Denial of service in NVIDIA GPU Display Driver for Linux arises when a local authenticated low-privileged user exhausts the DRM VMA offset address space, causing uncontrolled resource consumption in the kernel mode layer. The issue is limited to Linux and to availability impact; exploitation requires an existing local foothold and cannot provide code execution, privilege escalation, or data disclosure. No public exploit was identified at time of analysis, and the assessed risk is low, though shared or multi-tenant GPU systems such as VDI, cloud GPU, and Tesla/vGPU deployments face the greatest practical disruption.
Kernel memory exhaustion in the NVIDIA GPU Display Driver for Linux allows a local, unprivileged user to repeatedly drive error-handling paths in the driver's kernel-mode layer so that leaked allocations accumulate until kernel memory is depleted, resulting in a denial of service on the affected host. The flaw (CWE-401) affects the Linux display driver across the GeForce, RTX/Quadro/NVS and Tesla product lines, including vGPU guest-driver and Virtual GPU Manager deployments, and is local-only, requiring an existing low-privileged account (AV:L/PR:L) with no user interaction and causing availability-only impact (C:N/I:N/A:H). No public exploit code and no CISA KEV entry were identified at time of analysis, so exploitation requires an attacker who already holds a shell on the box and can sustain repeated triggering; the practical risk concentrates on shared, multi-tenant GPU hosts (vGPU, VDI, cloud GPU) where one tenant's resource exhaustion degrades every other workload on the same kernel.
Local denial of service in the NVIDIA GPU Display Driver for Linux lets any unprivileged user on the host trigger a NULL pointer dereference (CWE-476) inside the driver's kernel-mode layer, crashing or destabilising the graphics kernel component (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base score 5.5). The flaw spans NVIDIA's GeForce, RTX/Quadro/NVS and Tesla product lines and is bounded strictly to availability impact - there is no confidentiality or integrity loss and no path to privilege escalation - so the practical blast radius is limited to disrupting the machine, and is materially more serious only on multi-tenant or shared-GPU hosts (VDI, cloud GPU) where one low-privilege user's crash affects other tenants. Exploitation requires local access with a normal, non-privileged account and direct interaction with the driver's kernel interface; no public exploit identified at time of analysis, and the issue is not listed as confirmed actively exploited (CISA KEV).
Local attackers with low-privileged access can read uninitialized kernel memory from NVIDIA GPU Display Drivers on Windows and Linux, leading to information disclosure. The flaw resides in the kernel-mode driver and requires an existing account on the target system (CVSS 3.1: AV:L/PR:L, 5.5 Medium). No public exploit code or active exploitation has been identified at time of analysis.
NULL pointer dereference in the NVIDIA GPU Display Driver kernel module for Linux allows an authenticated local attacker to crash the driver, resulting in denial of service. Affected products include GeForce, RTX/Quadro/NVS, Tesla, and Guest Driver (vGPU) product lines. Exploitation requires an unprivileged local account (CVSS vector AV:L/PR:L) and yields only denial of service with no confidentiality or integrity impact; no public exploit has been identified at time of analysis.
Denial of service in NVIDIA Display Driver on Windows and Linux allows a local low-privileged attacker to crash the kernel-mode driver by triggering a divide-by-zero condition. Affected product branches include GeForce, RTX/Quadro/NVS, Tesla, and Virtual GPU Manager builds prior to the fixed versions in NVIDIA bulletin 5861, with impact limited to availability and no public exploit identified at time of analysis.
Local denial of service in NVIDIA GPU Display Driver for Linux lets a logged-in user or a low-privileged process with GPU device access (PR:L, confirmed via CVSS vector) crash the kernel mode driver by submitting a crafted ioctl that triggers a NULL pointer dereference (CWE-476), rated CVSS 5.5 Medium. Impact is availability-only - the assessed vector shows C:N/I:N/A:H, so no privilege escalation, code execution, or data exposure is achievable, and the attack is strictly local, not remotely reachable. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS score was supplied for this CVE.
Denial of service in NVIDIA GPU Display Driver for Windows arises from excessive kernel stack consumption in the kernel-mode color transform path when evaluating YCbCr420 display emulation, leading to a stack-based buffer overflow (CWE-121). A local attacker with low privileges (PR:L per the CVSS vector) can crash the system, but there is no impact to confidentiality or integrity. No public exploit code or active exploitation has been identified at time of analysis, and the moderate CVSS 5.5 reflects the local, DoS-only nature, making this a low-priority issue.
