VA:L) with no downstream-system impact, so practical damage is limited to constrained or blind SSRF-style information leakage and internal-network probing rather than full internal pivoting. Publicly available exploit code exists (referenced from a GitHub issue), and VulDB reports that the vendor was contacted but did not respond; the project uses a rolling release model, so no specific fixed version is documented. Affected deployments are typically hobbyist Java chat-server instances rather than internet-exposed production services.
SQL injection in java110 MicroCommunity (through version 2.0) allows remote attackers to inject arbitrary SQL through the fallBackSql argument of the fallBack API endpoint implemented in BusinessApi.java / QueryServiceSMOImpl.fallBack. Publicly available exploit code exists (published as a Gitee issue), and because CVSS 4.0 carries PR:N, exploitation is claimed to need no authentication - though an independent assessment notes the endpoint may in practice sit behind application authentication, which would narrow real-world exposure. The project has not responded to the report, so no vendor fix is identified, and the CVE is not listed in CISA KEV, meaning confirmed active exploitation has not been established.
Improper neutralization of Spring Expression Language (SpEL) input in halo-dev Halo versions up to 2.25.4/2.26.1 lets unauthenticated remote attackers influence expression handling through the comment reply-notification subscription component, producing low-level confidentiality, integrity, and availability impact. Publicly available exploit code exists and the vendor did not respond to disclosure, but there is no CISA KEV listing, so active exploitation is not confirmed. The independent assessment rates this as CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, a genuine but modest-severity issue.
Snipe-IT versions prior to 8.7.0 are affected by stored cross-site scripting in the uploaded-files API: an authenticated user with file-management access can upload an XML attachment carrying an xml-stylesheet reference and then request it through GET /api/v1/{object_type}/{id}/files/{file_id}?inline=true, which the API controller serves with Content-Disposition: inline without the safe-inline allowlist enforced by the equivalent web controller. Because the XML/XSLT is rendered in the Snipe-IT origin, an authorized victim who opens the attachment URL runs attacker-generated JavaScript under their own session, enabling same-origin data reads and authenticated actions with the victim's privileges. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N, base 8.7) confirms network reachability, an authenticated attacker, required victim interaction, and a scope change, but exploitation is bounded by the attacker's existing upload privileges and by the need for a separately authorized victim to open the link; no public exploit code or confirmed active exploitation was identified at time of analysis. Fixed in 8.7.0.
Unauthenticated account creation in the MasterStudy LMS WordPress plugin (versions 2.3.0 through before 3.7.50) lets remote attackers create user accounts - and be logged into them - on WordPress sites where the administrator has deliberately disabled user registration. The plugin's front-end registration flow fails to consult the site's registration setting before creating the account (CWE-862, missing authorization), so the restriction the administrator put in place is simply not enforced; publicly available exploit code exists, though there is no confirmation of active exploitation (no CISA KEV listing, and CISA's SSVC assessment records exploitation as 'none'). Exploitation is unauthenticated and needs no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), but the impact is capped at subscriber-level account creation with no confidentiality or availability effect, making this a genuine but low-to-moderate priority issue.
Memory corruption in the Botslab G980H dash camera firmware allows an authenticated attacker on the same local network segment to submit crafted command data that writes past the bounds of an allocated buffer, potentially corrupting authentication state or terminating the affected process so the device restarts. The result is a temporary denial of service - the device becomes briefly unavailable while it reboots - with no demonstrated path to code execution, privilege escalation, or data disclosure (CVSS 4.0 base 6.9; availability-only impact, adjacent vector, low privileges required, no user interaction). No public exploit code has been identified at time of analysis, and CISA has not listed this CVE in the KEV catalog; the issue is reported by ICS-CERT in advisory ICSA-26-267-01.
