Stored cross-site scripting in StockAgile allows an authenticated low-privileged attacker to inject persistent JavaScript through text fields such as code and name in the REST endpoint /inventory/configuration/pricing-tiers, which is then rendered in the management panel for other authenticated users. Exploitation requires a valid StockAgile account to write the payload and a second authenticated user to view the affected pricing-tier data, with impact limited to script execution in the panel's browser context and no availability impact. The issue is assessed as a moderate, not urgent, priority; no public exploit code was identified at time of analysis, and there is no confirmed active exploitation.
Stored cross-site scripting in the StockAgile API and management panel allows an authenticated remote attacker to persist arbitrary JavaScript into payment-method configuration records via the REST endpoint '/inventory/configuration/payment-methods', using text parameters such as 'code' and 'name' that are neither validated nor encoded before being rendered back to users. Because the injected script only fires when a second authenticated user opens the affected configuration in the web panel (CVSS UI:P / UI:R), exploitation requires both an attacker account with access to the payment-method configuration feature and a victim who views the poisoned data, and impact is confined to the victim's browser session. No public exploit code has been identified at time of analysis, and the vendor has published a fix. This is a genuine but low-priority stored XSS.
InvoicePlane releases prior to 1.7.2 store and serve image attachments (invoice, quote, and other attachment uploads) without stripping EXIF metadata, so any authenticated recipient with whom a picture is shared can recover embedded GPS coordinates, capture timestamps, camera/device identifiers, and similar details that the uploader never intended to disclose. The assessed vector requires an authenticated low-privileged user (PR:L) on the network to view the shared image, and exploitation is entirely contingent on the uploader having attached a photo that actually carries EXIF data - screenshots, re-encoded images, and scanned documents expose nothing, which keeps the practical impact low and conditional. Exploitation yields only whatever metadata happens to be present in the file, so this is a privacy leak rather than a code-execution or account-takeover flaw; no public exploit code has been identified and the issue is not listed on CISA KEV, though note that the 1.7.2 mitigation ships disabled by default and must be explicitly enabled to be effective.
Authenticated directory traversal in the WordPress plugin SSL Zen - SSL Certificate Installer & HTTPS Redirects (all versions up to and including 4.7.42) allows a user with administrator-level capabilities to read the contents of arbitrary files on the server through the 'file_name' parameter, exposing sensitive data such as wp-config.php or other credential-bearing files. The flaw is a classic CWE-22 path traversal (CVSS 3.1: AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, base 4.9 Medium), and the high privilege prerequisite substantially limits real-world impact because WordPress administrators already hold broad file-read/upload capabilities; our assessment rates this as a genuinely low-priority issue. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV; no EPSS score was supplied.
Cross-site scripting in Teldat's Regesta Smart HD-PLC powerline communications device (model TLDPH16D2, firmware 11.02.06.00.02) allows an attacker who already has authenticated access to the web management interface to inject a payload through the 'cmdcookie' parameter of /upgrade/index.html, which then executes in the browser of a logged-in user who triggers the crafted request. The vulnerability is confirmed only for firmware 11.02.06.00.02 and carries a low CVSS 4.0 base score of 4.8, consistent with an independent assessment of CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N that requires prior authentication (PR:L) and mandatory victim interaction (UI:R). No public exploit code and no confirmed active exploitation were identified at time of analysis, and the niche industrial deployment of these PLC devices further narrows real-world exploitability.
Authenticated RabbitMQ Server 4.2.0 through 4.2.8 and 4.3.0 through 4.3.2 users who hold only 'configure' permission on one exchange can bypass the alternate-exchange authorization check through the AMQP 1.0 management API, silently redirecting unrouteable messages into a target exchange on which they have no write permission. The defect is a missing authorization check (CWE-862) in the PUT /exchanges/:name handler, reachable whenever AMQP 1.0 is enabled - the default in RabbitMQ 4.x - while the equivalent AMQP 0-9-1 channel path already enforces the check. Impact is confined to routing integrity with no confidentiality or availability loss; no public exploit code has been identified at time of analysis, and vendor-released patches are available in 4.2.9 and 4.3.3.
Cross-site scripting in the WikiLambda extension for MediaWiki allows a high-privileged wiki contributor to store script-bearing markup that executes in the browser of another user who views the crafted content, giving limited client-side impact (CVSS 3.1 base vector AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N; vendor-published CVSS 4.0 score 4.8). Only the pre-release version 1.47.0-alpha of the extension is affected, and the flaw has been remediated on the master branch, so no stable numbered MediaWiki release carries the vulnerable code; realistic exposure is confined to development or alpha deployments that have installed the extension. No public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV); this is a genuinely low-priority XSS despite the CWE-79 label.
Stored cross-site scripting in the MediaWiki TemplateSandbox extension allows low-privileged authenticated editors to inject arbitrary JavaScript into template sandbox previews, which then executes in the browser of any user induced to view the crafted content. Exploitation requires the extension to be installed, a valid low-privileged account to submit the malicious wikitext, and victim interaction with the preview. No public exploit code or active exploitation has been identified, and the impact is limited to browser-side script execution in the wiki origin rather than server compromise.