Denial of service in the NVIDIA GPU Display Driver for Windows and Linux arises from improper access control (CWE-862) in the kernel-mode layer, where a local user with a low-privileged account can invoke a driver interface they should not be authorized to reach and thereby crash or hang the affected system. Impact is limited to availability: with the assessed vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (base 5.5, Medium), exploitation requires pre-existing local authenticated access on a host running an affected driver branch - GeForce, RTX/Quadro/NVS, Tesla, or the vGPU Guest Driver/Virtual GPU Manager - and no remote path exists. No public exploit code has been identified and there is no confirmed active exploitation (no CISA KEV listing), and no code execution, privilege escalation, or data disclosure is achievable, making this a low-to-moderate operational priority that is chiefly relevant to multi-user, VDI, and shared-workstation environments.
Stored/DOM cross-site scripting in the JetEngine WordPress plugin (Crocoblock / Jetimpex) affects all versions up to and including 3.8.14.3, allowing an authenticated Subscriber-level user to inject markup that executes in the browser of a higher-privileged victim who views or interacts with the affected content. Rated CVSS 5.5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L), exploitation requires valid low-privilege credentials plus victim interaction, and the high attack complexity means additional non-trivial conditions must align for the payload to fire, limiting reliable exploitation. No public exploit code has been identified at the time of analysis, and the issue has not been confirmed as actively exploited.
Kiteworks Core versions before 9.5.1 fail to apply gateway-level API security controls to every request authenticated through the central authentication service, enabling an authenticated attacker to access REST API functionality on an unprotected path even with a revoked or signed-out session. This CWE-420 unprotected alternate channel yields low confidentiality and integrity impact (CVSS 5.4) and requires a valid authenticated session (PR:L). No public exploit code has been identified at time of analysis.
Improper authorization in JetBrains YouTrack allows an authenticated, low-privileged user to change a knowledge-base article's visibility settings even though that account does not hold the article update permission. Only instances running versions before 2026.2.18991 are affected, and the impact is limited to low confidentiality and low integrity with no availability impact (CVSS 5.4, AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N). No public exploit code has been identified at time of analysis, and there is no indication of confirmed active exploitation (CISA KEV); the vendor has released a fixed build, making this a modest-severity broken access control issue rather than a top-tier priority.
Stored cross-site scripting in Moodle's forum post rendering templates allows an authenticated user with forum posting rights - typically any enrolled student or participant - to embed malicious markup in a forum post that executes in the browser of another user who views that post. Exploitation requires a valid low-privileged account (CVSS PR:L) plus victim interaction (UI:R), so it is not self-contained and depends on a second user opening the affected discussion; impact is confined to the victim's browser session, with partial confidentiality and integrity loss and no availability impact (moderate severity, CVSS 3.1 base 4.6). There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, but upstream fix commits referencing MDL-88981 are already public, which lowers the effort needed to reproduce the issue.
A heap/stack buffer overflow in the GPAC DASH client's URL resolution routine (gf_dash_resolve_url in src/media_tools/dash_client.c) lets a remote attacker corrupt memory by supplying a crafted DASH presentation whose initialization segment resolves to a scheme-prefixed gmem://blob URL, which is then written into an undersized output buffer. All GPAC builds up to and including 26.07.0 that exercise the DASH client path are affected; the attacker cannot reach the flaw unless a victim opens or streams the malicious DASH content (user interaction required) and no authentication is needed, with impact limited to low confidentiality, integrity and availability loss. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; the vendor has released abi-16.26 plus the upstream fix commit 4c8e26f278ff63eec57968f7bc696f604bb0cffd, making this a moderate, low-priority-by-signal issue.
Uncontrolled recursion in GraphicsMagick's WordPerfect Graphics (WPG) decoder (ExtractPostscript in coders/wpg.c) lets remote attackers crash image-processing workers by supplying a crafted WPG file; confidentiality and integrity are unaffected, making this a low-severity availability issue. All releases through 1.3.47 are affected per EUVD, and exploitation is unauthenticated but requires the victim or an automated pipeline to actually parse the malicious file (CVSS UI:P). No public exploit code or active exploitation has been identified at time of analysis, and the vendor has published a fix as commit 627b5b1b2fc2.
