Local attackers with low privileges can inject crafted text into the kernel log on Linux systems running the NVIDIA GPU Display Driver because the kernel mode layer fails to sanitize a supplied version string, leading to denial of service and data tampering. The vulnerability requires local access (AV:L) and low privileges (PR:L) with no user interaction, and has low impact on integrity and availability (I:L/A:L) with no confidentiality loss. No public exploit identified at time of analysis, and the overall risk is low despite the wide deployment of NVIDIA GPUs.
Denial of service in the NVIDIA GPU Display Driver for Windows and Linux occurs when a NULL pointer dereference is triggered in the kernel-mode layer, crashing or hanging the graphics subsystem on the affected host. Only systems with a physical NVIDIA GPU (GeForce, RTX/Quadro/NVS, or Tesla branches) running a driver older than the branch-specific fixed release are exposed, and exploitation requires an attacker who already holds HIGH privileges (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H), so an unprivileged local user cannot reach the vulnerable interface. There is no confidentiality or integrity impact, no public exploit code and no confirmed active exploitation (not in CISA KEV), and the EPSS score was not reported; the high-privilege prerequisite caps real-world priority at LOW despite the nominal MEDIUM CVSS.
Denial of service in NVIDIA GPU Display Driver on Windows and Linux is possible when a highly privileged local attacker reaches a firmware code path that dereferences a null pointer. Affected products include GeForce, RTX/Quadro/NVS, and Tesla driver branches prior to the fixes documented in NVIDIA bulletin 5861, with some older branches limited to Maxwell, Volta, and Pascal GPUs. The assessed vector is local and requires high privileges, with availability impact only; no public exploit identified at time of analysis, and the low CVSS score of 4.4 reflects those constraints.
Administrator-level users on WordPress installations running the EWWW Image Optimizer plugin before 8.8.0 can rename or delete existing WebP-derivative image files outside the current site's own uploads directory, because the plugin's WebP-derivative file migration routine is not confined to that directory. On a WordPress multisite network this crosses a real authorization boundary, allowing an administrator of one site to tamper with image files belonging to a different site they have no access to; on a single-site install the practical benefit to an already-privileged administrator is minimal, which is consistent with the modest CVSS 3.1 base score of 4.4 (AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:L/A:L) and with CISA SSVC signals showing no exploitation and no automation. No public exploit identified at time of analysis, and the vendor has released a fix in version 8.8.0.
Authorization bypass in JetBrains YouTrack before 2026.2.19197 lets an authenticated low-privileged user circumvent a helpdesk project's Authorized Reporters allowlist and file reports that the configuration was meant to block. The issue is network-reachable with low complexity and no user interaction (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, score 4.3), but its impact is limited to integrity - unauthorized report submission - with no confidentiality or availability effect. It applies only to instances where a helpdesk project has actually been configured with an Authorized Reporters restriction, and the CVSS PR:L metric confirms the attacker must already hold a valid low-privileged account rather than being fully anonymous; no public exploit identified at time of analysis.
Content injection in the Kiteworks Core PDF viewer in versions before 9.5.1 allows remote attackers to load an attacker-controlled document inside the application's own trusted domain, because a URL parameter used by the viewer is not sufficiently validated (CWE-601). Under the assessed CVSS:3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N (base 4.3), no authentication is required of the attacker, but exploitation depends on a victim clicking a crafted link and then trusting the rendered content; the resulting impact is limited to integrity/content spoofing (I:L) with no reading of Kiteworks data, no code execution, and no availability impact. There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis; the primary abuse case is raising the credibility of phishing that relies on links embedded in the displayed content. A vendor-released patch exists in Kiteworks Core 9.5.1.
Server-side request forgery in JetBrains YouTrack before 2026.2.18991 lets an authenticated user coerce the server-side PDF export renderer into making outbound requests to attacker-influenced URLs by storing crafted XHTML content that is rendered when that content is exported to PDF. The assessed impact is confidentiality-only (CVSS 3.1 base 4.3, AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), and the attack requires a valid YouTrack account plus write access to a stored field that reaches the PDF renderer; no public exploit identified at time of analysis, and the issue is not in CISA KEV.
Kiteworks Core versions below 9.5.1 fail to enforce which roles a shared folder's Manager is allowed to assign, so an authenticated user who already holds the Manager role on a folder can grant the Owner role on that same folder to themselves or to other members. The weakness works in a default configuration, but its impact is bounded: it is an escalation to Owner within that one folder and does not by itself confer tenant-wide or system-administrator rights. Rated CVSS 4.3 (integrity-only, low confidentiality and availability impact), with no public exploit code identified at time of analysis and no CISA KEV entry.
