Stored cross-site scripting in the Bold Page Builder WordPress plugin (all versions up to and including 5.7.2) lets an authenticated attacker with Contributor-level access or higher plant arbitrary JavaScript in a page by abusing the 'target' attribute of the bt_bb_icon shortcode. The payload is persisted in the shortcode and executes in the browser of any user - including an administrator - who later views the injected page, allowing session theft, privilege escalation or site takeover. Exploitation requires a valid Contributor-or-higher account on a site running the plugin, and no public exploit code has been identified at time of analysis; severity is rated moderate (CVSS 6.4) because of the authentication prerequisite and the need for a victim to view the page.
Stored cross-site scripting in the Smart Slider 3 WordPress plugin (Nextend, CPE nextendweb:smart_slider_3) up to and including version 3.5.1.38 lets an authenticated attacker with contributor-level access or higher inject arbitrary JavaScript through the slider's 'data-href' parameter, which is then rendered unsanitized on pages and executes in the browser of any user who views the injected content. Scoring is CVSS 3.1 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N); the attack requires valid contributor credentials and is therefore not reachable by anonymous visitors, but no victim interaction is needed to plant the payload - only a subsequent page view by another user to trigger it. There is no CISA KEV entry and no public exploit identified at time of analysis, though the risk is meaningfully elevated on sites with open contributor registration or many low-trust editorial accounts, where the stored script can be aimed at higher-privileged users or site visitors.
Stored cross-site scripting in the HT Mega Addons for Elementor - Elementor Widgets & Template Builder WordPress plugin (all versions up to and including 3.1.1) lets an authenticated attacker with contributor-level access or higher inject arbitrary JavaScript into a page through the Data Table widget's 'display_options' setting. The payload is persisted and then executes in the browser of any visitor - including administrators - who views the affected page, and because the CVSS scope is changed (S:C), the injected script runs in the context of the site's origin rather than a sandboxed component. The primary limiting factor is the prerequisite of a pre-existing contributor-or-higher account, so realistically exposed sites are those that permit untrusted users to register or otherwise obtain contributor privileges; no public exploit code has been identified at time of analysis and the issue is not a confirmed actively exploited (CISA KEV) vulnerability.
Stored cross-site scripting in the Bold Page Builder WordPress plugin (all versions up to and including 5.7.2) allows authenticated users with Contributor-level access or higher to inject arbitrary JavaScript through the title attribute of the bt_bb_service shortcode, which then executes in the browser of any user who views the injected page. The weakness is insufficient input sanitization and output escaping on user-supplied shortcode attributes (CWE-79), rated 6.4 under CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N - a remote, unauthenticated-looking network vector that actually requires a low-privileged authenticated account, with scope change because the script runs in the context of the hosting page. There is no public exploit identified at time of analysis, and real-world exposure is limited to sites that hand Contributor accounts to untrusted users and have not moved past version 5.7.2.
Stored cross-site scripting in the Bold Page Builder WordPress plugin through version 5.7.2 allows authenticated users with Contributor-level access or higher to inject arbitrary JavaScript through the 'caption' attribute of the bt_bb_image shortcode, which executes when any user renders an affected page. The CVSS 6.4 moderate-severity issue was reported by Wordfence and requires the plugin to be installed and active; exploitation is persistent but is limited by the Contributor authentication requirement. Exploitation status: no public exploit identified at time of analysis, and no CISA KEV entry is provided in the intelligence.
Authentication bypass in Liquid-co OpenSave's WAN relay lets an unpaired room member impersonate a paired device and reach protected sync routes for save data, snapshots, and file operations. Any OpenSave instance running a version before 2.4.0-beta.1 with WAN relay sync enabled is affected; the attacker must already hold a valid 12-character room code, which is cryptographically generated and shared out-of-band, so exposure is realistically limited to people the room owner deliberately invited or whose code leaked, rather than the open internet. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the issue is resolved by the vendor's 2.4.0-beta.1 release, which adds end-to-end encryption over the relay plus single-use per-request proof of the pairing key.