Cross-site request forgery (CSRF) in the Supsystic Photo Gallery WordPress plugin through version 1.21.0 allows remote, unauthenticated attackers to make a logged-in administrator perform unintended state-changing actions within the plugin, such as modifying gallery settings or content, by tricking them into visiting a malicious page. Exploitation requires the victim to be authenticated and socially engineered into interacting with the attacker's page (UI:R), but the attacker needs no credentials (PR:N), and the impact is limited to low integrity and availability. No public exploit code has been identified, and no vendor patch is available at time of analysis.
Cross-site request forgery (CSRF) in Razorpay Payment Links for WooCommerce versions 2.1.5 and earlier allows unauthenticated attackers to perform state-changing actions under an authenticated victim's session. Exploitation requires the victim to visit a malicious page or click a crafted link while logged into the WordPress site (UI:R), and the attack's success depends on the victim's privileges and the absence of CSRF mitigations like nonces or SameSite cookies. No public exploit code or active exploitation has been identified, and the moderate CVSS score of 5.4 reflects low integrity and availability impact with no confidentiality impact.
Broken access control in The Events Calendar WordPress plugin through version 6.17.5 allows an authenticated Contributor-level user to perform actions that should be reserved for higher-privileged roles, resulting in low integrity and availability impact with no confidentiality loss. The flaw is network-reachable with low attack complexity and no user interaction required, but it hinges on the attacker already holding a valid Contributor (or higher) account, so sites that do not allow open Contributor registration or that tightly control low-privilege accounts are substantially less exposed. No public exploit code has been identified at time of analysis, the issue is not in CISA KEV, and the assessed severity is 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) - a genuine but low-to-moderate priority issue.
Broken access control in the WordPress plugin AllAble Connector (versions up to and including 0.13.4) lets an authenticated attacker holding only a low-privilege Subscriber account invoke functionality that should be restricted to higher-privileged users, resulting in partial loss of confidentiality and integrity (CVSS 5.4, CWE-862). Exploitation requires the attacker to already hold a Subscriber-level or higher account on a site running the vulnerable plugin - a bar that self-service registration on many WordPress sites meets - but needs no user interaction and is reachable remotely, per the assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. The flaw was reported by Patchstack; no public exploit code has been identified and there is no indication of confirmed active exploitation (not in CISA KEV), and the exact vulnerable endpoint has not been disclosed in the available data.
Stored cross-site scripting in the WordPress plugin pixfort Core affects every release before 4.3.3, letting an authenticated attacker with Contributor-level access plant script content that runs in a higher-privileged user's browser once that user views, previews, or moderates it. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, score 5.4) confirms the Contributor authentication barrier together with mandatory victim interaction, so the injected payload fires in an administrator or editor session rather than automatically - a scope-change condition that matters because the script executes with the victim's privileges. There is no indication of exploitation activity: no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS figure supplied with the source data, so this should be treated as a genuine-but-low-priority issue and handled through routine plugin update cycles.
Insecure direct object reference in the Business Directory WordPress plugin, affecting versions up to and including 6.4.27, lets an authenticated Contributor-level account manipulate an object identifier so the plugin returns or modifies directory records belonging to another user. The issue rates CVSS 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L, CWE-639): remote and low complexity, but gated on holding a valid low-privilege WordPress account (Contributor or higher), which excludes purely anonymous attackers, with impact bounded to low integrity and availability effects and no confidentiality loss. Exploitation status: no public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
WordPress sites running the WPFunnels Creator LMS plugin at version 1.2.19 or earlier expose an authenticated manipulation and disclosure weakness, where improper validation of a specified quantity value lets an attacker with a Subscriber-level account or higher read limited data and alter limited plugin content (CVSS 5.4, C:L/I:L/A:N). Exploitation is network-reachable, low complexity, and requires no victim interaction, but remains gated behind the low-privilege login prerequisite, which is trivial to satisfy on sites with open user registration. No public exploit code and no confirmed active exploitation were identified at time of analysis, and this is assessed as a genuinely low-priority issue despite the MEDIUM base score.