Authorization bypass in InvoicePlane versions prior to 1.7.2 lets unauthenticated remote attackers satisfy the application's primary role check when the instance is configured with a non-standard session backend that returns non-string scalar values for the session user_type key; the User_Controller constructor compares that session value against the required role using PHP's loose inequality operator, so type juggling can pass a check it should fail. Against the default CodeIgniter session store, which returns strings, the comparison behaves correctly and the bypass does not occur, which is why the assessed CVSS is 4.8 with high attack complexity and impact limited to low confidentiality and integrity. No public exploit identified at time of analysis.
Stored cross-site scripting in InvoicePlane 1.7.2-beta-1 and earlier lets an authenticated administrator who can edit client records persist an attribute-breaking payload in the client_email field, which the invoice and quote mailer views then render unescaped inside a double-quoted to_email value attribute. When the mailer feature is configured for the affected client and a second authenticated administrator opens the related mailer page, the injected JavaScript runs in the InvoicePlane origin and can act with that victim's session. Exploitation requires two separate high-privilege admin accounts plus victim user interaction, which keeps this a genuine but low-priority issue; no public exploit code has been identified at time of analysis, and the flaw is fixed in version 1.7.2.
Local low-privileged users can trigger a genuine but low-urgency race condition in the Linux kernel's IPv6 multicast list handling, causing a crash or denial of service on kernels built with IPv6 support. The defect affects kernels before the vendor fixes, traces back to approximately Linux 2.6.38, and is fixed in 7.2.7 and 7.3-rc2 per EUVD. No public exploit identified at time of analysis, EPSS is 0.17% (6th percentile), and the this_month priority label reflects limited, local-only, timing-dependent exposure.
Uninitialized-mutex use in the Linux kernel Bluetooth HCI core can be triggered by a local low-privileged user who causes an HCI controller flagged with quirks such as HCI_QUIRK_RAW_DEVICE (and therefore HCI_UNCONFIGURED) to be registered while the power_on work item races ahead of msft_register() initialization. The window is a narrow timing race in hci_register_dev(), where hdev->msft_data is published before mutex_init(&msft->filter_lock) completes, so hci_power_on() -> hci_dev_do_close() -> msft_do_close() can lock an uninitialized mutex, producing a DEBUG_LOCKS warning and a kernel warning/backtrace (availability impact, no confidentiality or integrity effect). EPSS is 0.17% (5th percentile), there is no CISA KEV listing, and no public exploit code has been identified at time of analysis; vendor-released patches exist for the affected stable branches.
LDAP filter bypass in GLPI versions prior to 10.0.26 and 11.0.8 allows an authenticated hotliner or technician with access to the user-import feature to inject crafted criteria and read LDAP objects that the configured default filter was intended to exclude. The issue is a limited information-disclosure flaw: it does not grant write access, code execution, or access to GLPI's own data, and exploitation requires an existing LDAP integration with a configured default filter. No public exploit code was identified at time of analysis, and NVD rates it CVSS 4.6.
RabbitMQ Shovel plugin before 4.3.3, 4.2.9, 4.1.14, and 4.0.23 can write plaintext AMQP credentials from shovel worker GenServer state into crash dump files because the process does not implement the OTP format_status/2 callback; a crash (e.g., network partition) triggers the SASL error handler to serialize the full state, including deobfuscated amqp://user:password@host URIs. Exploitation is not remote: it requires the Shovel plugin to be configured with credentialed URIs, a subsequent crash, and authenticated high-privileged read access to the node's error log or crash dump (CVSS 3.1 PR:H), exposing credentials for the separate upstream/downstream brokers rather than the RabbitMQ node's own data. No public exploit has been identified at time of analysis, and vendor patches are available in the fixed versions.
Symlink traversal in the drag-and-drop remote staging path of kitty 0.47.0 up to (but not including) 0.49.0 lets a program that can write to the terminal create new files (mode 0644) and directories (mode 0755) at arbitrary absolute paths writable by the user running kitty, by declaring two identically named entries - the first a symlink to a chosen absolute path, the second a directory. Exploitation is local and requires the victim to actively initiate a drag-and-drop operation from the terminal (UI:A); the assessed vector is CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N (CVSS 4.0 base 4.6), so impact is limited to integrity of newly created paths, and O_CREAT|O_WRONLY|O_EXCL semantics prevent overwriting any pre-existing file. No public exploit code identified at time of analysis, and the vendor released a fix in 0.49.0 that refuses symlinked directory entries during remote drag staging.
