Unauthenticated account takeover in the FluentCart WordPress plugin before 1.6.5 lets remote attackers who already know an existing guest customer's email address complete the guest-checkout flow using that address and obtain a logged-in account tied to the victim's stored customer record. The flaw is an authentication bypass in the plugin's guest checkout logic, requiring no victim interaction and no privileges, but it is limited to customers whose email address the attacker already knows. No public exploit was identified at time of analysis, and the impact is moderate, with low confidentiality and integrity impact and no availability impact.
Stored cross-site scripting in the WordPress plugin Real Estate Manager - Property Listing and Agent Management affects all versions up to and including 7.3, allowing a low-privileged authenticated user (subscriber or above) to persist arbitrary JavaScript through the 'before_price_text' parameter that then executes in the browser of any visitor viewing the injected page. The flaw is compounded by the wp_ajax_rem_create_pro_ajax AJAX handler having no capability, nonce, or ownership check, and because the payload is saved with update_post_meta rather than into post_content, the wp_kses filtering normally tied to the unfiltered_html capability never applies. Rated CVSS 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), this is a genuine but moderate-priority issue; no public exploit code or confirmed active exploitation was identified at time of analysis.
Stored cross-site scripting in the WordPress plugin Viable URL Media Uploader (all versions up to and including 1.0.0) lets an authenticated user holding Author-level capabilities or higher upload a crafted SVG file whose embedded script content is neither sanitized on upload nor escaped on output, so the payload executes whenever a visitor or administrator browses directly to the uploaded SVG's URL. The flaw carries a CVSS 3.1 base score of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), reflecting a scope change into the browsing context plus low confidentiality and integrity impact; exploitation is gated by the Author+ prerequisite, so the attacker pool is limited to trusted or already-compromised accounts on sites running this niche plugin. No public exploit code and no confirmed active exploitation were identified at time of analysis, though the Wordfence disclosure and a linked Trac source reference make the vulnerable code path publicly visible.
Use-after-free in the NVIDIA GPU Display Driver kernel module (CVE-2026-47586) allows an attacker with local access to the GPU device on Windows or Linux to corrupt kernel memory, with potential outcomes including code execution, privilege escalation, denial of service, information disclosure, and data tampering. The vendor CVSS vector (AV:P/AC:H/PR:N) is anomalous - designating physical access and no privileges - while the independent assessment uses AV:L/AC:H/PR:L, indicating that exploitation is not remotely triggerable and instead depends on winning a timing/command-sequence race after obtaining local low-privileged access to the driver. No public exploit code or confirmed active exploitation is identified at time of analysis, and exploitation signals point to a low-to-moderate real-world priority despite the memory-corruption impact.
An out-of-bounds write in the kernel-mode layer of the NVIDIA GPU Display Driver for Linux can be triggered by an already-privileged local user who wins a narrow race condition between concurrent kernel operations, potentially yielding code execution in kernel context, denial of service, privilege escalation, information disclosure, and data tampering. Affected branches include GeForce, RTX/Quadro/NVS, Tesla, and Guest Driver products on Linux (CVSS 3.1 base 6.4). Impact is bounded by the requirement for high local privileges (PR:H) and the non-deterministic nature of the race (AC:H); no public exploit code and no confirmed active exploitation were identified at time of analysis.
Stored cross-site scripting in ReactPress - Create React App for WordPress 3.4.0 and earlier lets authenticated attackers with subscriber-level access or higher poison pages with arbitrary JavaScript by supplying a crafted permalink. The plugin passes the value through sanitize_url() but then fetches the attacker-controlled remote URL and writes its raw response body to disk with file_put_contents(), so script tags and event handlers are persisted and later served to visitors. The issue has no public exploit identified at time of analysis, is not confirmed actively exploited (CISA KEV), and has a CVSS base score of 6.4 assessed as a genuine but bounded risk.
Stored cross-site scripting in the Bold Page Builder WordPress plugin (all versions up to and including 5.7.2) allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts via the 'background_image' parameter of the bt_bb_section shortcode. The injected scripts execute in the browser of any user who views the affected page, potentially enabling session hijacking or other client-side attacks. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS base score is 6.4 (Medium).
