Stored cross-site scripting in the WordPress plugin Duplicate Post (copy-delete-posts) through version 1.5.6 lets an authenticated subscriber-level user inject arbitrary JavaScript via the 'noti_token' parameter, which then executes in the browser of anyone who later views the affected page. Exploitation is not unconditional: the site owner must have enabled the plugin's User Level Permissions for the Subscriber role, a non-default setting that exposes the i_saw_this_noti AJAX branch used to deliver the payload, so default installations are not reachable by low-privilege users. No public exploit code has been identified at time of analysis, and no KEV listing applies, though the stored nature of the flaw means a single successful injection can affect privileged administrators and visitors; the vendor has released version 1.5.7 as the fix.
Stored cross-site scripting in the Awesome Support WordPress helpdesk plugin (all versions through 6.4.0) lets an authenticated attacker with only Subscriber-level access persist arbitrary JavaScript through the 'gdpr-data' parameter, which then executes in the browser of any user who later views the injected page, including administrators. The prerequisite bar is unusually low for an authenticated XSS: the required wpas-gdpr-nonce is emitted via wp_localize_script to every logged-in user on frontend plugin pages and on /wp-admin/profile.php, and the AJAX handlers accept an arbitrary 'gdpr-user' ID without checking ownership, so a Subscriber can target other accounts rather than only their own. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing); an upstream fix changeset is referenced but no tagged patched version is independently confirmed. This is a moderate, authenticated-only web vulnerability that does not warrant emergency prioritization.
Stored cross-site scripting in bbp Style Pack (a WordPress plugin) versions up to and including 6.4.8 allows authenticated attackers with subscriber-level access to inject arbitrary web scripts via the display_name and bbp_reply_content parameters. Successful exploitation requires wrapping the crafted reply in a <pre> block to bypass WordPress's wpautop/wptexturize quote conversion, and the injected script executes when any user views the affected page. No public exploit code is identified, and there is no indication of active exploitation in the provided intelligence; the CVSS 3.1 vector (6.4 Medium) reflects network-reachable, low-privilege exploitation with scope change.
Stored cross-site scripting in the Redux Framework WordPress plugin affects all versions up to and including 4.5.14, letting an authenticated attacker with only Subscriber-level access plant a persistent script payload that later executes in the browsers of other users, including administrators. The chain works by storing a malicious value in user-meta fields (biography, session_tokens via a crafted login User-Agent, or persisted_preferences via the REST API) and then having that tainted data promoted into the site-wide redux_demo option when a media-URL repair runs on the Redux demo panel; the merged value is rendered without output escaping through the 'user-mediaurl' media field path and the bundled jsonview.js. Rated CVSS 3.1 6.4 Medium (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), it requires a low-privileged account and no victim interaction once the merge has occurred, and no public exploit code or confirmed active exploitation was identified at time of analysis; a fix is available in version 4.5.15.
Stored cross-site scripting in the Download Manager WordPress plugin before 3.3.71 lets an authenticated user with the WordPress Author role or higher save a crafted package setting that is later output without sufficient escaping, so script executes in the browser of any visitor who opens that package's download dialogue - including administrators. Exploitation is gated by two conditions: the site must run PHP below 8.1, because the sanitisation applied at save time only neutralises single quotes on PHP 8.1 and later, and the attacker must already hold an Author-level account or above. Our assessment rates this CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N - a genuine but conditional issue rather than a widespread emergency; vendor-released patch 3.3.71 is available and no public exploit code was identified at time of analysis.
Information disclosure in Next.js 16.3.0 through 16.3.7 is a modest-severity cache-correctness flaw that can serve cached content for one root-param value to requests for a different root-param value when the opt-in Cache Components feature is enabled, allowing remote unauthenticated requests to receive content intended for another tenant, locale, or region. The flaw requires nested use cache functions where an inner function reads next/root-params; the leaked content is not attacker-controlled and depends on which invocation first populates the shared cache entry. Vendor-released patch: 16.3.8; no public exploit identified at time of analysis.