Use-after-free in the drag-and-drop source path of the kitty terminal emulator (versions 0.47.0 up to but not including 0.49.0) allows any program that controls the terminal's output byte stream to make the terminal read from and write to freed heap memory while the user is actively dragging content out of the window. The flaw lives in drag_remote_file_data() in kitty/dnd.c, which keeps a DragRemoteItem pointer into an array that the error path's cancel_drag()/drag_free_offer() teardown frees, then continues to dereference and write through it; per the assessed vector this is a local, user-interaction-required issue (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) with integrity and availability impact only and no confidentiality impact, matching the vendor's low 4.6 CVSS 4.0 base score. No public exploit code was identified at time of analysis, and the issue is not confirmed actively exploited (not in CISA KEV); a vendor patch is available in kitty 0.49.0.
RabbitMQ Management versions 3.13.0 through 3.13.18, 4.0.23, 4.1.14, 4.2.9 and 4.3.4 render an attacker-controlled AMQP queue name as unescaped HTML in an authorization-error reason when the OAuth management UI is enabled, allowing an injected <base> element to retarget the UI's automatic relative refresh. An authenticated attacker holding queue 'configure' permission can therefore cause a management administrator who clicks 'Get Message(s)' on the crafted queue to send their Authorization header to an attacker-controlled endpoint whose CORS policy accepts the management origin. Exploitation requires a stacked set of preconditions - non-default OAuth UI, attacker queue-configure rights, an administrator who can see but cannot read the queue, a victim click, a Content Security Policy lacking base-uri and connect-src, and an attacker endpoint that permits the management origin via CORS - which substantially limits real-world risk; no public exploit identified at time of analysis, and the issue is rated MEDIUM (CVSS 4.0 base 4.5).
Reversed argument ordering in the Linux kernel IPVS connection-synchronization sender (sync protocol version 1) causes hton_seq() to write to the wrong buffer, leaving 24 bytes of a kmalloc-backed sync message uninitialized while clobbering live connection sequence state with values read back from that buffer. The flaw, tracked as CVE-2026-98078, affects Linux kernels since the sync code was introduced at 2.6.39 and is reachable only on hosts acting as IPVS/LVS directors that have the sync daemon explicitly enabled in master/sender mode on protocol version 1 - a non-default, specialized load-balancer cluster configuration. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) and the 4.4 base score reflect local access with low privileges and limited confidentiality, integrity, and availability impact; EPSS is only 0.20% (9th percentile) and there is no public exploit identified at time of analysis, making this a low-priority defensive-patch issue rather than an urgent threat.
Salt deduction in PostgreSQL Anonymizer prior to 3.2.3 allows an authenticated low-privileged masked role to bypass RESTRICTED function protections by calling anon.hash() from inside a sub-select, collecting (seed, hash_output) pairs and performing an offline brute-force attack to recover the masking salt. This is a low-severity information-disclosure issue (CVSS 4.3, PR:L) that weakens masking guarantees but does not directly reveal plaintext or grant privilege escalation; no public exploit identified at time of analysis and no CISA KEV entry was identified. The issue is fixed in PostgreSQL Anonymizer 3.2.3 and later.
Authorization bypass in the Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress (all versions through 9.1.0) allows any authenticated user holding Contributor-level access or higher to act on other users' social-media scheduling data, including viewing, modifying, or deleting records. Because the plugin's b2s_security_nonce is rendered on the post-edit meta box that Contributors can already access, the nonce does not function as a privilege barrier, so attackers can read another user's network authentication IDs and scheduled post content, overwrite Open Graph and Twitter Card metadata on posts they do not own, rebind another user's social-network authorization, and mass-hide scheduled posts sitewide. Exploitation requires a low-privileged account on a site running the affected plugin; no public exploit code has been identified at time of analysis, and no CISA KEV entry is associated with this CVE. Practical exposure is limited to multi-author or membership sites that grant Contributor or higher roles to untrusted users.
Authorization bypass in the OpenStation - Desktop Windows, Dock & Virtual Desktops for WP Admin WordPress plugin (slug desktop-mode) through version 1.1.7 lets any authenticated user - even one holding only the default 'read' capability that every Subscriber gets - read the title, status, date, permalink and a 300-character content excerpt of private, draft, pending and future posts, as well as the body and AI-moderation verdicts of unapproved and spam comments. The intended 'custom-level access plus enabled AI feature' prerequisite collapses because any logged-in user can self-enable ai.enabled by posting to /desktop-mode/v1/os-settings from the /openstation/ portal. It is a read-only confidentiality leak with no write or code-execution impact, no public exploit identified at time of analysis, and no CISA KEV or EPSS signal, which is consistent with the genuinely low-priority assessment.
Symlink traversal in the Sieve mail-filtering service can disclose arbitrary files readable by the Sieve/mail service account. The flaw requires the attacker to control a symlink in a filesystem location processed by Sieve, which generally means local filesystem access or an authenticated mail account with ManageSieve or equivalent script-upload privileges; the assessed vector is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, so it is not remotely exploitable without credentials in a default configuration. Impact is limited to confidentiality - no code execution, file modification, or denial of service - and no public exploit code, KEV listing, EPSS score, or vendor patch version was present in the input; no public exploit identified at time of analysis.