Authenticated users with Contributor-level access or higher on WordPress sites running the Bold Page Builder plugin (boldthemes) at version 5.7.2 or earlier can inject arbitrary JavaScript through the 'images' parameter of the bt_bb_css_image_grid shortcode, which is then stored in page content and executed in the browser of any visitor who later loads the poisoned page. The flaw is a stored cross-site XSS (CWE-79) rated CVSS 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), reflecting a remote, low-privilege attack path with a scope change because scripts run in the context of higher-privileged WordPress users. Exploitation is not confirmed as active (no CISA KEV listing) and no public exploit code was identified at time of analysis, but the low skill floor for shortcode-attribute XSS makes a moderate priority for any site exposing Contributor accounts.
Stored cross-site scripting in the Bold Page Builder WordPress plugin (all versions up to and including 5.7.2) lets an authenticated attacker with Contributor-level access or higher plant arbitrary JavaScript in a page by abusing the 'target' attribute of the bt_bb_icon shortcode. The payload is persisted in the shortcode and executes in the browser of any user - including an administrator - who later views the injected page, allowing session theft, privilege escalation or site takeover. Exploitation requires a valid Contributor-or-higher account on a site running the plugin, and no public exploit code has been identified at time of analysis; severity is rated moderate (CVSS 6.4) because of the authentication prerequisite and the need for a victim to view the page.
Stored cross-site scripting in the Smart Slider 3 WordPress plugin (Nextend, CPE nextendweb:smart_slider_3) up to and including version 3.5.1.38 lets an authenticated attacker with contributor-level access or higher inject arbitrary JavaScript through the slider's 'data-href' parameter, which is then rendered unsanitized on pages and executes in the browser of any user who views the injected content. Scoring is CVSS 3.1 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N); the attack requires valid contributor credentials and is therefore not reachable by anonymous visitors, but no victim interaction is needed to plant the payload - only a subsequent page view by another user to trigger it. There is no CISA KEV entry and no public exploit identified at time of analysis, though the risk is meaningfully elevated on sites with open contributor registration or many low-trust editorial accounts, where the stored script can be aimed at higher-privileged users or site visitors.
Stored cross-site scripting in the HT Mega Addons for Elementor - Elementor Widgets & Template Builder WordPress plugin (all versions up to and including 3.1.1) lets an authenticated attacker with contributor-level access or higher inject arbitrary JavaScript into a page through the Data Table widget's 'display_options' setting. The payload is persisted and then executes in the browser of any visitor - including administrators - who views the affected page, and because the CVSS scope is changed (S:C), the injected script runs in the context of the site's origin rather than a sandboxed component. The primary limiting factor is the prerequisite of a pre-existing contributor-or-higher account, so realistically exposed sites are those that permit untrusted users to register or otherwise obtain contributor privileges; no public exploit code has been identified at time of analysis and the issue is not a confirmed actively exploited (CISA KEV) vulnerability.
Stored cross-site scripting in the Bold Page Builder WordPress plugin (all versions up to and including 5.7.2) allows authenticated users with Contributor-level access or higher to inject arbitrary JavaScript through the title attribute of the bt_bb_service shortcode, which then executes in the browser of any user who views the injected page. The weakness is insufficient input sanitization and output escaping on user-supplied shortcode attributes (CWE-79), rated 6.4 under CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N - a remote, unauthenticated-looking network vector that actually requires a low-privileged authenticated account, with scope change because the script runs in the context of the hosting page. There is no public exploit identified at time of analysis, and real-world exposure is limited to sites that hand Contributor accounts to untrusted users and have not moved past version 5.7.2.
Stored cross-site scripting in the Bold Page Builder WordPress plugin through version 5.7.2 allows authenticated users with Contributor-level access or higher to inject arbitrary JavaScript through the 'caption' attribute of the bt_bb_image shortcode, which executes when any user renders an affected page. The CVSS 6.4 moderate-severity issue was reported by Wordfence and requires the plugin to be installed and active; exploitation is persistent but is limited by the Contributor authentication requirement. Exploitation status: no public exploit identified at time of analysis, and no CISA KEV entry is provided in the intelligence.