Heap buffer overflow in the Perl Imager module before version 1.037 allows memory corruption inside i_gsampf_fp when a host application asks for float samples across more than one channel of an attacker-supplied paletted image, with the image's own palette controlling the bytes written past the end of the allocation. The vulnerable path is conditional rather than universal: it is only reached when an application calls getsamples() with type 'float' on a palette-type image and requests multiple channels, so real-world exposure depends on how the embedding application uses the library. No public exploit code and no confirmed active exploitation were identified at time of analysis, and CISA's SSVC evaluation rates exploitation as 'none' and automatable as 'no'; the vendor CVSS vector indicates low privileges required (PR:L) while our independent assessment treats the vector as unauthenticated with high attack complexity (PR:N/AC:H), so authentication requirements are not consistent across sources.
Unauthenticated WebSocket access in Podgrab can expose playback metadata and server-side file paths when the /ws route bypasses configured BasicAuth, allowing remote attackers to join the allConnections set and replay captured PlayerExists broadcasts as RegisterPlayer messages. This is a moderate-priority issue: the independent assessment rates it CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N because meaningful data theft depends on a legitimate authenticated user generating broadcasts concurrently, and impact is limited to information disclosure plus possible playback disruption; no public exploit identified at time of analysis.
WP Project Manager 4.0.7 and earlier contains a broken access control flaw that lets an authenticated low-privilege user - a WordPress subscriber - perform actions beyond the capabilities their role should permit, yielding limited but real confidentiality, integrity, and availability impact (CVSS 6.3, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L). Exploitation requires network reachability plus a valid subscriber-level account, so it is practical mainly on sites with open or self-service user registration enabled; no user interaction and no non-default plugin configuration are needed. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the reported EPSS signal does not elevate this beyond a moderate, authenticated authorization weakness. This is a moderate-risk authenticated authorization issue rather than a critical unauthenticated exposure.
Apache APISIX versions 2.14.1 through 3.18.0 can serve requests to protected upstream endpoints without authentication when a permissive (public) route overlaps the path space of a protected route and the client supplies a crafted encoded, non-canonical path. Because authorization is evaluated against the permissive route while the request ultimately resolves to the protected upstream, the protected route's policies are bypassed entirely; the assessed vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N) reflects a fully remote, unauthenticated attack that is gated only by the non-default requirement of an overlapping permissive-and-protected route configuration. There is no public exploit code identified at time of analysis and no confirmed active exploitation (CISA KEV), and the issue is fixed by upgrading to Apache APISIX 3.19.0.
Unauthenticated attackers can advance suspended n8n workflow executions by submitting resume requests that the Send and Wait node in 'Approve Within Chat' mode accepts without verifying the requester's identity or approval permissions. Affected are n8n releases before 2.39.6 and 2.40.0 releases before 2.40.1; exploitation is only possible when a workflow is actively paused at such an approval node, and the resulting impact is integrity-only, limited to advancing that execution and any actions it guards. No public exploit code has been identified at time of analysis, and CISA KEV does not list this issue; vendor patches are available in 2.39.6 and 2.40.1.
Quadratic CPU consumption in the JSONC parser and verifier of the stream-json npm package (stream-json/jsonc/parser.js and jsonc/verifier.js) before version 3.6.0 lets an unauthenticated local attacker stall a Node.js process by supplying one large valid block or line comment split across many small input chunks. Only the JSONC code path is affected; the plain JSON parser discards consumed string and number data and is explicitly not vulnerable. Impact is availability-only (CVSS 3.1 6.2, AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - event-loop stall, no confidentiality or integrity loss), and the maintainer frames the vector as local because documented JSONC input is locally owned or user-controlled configuration rather than internet-facing data. No public exploit code identified at time of analysis; a vendor patch is available in 3.6.0.
Reflected cross-site scripting in the WordPress plugin Social Media Share Buttons & Social Sharing Icons (slug ultimate-social-media-icons, vendor inisev) affects all versions up to and including 3.0.1, allowing an unauthenticated attacker to inject script into a crafted URL that executes in the browser of a victim who opens it and triggers the plugin's WeChat share dialog. Exploitation is gated by two conditions baked into the vulnerable path: the victim must be browsing with a mobile user-agent and must click the WeChat share icon, after which the injected script runs automatically without further interaction (CVSS 3.1 base 6.1, AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the practical risk is lower than the unauthenticated network framing suggests because of the mobile-agent and share-click preconditions.
