Malformed UTF-8 in a filename can bypass the control-character check performed by Flysystem's default WhitespacePathNormalizer before version 3.35.3, letting a filename containing ANSI escape sequences survive normalization and be stored via Filesystem::write(). When an administrator later renders Filesystem::listContents() output in an ANSI-interpreting terminal, those sequences can hide or spoof entries in the listing, giving a malicious write-capable user (PR:L) a terminal-output deception primitive with UI:R. The issue is confined to spoofed or hidden directory listings - there is no code execution, no data disclosure, and no integrity impact beyond the stored filename itself; no public exploit code has been identified at time of analysis and there is no confirmed active exploitation, and the CVSS 3.5 score reflects the low overall risk.
Information disclosure in Google Chrome on Android before version 154.0.8037.92 allows an attacker who has already compromised the renderer process to read memory outside the browser sandbox by getting the victim to load a crafted HTML page. The flaw is an uninitialized-resource bug (CWE-908) in the GPU component, so it leaks memory rather than executing code or modifying state, and the practical exploitability is sharply limited by the precondition that the attacker must first hold a compromised renderer - a requirement the scored vector does not capture despite PR:N. Scored CVSS is only 3.4 (AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N), no public exploit code was identified at time of analysis, and no confirmed active exploitation (CISA KEV) is associated with this CVE; a vendor-released fix exists in Chrome 154.0.8037.92, making this a low-priority patch-and-move-on item despite Chromium's 'High' security severity label.
Memory disclosure across the Chrome sandbox boundary affects Google Chrome on Windows prior to 154.0.8037.92, where an uninitialized resource in the Media component lets content read memory it should not be able to reach. Exploitation is not self-contained: the attacker must already have compromised the renderer process through a separate, earlier vulnerability, and then have the victim load crafted HTML that exercises the Media code path (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N, base 3.4). Impact is limited to low-confidentiality readout with no integrity or availability effect, making this realistically an exploit-chain building block, and there is no public exploit identified at time of analysis; a vendor patch is available in 154.0.8037.92.
An uninitialized-memory flaw in Chrome's GPU component (CVE-2026-102319, CWE-908) lets an attacker who has already compromised the renderer process read memory outside the browser sandbox by loading a crafted HTML page, providing a sandbox-weakening information-disclosure primitive rather than direct code execution. Affected are Google Chrome builds prior to 154.0.8037.92 on all platforms (CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*); the independent assessment scores this CVSS 3.1 at 3.4 (AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N), classifying it as a genuine but low-priority issue despite Chromium's internal 'High' label, because it requires a prior renderer compromise, high attack complexity, and user interaction, and yields only partial confidentiality impact. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and vendor-released patch Chrome 154.0.8037.92 is available.
A local buffer overflow in the underlying operating system of HPE Networking Instant On devices (all builds up to and including 3.4.1.0) allows a low-privilege authenticated local attacker to interrupt the normal operation of a single affected service. The flaw is rated CVSS 3.1 3.3 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L), meaning it is not remotely reachable, requires an existing low-privileged local foothold on the device OS, and is limited to partial availability impact on one service with no confidentiality or integrity loss; no public exploit identified at time of analysis, and no CISA KEV listing or EPSS scoring is associated with this CVE. Overall risk is low and the pre-existing authenticated local access requirement is the dominant limiting factor.
Authenticated path traversal in the HPE Networking Instant On command line interface allows an attacker who already holds administrative CLI access to steer file operations outside the intended directory, modifying a limited set of files on the underlying operating system and interrupting normal operation of the affected service. Only Instant On versions up to and including 3.4.1.0 are affected, and the vector is local (AV:L) with high attack complexity (AC:H) and high privileges required (PR:H), giving a CVSS 3.1 base score of 3.0. There is no data disclosure, no integrity or availability impact outside the limited file set and service interruption, no CISA KEV entry, and no public exploit identified at time of analysis.