Authenticated IDOR in the WordPress plugin Flexible PDF Coupons (versions up to and including 1.14.11) lets a Contributor-level account manipulate object identifiers to act on coupon and PDF records it does not own. The vulnerability is network-reachable and low complexity, but requires a valid low-privilege WordPress account (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L, base 5.4), and per the assessed vector the impact is limited to low integrity and availability effects with no confidentiality disclosure. No public exploit identified at time of analysis; there is no CISA KEV listing and no EPSS signal was provided, and no vendor-released patch version was identified in the available data.
Grafana's dashboard creation API fails to authorize the file-provisioning annotations grafana.app/managedBy, grafana.app/managerId and grafana.app/sourcePath, so a user holding only the Editor role can create a dashboard that appears to be file-provisioned and is therefore no longer updatable or deletable by administrators through Grafana. Exploitation needs an authenticated account with at least Editor rights in the target organization (CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L, base 5.4) and affects default deployments with Editor users; the impact stays inside the attacker's own organization and no data is exposed, making it a management denial on the affected dashboard rather than a data-breach primitive. No public exploit identified at time of analysis.
OS command injection in the PFU Limited Image Scanner Driver for Linux (both the fi series and sp series packages) allows a user who already holds a valid login on the affected host to execute arbitrary operating-system commands, potentially at the privilege level of the driver or its helper processes. Exploitation is not remote and not trivial: the assessed vector (AV:L/AC:H/PR:L/UI:R) and the vendor's own wording that the attacker must make 'certain preparations' indicate that a local account plus staging of specific conditions, and possibly a triggering scan-related action by another user, are prerequisites. No public exploit identified at time of analysis and no CISA KEV listing was present in the supplied intelligence, so this is assessed as a genuinely moderate rather than high priority issue - the confidentiality, integrity and availability impact is high where it is successfully triggered, but the local-access and high-complexity gates sharply limit realistic exposure.
Partial denial of service in Kiteworks Email Protection Gateway before 9.5.1 is achievable by unauthenticated remote attackers who repeatedly invoke a server-side operation that is exposed without any authentication check (CWE-306), consuming disproportionate resources relative to the request. The impact is availability-only and limited (CVSS 3.1 5.3, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) - sustained repetition is required, so effectiveness depends on the gateway's resource headroom and any upstream rate limiting or network filtering. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; a vendor-released patch is available in version 9.5.1, and the issue is tracked as EUVD-2026-90268 with advisory GHSA-wwhf-5862-rjxq.
Stored cross-site scripting in AJA HELO Plus firmware before 2.1.7 lets an unauthenticated attacker with network access to the device's web configuration API write a malicious JavaScript payload into the eParamID_SystemName field via /config?action=set, which then executes in the browser of any administrator who opens the management interface. The write path is only reachable when device authentication is disabled, making that an operator-chosen configuration the primary gating condition, and successful exploitation requires a victim administrator to load the interface (UI:P passive interaction). Impact is limited to hijacking the authenticated session and exfiltrating stored secrets - web UI credentials, RTMP stream keys, publish URLs, and NFS/SMB share credentials - rather than code execution on the device itself; no public exploit identified at time of analysis, and the vendor has released firmware 2.1.7 as the fix.
HTTP request smuggling in libsoup's SoupServer - as shipped in Red Hat Enterprise Linux 6, 7, 8, 9, and 10 - allows remote, unauthenticated attackers to have an attacker-controlled HTTP request processed as an unintended subsequent request on a keep-alive connection. The issue triggers when an HTTP/1.x client sends 'Expect: 100-continue' with a declared body and the SoupServer-based application issues an early final (non-1xx) response before that body is read; SoupServer then neither drains the body bytes nor closes the connection, so the leftover bytes are parsed as the next request. Rated CVSS 3.1 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), the flaw carries limited integrity impact on request handling while leaving confidentiality and availability unaffected, and it is inert unless the specific combination of keep-alive, a declared body, and an early final response is present. No public exploit code and no confirmed active exploitation were identified at time of analysis.