Reflected cross-site scripting in the Ad Inserter - Ad Manager & AdSense Ads plugin for WordPress affects all versions up to and including 2.8.18, letting unauthenticated remote attackers run arbitrary JavaScript in a victim's browser session. The flaw lives in the '{search-query}' dynamic tag: when an ad block uses that tag, the plugin reads the Referer header, is trivially fooled by any referrer containing a '/google.com/'-style segment, and injects the decoded query string into the page without escaping. Because the request is cross-site and carries no authentication privilege (PR:N), the attacker must lure a victim - ideally a signed-in administrator - to an attacker-controlled page that frames or links to an ordinary post on the target site (UI:R); the configuration precondition is a site that uses the '{search-query}' tag with automatic insertion enabled, an opt-in, non-default feature. No public exploit code was identified at time of analysis, and no CISA KEV entry is associated with this CVE; the vulnerability is fixed in plugin version 2.8.19.
Reflected cross-site scripting (XSS) in the Ad Inserter - Ad Manager & AdSense Ads WordPress plugin through 2.8.18 allows unauthenticated attackers to inject arbitrary script through the 's' search parameter, which executes in a victim's browser if they are tricked into clicking a crafted link. Real-world exploitation is constrained by two gates: an administrator must have configured at least one block using the {title} or {short-title} placeholder with that block enabled on search pages (a documented but non-default setting), and a victim must interact with the malicious URL (CVSS UI:R). No public exploit code has been identified at time of analysis, and no EPSS score or CISA KEV entry was provided; the issue is fixed in version 2.8.19.
Post-login redirection in OpenShift's oauth-proxy fails to validate the `rd` destination parameter, so a remote unauthenticated attacker who convinces a user to follow a crafted link can send that user's browser to an arbitrary external website once authentication completes (CWE-601, CVSS 6.1). Red Hat OpenShift Container Platform 4 deployments that expose oauth-proxy login flows are affected, and exploitation depends on the victim clicking the attacker's link and authenticating through that proxy (UI:R); the resulting impact is a browser redirect rather than code execution or data compromise, with real risk arising when the victim is socially engineered into trusting the attacker-controlled landing page for phishing or credential harvesting. No public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score was supplied with the source data.
Reflected DOM-based cross-site scripting in the CodePeople Calculated Fields Form plugin for WordPress (all versions up to and including 5.5.1.3) allows unauthenticated attackers to execute arbitrary script in a victim's browser, but only on sites that have been specifically configured to expose the flaw. The issue is conditional rather than a default-configuration defect: the site must host a public form with a Select2-enabled dropdown whose choices are built by a calculated equation that pipes a URL parameter through GETURLPARAMETER() into setChoices({texts:[...]}); where that wiring exists, a single crafted link is enough to trigger script execution when a user clicks it. No public exploit code has been identified at time of analysis, and there is no confirmed active exploitation; the assessed severity is moderate (CVSS 6.1), with impact confined to the victim's session (C:L/I:L/A:N) and victim interaction required (UI:R).
Fail-open error handling in the Data Masking utility of Powertools for AWS Lambda (Python) before 3.35.0 can cause sensitive field values to be emitted unmasked into logs or storage whenever a masking operation fails at runtime. The flaw (CVSS 5.3, vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) is only reachable in applications that actually apply Data Masking to sensitive fields, and only when a masking rule errors - an invalid masking path, a regular expression that cannot be compiled, or a masking-provider failure - after which the original value is returned with nothing more than a warning instead of an exception. There is no public exploit identified at time of analysis; this is a genuine data-confidentiality weakness but a low-urgency one in real terms, because the attacker must also obtain access to the downstream destination (log store or storage) where the unmasked value is written.