Authentication bypass in Liquid-co OpenSave's WAN relay lets an unpaired room member impersonate a paired device and reach protected sync routes for save data, snapshots, and file operations. Any OpenSave instance running a version before 2.4.0-beta.1 with WAN relay sync enabled is affected; the attacker must already hold a valid 12-character room code, which is cryptographically generated and shared out-of-band, so exposure is realistically limited to people the room owner deliberately invited or whose code leaked, rather than the open internet. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the issue is resolved by the vendor's 2.4.0-beta.1 release, which adds end-to-end encryption over the relay plus single-use per-request proof of the pairing key.
OS command execution on a second appliance node is possible in multi-node (clustered) Kiteworks Core deployments running versions below 9.5.1, but only for an attacker who has already achieved code execution on another node in the same cluster. An unvalidated value submitted through an internal cluster interface is written into the monitoring configuration of a peer node, where it can be interpreted as an OS command running under an unprivileged service account. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV); the CVSS 3.1 score of 6.3 (AV:L/PR:L/S:C) reflects the strong prerequisites - local-adjacent access, existing low-privilege foothold, and a multi-node topology.
OS command injection in the Git Remove MCP Tool of 0xshariq github-mcp-server (all revisions up to commit 52e764a7d66eac1726fce02ca7bb5a638571801a) lets an attacker who can influence the tool's 'File' argument inject shell metacharacters that are executed by child_process.exec in src/github.ts. Publicly available exploit code exists (reported via a GitHub issue on the project's own repository), but there is no evidence of confirmed active exploitation in CISA KEV, and the vendor has not responded to the report. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) rates confidentiality, integrity and availability impact as high, although the practical exposure depends heavily on how the MCP server is deployed - a network-accessible MCP transport makes the AV:N path realistic, whereas a local stdio deployment limits reach to whatever can feed input into the connected LLM client.
Server-side request forgery in the @astrojs/netlify adapter (5.2.0 through 8.2.3) lets unauthenticated remote attackers make the Netlify Image CDN fetch URLs whose host they control, by embedding an allowlisted origin inside the path or query string of a request to the public /.netlify/images endpoint. The impact is limited: Netlify egress protections restrict which internal or external targets are actually reachable and image-transformation handling prevents fetched response bodies from being returned to the attacker, so no confidentiality or integrity impact has been demonstrated and only low availability impact is assessed (CVSS 6.3 per the 4.0 vector; independent assessment CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L). No public exploit code has been identified at time of analysis, and the flaw is fixed in @astrojs/netlify 8.2.4.
An integer overflow in the blosclz decompression path of C-Blosc2 3.3.2 and earlier allows a remote attacker who can supply crafted compressed data to a program that calls blosclz_decompress to corrupt an output-buffer bounds computation, potentially causing memory corruption. Successful exploitation depends entirely on a consuming application accepting and decompressing attacker-influenced Blosc2/blosclz data, and the vendor characterizes the attack as high complexity and difficult; per the CVSS 4.0 vector the impact is Low across confidentiality, integrity, and availability and no privileges or user interaction are required. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, so this is assessed as a real but low-priority memory-safety defect; the vendor-released fix is version 3.3.3.
Deep-merge prototype pollution in Vaadin Charts and Vaadin Component Base lets remote, unauthenticated attackers write arbitrary properties onto JavaScript's Object.prototype whenever a Vaadin application merges an object it does not control into a chart configuration (e.g. updateConfiguration or a chart series config) or into a component's i18n property. Once injected, those properties are visible to every object in the running client-side application, degrading UI integrity and availability rather than exposing data or yielding direct code execution. Exploitation is conditional - the host application must actually route crafted input containing a __proto__ (or equivalent prototype) key into one of those two merge sinks - and no public exploit code has been identified at time of analysis, with no confirmed active exploitation (CISA KEV). Affected ranges are Vaadin 23.0.0-23.6.13, 24.0.0-24.9.20, 24.10.0-24.10.9, 25.0.0-25.1.11 and 25.2.0-25.2.6 across the Maven artifacts and the corresponding @vaadin/charts and @vaadin/component-base npm packages.