OS command execution on a second appliance node is possible in multi-node (clustered) Kiteworks Core deployments running versions below 9.5.1, but only for an attacker who has already achieved code execution on another node in the same cluster. An unvalidated value submitted through an internal cluster interface is written into the monitoring configuration of a peer node, where it can be interpreted as an OS command running under an unprivileged service account. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV); the CVSS 3.1 score of 6.3 (AV:L/PR:L/S:C) reflects the strong prerequisites - local-adjacent access, existing low-privilege foothold, and a multi-node topology.
Server-side request forgery in the @astrojs/netlify adapter (5.2.0 through 8.2.3) lets unauthenticated remote attackers make the Netlify Image CDN fetch URLs whose host they control, by embedding an allowlisted origin inside the path or query string of a request to the public /.netlify/images endpoint. The impact is limited: Netlify egress protections restrict which internal or external targets are actually reachable and image-transformation handling prevents fetched response bodies from being returned to the attacker, so no confidentiality or integrity impact has been demonstrated and only low availability impact is assessed (CVSS 6.3 per the 4.0 vector; independent assessment CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L). No public exploit code has been identified at time of analysis, and the flaw is fixed in @astrojs/netlify 8.2.4.
An integer overflow in the blosclz decompression path of C-Blosc2 3.3.2 and earlier allows a remote attacker who can supply crafted compressed data to a program that calls blosclz_decompress to corrupt an output-buffer bounds computation, potentially causing memory corruption. Successful exploitation depends entirely on a consuming application accepting and decompressing attacker-influenced Blosc2/blosclz data, and the vendor characterizes the attack as high complexity and difficult; per the CVSS 4.0 vector the impact is Low across confidentiality, integrity, and availability and no privileges or user interaction are required. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, so this is assessed as a real but low-priority memory-safety defect; the vendor-released fix is version 3.3.3.
Deep-merge prototype pollution in Vaadin Charts and Vaadin Component Base lets remote, unauthenticated attackers write arbitrary properties onto JavaScript's Object.prototype whenever a Vaadin application merges an object it does not control into a chart configuration (e.g. updateConfiguration or a chart series config) or into a component's i18n property. Once injected, those properties are visible to every object in the running client-side application, degrading UI integrity and availability rather than exposing data or yielding direct code execution. Exploitation is conditional - the host application must actually route crafted input containing a __proto__ (or equivalent prototype) key into one of those two merge sinks - and no public exploit code has been identified at time of analysis, with no confirmed active exploitation (CISA KEV). Affected ranges are Vaadin 23.0.0-23.6.13, 24.0.0-24.9.20, 24.10.0-24.10.9, 25.0.0-25.1.11 and 25.2.0-25.2.6 across the Maven artifacts and the corresponding @vaadin/charts and @vaadin/component-base npm packages.
Subscriber privilege escalation in FluentBoards WordPress plugin versions up to 2.0.12 lets an authenticated low-privilege user elevate privileges within the plugin. Exploitation requires a valid Subscriber-level account, is remote and low-complexity, and can result in low confidentiality, integrity, and availability impact; sites with open registration are most exposed. No public exploit or CISA KEV active-exploitation confirmation was identified at time of analysis, making this a genuine but moderate-priority issue rather than a high-urgency one.
Stored cross-site scripting in MISP (all versions before 2.5.48) lets an authenticated account holding the perm_galaxy_editor permission - granted to the stock User role, so any ordinary user on a multi-user instance qualifies - persist arbitrary HTML or JavaScript in a galaxy's icon field via the galaxy add, edit, and sync/import capture endpoints. The stored value is later concatenated into markup by the D3-based correlation graph scripts of both the default and Overmind themes and inserted with jQuery's .html(), so any other user who opens the correlation graph of an event containing a cluster from the poisoned galaxy executes the attacker's script in their own MISP session, exposing session credentials and allowing actions or displayed-data tampering as that victim. Because exploitation requires editor privileges plus victim interaction (CVSS 4.0 6.2; independent assessment CVSS 3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), this is a genuine but moderate-risk stored XSS, and no public exploit identified at time of analysis, with no confirmed actively exploited (CISA KEV) status.