Stale authentication material tied to JetBrains YouTrack's mailbox integration continues to be accepted after a user's password reset in versions prior to 2026.2.18991, letting an actor who already holds the pre-reset credentials keep authenticating through that path when the reset should have invalidated them. The flaw is limited to deployments that use the mailbox integration feature and to accounts that have actually undergone a password reset; the impact is integrity-only (no confidentiality or availability effect), and the assessed complexity is higher than the base 5.3 vector implies because a preceding reset plus possession of the stale credentials are both required. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (CISA KEV); the vendor has released a fix.
Server-side request forgery in OpenClaw Windows Node through 2026.9.4 allows an attacker who already holds gateway or agent access to invoke the canvas.present capability and make the node's WebView issue requests to localhost, RFC1918 private ranges, link-local/cloud-metadata addresses, CGNAT and Tailscale (100.64/10) services from the user's machine - destinations that canvas.navigate would reject through its URL risk evaluation, which canvas.present bypasses entirely. The prerequisite is an authenticated control channel to the node (CVSS vector PR:L), so this is not exploitable by anonymous external attackers and yields only limited confidentiality and integrity impact (VC:L/VI:L, no availability impact); a prompt-injected but legitimately connected agent is a realistic delivery path. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, but it is a genuine, bounded SSRF risk in deployments that expose the gateway/agent channel. An upstream fix commit exists, though a tagged released version is not independently confirmed in the supplied data.
Unauthenticated sensitive data exposure in the Multiple Pages Generator (MPG) WordPress plugin from Themeisle, affecting versions 4.2.3 and earlier, allows any remote visitor to read information the plugin includes in its HTTP responses without authenticating or interacting with the site (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, base score 5.3). The consequence is confined to partial confidentiality loss - no integrity or availability impact - making it an information-gathering aid that could support follow-on attacks rather than a direct compromise vector. No public exploit code has been identified at time of analysis, and the flaw has not been confirmed as actively exploited (CISA KEV).
Decodable credential storage in Itron MV-90 xi 3.0 lets an attacker who can read the product's configuration file recover stored passwords and password histories and then log in to MV-90 as any user, including privileged accounts. The attack is local, not remote: the assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) requires prior access to the host and a low-privileged account or equivalent filesystem read permission on the config file, after which no user interaction is needed, making this a privilege-escalation and lateral-movement primitive rather than an initial-access flaw. No public exploit has been identified at time of analysis (CISA SSVC records Exploitation: none), and the cross-vendor assessment rates technical impact as partial, so exploitation is opportunistic and contingent on the attacker already having a foothold with file-read access.
Authenticated users with only the read-only dashboard.user.view permission in bbs-go through 4.4.6 can reach the /api/admin/user/synccount endpoint because AdminMiddleware matches the view permission rule before the intended dashboard.user.update rule. Repeated calls trigger expensive full-table user recounts and cache invalidations, causing low-impact denial of service through concurrent database work. No public exploit was identified at time of analysis, and an upstream patch commit is available from the vendor.
An authorization bypass (IDOR, CWE-639) in the Pay with Vipps for WooCommerce WordPress plugin, versions through 6.2.4, lets an authenticated, logged-in user retrieve order or customer records belonging to other users by supplying a manipulated, user-controlled object key. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N) shows the attacker must already hold a valid account (PR:L), that no user interaction is needed, and that the impact is limited to low confidentiality loss with no integrity or availability effect. Our independent assessment (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) rates this as moderate-severity and low real-world risk, confined to WooCommerce stores that actually use the Vipps payment method; no public exploit identified at time of analysis.
The Vaadin Spreadsheet component fails to enforce sheet protection when writing cell comments, so any authenticated user of an application that renders a spreadsheet can insert or overwrite comments on a protected sheet - including on cells that are explicitly locked - and can write a comment to a cell that does not yet exist, which creates the underlying row and cell. Only logged-in users of the host application are affected (CVSS v4.0 base 5.3; independent assessment CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), and the impact is confined to spreadsheet integrity: no confidentiality or availability impact, no user interaction, and low attack complexity. Exploitation requires the Spreadsheet component to actually be rendered, sheet protection to be enabled, and a valid session; no public exploit code or CISA KEV entry is identified at time of analysis. Fixed releases (Vaadin 23.6.14, 24.9.22, 24.10.10, 25.1.12, 25.2.7 and Spreadsheet add-on 3.1.1) are available per the vendor advisory.