Subscriber privilege escalation in FluentBoards WordPress plugin versions up to 2.0.12 lets an authenticated low-privilege user elevate privileges within the plugin. Exploitation requires a valid Subscriber-level account, is remote and low-complexity, and can result in low confidentiality, integrity, and availability impact; sites with open registration are most exposed. No public exploit or CISA KEV active-exploitation confirmation was identified at time of analysis, making this a genuine but moderate-priority issue rather than a high-urgency one.
Stored cross-site scripting in MISP (all versions before 2.5.48) lets an authenticated account holding the perm_galaxy_editor permission - granted to the stock User role, so any ordinary user on a multi-user instance qualifies - persist arbitrary HTML or JavaScript in a galaxy's icon field via the galaxy add, edit, and sync/import capture endpoints. The stored value is later concatenated into markup by the D3-based correlation graph scripts of both the default and Overmind themes and inserted with jQuery's .html(), so any other user who opens the correlation graph of an event containing a cluster from the poisoned galaxy executes the attacker's script in their own MISP session, exposing session credentials and allowing actions or displayed-data tampering as that victim. Because exploitation requires editor privileges plus victim interaction (CVSS 4.0 6.2; independent assessment CVSS 3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), this is a genuine but moderate-risk stored XSS, and no public exploit identified at time of analysis, with no confirmed actively exploited (CISA KEV) status.
Stored cross-site scripting in MISP before 2.5.48 allows an authenticated user with galaxy editor privileges to persist a javascript: URI in a Galaxy Cluster's 'source' field, which the application then renders as a clickable hyperlink; when a victim views the affected cluster and clicks the link, embedded script executes in the victim's browser context, enabling session hijacking, data exfiltration, or unauthorized actions as the victim. The sync path is the key risk amplifier: because Galaxy Clusters propagate between federated MISP instances, an editor on any instance that synchronizes to the target can plant the payload, so the attack surface extends beyond a single local deployment. Exploitation requires both authenticated galaxy editor access (PR:L) and active victim interaction (the victim must click the rendered link, not merely load the page), and no public exploit code was identified at time of analysis; the vendor has released a fix in 2.5.48.
Stack-based buffer overflow in Artifex Ghostscript up to 10.09.0 within the pdfwrite (vector output) device, reachable through Type1 charstring subroutine handling in devices/vector/gdevpsfx.c (type1_callsubr). Attackers can trigger the overflow remotely by supplying a crafted document/font that is processed through the pdfwrite path, unauthenticated but requiring the victim or an automated conversion pipeline to render the malicious input; publicly available exploit code exists, so exposure should be treated as urgent for any service or workstation that converts untrusted PostScript/PDF content. CVSS 4.0 base is 5.3 (E:P) and the independent assessment scores it CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L, with bounded impact that realistically skews toward denial of service or limited memory corruption rather than guaranteed code execution; EPSS, KEV and SSVC provide no signal of active exploitation at time of analysis.
SQL injection in OS4ED openSIS-Classic (up to and including version 9.3) lets an authenticated low-privileged user - a staff or teacher account is sufficient - manipulate the 'cust' argument handled by functions/CustomFieldsFnc.php in the Student Search component and read or partially modify the backend database, including student records. Publicly available exploit code exists, and the vendor was notified through a public GitHub issue but has not responded, so no vendor-released patch is identified at time of analysis. This is a high-CVSS-but-moderate-real-risk issue: the requirement for a valid authenticated session and the product's education-sector, small-scale deployments meaningfully narrow the exposed population.
