Stored cross-site scripting in the Schema & Structured Data for WP & AMP WordPress plugin (all versions before 1.67) lets an attacker holding the editor role or higher inject arbitrary JavaScript into schema fields that are saved without a capability check and rendered without output escaping. The injected script executes when a higher-privileged user, typically an administrator, opens the affected admin screen; exploitation is only possible on WordPress multisite installations, where editors do not hold the unfiltered_html capability, and the independent assessment additionally treats the scope as changed relative to the published CVSS 3.5 base score. There is no public exploit code identified at time of analysis, and CISA's SSVC evaluation records exploitation as none and automatable as no, which is consistent with the non-default multisite deployment, authenticated attacker position, and required victim interaction (CVSS:3.1/AV:N/AC:L/PR:H/UI:R, authenticated with high privileges).
Open redirect in the Safe Redirect Manager WordPress plugin before 2.3.0 lets unauthenticated attackers bounce a victim's browser to an arbitrary external site. Exploitation is not out-of-the-box: it requires a site administrator to have already configured a wildcard redirect rule whose destination is an absolute URL (the reason the assessed vector carries AC:H), and the victim must actively follow an attacker-crafted request path (UI:R). No authentication is needed by the attacker (PR:N) and impact is integrity-only (I:L), with no data disclosure or service disruption; no public exploit identified at time of analysis, and CISA's SSVC decision framework rates exploitation as 'none'.
Server-side request forgery in Kiteworks Core before 9.5.1 lets an authenticated administrator on a node with the separately licensed gateway role enabled supply a connector URL that the server fetches without adequately validating the URL scheme or destination, causing outbound requests to internal network services. Exploitation requires two prerequisites: a valid administrative session (CVSS PR:H) and an active optional gateway role, which is not a default configuration, and the resulting impact is constrained to limited confidentiality and integrity with no availability effect (CVSS 3.3, AC:H). No public exploit code has been identified at time of analysis and there is no evidence of active exploitation; the vendor has released a fixed version, 9.5.1, and the issue was reported through CISA's coordinated disclosure channel.
Authenticated project administrators in JetBrains YouTrack before 2026.2.19197 can read comments from projects they do not administer by exploiting a notification-template authorization bypass. This network-exploitable flaw requires an account with project-administrator privileges and no user interaction, resulting in a high-confidentiality impact with a scope change (CVSS 7.7). No public exploit or active exploitation has been identified at time of analysis.
JetBrains YouTrack before 2026.2.19197 contains a broken access control vulnerability (CWE-862) that allows authenticated users with low privileges to read information from projects they are not authorized to access via several endpoints lacking authorization checks. The flaw requires a valid account and impacts only confidentiality; no data modification or privilege escalation is possible. It is rated low severity (CVSS 2.7) and no public exploit has been identified at time of analysis.
Stored SMTP credentials in JetBrains YouTrack can be exposed to an already-authenticated administrator by changing the configured SMTP server host, affecting versions before 2026.2.18991. The issue is rated CVSS 2.7 (AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N), so confidentiality impact is limited and exploitation requires high-privilege access - in practice an insider or an attacker who has already compromised an admin account in an instance where outbound email/notification delivery is configured. A vendor patch is available, and no public exploit has been identified at time of analysis.
Authenticated users on Moodle instances with the AI image-generation web service enabled can bypass capability checks to invoke the feature without proper authorization, leading to unauthorized use of AI image generation. This low-severity authorization flaw (CWE-425) requires a valid Moodle account but not the specific capability normally required, and the AI subsystem must be configured; it enables quota/cost abuse but no data disclosure or code execution. No public exploit code or active exploitation is known at time of analysis, and the assessed CVSS is 2.7 with PR:L.