Improper access control in JetBrains YouTrack before 2026.2.18991 lets an authenticated user who has only view-only permission on a Gantt chart perform edit operations that the access model should block. The flaw is network-reachable but requires a valid YouTrack account (PR:L), has no user-interaction component, and is confined to low-severity integrity impact on scheduling/Gantt data with no confidentiality or availability effect (CVSS 4.3, CWE-863). There is no confirmed active exploitation (CISA KEV not listed) and no public exploit identified at time of analysis; the vendor has released a fixed build in 2026.2.18991.
JetBrains YouTrack before 2026.2.19197 fails to enforce read permissions when creating a project from a custom template, allowing an authenticated low-privileged user to read template data they are not authorized to access. This missing authorization flaw (CWE-862) has a low confidentiality impact (CVSS 3.1) and requires high attack complexity, a valid account, and the existence of an unreadable custom template; no public exploit code has been identified. The vendor has released a patch in version 2026.2.19197.
Direct URL access to Moodle's manual enrolment management page allows authenticated users who already hold enrolment-management permissions to modify manual enrolments even after an administrator has disabled the manual enrolment plugin in the UI. The issue is a forced-browsing access-control weakness rated low real risk with integrity-only impact: it does not let unauthenticated or ordinary users exploit it, read data, or escalate privileges. No public exploit identified at time of analysis, and no CISA KEV entry was reported.
An authenticated teacher in Moodle can add users to groups that belong to courses they are not authorized to manage, because the enrol-user-into-course-with-group-assignment workflow fails to verify that the supplied group actually belongs to the target course. The flaw is a low-severity authorization weakness (CVSS 4.3, CWE-842, Placement into Incorrect Group) that requires a valid teacher-level account (PR:L) and causes only limited integrity impact to group membership; no public exploit code was identified and there is no evidence of active exploitation at time of analysis. Confidentiality and availability are unaffected, so the practical risk is unauthorized group placement and possible exposure of course-group context rather than data theft or service disruption.
Missing capability check in Moodle's grade-penalty recalculation routine allows any authenticated low-privileged user to trigger unauthorized recalculation and modify grade penalty records, potentially altering student assessment scores. The flaw requires a valid Moodle account but no additional user interaction; it is not known to be actively exploited, and no public exploit code has been identified at time of analysis. Impact is limited to integrity of grade-penalty data with no confidentiality or availability impact.
Broken access control in the miniOrange "Prevent files / folders access" WordPress plugin (versions through 2.6.7) lets an authenticated Subscriber - the lowest standard WordPress role - read the contents of files and folders the plugin is configured to protect. The condition is a missing-authorization flaw (CWE-862) scored CVSS 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), so the impact is confidentiality-only: protected content can be disclosed, but nothing can be modified or taken offline. No KEV listing, public exploit code, or EPSS signal accompanies this disclosure, so no public exploit identified at time of analysis; practical risk depends on whether self-registration is enabled on the target site or the attacker otherwise holds a Subscriber account.
Authenticated users with Subscriber-level access or higher can exploit an insecure direct object reference in Webba Booking (webba-booking-lite) versions 6.5.0 and earlier to read booking records belonging to other users, resulting in limited information disclosure. The vulnerability requires a valid WordPress account (PR:L) and no user interaction, but has a low CVSS score of 4.3 due to its limited confidentiality impact and lack of integrity or availability effects. No public exploit code has been identified, and the issue is considered a low-priority, low-real-risk vulnerability per independent assessment, though sites with open user registration face greater exposure.
Subscriber-level insecure direct object reference (IDOR) in the Omnisend WordPress plugin through version 1.9.0 allows an authenticated low-privilege user (Subscriber or higher) to modify certain objects they do not own. The flaw is rated CVSS 4.3 with a limited integrity-only impact, requires no user interaction, and can be reached remotely; no public exploit was identified at time of analysis. Sites running the plugin 1.9.0 or earlier with open registration are at higher practical risk because obtaining the required Subscriber account is trivial.
Authenticated WordPress users with Contributor-level access can exploit an insecure direct object reference (IDOR) in the Safe SVG plugin (versions 2.5.0 and earlier) to read data they are not authorized to access. The vulnerability requires a low-privileged account, network access, and no user interaction, but only results in limited confidentiality impact. No public exploit identified at time of analysis.
An authenticated, low-privilege Grafana user can read alert rule configurations from folders they are not authorized to view through the alert rules API list endpoint, because the folder-based authorization filter is dropped when the caller's set of readable folders is empty - causing the endpoint to return every alert rule in the organization. Starting with Grafana 13.1.0, any user can also trigger cross-folder disclosure by simply supplying a folder filter to that same endpoint. The impact is confidentiality-only and limited to rule configuration metadata (data source credentials are not exposed); the vendor (security@grafana.com) is the reporting source, and no public exploit code has been identified at time of analysis.