Stored HTML injection in JetBrains YouTrack before 2026.2.18991 allows unauthenticated remote attackers to plant attacker-controlled markup into the application through the User-Agent HTTP header, which is subsequently stored and rendered to other users without adequate output encoding. Impact is limited to Low confidentiality with a scope change and no integrity or availability effect; exploitation depends on user interaction (UI:R), as a user - typically an operator reviewing stored request or user-agent data - must open the affected page for the injected HTML to render. There is no public exploit identified at time of analysis, and the vendor has released a fix in version 2026.2.18991.
Reflected cross-site scripting (XSS) in Moodle's password reset page allows unauthenticated remote attackers to execute arbitrary script in a victim's browser by tricking them into opening a crafted password-reset link containing a malicious username. The flaw stems from insufficient sanitization of the username input and is assigned CVSS 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N). No public exploit code or active exploitation is known at the time of analysis; an upstream fix commit (MDL-88335) is referenced but a released patched version is not independently confirmed.
A heap buffer overflow in Mozilla Thunderbird occurs when a user opens an email message of 2GB or larger in size, allowing the overflowing write to corrupt memory and crash the client. The assessed CVSS vector (6.1, AV:L/AC:L/PR:N/UI:R) shows the attack is local and requires the victim to actively open the oversized message, with impact limited to availability (crash) and low integrity, and no confidentiality loss; no public exploit code or confirmed active exploitation (CISA KEV) is associated with this issue, and EPSS is low at 0.19% (8th percentile). The flaw is fixed in Thunderbird 157, and the real-world risk is further constrained because mail servers and gateways typically reject or truncate messages of that size before they ever reach the client.
An uncaught exception in the mailto: scheme handler of uri-js through 4.4.1 allows remote attackers to disrupt or crash applications that call URI.parse() on attacker-supplied mailto URIs. The flaw is remotely reachable and requires no authentication (CVSS 4.0 vector PR:N, AV:N), but its impact is limited to a low-severity availability hit - the crafted input triggers an unhandled exception rather than code execution, data disclosure, or integrity loss. Publicly available exploit code exists, referenced through the upstream GitHub issue tracker, though there is no indication of confirmed active exploitation; the upstream project has not responded to the report, so no fixed version is available.
Authorization bypass in AdithyaYelloju Restaurant-Management-System (commit 7f0e7e8) allows an authenticated low-privileged attacker to manipulate the ID argument in requests to the /admin/ Admin Area endpoint, thereby accessing or altering records belonging to other users. Publicly available exploit code exists, but no active exploitation in the wild has been confirmed. The impact is limited to Low-severity confidentiality and integrity effects, and exploitation requires a deployed instance and valid credentials.
Authenticated SQL injection in OS4ED openSIS-Classic 9.3 and earlier allows a low-privileged user to manipulate the LO_sort argument in the Student List Search endpoint, which reaches the DBQuery function and can expose or alter database contents. The issue is remotely exploitable, requires a valid session (CVSS PR:L), and publicly available exploit code exists; there is no confirmed CISA KEV active exploitation. The affected release is a niche open-source PHP student information system, so real-world priority is modest despite the SQL injection class.
SQL injection in OS4ED openSIS-Classic up to and including version 9.3 lets an authenticated attacker with any valid low-privileged account run arbitrary SQL against the backend database by manipulating the Tables argument passed to DBQuery_assignment in modules/grades/Assignments.php. The endpoint is reachable over the network with no user interaction and no special configuration, and publicly available exploit code exists; however, exploitation requires a valid session (CVSS vector PR:L, and the assessed vector confirms PR:L), so anonymous internet-wide attacks are not possible, and no confirmed active exploitation (CISA KEV) has been reported. Real-world priority is therefore low-to-moderate, driven mainly by the authentication prerequisite and openSIS-Classic's limited deployment footprint.
Cross-site scripting in the Guest Book component of gedelumbung HospitalManagement (PHP) allows remote, unauthenticated attackers to inject script payloads through the nama, email, and pesan fields handled by the kirim function in application/modules/web/controllers/buku_tamu.php, with the payload executing when a victim loads the affected guest-book page (publicly available exploit code exists; no confirmed active exploitation). The project ships as a rolling release, so no discrete affected or fixed version numbers exist - any deployment at or before commit c2d45543789a3887067d3915f69d44cfc2cf76a8 is presumed vulnerable. Impact is limited: the maintainer has not responded to the issue report and no vendor patch is available, but the required victim interaction, the low CVSS 2.1 base score, and a niche installation base keep this a low-priority finding.