Account enumeration in Maksisoft Gym 0.5.10 (and later 0.5.x builds short of 0.5.11) lets unauthenticated remote attackers determine which usernames or email addresses correspond to real accounts by observing inconsistent responses from login, registration, or password-reset endpoints. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N scores 5.3, reflecting a network-reachable, no-authentication, no-interaction information-disclosure issue with confidentiality-only, low-severity impact - there is no direct account takeover, integrity, or availability effect. No public exploit code has been identified at time of analysis, and the issue is not confirmed actively exploited (not in CISA KEV); real-world exposure is further limited by the small, regionally concentrated deployment base and by the attacker's need to supply candidate identifiers to test.
Unauthenticated denial of service in the Two Factor WordPress plugin versions up to and including 0.16.0 allows remote attackers to degrade service availability. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) indicates a network-reachable, low-complexity attack requiring no authentication or user interaction, but with only low availability impact and no effect on confidentiality or integrity (base score 5.3). No public exploit identified at time of analysis; the vulnerability is tracked as CWE-770 (Allocation of Resources Without Limits or Throttling).
Unauthenticated insecure direct object reference (IDOR) in the RadiusTheme Review Schema WordPress plugin affects all versions up to and including 3.1.0, allowing remote attackers to reach plugin objects by manipulating an identifier without any login or user interaction. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms the flaw is network-reachable and unauthenticated, but the scope is narrow: only low-integrity modification (C:N/I:L/A:N), so the practical outcome is unauthorized alteration of the objects the IDOR exposes rather than data disclosure or site takeover. No confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, and no fixed version is specified in the available intelligence. Overall this is a moderate-severity, low-real-risk issue whose main uncertainty is the undocumented endpoint and parameter.
Unauthenticated sensitive data exposure in the Notivo WordPress plugin (woo-notification) through version 1.4.2 allows remote attackers to retrieve limited confidential information from affected sites without authentication or user interaction. The CVSS vector (PR:N/UI:N) confirms the issue is remotely exploitable on a default installation, but impact is confined to low confidentiality (C:L) with no integrity or availability effect. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and the plugin's narrow deployment footprint limits exposure relative to core WordPress.
Unauthenticated attackers can bypass a membership/access-control check in the WordPress plugin Paid Member Subscriptions (CozmoLabs) at versions 3.0.9 and earlier, allowing protected content or functionality to be reached without valid membership credentials. The CVSS 3.1 base score of 5.3 (Medium) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N confirms the attack is remote, low-complexity, requires no authentication or user interaction against a default installation, but is capped at a LOW integrity-only impact with no confidentiality or availability effect. Reported by Patchstack; no public exploit identified at time of analysis, and the flaw is not in CISA KEV.
Client Invoicing by Sprout Invoices versions up to and including 20.8.17 exposes an unauthenticated Insecure Direct Object Reference (IDOR) that lets a remote attacker read individual billing, invoice and client records simply by manipulating an object-identifier parameter. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, base score 5.3 Medium) confirms the flaw is remotely reachable with low complexity and no authentication or user interaction, although impact is limited to low-severity confidentiality loss with no integrity or availability effect. No public exploit code or confirmed active exploitation was identified at time of analysis; the issue was reported through Patchstack and affects any WordPress site running the plugin at or below version 20.8.17.
Unauthenticated remote attackers can exploit an insecure direct object reference (IDOR) in the GiveWP WordPress donation plugin through versions 4.16.9 and earlier to manipulate another entity's object without authorization. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, yielding a moderate 5.3 score; impact is limited to integrity, with no confidentiality or availability effect, and exploitation depends on enumerating or predicting valid object identifiers. No public exploit identified at time of analysis, and the exact vulnerable endpoint and parameter are not disclosed in the advisory.
Unauthenticated attackers can read appointment and booking records from WordPress sites running the Simply Schedule Appointments plugin at version 1.6.12.31 or earlier by manipulating object identifiers passed to the plugin's public-facing endpoints, an insecure direct object reference (IDOR) issue tracked as CVE-2026-94673. The flaw carries a CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N): no credentials, no user interaction, and only low-complexity remote requests are required, but impact is limited to confidentiality - data can be viewed, not altered or deleted. Exploitation is feasible against default configurations wherever the plugin is installed and its AJAX/REST endpoints are reachable; no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score was supplied, so real-world urgency is moderate rather than critical, with exposure bounded to the objects the vulnerable endpoint exposes rather than the whole site.