Stored cross-site scripting in MISP before 2.5.48 allows an authenticated user with galaxy editor privileges to persist a javascript: URI in a Galaxy Cluster's 'source' field, which the application then renders as a clickable hyperlink; when a victim views the affected cluster and clicks the link, embedded script executes in the victim's browser context, enabling session hijacking, data exfiltration, or unauthorized actions as the victim. The sync path is the key risk amplifier: because Galaxy Clusters propagate between federated MISP instances, an editor on any instance that synchronizes to the target can plant the payload, so the attack surface extends beyond a single local deployment. Exploitation requires both authenticated galaxy editor access (PR:L) and active victim interaction (the victim must click the rendered link, not merely load the page), and no public exploit code was identified at time of analysis; the vendor has released a fix in 2.5.48.
Stored HTML injection in JetBrains YouTrack before 2026.2.18991 allows unauthenticated remote attackers to plant attacker-controlled markup into the application through the User-Agent HTTP header, which is subsequently stored and rendered to other users without adequate output encoding. Impact is limited to Low confidentiality with a scope change and no integrity or availability effect; exploitation depends on user interaction (UI:R), as a user - typically an operator reviewing stored request or user-agent data - must open the affected page for the injected HTML to render. There is no public exploit identified at time of analysis, and the vendor has released a fix in version 2026.2.18991.
Reflected cross-site scripting (XSS) in Moodle's password reset page allows unauthenticated remote attackers to execute arbitrary script in a victim's browser by tricking them into opening a crafted password-reset link containing a malicious username. The flaw stems from insufficient sanitization of the username input and is assigned CVSS 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N). No public exploit code or active exploitation is known at the time of analysis; an upstream fix commit (MDL-88335) is referenced but a released patched version is not independently confirmed.
A heap buffer overflow in Mozilla Thunderbird occurs when a user opens an email message of 2GB or larger in size, allowing the overflowing write to corrupt memory and crash the client. The assessed CVSS vector (6.1, AV:L/AC:L/PR:N/UI:R) shows the attack is local and requires the victim to actively open the oversized message, with impact limited to availability (crash) and low integrity, and no confidentiality loss; no public exploit code or confirmed active exploitation (CISA KEV) is associated with this issue, and EPSS is low at 0.19% (8th percentile). The flaw is fixed in Thunderbird 157, and the real-world risk is further constrained because mail servers and gateways typically reject or truncate messages of that size before they ever reach the client.
Privilege escalation and potential code execution in the NVIDIA GPU Display Driver for Windows and Linux arise from an incorrect permission assignment (CWE-732) within a secure microcontroller component, allowing an attacker who already holds privileged local access to write to protected memory that should be restricted. Exploitation is gated by two strong prerequisites - the CVSS vector (AV:L/AC:H/PR:H/UI:N) requires local access with administrator/root-equivalent privileges and high attack complexity - so this is a genuine but lower-tier risk that primarily matters as a post-compromise escalation or persistence primitive rather than a standalone entry vector. Affected branches include GeForce (only Maxwell, Volta, and Pascal architecture GPUs), RTX/Quadro/NVS, and Tesla data-center drivers below the branch-specific fixed versions in NVIDIA bulletin 5861; there is no public exploit identified at time of analysis and no confirmed active exploitation (not in CISA KEV).