JetBrains YouTrack before 2026.2.19197 can disclose integration credentials to an authenticated user who holds the low-level Admin Read permission through import configurations, allowing that user to view secrets that should remain restricted. The flaw is CWE-863 incorrect authorization with a vendor CVSS score of 3.3 (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N), and the independent assessment further narrows impact to confidentiality only (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N). Exploitation requires high privileges, high attack complexity, and a vulnerable instance that has integrations with stored credentials; no public exploit identified at time of analysis, and vendor-released patch 2026.2.19197 is available, so real-world urgency is low.
Content injection in Astra WordPress Theme 4.13.12 and earlier allows an authenticated WooCommerce Shop Manager to insert untrusted markup or script content into affected pages. The flaw is network-reachable and low-complexity but requires high privileges and an active WooCommerce installation, yielding only limited integrity impact with no confidentiality or availability loss; CVSS is 2.7. No public exploit identified at time of analysis, and it is not confirmed actively exploited (CISA KEV).
Moodle user-list filters do not enforce the same profile-field visibility restrictions that are applied when a profile is viewed directly, so an authenticated user holding manager privileges can filter user listings on hidden profile attributes and infer their values from the results returned. The issue is low severity, assessed at CVSS 3.1 base score 2.7 (AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N), and is limited to information disclosure - there is no integrity or availability impact and no code execution path. The elevated manager role is the gating prerequisite, so the flaw is not reachable by anonymous visitors or ordinary authenticated users, and no public exploit code has been identified at time of analysis.
Missing authorization checks in the Media Library Organizer WordPress plugin versions 2.0.4 through 2.1.3 allow authenticated users holding a contributor-level account (or higher) to create publicly visible terms in any taxonomy registered on the site, including ones they have no management rights over. The flaw is a CWE-862 missing capability check that is exercised over the network without user interaction, but it requires a valid low-privileged WordPress account and produces only a limited integrity impact - no confidentiality or availability loss - so despite the 'Authentication Bypass' tag this is a low-severity finding (assessed CVSS 2.7) with no public exploit identified at time of analysis and no listing in CISA KEV; CISA SSVC rates exploitation as none and not automatable. Vendor-released patch: 2.1.4.
SQLCipher before 4.15.0 contains a local SQL injection in the sqlcipher_export() convenience function when a host application passes an attacker-influenced source database name. A crafted source name can bypass defensive restrictions, execute normally blocked statements, and modify the sqlite_schema table, leading to database corruption; confidentiality is not affected and decryption is not exposed. The independent assessment rates this as a low-real-risk issue despite being a genuine CWE-89 SQL injection, requiring the specific code path of sqlcipher_export with untrusted input; no public exploit identified at time of analysis and no CISA KEV active exploitation is present in the provided data, and SQLCipher 4.15.0 fixes the issue by validating the source database name.
Credential-precedence handling in Claude Code causes the CLI to request an organization's server-managed settings with a locally stored API key instead of the user's authenticated Claude Enterprise or Team session, so when that key is rejected the session starts without the organization's policy - permission deny rules, model restrictions and managed-only locks go unenforced - or keeps applying a stale cached policy while still operating as the organization account. Only organizations that use server-managed (cloud policy) settings are affected: Claude for Enterprise from version 2.0.68 and Claude for Work (Team) from version 2.1.38, and the issue requires local access to a device where an API key was previously persisted via /login or written directly into the configuration (PR:L), with the complete policy-loss case additionally requiring that no managed settings were ever cached on that machine. Severity is low (CVSS 4.0 base 2.0; local, integrity-only, no confidentiality or availability impact), endpoint-managed MDM or file-based settings are not affected, and no public exploit identified at time of analysis.
Authenticated SQL injection in SourceCodester Online Leave Management System 1.0 allows a user holding an administrator session to inject arbitrary SQL through the date_start and date_end parameters of the reporting page at /admin/?page=reports, enabling read and modification of backend database contents. Exploitation is remote over the network with no user interaction and no non-default configuration, but the CVSS 4.0 vector (PR:H) and the independent assessment (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L) both confirm that the attacker must already hold high privileges, which caps the real-world severity at the low end (CVSS 4.0 base 2.0) despite SQL injection being a serious bug class in general. No CISA KEV entry exists; however, publicly available exploit code exists (the CVSS 4.0 vector carries E:P and the description states the exploit is public), so administrators of exposed instances should treat the flaw as practically exploitable by anyone who has already obtained admin credentials.