Unauthenticated Bluetooth Low Energy access on the Botslab G980H dash camera lets any attacker within BLE radio range read sensitive on-device data - device identifiers, firmware details, and protected WiFi credentials - because the firmware exposes GATT characteristics without requiring authenticated pairing or client binding. The flaw is a missing-authentication condition (CWE-306) that exists in the default device state, so no credentials, user interaction, or special tooling are required; the practical constraint is physical proximity, as there is no internet-reachable attack path. No public exploit code has been identified at time of analysis, and CISA published an ICS advisory (ICSA-26-267-01) covering the product. Because impact is limited to confidentiality (no integrity or availability effect), this is best characterized as a real but physically constrained information-disclosure issue rather than a mass-exploitable network flaw.
Authenticated, low-privileged WordPress users can read other accounts' non-public event and venue content - including unpublished, pending and trashed events and full street addresses - on sites running the Events Manager plugin before 7.4.5, because the logged-in event and location search does not force the search scope to the caller when a custom 'owner' value is supplied. Any account on the target site (subscriber-level or similar) is sufficient and no user interaction or administrative rights are required, making this a read-only information disclosure rated CVSS 4.3 (MEDIUM) and described by CISA's SSVC assessment as non-automatable with partial technical impact. Publicly available exploit code exists, but there is no confirmed active exploitation (the issue is not listed in CISA KEV), and the vendor has addressed it in version 7.4.5.
Any authenticated user of a WordPress site running the Masteriyo LMS plugin before 3.4.2 can retrieve the correct answer keys for quizzes across the entire site, including quizzes belonging to courses they are not enrolled in, because the plugin's answer-redaction routine only covers a fixed list of question types and returns every other type's answers in full. The issue requires only a low-privileged account such as a student (CVSS vector PR:L, base score 4.3) and publicly available exploit code exists; however, CISA's SSVC assessment rates the flaw non-automatable with only partial technical impact, and there is no KEV listing or other evidence of active exploitation in the wild at time of analysis.
Missing authorization checks in the MasterStudy LMS WordPress plugin before 3.7.50 let any authenticated user - including a self-registered subscriber - record lesson completions for courses they are not enrolled in, corrupting course-progress and completion data. Exploitation requires only a low-privilege account (CVSS:3.1/AV:N/AC:L/PR:L/UI:N), with no administrative rights and no user interaction, and publicly available exploit code exists (no CISA KEV entry, so confirmed active exploitation is not established). Impact is limited to integrity of progress records - there is no confidentiality or availability effect - making this a genuine but low-severity data-integrity flaw rather than an emergency.
Any authenticated WordPress user - down to the lowest-privilege Subscriber role - can invoke an administrative maintenance action in the MasterStudy LMS plugin (versions 2.3.0 through before 3.7.50) because the handler performs no capability check and no nonce verification, resulting in published content created and attributed to the attacker's own account. The network-reachable, PR:L vector (CVSS 3.1 4.3, CWE-862) means the only real prerequisite is obtaining a login, which is trivial on LMS sites that permit open self-service registration and a genuine limiter where registration is closed; no user interaction or admin rights are needed, and the assessed impact is integrity-only. Publicly available exploit code exists via the WPScan advisory, but there is no CISA KEV listing and SSVC rates exploitation as none, so this is a low-to-moderate priority finding rather than an actively exploited one; a vendor patch is available in 3.7.50.
Masteriyo LMS, a WordPress learning-management plugin, discloses the course-progress and learning-activity records of every learner on a site to any authenticated user in versions before 3.4.2. Exploitation requires only a valid, low-privileged WordPress account - a self-registered Subscriber is sufficient - because the endpoint's ownership check is skipped when the requested account is not supplied as a non-zero value, causing a site-wide dump of all learners' records. Publicly available exploit code exists; the issue is rated modest priority (CVSS 4.3, confidentiality-only, no write or code-execution impact) and no confirmed active exploitation has been reported.