Kiteworks Core appliances that are mid-way through first-time activation expose an unauthenticated setup endpoint which enforces neither authentication (CWE-306) nor its intended state precondition, letting an unauthenticated, network-positioned attacker repeatedly re-trigger the privileged activation routine and drive the appliance into an incompletely configured state. The exposure is confined to the transient initial-activation window before the system is fully configured, so only newly deployed or re-provisioned appliances are at risk and the resulting impact is limited to setup integrity disruption - there is no confidentiality loss, no code execution, and no persistent takeover. No public exploit code or confirmed active exploitation has been identified at time of analysis (no CISA KEV listing), and vendor-supplied patching is available; practical priority is consequently LOW-to-MEDIUM despite the network-reachable, unauthenticated vector.
Denial of service in JetBrains YouTrack allows an unauthenticated remote attacker to exhaust server CPU and request-handling threads by sending crafted email content that triggers catastrophic regular-expression backtracking in mailbox mail-rule filters, affecting all releases up to 2026.2.19197. The impact is limited to availability (CVSS:C:N/I:N/A:H, base score 5.9); there is no confidentiality or integrity effect. Exposure is contingent on a non-default, operator-dependent configuration - the mailbox integration must be enabled with regex-based mail-rule filters - and there is no public exploit identified at time of analysis, so this is a genuine but modest-priority availability issue rather than a broadly exploitable one.
ECDSA adaptor pre-signature verification in UltrafastSecp256k1 before 4.2.0 accepts forged adaptor pre-signatures whose r value is not cryptographically bound to the adaptor point T, allowing a malicious signing counterparty to produce a pre-signature that passes ecdsa_adaptor_verify even though it is not genuinely adaptable. This is an integrity-only cryptographic soundness flaw (CVSS 3.1 5.9, AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N) affecting deployments that use the library's ECDSA adaptor-signature path, such as atomic swaps, discreet log contracts, or payment channels. No public exploit code was identified at time of analysis, and it is fully fixed in 4.2.0.
Author-level cross-site scripting (XSS) in the Supreme Modules Lite (Supreme Modules for Divi) WordPress plugin affects all versions up to and including 2.5.63, allowing a user holding content-authoring privileges to store a script payload through the plugin's Divi module fields. When a higher-privileged user - typically an administrator - later loads the affected page or module, the injected JavaScript executes in their session context (CVSS 5.9, AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L; our assessment lowers the privilege bar to PR:L based on the 'Author' wording). Real-world risk is modest: exploitation demands a pre-existing account with at least Author-level rights, depends on both the plugin and the underlying Divi theme/builder being installed and active, and requires victim interaction, so no public exploit code has been identified at time of analysis. No entry exists in CISA KEV and no EPSS enrichment was supplied.
Unauthenticated denial of service affecting the WP Store Locator WordPress plugin in all versions before 3.0.0, where crafted requests trigger uncontrolled server-side resource consumption that can slow or take a site offline. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms a remote, unauthenticated attacker needs no user interaction, but the High attack complexity means the attacker must first identify and craft the specific request pattern - most likely against the plugin's store-search or map-data query handling - and typically repeat it at scale to exhaust resources; there is no confidentiality or integrity impact. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the issue is assessed as a genuine but moderate-priority availability risk rather than an emergency, with the practical exposure limited to sites whose affected plugin endpoint is publicly reachable.
Server-side request forgery in the Broken Link Notifier WordPress plugin (versions 1.3.1 up to but not including 2.0.0.1) allows unauthenticated remote attackers to bypass the plugin's internal-address filter and make the WordPress host send requests to internal services. The plugin validates the URL it is given but does not re-validate the destination after an HTTP redirect, so an attacker-supplied link that redirects to a loopback, RFC1918, or cloud metadata address slips past the SSRF guard. The issue is rated CVSS 3.1 5.8 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N) with scope change into internal services but only low confidentiality impact and no integrity or availability impact; no public exploit identified at time of analysis, and CISA's SSVC assessment records no exploitation with partial technical impact.