Authenticated Moodle users who hold Report Builder audience-management permissions can abuse an improperly validated audience class name to instantiate arbitrary internal PHP classes, producing unexpected internal objects and altered application behavior (CWE-470, unsafe reflection). The vendor and independent assessment both rate real-world risk as low: the assessed vector is CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N (score 2.2), because reaching the flaw requires a semi-privileged authenticated account able to create or manage Report Builder audiences, and the attack is rated high complexity with no victim interaction. Impact is bounded to integrity - no confidentiality or availability effect is described - and no public exploit code or confirmed active exploitation was identified at time of analysis.
Information disclosure in Moodle's grade web service allows an authenticated student to view profile details of other students enrolled in the same course even though they lack the required capability. The issue is a low-severity confidentiality-only flaw (CVSS 4.3, CWE-359) reachable over the network with low attack complexity but requiring a valid student account. No public exploit code or confirmed active exploitation was identified in the provided data, and an upstream fix commit (MDL-89381) is referenced but a released patched version is not independently confirmed.
Authenticated remote users of Moodle can bypass the URL downloader's host-blocking logic by encoding a restricted destination as an IPv4-mapped IPv6 address (for example ::ffff:<internal-ip>), causing the server to fetch resources from internal or otherwise blocked hosts on the attacker's behalf. Successful abuse yields Server-Side Request Forgery limited to confidentiality impact (CVSS 3.1 base 4.3, AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), meaning the practical damage depends on what the Moodle server itself can reach - typically cloud instance-metadata endpoints or internal-only services - and is reduced on segmented networks. No public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), so this is a genuine but modest-priority issue that should be scheduled alongside routine patch cycles rather than treated as an emergency.
Information disclosure in the Image Optimizer WordPress plugin before 1.7.7 allows any authenticated user to read attachment metadata and site-wide statistics that are meant to be administrator-only, because several read REST routes fail to enforce the intended capability check (CVSS:3.1 4.3, PR:L, confidentiality impact only). The only real prerequisite is a valid WordPress account of any privilege level on a site running the vulnerable plugin, so exposure is greatest where open registration or low-privilege user accounts are available; no victim interaction is required and attack complexity is low. There is no confirmed active exploitation (CISA SSVC: exploitation none, not automatable) and no public exploit code identified at time of analysis, and a vendor patch is available.
Broken access control in the Robin Image Optimizer WordPress plugin before 2.0.8 lets any authenticated subscriber-level user render admin-only plugin pages and read the plugin's stored settings, because a bundled admin-framework request handler dispatches requests without performing a capability check. The flaw is network-reachable but authenticated (CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, 4.3 Medium), so practical exploitation depends on the target site permitting open or self-service registration; otherwise the attacker must already hold any low-privilege credential. Impact is limited to disclosure of the plugin's own configuration data - there is no integrity or availability effect, no escalation to administrator, and no public exploit code identified at time of analysis, so this is a low-real-risk issue despite its 'Authentication Bypass' tag.
Missing authorization in the All in One Files Upload WordPress plugin before 2.0.17 lets any authenticated user - a subscriber-level account is sufficient per the reported issue - rewrite the plugin's saved settings, because the settings-save handler performs neither a capability check nor a request-authenticity (nonce/CSRF) check. The impact is integrity-only and limited to plugin configuration; there is no data disclosure, no denial of service, and no server-side code execution, which is consistent with the assessed CVSS 3.1 base score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) and the CISA SSVC decision of exploitation: none, automatable: no, technical impact: partial. No public exploit code was identified at time of analysis, and vendor-released patch 2.0.17 is available. The practical exposure is greatest on sites that allow open or self-service registration, since the attacker must first hold a valid WordPress account.
All In One WP Security & Firewall 5.4.8 and earlier contains an authentication-bypass-by-spoofing flaw that lets a logged-in Subscriber-level user slip past a plugin security check by supplying a spoofable or predictable value, yielding limited confidentiality and integrity impact (CVSS 4.2, C:L/I:L/A:N). Exploitation is not trivially repeatable: it requires an account at Subscriber level or higher (PR:L) and is gated by high attack complexity (AC:H), meaning the attacker must satisfy conditions outside their direct control such as specific plugin state or timing. No public exploit code and no confirmed active exploitation have been identified at time of analysis, so the practical risk is modest despite the plugin's very large WordPress install base.