Buffer overflow in the API endpoint of HPE Networking Instant On lets an authenticated attacker who already holds administrative privileges interrupt the affected service, producing a short-lived denial of service that recovers on its own without manual intervention. Only administrators can reach the vulnerable code path (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L), and there is no confidentiality or integrity impact, so the practical exposure is limited to brief, self-healing service interruptions. All Instant On versions up to and including 3.4.1.0 are reported affected; no public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV), which is consistent with the low 2.7 base score.
Low-privileged pretix team members who can reach a specific event but who were deliberately denied access to that event's orders can read two aggregated business figures they should not see: the event's attendee count and its total revenue. Exploitation requires an authenticated account already placed on the organizer's team with event-level access but without order-level permission, so there is no path for an outside, unauthenticated attacker, and the disclosure is confined to aggregate numbers rather than individual order or personal data. No public exploit code has been identified at time of analysis, and the issue is assessed as a genuinely low-risk, low-priority information-disclosure bug affecting pretix installations before 2026.7.1.
Cache poisoning in UnoPim before 2.0.1 and 2.1.x before 2.1.1 allows unauthenticated remote attackers to inject an arbitrary origin into admin layout pages by sending a crafted X-Forwarded-Host header, because the application trusts every connecting client as a proxy and never validates the header. When a shared caching proxy or CDN stores the poisoned admin response, a subsequent administrator loading that page has the admin UI's JavaScript assets resolved from the attacker's server, executing attacker-supplied code inside an authenticated session. Exploitation is conditional - it requires an intermediary cache in front of admin responses and an administrator visiting the poisoned page (assessed CVSS 3.1 AV:N/AC:H/PR:N/UI:R/S:C, with limited confidentiality and integrity impact), no public exploit code or confirmed active exploitation was identified at time of analysis, and the CVSS 4.0 base score is 2.3.
API-uploaded files in pretix are not correctly bound to the uploader's authentication method, and a single session token is shared across all token-based API users, undermining the intended isolation. This affects pretix versions prior to 2026.7.1. Exploitation requires a valid token-based API account and knowledge of the randomly generated UUID of a target file, which only exists for about a day, making real-world risk very low (CVSS 2.3). No public exploit code has been identified at time of analysis, and the issue is not known to be actively exploited.
Server-side request forgery in Fider before 0.38.0 lets an authenticated administrator who controls DNS for a configured hostname redirect the server's outbound HTTP requests to internal services or cloud metadata endpoints by exploiting a time-of-check/time-of-use gap between URL validation and the actual connection. The exposure is narrow: only webhook URLs and custom OAuth provider token/profile URLs are user-configurable outbound targets, the attacker needs admin privileges and must win a DNS-rebinding race (high attack complexity), and instances with AllowPrivateNetworkTargets deliberately enabled are out of scope, so this remains a low-priority issue despite the network vector (CWE-918). No public exploit code has been identified at time of analysis and there is no evidence of active exploitation; v0.38.0 fixes the flaw by re-checking the resolved IP at dial time.
OAuth access tokens issued by pretix continue to be honored for their entire original lifetime even after an administrator manually disables the OAuth client (application) they belong to, so disabling an application is not an effective immediate revocation mechanism. Exploitation requires an attacker to already possess a valid, unexpired access token that was issued to that client before it was disabled, meaning this is an authenticated, high-complexity access-control weakness rather than a remotely reachable bypass. Severity is low (vendor CVSS 4.0 score 2.1; independent CVSS 3.1 assessment 2.1 with C:L/I:L, AC:H, PR:L), no CISA KEV listing is present and no public exploit code has been identified at time of analysis, and no EPSS score was supplied in the available intelligence. Because the exposure window is bounded by the token's original TTL and cannot be extended, the practical risk is limited to the residual lifetime of already-issued tokens.