Information disclosure in the NVIDIA GPU Display Driver kernel-mode component (Windows and Linux) lets an authenticated local user read another process's GPU channel state, because the driver performs missing authorization checks (CWE-862) when a process requests channel state it does not own. The flaw is rated CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), so it requires a pre-existing local, low-privileged foothold and yields confidentiality impact only - no integrity or availability effect - and there is no public exploit identified at time of analysis. Practical risk concentrates on hosts where multiple security contexts share the same GPU, such as multi-user workstations, VDI, and cloud/virtual-GPU deployments; single-user desktops with one active GPU context gain little from this primitive, so the overall priority is low-to-moderate and locally scoped.
Local information disclosure in NVIDIA Display Driver for Windows and Linux allows an authenticated local user with low privileges to access another process's GPU channel state because the kernel-mode driver omits authorization checks. Affected platforms include NVIDIA GeForce, RTX/Quadro/NVS, and Tesla GPUs; the issue is rated CVSS 5.5 with high confidentiality impact but no integrity or availability impact. No public exploit was identified at time of analysis, and the practical risk is greatest in multi-user or multi-tenant GPU environments such as VDI and cloud-GPU deployments.
A NULL pointer dereference in the kernel-mode component of the NVIDIA GPU Display Driver for Windows allows a local attacker who can already execute low-privileged code on the host to crash the graphics kernel driver, taking down the display stack or bugchecking the whole machine. The flaw is confined to availability: per the assessed CVSS:3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, there is no network path, no user interaction, and no confidentiality or integrity impact, so it cannot be used for code execution, privilege escalation, or data disclosure. No public exploit code and no confirmed active exploitation were identified at time of analysis, and EPSS/KEV signals are absent; the practical risk is concentrated on multi-user, VDI, or cloud-GPU Windows hosts where an unprivileged tenant could repeatedly disrupt the machine, making this a genuinely low-to-moderate priority issue despite the ubiquity of the affected hardware.
Denial of service in the NVIDIA GPU Display Driver for Windows kernel module allows a local low-privileged user to trigger improper locking, potentially crashing or hanging the system. The vulnerability affects GeForce, RTX/Quadro/NVS, and Tesla product lines, but exploitation is limited to local access with existing low-level privileges and no user interaction, resulting in availability impact only. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS score is 5.5, making this a low-to-moderate priority issue despite the ubiquity of the driver.
Local, authenticated, low-privilege users on Linux hosts can cause a denial-of-service condition against the NVIDIA GPU Display Driver kernel-mode layer by repeatedly invoking an interface that emits unrate-limited error messages, leading to uncontrolled kernel log generation and resource exhaustion. Affected products include GeForce, RTX/Quadro/NVS, and Tesla GPU families running the Linux driver, as reflected in the NVIDIA CPE entries. Despite the moderate 5.5 CVSS score, this is a low-priority issue because exploitation requires local code execution with no remote or unauthenticated path, only availability is impacted, and no public exploit has been identified at time of analysis.
Denial of service in NVIDIA GPU Display Driver for Linux arises when a local authenticated low-privileged user exhausts the DRM VMA offset address space, causing uncontrolled resource consumption in the kernel mode layer. The issue is limited to Linux and to availability impact; exploitation requires an existing local foothold and cannot provide code execution, privilege escalation, or data disclosure. No public exploit was identified at time of analysis, and the assessed risk is low, though shared or multi-tenant GPU systems such as VDI, cloud GPU, and Tesla/vGPU deployments face the greatest practical disruption.
Kernel memory exhaustion in the NVIDIA GPU Display Driver for Linux allows a local, unprivileged user to repeatedly drive error-handling paths in the driver's kernel-mode layer so that leaked allocations accumulate until kernel memory is depleted, resulting in a denial of service on the affected host. The flaw (CWE-401) affects the Linux display driver across the GeForce, RTX/Quadro/NVS and Tesla product lines, including vGPU guest-driver and Virtual GPU Manager deployments, and is local-only, requiring an existing low-privileged account (AV:L/PR:L) with no user interaction and causing availability-only impact (C:N/I:N/A:H). No public exploit code and no CISA KEV entry were identified at time of analysis, so exploitation requires an attacker who already holds a shell on the box and can sustain repeated triggering; the practical risk concentrates on shared, multi-tenant GPU hosts (vGPU, VDI, cloud GPU) where one tenant's resource exhaustion degrades every other workload on the same kernel.