Login CSRF through partial-pipeline session fixation in the social-core library of Python Social Auth before 5.0.0 allows an unauthenticated remote attacker (PR:N) to seed an authentication flow, harvest the resulting partial_token and verification data, and then induce a victim's browser to resume that attacker-controlled flow so the victim ends up authenticated as the attacker's account. Only applications that use resumable partial pipeline steps - such as the built-in mail_validation step or custom steps decorated with @partial - are exposed; success additionally requires victim interaction (UI:R) and reliable delivery of the attacker's token into the victim's browser, which is why the high attack complexity keeps the CVSS 3.1 base score at 4.2. The impact is limited to authenticating the victim as the attacker (a login-CSRF/session-fixation outcome) rather than taking over the victim's own account, and no public exploit has been identified at time of analysis.
Unauthenticated attackers within WiFi range of a Botslab G980H dash camera can derive its default WiFi password from predictable device information - portions of which the camera itself advertises - and use limited guessing to obtain the remaining characters, gaining unauthorized access to the camera's own wireless network. Exploitation requires physical proximity and is only feasible while the factory default WiFi password remains unchanged, so this is a moderate, geographically constrained risk rather than an internet-facing one. No public exploit code or confirmed active exploitation has been identified at time of analysis, and mitigation is trivial where the operator has already set a custom WiFi password.
WiFi credential exposure affects Botslab G980H dash cameras, whose firmware encrypts the credentials the device communicates using a hard-coded cryptographic key and initialization vector (CWE-321). An attacker who is within adjacent wireless range of the camera, captures the protected credential, and then extracts the key and IV from a firmware image can recover the WiFi password and join the camera's network; no authentication or user interaction is required, though the combination of credential interception and firmware reverse-engineering makes practical exploitation difficult (CVSS 4.0 base 6.0; assessed as AV:A/AC:H/PR:N/UI:N with high confidentiality impact only). Impact is confined to disclosure of the WiFi passphrase and access to the device's own network, with no direct integrity or availability effect on the camera, and no public exploit identified at time of analysis; CISA's ICS-CERT published the finding as ICSA-26-267-01, so deployers of this IoT camera should treat the risk as LOW-to-MODERATE and localized rather than broadly exploitable.
Botslab G980H dash camera firmware writes sensitive configuration data - including WiFi credentials - into diagnostic logs created during the vendor support process, and those logs persist on the removable storage media (microSD card) after the support session ends. An unauthenticated attacker who physically obtains the card can simply read the log files and recover the device's WiFi credentials and other configuration details; per the CVSS 4.0 vector AV:P/PR:N/UI:N this requires physical possession of the media, and there is no network-reachable path to the data. The issue is a confidentiality-only disclosure (CWE-532) with no public exploit identified at time of analysis, and our independent assessment rates it a genuinely low-priority problem whose 5.1 score is driven almost entirely by the physical attack vector rather than any remote reachability.
PaperCut MF/NG's report-generation functionality can be reached without valid credentials, letting an unauthenticated remote attacker trigger report generation and read the sensitive information those reports expose. The defect is an authentication/authorization bypass (CWE-639) that needs only network reachability to the application server - no credentials and no user interaction (PR:N/UI:N) - and is scoped to confidentiality loss (VC:L/SC:L, with no integrity or availability impact), which keeps overall risk moderate and bounded at a CVSS score of 6.9. No public exploit code has been identified at time of analysis and the issue has not been confirmed as actively exploited (not in CISA KEV).
Improper identifier resolution in Brocade/Broadcom management software's Java cache-key handling can let an authenticated attacker on an adjacent network trigger identity mismatches, producing high integrity impact without confidentiality or availability loss. The flaw is a moderate-severity object-comparison logic issue that requires a low-privilege account and specific user-account structures, making it realistically LOW priority for most organizations. No public exploit identified at time of analysis; apply the vendor fix described in Broadcom support advisory 39000.