Path traversal and symlink-validation flaws in ansible-runner's unstream_dir() (CVE-2026-103754) let an authenticated, low-privilege actor who can inject crafted archive content into the transmit/worker protocol create files, create symlinks, or change permissions outside the intended extraction directory, which can be leveraged toward code execution. The issue affects ansible-runner as shipped in Red Hat Ansible Automation Platform 2 (and upstream/AWX deployments) prior to the PR #1550 fix and carries a vendor-assigned CVSS 3.1 base score of 5.9 (AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L). No public exploit code or confirmed active exploitation was identified at time of analysis, and exploitation is constrained by the need to supply crafted archive members into this specific worker protocol path.
Cross-site request forgery in Pandora FMS version 777 and later allows an unauthenticated attacker to force deletion of alert commands in a target console, provided an authenticated administrator with a live session visits an attacker-controlled page. The flaw (CWE-352) exists because state-changing alert-command deletion is exposed through GET requests that carry no anti-CSRF validation, so a malicious page can issue sequential requests that the console accepts as legitimate. The vendor scored it 5.9 (Medium) under CVSS 4.0 (AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:L), and no public exploit code has been identified at time of analysis; exploitation requires victim interaction and administrator privileges on the victim account.
Cross-site request forgery (CSRF) in Pandora FMS 777 and later allows a remote attacker to delete event responses by luring a logged-in administrator to a malicious page that issues a forged GET request to the event-response deletion function. The attacker needs no credentials of their own - the CVSS 4.0 vector carries PR:N with UI:A, and the independent assessment records PR:N/UI:R - but the victim must hold an active administrative session and must perform the interaction of visiting the attacker-controlled page, making this a social-engineering-dependent attack rather than a fully autonomous one. No public exploit code or confirmed active exploitation has been identified at time of analysis, no EPSS score was supplied, and the vendor maintains a security advisory index at https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/. Impact is bounded to the deletion of event responses (high integrity, low availability per the assessment) rather than full administrative takeover, giving a constrained but genuine risk profile for privileged monitoring workflows.
High-privilege authenticated users can abuse the agent upgrade feature in Genian NAC and Genian ZTNA to write files outside the intended extraction directory via a ZIP Slip path traversal (CWE-862, missing authorization and integrity verification), which can result in arbitrary code execution on the appliance. Affected releases include Genian NAC 4.0.175, 5.0.65 LTS, 5.0.75 LTS, 5.0.85 Stable, and 5.0.86, plus Genian ZTNA 6.0.26 LTS, 6.0.35 LTS, 6.0.45 Stable, and 6.0.46. Exploitation is gated by high attack complexity and a high privilege requirement (PR:H) on the upgrade/management function, and there is no public exploit identified at time of analysis; the vendor (via KrCERT) scores it CVSS 4.0 5.9 Medium with integrity-only impact, while an independent assessment rates CVSS 3.1 7.0 (AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) reflecting the possible RCE outcome.
Cross-site scripting (CWE-79) in an unidentified Johnson Controls web application component affects builds prior to 3.0b63, allowing an attacker with a low-privileged authenticated session (CVSS PR:L) to submit crafted input into a field that is rendered to other users without proper neutralization. The reported CVSS 4.0 base score is 5.8 (Medium), with scope-change metrics (SC:H/SI:H/SA:H) indicating the impact can extend beyond the vulnerable component into the browser session or downstream consumers of the page. The affected product cannot be pinned down from the source data because the CPE entry resolves to a generic classification label ('CWE-79 - Cross-site Scripting' / 'CAPEC-63') rather than a real product name, so the specific Johnson Controls offering, the vulnerable feature, and whether the flaw is stored or reflected remain unconfirmed; the only vendor reference is the Johnson Controls cybersecurity advisory page. There is no confirmed CISA KEV listing (not confirmed actively exploited (CISA KEV)), but the CVSS 4.0 Exploit Maturity value of Proof-of-Concept (E:P) indicates publicly available exploit code exists, and our independent assessment notes that reliable exploitation depends on a second user rendering the injected content, which limits reliability and scope.