Local denial of service in the NVIDIA GPU Display Driver for Linux lets any unprivileged user on the host trigger a NULL pointer dereference (CWE-476) inside the driver's kernel-mode layer, crashing or destabilising the graphics kernel component (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base score 5.5). The flaw spans NVIDIA's GeForce, RTX/Quadro/NVS and Tesla product lines and is bounded strictly to availability impact - there is no confidentiality or integrity loss and no path to privilege escalation - so the practical blast radius is limited to disrupting the machine, and is materially more serious only on multi-tenant or shared-GPU hosts (VDI, cloud GPU) where one low-privilege user's crash affects other tenants. Exploitation requires local access with a normal, non-privileged account and direct interaction with the driver's kernel interface; no public exploit identified at time of analysis, and the issue is not listed as confirmed actively exploited (CISA KEV).
Local attackers with low-privileged access can read uninitialized kernel memory from NVIDIA GPU Display Drivers on Windows and Linux, leading to information disclosure. The flaw resides in the kernel-mode driver and requires an existing account on the target system (CVSS 3.1: AV:L/PR:L, 5.5 Medium). No public exploit code or active exploitation has been identified at time of analysis.
NULL pointer dereference in the NVIDIA GPU Display Driver kernel module for Linux allows an authenticated local attacker to crash the driver, resulting in denial of service. Affected products include GeForce, RTX/Quadro/NVS, Tesla, and Guest Driver (vGPU) product lines. Exploitation requires an unprivileged local account (CVSS vector AV:L/PR:L) and yields only denial of service with no confidentiality or integrity impact; no public exploit has been identified at time of analysis.
Denial of service in NVIDIA Display Driver on Windows and Linux allows a local low-privileged attacker to crash the kernel-mode driver by triggering a divide-by-zero condition. Affected product branches include GeForce, RTX/Quadro/NVS, Tesla, and Virtual GPU Manager builds prior to the fixed versions in NVIDIA bulletin 5861, with impact limited to availability and no public exploit identified at time of analysis.
Local denial of service in NVIDIA GPU Display Driver for Linux lets a logged-in user or a low-privileged process with GPU device access (PR:L, confirmed via CVSS vector) crash the kernel mode driver by submitting a crafted ioctl that triggers a NULL pointer dereference (CWE-476), rated CVSS 5.5 Medium. Impact is availability-only - the assessed vector shows C:N/I:N/A:H, so no privilege escalation, code execution, or data exposure is achievable, and the attack is strictly local, not remotely reachable. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS score was supplied for this CVE.
Denial of service in NVIDIA GPU Display Driver for Windows arises from excessive kernel stack consumption in the kernel-mode color transform path when evaluating YCbCr420 display emulation, leading to a stack-based buffer overflow (CWE-121). A local attacker with low privileges (PR:L per the CVSS vector) can crash the system, but there is no impact to confidentiality or integrity. No public exploit code or active exploitation has been identified at time of analysis, and the moderate CVSS 5.5 reflects the local, DoS-only nature, making this a low-priority issue.
Denial of service in the NVIDIA GPU Display Driver for Windows and Linux arises from improper access control (CWE-862) in the kernel-mode layer, where a local user with a low-privileged account can invoke a driver interface they should not be authorized to reach and thereby crash or hang the affected system. Impact is limited to availability: with the assessed vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (base 5.5, Medium), exploitation requires pre-existing local authenticated access on a host running an affected driver branch - GeForce, RTX/Quadro/NVS, Tesla, or the vGPU Guest Driver/Virtual GPU Manager - and no remote path exists. No public exploit code has been identified and there is no confirmed active exploitation (no CISA KEV listing), and no code execution, privilege escalation, or data disclosure is achievable, making this a low-to-moderate operational priority that is chiefly relevant to multi-user, VDI, and shared-workstation environments.