Cross-site scripting (XSS) in the MediaWiki MediaSearch extension (versions 1.46, 1.45, and 1.43) allows an authenticated user to inject script-related HTML into the media search interface, which executes in the browser of a victim who passively interacts with the crafted content. The vulnerability requires the MediaSearch extension to be installed and enabled, and impact is limited to low confidentiality and integrity with no server-side code execution. No public exploit code has been identified at the time of analysis, and the CVSS 4.0 score is 1.2; an upstream fix is available via Gerrit change I79e8200289bd120c3c971ba830776eaae779bb99.
Information disclosure in the MediaWiki PageTriage extension (versions 1.43, 1.45, and 1.46) allows an authenticated, low-privileged user to elicit restricted data through the extension's data-query interface. Exploitation requires a specific precondition (AT:P) and passive user interaction (UI:P), and the impact is limited to low confidentiality loss with no effect on integrity or availability; no public exploit identified at time of analysis. The Wikimedia Foundation has published an upstream fix via Gerrit, and this is a low-priority issue that does not warrant urgent action.
Stored cross-site scripting in the MediaWiki Page Forms extension (versions 1.43, 1.45, and 1.46) lets an authenticated user who can submit or edit Page Forms content plant script-related HTML that executes in the browser of any other user who later views the affected page. Exploitation is high-friction: the attacker must hold a valid MediaWiki account with form-edit privileges, stored payloads only fire when a second user opens the poisoned page, and the late-breaking CVSS 4.0 score is only 1.2 while our independent assessment rates confidentiality and integrity impact Low with no availability impact. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (no CISA KEV listing); realistic harm depends on luring a higher-privileged user to view the tainted page.
Cross-site scripting in the MediaWiki CommonsMetadata extension (versions 1.43, 1.45 and 1.46) allows an authenticated editor who can write attacker-controlled content into file/media metadata to plant script-related HTML that executes when another user views the rendered page, giving low confidentiality and integrity impact confined to the victim's browser session. The root cause is CWE-80 (improper neutralization of script-related HTML tags), and the vendor's CVSS v4 score of 1.1 reflects high privileges (PR:H), an attack requirement (AT:P) and passive user interaction (UI:P), with a proof-of-concept-level exploit maturity metric (E:P) rather than any observed attacks. The independent assessment agrees this is a low-priority, low-real-risk issue that requires the optional extension to be installed and a victim to subsequently view the injected page; no CISA KEV listing or other confirmation of active exploitation appears in the available data, and Wikimedia has published both a tracking task and an associated Gerrit change addressing the flaw.
Reflected cross-site scripting in the MediaWiki ReadingLists extension (versions 1.45 and 1.46) lets an authenticated user with access to the extension inject script-related HTML into a page through a crafted URL parameter that is echoed back unsanitized. Because the flaw is reflected rather than stored, an attacker must lure a separate logged-in victim into following the malicious link, and any script executes only within that victim's browser session - there is no server-side compromise. This is a low-priority issue despite being network-reachable: no public exploit code has been identified at time of analysis, exploitation is blocked on wikis that do not have the extension or have applied the upstream fix, and the attack is further constrained by the requirement that the victim actively follow the crafted URL.