Unrestricted file upload in gedelumbung HospitalManagement lets an authenticated low-privilege user abuse the ADMIN_RS_KCFINDER argument in the KCFinder File Manager to plant arbitrary files on the server, potentially escalating to remote code execution if the uploads land in a web-executable path. The project ships as a rolling release with no versioned tags, so all deployments tracking the repository up to commit c2d45543789a3887067d3915f69d44cfc2cf76a8 are assumed affected; publicly available exploit code exists and the maintainer has not responded to the upstream issue report. Note that severity signals conflict: the supplied CVSS 4.0 score is 5.3 (Medium, with exploit maturity E:P), while our internal 3.1 assessment scores 8.8 (High) given the high confidentiality, integrity, and availability impact once code execution is achieved.
SQL injection in OS4ED openSIS-Classic 9.0 through 9.3 allows a high-privilege authenticated user to manipulate the 'students' argument in the General Information Tab save action and inject data into backend SQL queries. Publicly available exploit code exists, but there is no CISA KEV confirmation, and the independent assessment treats this as a moderate, not urgent, priority because exploitation requires an authenticated high-privilege account. No vendor-released patch is identified, and the upstream project has not responded to the issue report.
Path traversal (CWE-22) in the open-source PHP hospital management application gedelumbung HospitalManagement lets an attacker who already holds an authenticated admin-level session manipulate the 'gbr' argument passed to the hapus (delete) action in application/modules/admin/controllers/data_galeri.php, reaching files outside the intended gallery directory. The issue is remotely reachable with low complexity and no user interaction, but it is gated behind high privileges (PR:H), so it is not exploitable by an unauthenticated default user; our independent assessment rates the real-world risk as low-to-moderate despite the mid-range CVSS 4.0 base score of 5.1. Publicly available exploit code exists, there is no confirmed in-the-wild exploitation and no CISA KEV listing, and the project has not shipped a fixed release - the repository uses rolling delivery, so no affected or updated version numbers can be pinned.
Improper authorization in the gedelumbung HospitalManagement configuration handler lets an authenticated high-privilege user write arbitrary configuration values through the sistem.php 'simpan' action without the application enforcing an adequate access-control check. Only deployments running the current rolling-release codebase are affected, since the project publishes no versioned releases and the CPE entry carries a wildcard version; the practical exposure is limited to Low confidentiality, integrity, and availability impact on configuration data rather than full host or data compromise. Publicly available exploit code exists via the project's GitHub issue tracker (issue #12), but there is no indication of confirmed active exploitation, and the EPSS-style risk signal remains modest; the attacker must already hold an administrative session (CVSS PR:H, assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N), which keeps real-world risk low despite the nominally elevated severity.
Privilege escalation and potential code execution in the NVIDIA GPU Display Driver for Windows and Linux arise from an incorrect permission assignment (CWE-732) within a secure microcontroller component, allowing an attacker who already holds privileged local access to write to protected memory that should be restricted. Exploitation is gated by two strong prerequisites - the CVSS vector (AV:L/AC:H/PR:H/UI:N) requires local access with administrator/root-equivalent privileges and high attack complexity - so this is a genuine but lower-tier risk that primarily matters as a post-compromise escalation or persistence primitive rather than a standalone entry vector. Affected branches include GeForce (only Maxwell, Volta, and Pascal architecture GPUs), RTX/Quadro/NVS, and Tesla data-center drivers below the branch-specific fixed versions in NVIDIA bulletin 5861; there is no public exploit identified at time of analysis and no confirmed active exploitation (not in CISA KEV).