Stored/DOM cross-site scripting in the JetEngine WordPress plugin (Crocoblock / Jetimpex) affects all versions up to and including 3.8.14.3, allowing an authenticated Subscriber-level user to inject markup that executes in the browser of a higher-privileged victim who views or interacts with the affected content. Rated CVSS 5.5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L), exploitation requires valid low-privilege credentials plus victim interaction, and the high attack complexity means additional non-trivial conditions must align for the payload to fire, limiting reliable exploitation. No public exploit code has been identified at the time of analysis, and the issue has not been confirmed as actively exploited.
Kiteworks Core versions before 9.5.1 fail to apply gateway-level API security controls to every request authenticated through the central authentication service, enabling an authenticated attacker to access REST API functionality on an unprotected path even with a revoked or signed-out session. This CWE-420 unprotected alternate channel yields low confidentiality and integrity impact (CVSS 5.4) and requires a valid authenticated session (PR:L). No public exploit code has been identified at time of analysis.
Improper authorization in JetBrains YouTrack allows an authenticated, low-privileged user to change a knowledge-base article's visibility settings even though that account does not hold the article update permission. Only instances running versions before 2026.2.18991 are affected, and the impact is limited to low confidentiality and low integrity with no availability impact (CVSS 5.4, AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N). No public exploit code has been identified at time of analysis, and there is no indication of confirmed active exploitation (CISA KEV); the vendor has released a fixed build, making this a modest-severity broken access control issue rather than a top-tier priority.
Stored cross-site scripting in Moodle's forum post rendering templates allows an authenticated user with forum posting rights - typically any enrolled student or participant - to embed malicious markup in a forum post that executes in the browser of another user who views that post. Exploitation requires a valid low-privileged account (CVSS PR:L) plus victim interaction (UI:R), so it is not self-contained and depends on a second user opening the affected discussion; impact is confined to the victim's browser session, with partial confidentiality and integrity loss and no availability impact (moderate severity, CVSS 3.1 base 4.6). There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, but upstream fix commits referencing MDL-88981 are already public, which lowers the effort needed to reproduce the issue.
A heap/stack buffer overflow in the GPAC DASH client's URL resolution routine (gf_dash_resolve_url in src/media_tools/dash_client.c) lets a remote attacker corrupt memory by supplying a crafted DASH presentation whose initialization segment resolves to a scheme-prefixed gmem://blob URL, which is then written into an undersized output buffer. All GPAC builds up to and including 26.07.0 that exercise the DASH client path are affected; the attacker cannot reach the flaw unless a victim opens or streams the malicious DASH content (user interaction required) and no authentication is needed, with impact limited to low confidentiality, integrity and availability loss. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; the vendor has released abi-16.26 plus the upstream fix commit 4c8e26f278ff63eec57968f7bc696f604bb0cffd, making this a moderate, low-priority-by-signal issue.
Uncontrolled recursion in GraphicsMagick's WordPerfect Graphics (WPG) decoder (ExtractPostscript in coders/wpg.c) lets remote attackers crash image-processing workers by supplying a crafted WPG file; confidentiality and integrity are unaffected, making this a low-severity availability issue. All releases through 1.3.47 are affected per EUVD, and exploitation is unauthenticated but requires the victim or an automated pipeline to actually parse the malicious file (CVSS UI:P). No public exploit code or active exploitation has been identified at time of analysis, and the vendor has published a fix as commit 627b5b1b2fc2.