Pgpool-II writes sensitive cluster configuration and topology information into its log files, allowing an authenticated attacker who can read those logs to learn details about the PostgreSQL cluster. Exploitation requires a valid low-privilege account (CVSS vector PR:L, network reachable) plus read access to the log store, and the resulting impact is limited to confidentiality (C:L) with no integrity or availability effect. No public exploit code has been identified at time of analysis, and this rates as a low-to-moderate priority information-disclosure issue rather than a critical one.
Unauthenticated information disclosure in the Course Booking System WordPress plugin (versions 7.0 through before 7.0.9) lets any anonymous visitor download the full booking export, exposing the name, email address, and billing address of every customer who has booked a course. The flaw is an access-control gap in the plugin's export function (CWE-200), reachable over the network with no privileges or user interaction required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, 5.3). This is a genuine but moderate-severity exposure: impact is confined to confidentiality of already-collected booking PII, with no write capability or code execution, and there is no public exploit identified at time of analysis and no indication of active exploitation (CISA SSVC exploitation: none).
Unauthenticated information disclosure in the YayReviews WordPress plugin (all releases before 1.4.1, with the EUVD entry listing 1.0.4 as the earliest confirmed affected version) allows remote attackers to retrieve individual customer review records from an API route that enforces no access control, including reviews still awaiting moderation. Per the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, no authentication, user interaction, or non-default configuration is required - the only prerequisite is that the site runs a vulnerable version with the route reachable - and the consequence is bulk harvesting of reviewers' email addresses and other non-public review content, with no integrity or availability impact. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the CISA SSVC assessment records Exploitation: none while flagging the issue as Automatable: yes, so the realistic risk is low-to-moderate PII exposure proportional to the plugin's modest deployment footprint rather than site compromise.
Unauthenticated attackers can forge shipment-status webhook requests to the InPost PL WordPress plugin (versions 1.7.5 through before 1.9.8) and prematurely mark a target order as completed, provided they know that order's parcel tracking number. The webhook handler relies only on a non-secret identifier and an IP allowlist that is not actually enforced, so the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no credentials or user interaction are required; the practical limiting factor is knowledge of a valid tracking number, which scopes abuse toward specific known orders rather than untargeted mass exploitation. This is a low-severity access-control flaw (CWE-862, CVSS 5.3) with no data disclosure or service disruption, and no public exploit code or active exploitation is known at time of analysis (SSVC Exploitation: none; no CISA KEV entry).
Unauthenticated information disclosure in the Connections Business Directory WordPress plugin (versions through 10.4.67) allows remote attackers to read directory entries that should be restricted-including names, organizations, biographies, internal notes, and street addresses-because certain REST API read endpoints omit visibility and moderation-status checks. The plugin has been closed on WordPress.org and no fixed version is available, while no public exploit code has been identified at the time of analysis. The CVSS 3.1 base score of 5.3 reflects a network-reachable, low-complexity, unauthenticated confidentiality-only impact per the assessed vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.
Unauthenticated information disclosure in the New User Approve WordPress plugin before 3.2.10 lets remote attackers retrieve registered users' ID, username, email address and registration date via integration REST API routes that skip authentication checks while the integration remains unconfigured. The flaw carries a CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) and is rated moderate severity; no public exploit identified at time of analysis, and CISA's SSVC assessment records exploitation as none with automatable attack potential. Sites running affected versions 3.1.0 through 3.2.10 are exposed in the default unconfigured-integration state, whereas sites that have set up the integration are not affected.
Unauthenticated visitors can read the rendered content of non-published WordPress posts and pages - including drafts, pending, private, and scheduled items - on any site running the Solace Extra plugin before 1.7.2, because the plugin's front-end preview routes omit both authorization and post-status checks. Exploitation is trivial: no credentials, no user interaction, and no non-default configuration are needed (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), though impact is limited to confidentiality, bounded by whatever unpublished content exists on the target site and by what the preview routes can render. There is no public exploit code and no confirmed active exploitation (SSVC exploitation: none) at time of analysis, and a vendor fix is already available in 1.7.2, so this rates as a genuine but low-to-moderate priority information-disclosure issue rather than an emergency.