The CVE-2026-17545 record is effectively empty: it ships with no description, no CVSS vector, no CWE mapping, and no CPE data, and the only intelligence attached to it is that it was reported through the Ubuntu vendor coordination channel. Because the affected package, the vulnerable component, and the required attacker position are all unknown, the risk to any specific Ubuntu deployment cannot be meaningfully assessed from the available data and no impact statement should be issued yet. No public exploit code has been identified at time of analysis, and no EPSS score, KEV listing, or proof-of-concept reference accompanies the record, so there is currently no signal of exploitation activity. The immediate action is intelligence collection rather than mitigation: retrieve the corresponding Ubuntu Security Notice and CVE tracker entry to learn which package and version range are involved before assigning severity or exposure.
Unauthenticated information disclosure in the SPON Communications IP Network Audio Device XC-9603 (firmware 1.2.3_20181106 Build 107) allows remote attackers to retrieve sensitive configuration data, including the contents of /ini/sys_cfg.txt, because the loadCfg configuration-download function does not enforce authorization. Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), exploitation requires only network reachability to the device's HTTP/configuration service; no credentials or user interaction are needed, and the real-world impact depends on whether the served configuration file contains credentials or other secrets. There is no vendor-released patch: the vendor was contacted about the disclosure and did not respond, and no public exploit code or confirmed active exploitation was identified at time of analysis. This is a genuine but low-to-moderate priority issue that is most relevant to organizations exposing these audio/PA endpoints on internal or campus networks.
Unauthenticated remote access to system logs in ezGlobal's GPM LIGHT lets anyone who can reach the product's log-serving endpoint read sensitive operational data without credentials, user interaction, or special configuration (CVSS:4.0 AV:N/AC:L/AT:N/PR:N/UI:N, 6.9; independently assessed as CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). Impact is confined to confidentiality (C:L) - the attacker reads logs rather than altering or disrupting the service - so real-world severity hinges on whether those logs contain credentials, session tokens, internal hostnames, or PII instead of benign operational messages. Affected versions are unspecified (wildcard CPE), meaning every deployment should be treated as potentially vulnerable, and no public exploit code has been identified at time of analysis; the issue is not listed in CISA KEV.
Cleartext credential exposure in the job scheduling component of Brocade SANnav causes external server passwords and archive protection keys to be written unmasked into application logs and generated support bundles whenever scheduled support-save or related operational jobs execute. An authenticated, low-privileged user who already has read access to those logs or bundles can harvest the credentials and potentially reuse them against remote backup targets or protected archives. This is a confidentiality-only defect rooted in improper log masking (CWE-532), with no public exploit identified at time of analysis; practical impact is LOW-priority because the attacker must already hold log access and the secrets are only exposed after an affected job has actually run.
Ansible Automation Platform 2's gateway permits an authenticated gateway administrator (CVSS PR:H) to create a new service key for the Controller service cluster through the API, even though service-key creation is supposed to occur only via the installer-provisioned path; the resulting key is cryptographically indistinguishable from a legitimate one, so it can be used to mint a service-authentication token that impersonates the Controller service. When the non-default gateway OIDC workload-identity endpoint is enabled (FEATURE_OIDC_WORKLOAD_IDENTITY_ENABLED) and a downstream resource server such as HashiCorp Vault trusts the gateway's OIDC signing key, the attacker can induce the gateway to sign Workload Identity Tokens for arbitrary Controller workloads and retrieve the AAP credentials bound to that workload, crossing the administrator's authorization boundary to disclose secrets (C:H, no integrity or availability impact). Exploitation requires admin privileges plus that specific non-default trust configuration, and no public exploit has been identified at time of analysis; the defect is access-gated rather than broadly exploitable.