Credential tampering in n8n versions before 1.123.80 lets an authenticated user with editor access to a shared workflow bypass the workflow credential tamper guard by constructing a node whose ID duplicates an existing node while its name does not match, allowing the attacker to retain the victim's credentials and redirect secrets to attacker-controlled hosts. Exploitation is not available to anonymous or read-only users: it requires editor privileges on a workflow shared with a higher-privileged credential owner, so realistic risk is concentrated in multi-tenant or team deployments where low-privilege editors collaborate on workflows containing credentials owned by others, while single-user or fully-trusted-editor installations are effectively unaffected. There is no public exploit identified at time of analysis, and the vendor has released a fix in n8n 1.123.80; this is a moderate-risk authenticated authorization flaw (CWE-639, vendor-assigned CVSS 5.8 with changed scope) rather than a top-priority emergency.
Apache APISIX 3.17.0 can write an unmasked sensitive header value into its configured log sink when a specific, conditional response structure occurs, allowing anyone who can read those logs to recover data that should have been masked. The assessed CVSS:3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) shows the exposure is contingent on logging being enabled and capturing the affected header, on the attacker holding at least low privileges, and on log-sink readability, so an authenticated local actor with log access is the realistic threat model rather than an unauthenticated remote attacker. This is a genuinely low-to-moderate priority information-disclosure issue, not a high-urgency flaw; no public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor-released fix is Apache APISIX 3.18.0.
OS command injection in Johnson Controls EasyIO FS32 building-automation controllers running firmware before 3.0b63 allows an attacker who already holds high-privileged access on the device to execute arbitrary operating-system commands, with the 7.2 High score reflecting adjacent-network reachability, high attack complexity, and additional attack requirements as well as severe availability and downstream scope impact. Only firmware versions prior to 3.0b63 are affected, and exploitation is not a remote-internet scenario: the attacker must be positioned on the adjacent building-automation/OT network and must already be authenticated with elevated privileges, which effectively limits realistic abuse to insiders or adversaries who have established an OT foothold. There is no public exploit code identified at time of analysis and the vulnerability is not confirmed actively exploited (no CISA KEV listing); the exact feature or parameter carrying the injected command is not specified in the available description.
Authentication abuse in Johnson Controls EasyIO FS32 building-automation controllers running firmware earlier than 3.0b63 lets an attacker who already holds privileged access on the adjacent network leverage an insecurely initialized default resource to subvert authentication, with assessed consequences spanning integrity and availability of the controller and knock-on effects at system scope. Exploitation is heavily gated: the attacker must sit on the adjacent/local network (AV:A, not internet-reachable), must already be privileged (PR:H), must clear high attack complexity (AC:H) and a specific attack requirement (AT:P), so this is realistically reachable only by someone with an existing foothold on the building-automation network, not by an unauthenticated remote actor. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the CVSS 4.0 base score is 5.6 (medium).
Johnson Controls EasyIO FS32 building-automation controllers running firmware before 3.0b63 expose a file/path-handling function to externally controlled input (CWE-73), allowing a high-privileged, authenticated attacker with adjacent-network access to supply crafted file names or paths and reach files outside the intended location, with the potential to read sensitive data and to overwrite or corrupt files that affect device integrity and availability. Exploitation is constrained: it requires a foothold on the OT/building-automation network segment (CVSS AV:A), an elevated privileged session on the device (PR:H), a specific attack prerequisite (AT:P), and a high-complexity sequence (AC:H), yielding a base score of 5.6 under CVSS 4.0 and an assessed CVSS 3.1 vector of AV:A/AC:H/PR:H/UI:N/S:C/C:L/I:H/A:H. No public exploit code was identified at time of analysis and there is no CISA KEV listing, so this should be treated as a genuine but non-urgent issue whose practical risk is materially lower than the path-traversal label alone suggests.