Stored HTML injection in pretix lets an authenticated user with organizer permissions plant malicious markup inside the help texts of configurable fields, which is then rendered to other users who view the affected pages. Exploitation is gated by the organizer privilege level, requires a victim to subsequently load the injected content (UI:P), and the vendor rates it high-complexity with an additional attack requirement (AC:H/AT:P), so it is not reliably repeatable against arbitrary targets. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the CVSS 4.0 base score is only 2.1, reflecting limited confidentiality and integrity impact with no availability loss.
Object-level authorization bypass in owen2345 Camaleon CMS through 2.9.2 lets an authenticated user who holds only the media-library permission (`:manage, :media`) overwrite another user's avatar by calling the admin media crop endpoint with the `saved_avatar` parameter set to a victim's user ID. The crop action reaches the same avatar meta write that `UsersController#update` protects with `:manage, :users`, but enforces only the media permission, so the media library becomes a side door into profile editing; post-PR-#1267 the target is scoped to `current_site.users`, limiting the bypass to same-site, cross-user writes rather than cross-tenant ones. Publicly available exploit code exists (CVSS 4.0 vector carries E:P), and the vendor has released a fix in 2.9.3; the exposure is limited to profile-meta tampering with no access to passwords, credentials, or confidential data, so the assessed risk is genuinely low. No confirmed active exploitation (CISA KEV) was identified at time of analysis.
Unrestricted file upload in mwasikz robo-cafe-rms (the manage-food.php food-management endpoint) lets an attacker with an authenticated high-privilege admin session upload arbitrary files to the web server over the network, which can lead to remote code execution if the server executes uploaded PHP from the upload directory. All deployments are affected, since the project ships as a rolling release with no versioned affected or fixed builds (CPE cpe:2.3:a:mwasikz:robo-cafe-rms:*:*:*:*:*:*:*:*). Publicly available exploit code exists, and the vendor was contacted early but did not respond, so no vendor-released patch has been identified; VulDB rates the issue CVSS 4.0 5.1 (Medium), while our independent CVSS 3.1 assessment of AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H places it higher (7.2 High) because successful upload can yield full confidentiality, integrity and availability impact on the host. The main limiting factor is the admin-authentication prerequisite (PR:H), which makes this an authenticated post-compromise escalation rather than an unauthenticated remote compromise.
Stored cross-site scripting in mwasikz robo-cafe-rms allows an authenticated low-privilege user to inject arbitrary script into the profile Name, Address, or City fields, which then executes in the browser of any victim who views the affected profile page. Publicly available exploit code exists, and because the project follows a rolling-release model, no version boundary or vendor patch can be cited for the affected or fixed code. The risk is low-to-moderate in practice: exploitation requires a valid account, the injected content only fires when another user loads the poisoned view, and the product has a very small deployment base. Vendor contact was attempted early in the disclosure process and produced no response.
Session fixation in pretix allows an attacker to trick a victim into following a crafted link that silently logs the victim into the attacker's own customer account, so order details the victim subsequently enters can be captured into that attacker-controlled account. The behavior only occurs in a non-default cross-domain deployment where the event is served from a different domain than the organizer page, and it additionally requires victim interaction and the victim failing to notice the unfamiliar logged-in account before completing an order, which keeps practical reliability low; the issue is assessed as genuinely low risk (CVSS 3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N). No public exploit code or active exploitation has been identified at time of analysis, and pretix has published a fix in its 2026-7-1 release.
Information disclosure in Intelbras TIP 125i VoIP desk phones running firmware 4.3.35 or 4.3.41 allows an attacker who already holds a low-privilege account on the device's web management interface to read sensitive data that the 'Básico' configuration page embeds directly in its page source. Exploitation is remote but rated high-complexity and 'difficult' by the vendor, requiring network reachability to the phone's administrative UI plus at least low-level privileges; there is no user-interaction requirement and no integrity or availability impact - only a limited confidentiality leak. Publicly available exploit code exists, but the flaw is not confirmed actively exploited, and the CVSS 4.0 base score of 1.3 reflects the constrained, low-value exposure.