Weakly protected storage of remote-server credentials in Araxis Merge for Windows (versions 2011.4074 through 2026.0) allows an authenticated, non-administrative local user on the same host to recover and decrypt every credential the target user has saved in the product, because the credentials are kept in the Windows registry without sufficient cryptographic protection (CWE-522). The exposure is local-only (CVSS 4.0 6.8, AV:L/PR:L, confidentiality-only with no integrity or availability impact), so it is a moderate, locally-scoped credential-disclosure issue rather than a remotely exploitable flaw, and its real-world value depends on the attacker already holding an interactive account and on the victim having stored credentials. The issue is not listed in CISA KEV (no confirmed active exploitation); publicly available exploit code exists, and a researcher write-up plus a GitHub repository published under the grepstrength handle accompany the vendor advisory referenced in the CVE record.
Opening a crafted MOBI e-book in SumatraPDF versions before 3.6 can crash the application because the MOBI header decoder trusts an attacker-controlled header length and reads past a short heap buffer; the bug is limited to the MOBI parser and requires local file delivery plus the user actively opening the document. It is a memory-safety issue (CWE-125) fixed in 3.6, with no confirmed active exploitation, no public exploit identified at time of analysis, and low real-world priority per available signals despite a 6.8 CVSS 4.0 base score. In CVSS terms the vector is AV:L/PR:N/UI:P, so the attacker is unauthenticated but must get the victim to open a malicious file locally, and the assessed impact is only a client crash (no confidentiality, integrity, or scope impact).
Hard-coded credentials embedded in the Eufy Omni C20 robot vacuum (all versions per CPE cpe:2.3:a:eufy:omni_c20) let an attacker who can already read the device's log files recover those credentials and reuse them to reach information such as mapping data, resulting in a confidentiality-only exposure of the device's stored floor-plan content. The attack is strictly local and requires low privileges (CVSS 4.0 AV:L/PR:L/UI:N, assessed as CVSS 3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5), so there is no network attack path and no user interaction is needed once log access exists. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV not applicable); the real-world risk is LOW-to-MODERATE and this is not a broad remote-exploitation priority, because the prerequisite of prior local log-read access is the primary limiting factor.
Privilege escalation in TÜBİTAK ULAKBİM UlakPDF (all versions through 09092026) allows an authenticated, low-privileged user to reach data and functionality that should be reserved for higher-privileged roles, driven by an incorrect authorization check in the application's access-control logic. The issue carries a CVSS 3.1 base score of 6.8 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N), meaning it is network-reachable but requires a pre-existing valid low-privileged account plus a non-trivial precondition that the public description does not name, and requires no user interaction; confidentiality and integrity impacts are high while availability is unaffected. Reported by TR-CERT via siberguvenlik.gov.tr, the flaw is constrained in real-world priority by the credential prerequisite, the elevated attack complexity, and UlakPDF's narrow academic and government deployment footprint - no public exploit identified at time of analysis.
Command injection in Termix's SSH key deployment flow affects versions 1.7.0 through 2.5.0 and lets an authenticated user with high privileges execute arbitrary commands with the selected remote account's privileges by supplying a crafted public-key token that breaks out of a double-quoted grep -F shell command. The independent assessment rates confidentiality, integrity, and availability impact as high with scope changed because code runs on the target host, not merely the Termix server; no public exploit has been identified at time of analysis, and the flaw is fixed in version 2.5.1.
Authenticated delegated administrators in Keycloak can reset other users' passwords and take over their accounts when Fine-Grained Admin Permissions (FGAP) are enabled, because the Admin REST API's general user-update path skips the password-reset authorization check that the dedicated credential-reset flow enforces. Red Hat Build of Keycloak and Red Hat Single Sign-On 7 are the affected downstream products, and the flaw is rated 6.6 (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H, CWE-862). Exploitation is conditionally gated rather than internet-facing: it requires a non-default FGAP configuration and an already-provisioned semi-trusted admin holding user-profile edit rights but deliberately denied password-reset rights, making this an insider or lateral privilege-escalation issue; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
Risk assessment is currently not possible for CVE-2026-91768, an Ubuntu-tracked identifier that arrives with no description, no CVSS score, no CVSS vector, no CWE classification, and no CPE data; the only signal available is that the record was reported by the Ubuntu vendor source. Because attack vector, privileges required, user interaction, and affected package or deployment mode are all unspecified, no meaningful statement can be made about what an attacker could do or who is exposed. Exploitation status is unconfirmed: no public exploit identified at time of analysis, and there is no KEV listing, no EPSS score, and no proof-of-concept reference in the supplied intelligence. Security teams should treat this identifier as un-triageable and hold it in a watch state until the Ubuntu CVE tracker or the NVD/MITRE record supplies a description and affected package.