SQL injection in OS4ED openSIS-Classic up to and including 9.3 lets an authenticated, highly privileged user manipulate the argument values reaching the db_properties function in functions/DatabaseInc.php, allowing crafted input to alter or extract database contents through the Save Data Handler code path. The flaw is network-reachable and needs no user interaction, but the CVSS vector requires PR:H, so anonymous or low-privilege accounts cannot reach it directly; publicly available exploit code exists via the project's public issue report. The vendor was notified through that issue and has not responded, so no vendor-released patch is identified at time of analysis, and the overall real-world risk is assessed as low despite the SQL injection class.
Authorization bypass (CWE-639, IDOR) in gedelumbung HospitalManagement lets an authenticated user of the admin application read patient-report records belonging to other users by tampering with the id_param argument passed to the detail function in application/modules/admin/controllers/laporan_data_pasien.php. The flaw is remote and needs no user interaction, but the attacker must first hold a valid admin session, and impact is limited to read-only disclosure of patient report data (no integrity or availability effect); our independent assessment rates this CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, broadly consistent with the published CVSS 4.0 base score of 5.1 (Medium). Publicly available exploit code exists (the vendor GitHub issue thread serves as the proof of concept), but there is no confirmed active exploitation (CISA KEV). The project is unversioned, the vendor was notified via an issue report and has not responded, so no fixed release is identified at time of analysis.
Kiteworks Core appliances that are mid-way through first-time activation expose an unauthenticated setup endpoint which enforces neither authentication (CWE-306) nor its intended state precondition, letting an unauthenticated, network-positioned attacker repeatedly re-trigger the privileged activation routine and drive the appliance into an incompletely configured state. The exposure is confined to the transient initial-activation window before the system is fully configured, so only newly deployed or re-provisioned appliances are at risk and the resulting impact is limited to setup integrity disruption - there is no confidentiality loss, no code execution, and no persistent takeover. No public exploit code or confirmed active exploitation has been identified at time of analysis (no CISA KEV listing), and vendor-supplied patching is available; practical priority is consequently LOW-to-MEDIUM despite the network-reachable, unauthenticated vector.
Denial of service in JetBrains YouTrack allows an unauthenticated remote attacker to exhaust server CPU and request-handling threads by sending crafted email content that triggers catastrophic regular-expression backtracking in mailbox mail-rule filters, affecting all releases up to 2026.2.19197. The impact is limited to availability (CVSS:C:N/I:N/A:H, base score 5.9); there is no confidentiality or integrity effect. Exposure is contingent on a non-default, operator-dependent configuration - the mailbox integration must be enabled with regex-based mail-rule filters - and there is no public exploit identified at time of analysis, so this is a genuine but modest-priority availability issue rather than a broadly exploitable one.
ECDSA adaptor pre-signature verification in UltrafastSecp256k1 before 4.2.0 accepts forged adaptor pre-signatures whose r value is not cryptographically bound to the adaptor point T, allowing a malicious signing counterparty to produce a pre-signature that passes ecdsa_adaptor_verify even though it is not genuinely adaptable. This is an integrity-only cryptographic soundness flaw (CVSS 3.1 5.9, AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N) affecting deployments that use the library's ECDSA adaptor-signature path, such as atomic swaps, discreet log contracts, or payment channels. No public exploit code was identified at time of analysis, and it is fully fixed in 4.2.0.
Author-level cross-site scripting (XSS) in the Supreme Modules Lite (Supreme Modules for Divi) WordPress plugin affects all versions up to and including 2.5.63, allowing a user holding content-authoring privileges to store a script payload through the plugin's Divi module fields. When a higher-privileged user - typically an administrator - later loads the affected page or module, the injected JavaScript executes in their session context (CVSS 5.9, AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L; our assessment lowers the privilege bar to PR:L based on the 'Author' wording). Real-world risk is modest: exploitation demands a pre-existing account with at least Author-level rights, depends on both the plugin and the underlying Divi theme/builder being installed and active, and requires victim interaction, so no public exploit code has been identified at time of analysis. No entry exists in CISA KEV and no EPSS enrichment was supplied.