Authenticated users of the pretix ticketing platform can bypass validation logic built into the checkout flow by skipping entire check-in steps, allowing data that those steps were meant to verify to pass through unchecked. The flaw requires a legitimate participant in the checkout process (PR:L) and only affects the integrity of check-in/checkout data - there is no confidentiality or availability impact and no victim interaction is required. Only deployments running pretix versions prior to the 2026.7.1 release are exposed, and no public exploit identified at time of analysis; the vendor's own scoring is low (CVSS 1.3), matching an independent assessment of low real-world risk despite the 'Authentication Bypass' tag.
Use-after-free in libpng 1.6.0 through 1.6.58 can crash applications that use the sequential reader and call png_read_end after png_read_info without first reading the image rows. A crafted PNG containing a zTXt, iTXt or iCCP chunk that makes libpng abandon zlib decompression early leaves a stale input pointer in the zlib stream; the zTXt/iTXt path then reads through a freed heap buffer (a larger tEXt or pCAL chunk before IDAT must first reallocate the read buffer), while the iCCP path is a stack use-after-return. Impact is confined to denial of service - the dangling pointer is only read into a discarded scratch buffer, so there is no data disclosure or corruption - and the required API call sequence is rare in practice; no public exploit has been identified at time of analysis, and the vendor rates it 5.9 Medium (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H), consistent with the independent assessment.
Risk cannot be meaningfully assessed from the available data for CVE-2026-96543, which is currently known only through the vendor:ubuntu security feed with no description, no CWE, no CVSS score or vector, and no identified affected package. Because the affected product or feature, the protocol involved, and the configuration prerequisites are all absent, it is not possible to determine who is affected or what an attacker could achieve. No public exploit identified at time of analysis, and no patch version data was supplied, so the corresponding Ubuntu Security Notice (USN) must be reviewed manually to establish exploitation prerequisites and impact.
Ubuntu is the only vendor identified for CVE-2026-96544, but the intelligence feed supplies no description, CWE, CVSS score, or CVSS vector, so the affected component, the vulnerable version range, and the resulting impact are all unconfirmed. The identifier comes from a vendor advisory channel (vendor:ubuntu), which indicates the flaw is most likely tracked against one or more Ubuntu source packages rather than a third-party upstream product, but the specific package and release cannot be determined from the data at hand. No public exploit code and no confirmed active exploitation are indicated by the supplied intelligence, and because no CVE record, Ubuntu Security Notice, or patch reference was included, no meaningful severity or risk rating can be assigned until the authoritative record is retrieved.
No impact assessment is possible for CVE-2026-95622 from the intelligence available at this time: the record supplies no description, no CVSS score or vector, no CWE classification, and no CPE identifiers, and the only attribution is a 'vendor:ubuntu' reporter tag. Consequently the vulnerable component, the affected Ubuntu package and release, and the privileges an attacker would require remain unknown, and no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS signal are present to suggest real-world activity. The identifier should be treated as unverified and non-actionable until NVD/MITRE publishes the CVE record and the Ubuntu security team issues a corresponding USN or tracker entry.
Local privilege escalation in LXC can occur when lxc-copy updates a cloned container's hostname in host context and follows a symlink planted in the source container's root filesystem. An attacker who already controls files in a container can position the symlink, and a host administrator must then run lxc-copy against that container, causing a root-privileged write to an attacker-chosen path and potentially compromising the host. The assessed vector is CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:H, and no public exploit or active exploitation is identified in the available data.
Ubuntu Linux is the only product context available for CVE-2026-88841, and the record is effectively a placeholder: the supplied intelligence contains no description, no affected package or component name, no CVSS score or vector, no CWE mapping, no CPE identifiers, and no references beyond the originating vendor tracker (vendor:ubuntu). Because of this, the concrete impact, attack vector, authentication requirements, and platform prerequisites cannot be stated, and no public exploit code has been identified at time of analysis. Risk cannot be meaningfully assessed from the available data; the only defensible action at this point is to obtain the Ubuntu CVE tracker entry and the referenced upstream advisory before making any defensive or prioritization decision.