Improper access control in Delta Electronics DIAEnergie before 1.11.00.022 allows a low-privileged authenticated user to read sensitive data that should be restricted to higher-privilege roles, with network-reachable, low-complexity exploitation that requires no user interaction. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, 6.5 Medium) shows the impact is confined to confidentiality - no integrity or availability effect - and the PR:L component means an attacker must already hold at least a valid low-privilege account on the web application rather than being a fully anonymous internet scanner. No public exploit code was identified at time of analysis and the vulnerability is not confirmed as actively exploited (not listed in CISA KEV), so risk is highest for environments where DIAEnergie is network-exposed and accounts are broadly provisioned.
Recursive XML attribute parsing in Wazuh (src/os_xml/os_xml.c) can exhaust the analysisd worker-thread stack, causing a segmentation fault that halts log ingestion on the affected manager. An attacker who controls a legitimately enrolled Wazuh agent (authenticated, PR:L) can trigger this by having that agent forward a Windows EventChannel event containing a single XML element with a very large number of attributes, which analysisd then parses. All Wazuh versions from 3.8.0 through 4.14.6 are affected; the issue is fixed in 4.14.7, there is no indication of confirmed active exploitation (not in CISA KEV), and no public exploit code has been identified at time of analysis. Impact is availability-only - the worker crashes and ingestion stops, but no data is read, modified, or exposed.
CVE-2025-14181 currently has no usable detail: the record contains no description, no CVSS score, no CVSS vector, and no CWE, and the only supplied attribution is the vendor source "ubuntu". Because the affected component, the impact class, and the attack vector are all undefined, it is not possible to state who is affected beyond the Ubuntu distribution packaging channel, nor what an attacker could achieve; authentication requirements are not confirmed from available data, and no public exploit identified at time of analysis and no CISA KEV entry is present. Risk cannot be meaningfully assessed from the available data, so this identifier should be triaged as unresolved rather than as a confirmed threat until the Ubuntu security advisory and NVD entry are populated.
A regular expression denial of service in Habitica's group member-search endpoint allows an authenticated user to send a crafted `search` query parameter to GET /api/v3/groups/:groupId/members that is compiled directly into a JavaScript RegExp, causing catastrophic backtracking that degrades application response times or halts Node.js worker processes. The flaw affects Habitica versions 4.172.1 through 5.48.1 in default configurations; both self-hosted instances and the shared hosted service are exposed, with the hosted instance allowing a single account to degrade service for all users. Exploitation requires only a valid account and membership in a group (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 6.5), and no public exploit code was identified at time of analysis. The issue is fixed in version 5.48.2.
The security impact of CVE-2026-95811 cannot be established from the available intelligence: the record carries no description, no CVSS score or vector, and no CWE classification, and the only confirmed signal is that Ubuntu is the reporting vendor, which indicates a flaw in a package distributed through Ubuntu rather than identifying which package. Because the affected component, attack surface, and prerequisites are all unknown, no defensible claim about confidentiality, integrity, or availability impact can be made, and no public exploit code or CISA KEV entry has been identified at time of analysis. This should be treated as an intelligence gap to close - retrieve the associated Ubuntu Security Notice (USN) and the NVD entry - rather than as a basis for a triage or risk-acceptance decision.