Unauthenticated denial of service affecting the WP Store Locator WordPress plugin in all versions before 3.0.0, where crafted requests trigger uncontrolled server-side resource consumption that can slow or take a site offline. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms a remote, unauthenticated attacker needs no user interaction, but the High attack complexity means the attacker must first identify and craft the specific request pattern - most likely against the plugin's store-search or map-data query handling - and typically repeat it at scale to exhaust resources; there is no confidentiality or integrity impact. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the issue is assessed as a genuine but moderate-priority availability risk rather than an emergency, with the practical exposure limited to sites whose affected plugin endpoint is publicly reachable.
Server-side request forgery in the Broken Link Notifier WordPress plugin (versions 1.3.1 up to but not including 2.0.0.1) allows unauthenticated remote attackers to bypass the plugin's internal-address filter and make the WordPress host send requests to internal services. The plugin validates the URL it is given but does not re-validate the destination after an HTTP redirect, so an attacker-supplied link that redirects to a loopback, RFC1918, or cloud metadata address slips past the SSRF guard. The issue is rated CVSS 3.1 5.8 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N) with scope change into internal services but only low confidentiality impact and no integrity or availability impact; no public exploit identified at time of analysis, and CISA's SSVC assessment records no exploitation with partial technical impact.
Information disclosure in the NVIDIA GPU Display Driver kernel-mode component (Windows and Linux) lets an authenticated local user read another process's GPU channel state, because the driver performs missing authorization checks (CWE-862) when a process requests channel state it does not own. The flaw is rated CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), so it requires a pre-existing local, low-privileged foothold and yields confidentiality impact only - no integrity or availability effect - and there is no public exploit identified at time of analysis. Practical risk concentrates on hosts where multiple security contexts share the same GPU, such as multi-user workstations, VDI, and cloud/virtual-GPU deployments; single-user desktops with one active GPU context gain little from this primitive, so the overall priority is low-to-moderate and locally scoped.
Local information disclosure in NVIDIA Display Driver for Windows and Linux allows an authenticated local user with low privileges to access another process's GPU channel state because the kernel-mode driver omits authorization checks. Affected platforms include NVIDIA GeForce, RTX/Quadro/NVS, and Tesla GPUs; the issue is rated CVSS 5.5 with high confidentiality impact but no integrity or availability impact. No public exploit was identified at time of analysis, and the practical risk is greatest in multi-user or multi-tenant GPU environments such as VDI and cloud-GPU deployments.
A NULL pointer dereference in the kernel-mode component of the NVIDIA GPU Display Driver for Windows allows a local attacker who can already execute low-privileged code on the host to crash the graphics kernel driver, taking down the display stack or bugchecking the whole machine. The flaw is confined to availability: per the assessed CVSS:3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, there is no network path, no user interaction, and no confidentiality or integrity impact, so it cannot be used for code execution, privilege escalation, or data disclosure. No public exploit code and no confirmed active exploitation were identified at time of analysis, and EPSS/KEV signals are absent; the practical risk is concentrated on multi-user, VDI, or cloud-GPU Windows hosts where an unprivileged tenant could repeatedly disrupt the machine, making this a genuinely low-to-moderate priority issue despite the ubiquity of the affected hardware.
Denial of service in the NVIDIA GPU Display Driver for Windows kernel module allows a local low-privileged user to trigger improper locking, potentially crashing or hanging the system. The vulnerability affects GeForce, RTX/Quadro/NVS, and Tesla product lines, but exploitation is limited to local access with existing low-level privileges and no user interaction, resulting in availability impact only. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS score is 5.5, making this a low-to-moderate priority issue despite the ubiquity of the driver.
Local, authenticated, low-privilege users on Linux hosts can cause a denial-of-service condition against the NVIDIA GPU Display Driver kernel-mode layer by repeatedly invoking an interface that emits unrate-limited error messages, leading to uncontrolled kernel log generation and resource exhaustion. Affected products include GeForce, RTX/Quadro/NVS, and Tesla GPU families running the Linux driver, as reflected in the NVIDIA CPE entries. Despite the moderate 5.5 CVSS score, this is a low-priority issue because exploitation requires local code execution with no remote or unauthenticated path, only availability is impacted, and no public exploit has been identified at time of analysis.