An authenticated administrator on Kiteworks Core can bypass server-side content validation for administrative file uploads, allowing storage of files with dangerous content. While this alone does not execute code, it could be leveraged in a chained attack with a separate vulnerability. Affected versions are prior to 9.5.1, and a vendor patch is available. The low CVSS score (4.1) reflects the high privilege requirement and complex bypass, and no public exploit has been identified.
Guest-to-host memory corruption in QEMU's QXL paravirtual display device (hw/display/qxl) stems from the primary surface stride not being validated against the declared surface width, allowing a guest that controls the QXL device to drive the host QEMU process into out-of-bounds memory access. The assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:H) reflects a scope-crossing guest-to-host impact with high confidentiality and availability loss and limited integrity impact, but exploitation requires the QXL display device to be attached and the attacker to already control code inside the guest at guest-kernel/driver level; headless, virtio-gpu, and VNC-only guests are not exposed. Reported by the Ubuntu vendor; no public exploit has been identified at time of analysis.
QEMU xHCI emulation can allow a guest with low privileges and access to the emulated USB 3.0 host controller to trigger reentrant timer callbacks, resulting in a host-side QEMU crash or limited scope-changing effects rather than reliable remote code execution. The affected component is QEMU's hw/usb/hcd-xhci emulation, but the provided input contains no exact version range, CPE, or advisory link; Ubuntu is the reporting vendor. No published CVSS score, EPSS, KEV listing, or public exploit was provided, so the independent assessment estimates CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:H, and no public exploit identified at time of analysis. Exploitation requires a guest configured with emulated xHCI and the ability to drive the controller's registers or timers; it does not apply to VMs using USB passthrough only or to VMs without an emulated xHCI controller.
Out-of-bounds write in QEMU's emulated VGA display adapter can be triggered when a guest switches the display away from a graphics surface and then invokes text-mode rendering, corrupting memory that belongs to the host-side QEMU process. The assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) describes a local, low-privileged attacker who already has code execution inside the guest and can program VGA I/O ports or MMIO; the scope change (S:C) reflects that the faulty code runs in the hypervisor process, so a successful trigger can break the guest isolation boundary and affect the confidentiality, integrity and availability of QEMU and potentially the host. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and the input data does not confirm a specific released patched version.
QEMU's socket-backed I/O channel implementation (io/channel-socket) mishandles a zero-length write by treating it as an error, which can error out or tear down an otherwise healthy socket-backed I/O path. The assessed vector is local, high-complexity, low-privilege (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L), so impact is confined to availability of a channel such as a TCP/UNIX socket chardev, a socket network backend, or the migration transport, with no confidentiality or integrity effect. The CVE record itself carries no CVSS score, no CVSS vector and no CWE, no public exploit code has been identified at time of analysis, and the issue is reported by vendor:ubuntu rather than being confirmed actively exploited (CISA KEV).
QEMU's virtio-net Receive Segment Coalescing (RSC) path mishandles short, padding-bearing TCP segments and fails to strip trailing padding before caching a coalesced segment, allowing crafted traffic to fault the host-side QEMU process and deny service to the guest it serves. The independently assessed vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H) describes a remote, unauthenticated trigger with high attack complexity, no confidentiality or integrity impact, and a scope-changed high availability impact on the hypervisor, which is more severe than a guest-local crash because the QEMU process also backs the VM's other devices. Exploitation is gated by the guest negotiating RSC (VIRTIO_NET_F_GUEST_RSC/RSC_EXT) - typically Windows guests with LRO/RSC offload enabled, whereas many Linux guests do not negotiate it by default - and by the attacker's ability to deliver a crafted sequence of padded segments, so the affected population is a subset of virtio-net users. No vendor CVSS score, EPSS value, CISA KEV entry, or public proof-of-concept was supplied with this report, and no public exploit has been identified at time of analysis.
Device teardown of a QEMU virtio-balloon instance with free-page hinting engaged can leave a still-scheduled free-page bottom half that subsequently executes against freed state, crashing the QEMU process and taking the associated guest offline (availability-only impact). The exposure is constrained: the assigned assessment vector is CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H, meaning the trigger requires local low-privileged access in a high-complexity, timing-dependent race, with scope change reflecting the guest-to-QEMU-process boundary, and no impact to confidentiality or integrity. Affected are QEMU-based virtual machines configured with a virtio-balloon device (free-page hinting path) that is subsequently unrealized, e.g. via device hot-unplug or VM/device teardown; the reporting vendor is Ubuntu, which is tracking the issue. There is no public exploit identified at time of analysis, and no CVE-specific CVSS, CWE, EPSS, KEV, or POC data was supplied, so the severity framing here derives from the independent assessment rather than vendor-confirmed metrics.