Password spraying attacks against EasyIO FG controllers running firmware before 2.0b52 can succeed due to hard-coded credentials (CWE-798), enabling unauthenticated remote attackers to bypass authentication and potentially achieve high integrity and availability impact with low confidentiality impact. Affected devices are those with firmware versions prior to 2.0b52, and exploitation requires use of a vendor hard-coded credential and access to the controller's management interface, which may be exposed via BACnet/IP, web, or integration ports. This is a moderate-priority, context-dependent issue rather than an internet-wide emergency; no public exploit code or confirmed active exploitation has been identified at time of analysis, and the assessed CVSS v3.1 vector is AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H.
Local privilege escalation in Johnson Controls Easy IO FG controllers prior to version 2.0b52 allows an authenticated attacker with low-privileged local access to brute-force privilege management controls, potentially leading to high integrity and availability impact. Exploitation is complex and requires a specific attack precondition, and no public exploit code has been identified at the time of analysis. This is a medium-severity, operator-dependent flaw in a niche building-automation controller, not a high-priority mass-exploitation risk.
Server-side request forgery in JetBrains YouTrack before 2026.2.19422 allows an authenticated user holding administrative or project-level privileges to abuse the GitHub VCS integration and coerce the YouTrack server into issuing requests to destinations of the attacker's choosing. With a CVSS 3.1 base score of 5.5 (AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N), the impact is bounded to limited confidentiality and integrity loss with a scope change, and the high privilege prerequisite is the dominant limiting factor - this is a moderate-severity, low-real-world-priority issue rather than an anonymous or default-configuration exposure. At the time of analysis there is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis.
GEGL's Radiance HDR loader reads past the end of a memory-mapped image when a crafted .hdr file declares a scanline width larger than the actual data present in an uncompressed scanline, crashing the application that consumes the library - most notably GIMP, which uses GEGL for image processing. Any local user who opens such a file is affected; no authentication is required to the library, but the attacker must convince a victim to open the crafted file (UI:R), and the impact is availability-only (CVSS 5.5, AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H). No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, consistent with a low-priority, local denial-of-service rather than a code-execution primitive.
Missing current-password confirmation in Filament's app-based multi-factor authentication management actions (set-up, disable, regenerate recovery codes) allows an attacker who already holds an authenticated user session to enroll a new TOTP authenticator and harvest fresh recovery codes, or to disable existing app-based MFA and regenerate its recovery codes, by supplying only an existing valid app code or recovery code. The flaw affects Filament 4.0.0 through <4.13.3 and the 5.x line before 5.8.3, carrying a CVSS 3.1 score of 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) - the required authenticated session, per the independent assessment, is the limiting factor, and there is no path to unauthenticated sign-in through this issue. There is no public exploit identified at time of analysis and no CISA KEV listing; vendor-released patches exist in 4.13.3 and 5.8.3.
Stored cross-site scripting in the Advanced Woo Labels - Product Labels & Badges for WooCommerce plugin (all versions up to and including 2.51) lets an authenticated attacker with Contributor-level access or higher create product labels whose content is written to the database and later rendered without proper output escaping. When a victim - an editor, administrator, or any site visitor viewing a page that renders the label - loads the affected page, the injected script executes in their browser session, enabling session theft, privilege escalation, or content manipulation within the WordPress context; the scoring is moderate (CVSS 5.4, adjusted to scope-changed at 5.x-class impact by this assessment) and no public exploit code or confirmed active exploitation was identified at time of analysis. Note that version 2.46 contained only a partial fix, so installs in the 2.47-2.51 range remain exposed.
Physical attackers who can obtain, disassemble and hardware-modify a TP-Link Kasa EC70 v4 or EC71 v4 smart plug can restore the manufacturing-severed debug traces, interrupt the boot process and manipulate boot parameters to reach a non-standard initialization path that spawns an unauthenticated root shell during startup, giving full root-level control over the device (high confidentiality, integrity and availability impact to the device itself). The root cause is improper access control on the on-chip debug interface (CWE-1191): the production debug interface is not logically disabled at the firmware or chip level and the bootloader is not locked, so the physical cut of the debug traces is the only barrier. The attacker path is purely physical (CVSS 4.0 AV:P/AC:L/AT:P, assessed as CVSS 3.1 AV:P/AC:H), with no remote or over-the-air vector, and exploitation demands disassembly, trace rework (resoldering/bridging) and boot-timing manipulation; no public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, while vendor firmware updates are available per the TP-Link release notes.