Stored cross-site scripting (XSS) in the MediaWiki WikiForum extension allows an authenticated attacker holding a privileged forum role to plant script-related HTML that executes in the browser of any user who later views the manipulated forum page. The flaw is rooted in improper neutralization of script-related HTML tags (CWE-80) within WikiForum-managed fields on the master branch, and successful exploitation demands both elevated WikiForum permissions and victim interaction, which is why the vendor assigns it a very low CVSS 4.0 score of 1.1 and the independent assessment treats it as a low-priority issue. No public exploit code has been identified at time of analysis and the vulnerability is not confirmed actively exploited (not in CISA KEV), so the practical risk is primarily limited to wiki instances that run this optional extension.
Cross-site scripting (XSS) in the MediaWiki Collection (Book) extension affects versions 1.43, 1.45, and 1.46 and allows an authenticated low-privilege editor to inject script-related HTML into collection/book fields, which then executes when a separate victim interacts with the rendered page. The flaw targets non-script HTML elements (CWE-80), and exploitation is constrained by the requirement that the extension be installed and enabled, by the attacker needing editing access, and by mandatory victim interaction; the vendor assigns CVSS v4 base score 1.1 (CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/E:P). The supplied CVSS v4 vector's E:P metric indicates that publicly available exploit code exists, but there is no CISA KEV listing, and our independent CVSS v3.1 assessment (AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N) agrees this is low priority.
Cross-site scripting in the MediaWiki Wikbase (Wikibase) extension lets a privileged, authenticated contributor inject script-related HTML into wiki content that is subsequently rendered to other users visiting the affected page. The flaw affects installations running the extension on MediaWiki 1.46, 1.45, and 1.43, and requires both an attacker account with elevated rights and a victim who views the crafted page; independent assessment confirms a low-risk, basic XSS (CWE-80) with Low confidentiality, integrity, and availability impact, matching the very low vendor CVSS 4.0 score of 0.3. No public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV.
Cross-site scripting in the optional MediaWiki Wikistories extension (versions 1.46, 1.45 and 1.43) allows an attacker who can supply story content to embed script-related HTML tags that the extension fails to neutralize, so the injected markup executes in the browser of a victim who views the crafted story. The flaw is reachable only on MediaWiki installations that have explicitly installed and enabled the Wikistories extension - it is not part of a default MediaWiki deployment - and the vendor's CVSS 4.0 vector describes exploitation requiring high privileges (PR:H), victim interaction (UI:P) and an active-attack condition (AT:P), which sharply limits realistic exposure; there is no public exploit identified at time of analysis and impact is confined to low confidentiality, integrity and availability. The vendor-published CVSS 4.0 score is 0.3, and our independent CVSS 3.1 assessment (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) rates this a low-real-risk issue despite being an XSS-class flaw.
Algorithm::AhoCorasick::XS versions through 0.04 for Perl read the haystack string length before the scalar is stringified. The matches, first_match and match_details methods use the T_STD_STRING typemap to translate Perl scalars (SVs) into strings via the std::string constructor, using the SvPV macro to stringify the haystack input, and the SvCUR macro to determine the length of the SV. When the input SVs are references, integers (IVs) or floats (NVs), the SvCUR macro will return an invalid length if it is run before the input is stringified, leading to an out-of-bounds read which can abort the process. Note that the evaluation order of arguments to std::string is unspecified. Depending on the compiler, SvCUR may be run first and lead to an abort that cannot be caught within Perl. This can be triggered when the haystack is a numeric value, for example, my $ac = Algorithm::AhoCorasick::XS->new( [ "11", "22" ] ); $ac->matches( 211 ); This can occur when the haystack is the result of reading data from decoded JSON or a numeric database column. It can also be triggered when using a blessed object as a haystack.
Guest-to-host memory corruption in QEMU's QXL paravirtual display device (hw/display/qxl) stems from the primary surface stride not being validated against the declared surface width, allowing a guest that controls the QXL device to drive the host QEMU process into out-of-bounds memory access. The assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:H) reflects a scope-crossing guest-to-host impact with high confidentiality and availability loss and limited integrity impact, but exploitation requires the QXL display device to be attached and the attacker to already control code inside the guest at guest-kernel/driver level; headless, virtio-gpu, and VNC-only guests are not exposed. Reported by the Ubuntu vendor; no public exploit has been identified at time of analysis.