Cross-site request forgery (CSRF) in the Supsystic Photo Gallery WordPress plugin through version 1.21.0 allows remote, unauthenticated attackers to make a logged-in administrator perform unintended state-changing actions within the plugin, such as modifying gallery settings or content, by tricking them into visiting a malicious page. Exploitation requires the victim to be authenticated and socially engineered into interacting with the attacker's page (UI:R), but the attacker needs no credentials (PR:N), and the impact is limited to low integrity and availability. No public exploit code has been identified, and no vendor patch is available at time of analysis.
Cross-site request forgery (CSRF) in Razorpay Payment Links for WooCommerce versions 2.1.5 and earlier allows unauthenticated attackers to perform state-changing actions under an authenticated victim's session. Exploitation requires the victim to visit a malicious page or click a crafted link while logged into the WordPress site (UI:R), and the attack's success depends on the victim's privileges and the absence of CSRF mitigations like nonces or SameSite cookies. No public exploit code or active exploitation has been identified, and the moderate CVSS score of 5.4 reflects low integrity and availability impact with no confidentiality impact.
Broken access control in The Events Calendar WordPress plugin through version 6.17.5 allows an authenticated Contributor-level user to perform actions that should be reserved for higher-privileged roles, resulting in low integrity and availability impact with no confidentiality loss. The flaw is network-reachable with low attack complexity and no user interaction required, but it hinges on the attacker already holding a valid Contributor (or higher) account, so sites that do not allow open Contributor registration or that tightly control low-privilege accounts are substantially less exposed. No public exploit code has been identified at time of analysis, the issue is not in CISA KEV, and the assessed severity is 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) - a genuine but low-to-moderate priority issue.
Broken access control in the WordPress plugin AllAble Connector (versions up to and including 0.13.4) lets an authenticated attacker holding only a low-privilege Subscriber account invoke functionality that should be restricted to higher-privileged users, resulting in partial loss of confidentiality and integrity (CVSS 5.4, CWE-862). Exploitation requires the attacker to already hold a Subscriber-level or higher account on a site running the vulnerable plugin - a bar that self-service registration on many WordPress sites meets - but needs no user interaction and is reachable remotely, per the assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. The flaw was reported by Patchstack; no public exploit code has been identified and there is no indication of confirmed active exploitation (not in CISA KEV), and the exact vulnerable endpoint has not been disclosed in the available data.
Stored cross-site scripting in the WordPress plugin pixfort Core affects every release before 4.3.3, letting an authenticated attacker with Contributor-level access plant script content that runs in a higher-privileged user's browser once that user views, previews, or moderates it. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, score 5.4) confirms the Contributor authentication barrier together with mandatory victim interaction, so the injected payload fires in an administrator or editor session rather than automatically - a scope-change condition that matters because the script executes with the victim's privileges. There is no indication of exploitation activity: no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS figure supplied with the source data, so this should be treated as a genuine-but-low-priority issue and handled through routine plugin update cycles.
Insecure direct object reference in the Business Directory WordPress plugin, affecting versions up to and including 6.4.27, lets an authenticated Contributor-level account manipulate an object identifier so the plugin returns or modifies directory records belonging to another user. The issue rates CVSS 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L, CWE-639): remote and low complexity, but gated on holding a valid low-privilege WordPress account (Contributor or higher), which excludes purely anonymous attackers, with impact bounded to low integrity and availability effects and no confidentiality loss. Exploitation status: no public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
WordPress sites running the WPFunnels Creator LMS plugin at version 1.2.19 or earlier expose an authenticated manipulation and disclosure weakness, where improper validation of a specified quantity value lets an attacker with a Subscriber-level account or higher read limited data and alter limited plugin content (CVSS 5.4, C:L/I:L/A:N). Exploitation is network-reachable, low complexity, and requires no victim interaction, but remains gated behind the low-privilege login prerequisite, which is trivial to satisfy on sites with open user registration. No public exploit code and no confirmed active exploitation were identified at time of analysis, and this is assessed as a genuinely low-priority issue despite the MEDIUM base score.