HTML injection in JetBrains YouTrack's VCS command failure notifications (before 2026.2.19422) allows an authenticated attacker with high privileges to inject arbitrary HTML into notifications, potentially leading to content spoofing or script execution, but a victim must view the crafted notification. The vulnerability requires high attack complexity, and no public exploit code or active exploitation has been identified. Despite the low CVSS score of 2.0, it is a genuine XSS flaw that should be remediated by upgrading to version 2026.2.19422 or later.
Authenticated broken access control in the Magepeople WpTravelly (tour-booking-manager) WordPress plugin, affecting versions through 2.3.1, allows any logged-in low-privilege user to invoke plugin functionality that should be restricted to higher-privileged roles, weakening site integrity and availability. The assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L confirms a valid authenticated session is mandatory (PR:L, unauthenticated attackers are excluded), no user interaction is needed, and there is no confidentiality impact. There is no public exploit identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), so this presents as a moderate-priority, authenticated authorization gap whose real-world weight rises on sites that permit open registration or host many subscriber-level accounts.
Authenticated users of JetBrains YouTrack before version 2026.2.19422 can read notifications belonging to other users by directly referencing inbox thread identifiers that lack a proper per-user ownership check. The flaw is a classic insecure direct object reference (CWE-639) reachable over the network with low complexity and no user interaction, but it requires a valid low-privilege account, so it is not exploitable by unauthenticated outsiders. Impact is limited to confidentiality - disclosure of other users' notification contents - with no evidence of modification, service disruption, active exploitation, or publicly available exploit code at time of analysis; EPSS and KEV data were not provided, and the vendor has released a fix.
Missing capability checks in the WP Fusion Lite WordPress plugin before version 3.48.0 allow any authenticated subscriber-level user to read other users' email addresses and to trigger cross-user CRM re-syncs through two exposed admin AJAX handlers. The CVSS vector indicates the attacker must hold a valid logged-in account (PR:L, so authenticated, not unauthenticated), and sites that allow open or self-service user registration are the most exposed, since no user interaction or administrative privilege is needed. Impact is confined to information disclosure of email addresses and unintended CRM synchronisation activity rather than full site takeover, and no public exploit code was identified at time of analysis.
Information disclosure in Apache HTTP Server 2.4.0 through 2.4.68 arises from a path-equivalence flaw (CWE-55, '/./' single-dot directory) in the mod_userdir module, which mishandles the single-dot directory segment when the UserDir directive is configured with an absolute, non-wildcard path. Only deployments that load mod_userdir and use that specific second syntax form (for example 'UserDir /some/absolute/path') are exposed; servers on the default wildcard/username form, or without mod_userdir loaded, are unaffected regardless of version, so the practical exposure surface is a non-default configuration. The issue is network-reachable over HTTP and is assessed as low-confidentiality impact (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N); no public exploit code or confirmed active exploitation has been identified at time of analysis, and no patch version is specified in the available advisory data.
Unauthenticated information disclosure in WP Popular Posts (all versions up to and including 7.4.2) lets any remote attacker read sensitive edit-context fields - raw title, raw content body, password, meta, status, and guid - from non-public post objects such as drafts, private or password-protected posts, and wp_block synced patterns that WordPress core itself refuses to expose to anonymous callers. Scoring CVSS 3.1 as AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N (5.3 Medium), the flaw requires no authentication, user interaction, or non-default configuration because the plugin's REST route is registered with a permission_callback of __return_true and passes the caller-supplied context parameter (for example context=edit) directly into WP_REST_Posts_Controller::prepare_item_for_response() while the underlying query accepts an arbitrary post_type without enforcing public or show_in_rest visibility. The practical limit is data-dependent rather than access-dependent - a site with no sensitive non-public content leaks little - and no public exploit code or confirmed active exploitation was identified at time of analysis.