Out-of-bounds write in QEMU's emulated VGA display adapter can be triggered when a guest switches the display away from a graphics surface and then invokes text-mode rendering, corrupting memory that belongs to the host-side QEMU process. The assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) describes a local, low-privileged attacker who already has code execution inside the guest and can program VGA I/O ports or MMIO; the scope change (S:C) reflects that the faulty code runs in the hypervisor process, so a successful trigger can break the guest isolation boundary and affect the confidentiality, integrity and availability of QEMU and potentially the host. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and the input data does not confirm a specific released patched version.
QEMU xHCI emulation can allow a guest with low privileges and access to the emulated USB 3.0 host controller to trigger reentrant timer callbacks, resulting in a host-side QEMU crash or limited scope-changing effects rather than reliable remote code execution. The affected component is QEMU's hw/usb/hcd-xhci emulation, but the provided input contains no exact version range, CPE, or advisory link; Ubuntu is the reporting vendor. No published CVSS score, EPSS, KEV listing, or public exploit was provided, so the independent assessment estimates CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:H, and no public exploit identified at time of analysis. Exploitation requires a guest configured with emulated xHCI and the ability to drive the controller's registers or timers; it does not apply to VMs using USB passthrough only or to VMs without an emulated xHCI controller.
QEMU's virtio-net Receive Segment Coalescing (RSC) path mishandles short, padding-bearing TCP segments and fails to strip trailing padding before caching a coalesced segment, allowing crafted traffic to fault the host-side QEMU process and deny service to the guest it serves. The independently assessed vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H) describes a remote, unauthenticated trigger with high attack complexity, no confidentiality or integrity impact, and a scope-changed high availability impact on the hypervisor, which is more severe than a guest-local crash because the QEMU process also backs the VM's other devices. Exploitation is gated by the guest negotiating RSC (VIRTIO_NET_F_GUEST_RSC/RSC_EXT) - typically Windows guests with LRO/RSC offload enabled, whereas many Linux guests do not negotiate it by default - and by the attacker's ability to deliver a crafted sequence of padded segments, so the affected population is a subset of virtio-net users. No vendor CVSS score, EPSS value, CISA KEV entry, or public proof-of-concept was supplied with this report, and no public exploit has been identified at time of analysis.
Device teardown of a QEMU virtio-balloon instance with free-page hinting engaged can leave a still-scheduled free-page bottom half that subsequently executes against freed state, crashing the QEMU process and taking the associated guest offline (availability-only impact). The exposure is constrained: the assigned assessment vector is CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H, meaning the trigger requires local low-privileged access in a high-complexity, timing-dependent race, with scope change reflecting the guest-to-QEMU-process boundary, and no impact to confidentiality or integrity. Affected are QEMU-based virtual machines configured with a virtio-balloon device (free-page hinting path) that is subsequently unrealized, e.g. via device hot-unplug or VM/device teardown; the reporting vendor is Ubuntu, which is tracking the issue. There is no public exploit identified at time of analysis, and no CVE-specific CVSS, CWE, EPSS, KEV, or POC data was supplied, so the severity framing here derives from the independent assessment rather than vendor-confirmed metrics.
QEMU's socket-backed I/O channel implementation (io/channel-socket) mishandles a zero-length write by treating it as an error, which can error out or tear down an otherwise healthy socket-backed I/O path. The assessed vector is local, high-complexity, low-privilege (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L), so impact is confined to availability of a channel such as a TCP/UNIX socket chardev, a socket network backend, or the migration transport, with no confidentiality or integrity effect. The CVE record itself carries no CVSS score, no CVSS vector and no CWE, no public exploit code has been identified at time of analysis, and the issue is reported by vendor:ubuntu rather than being confirmed actively exploited (CISA KEV).