Information disclosure in Apache HTTP Server 2.4.0 through 2.4.68 allows an unauthenticated remote client to read WebDAV dead properties of resources it cannot author by sending an HTTP GET request to the module's internal .DAV state directory. The flaw is in mod_dav_fs (CWE-552, files or directories accessible to external parties) and is reachable only when mod_dav and mod_dav_fs are loaded with WebDAV enabled and the .DAV state directory is web-accessible, so no default configuration is affected. No public exploit identified at time of analysis, and there is no CISA KEV listing; the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) reflects a read-only, low-confidentiality leak of client-set metadata with no integrity, availability, or code-execution impact.
An exposed API endpoint in HCL BigFix Service Management returns sensitive internal database information to remote, unauthenticated callers (CVSS 5.3, AV:N/AC:L/PR:N/UI:N), giving attackers reconnaissance material that could support follow-on targeted database attacks. Impact is limited to confidentiality (C:L) with no integrity or availability effect, and no public exploit code or confirmed active exploitation has been identified at time of analysis; exploitation is assessed as network-reachable and automatable, so the practical risk depends heavily on whether the management interface is internet-facing or confined to a trusted internal segment.
Information disclosure in HCL BigFix Service Management allows unauthenticated remote attackers to retrieve sensitive data from two exposed API endpoints, with no user interaction required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N = 5.3, MEDIUM). Only confidentiality is affected at a low level; the flaw does not permit data modification or cause denial of service on its own, but the leaked data can be used to stage follow-on attacks against the platform. There is no vendor-released fix identified in the available data, no public exploit code identified at time of analysis, and no confirmed active exploitation (not listed in CISA KEV); the practical risk is driven primarily by whether the BigFix Service Management API tier is reachable from untrusted networks.
Inspection of publicly served JavaScript in BigFix Service Management lets unauthenticated remote users discover hidden administrative API endpoint paths, a low-severity reconnaissance issue that leaks endpoint names without exposing sensitive data, altering data, or causing denial of service. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N confirms no authentication or user interaction is required, but impact is limited to low confidentiality loss; no public exploit code or active exploitation has been identified at time of analysis. The disclosure is only useful if the discovered endpoints have separate exploitable flaws, which this CVE does not provide.
Authenticated staff-level users of Ghost CMS (versions 5.42.2 up to but not including 6.58.0) can infer other staff users' password hashes by supplying Admin API bulk post and page edit/delete filters that reference restricted fields such as authors.password. Because the bulk operation code paths fail to reject these restricted-field filters, the match/no-match behaviour acts as a boolean oracle that leaks information about the stored hash, which an attacker can then attack with offline password-guessing (cracking) - it does not hand over credentials directly. This is a genuine but modest-priority authenticated information disclosure (CVSS 5.3, assessed CVSS:3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, CWE-203); there is no CISA KEV entry and no public exploit identified at time of analysis, and the issue is fully remediated in Ghost 6.58.0.
Team-scoped users in Fleet DM before 4.89.0 can read MDM command results for hosts on other teams via the commands/results endpoint when a shared command UUID targets hosts across multiple teams, exposing host UUIDs, command payloads, and device responses. Exploitation requires an authenticated low-privileged team-scoped account on an instance with MDM features in use, and the disclosure is limited to results tied to such cross-team command UUIDs; there is no public exploit identified at time of analysis. CVSS 4.0 base score is 5.3, with an assessed CVSS 3.1 base score of 4.3 reflecting read-only low confidentiality impact.
Server-side request forgery in Ghost 3.20.2 through 6.50.x allows authenticated staff users to trigger outbound HTTP requests to arbitrary URLs via the image dimension refetching feature. Attackers can point image cards at internal network endpoints or cloud metadata services (e.g., 169.254.169.254) to access resources unavailable from the public internet. No public exploit code identified at time of analysis; the vendor has released a patch in Ghost 6.51.0.
Cleartext 802.11 session traffic between Teledyne FLIR Aware2 (versions through 6.9.0.2) and PackBot robots can be sniffed, hijacked, or modified by an adjacent unauthenticated attacker who is within radio range of the robot's wireless network, giving limited confidentiality, integrity, and availability impact (assessed CVSS 3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L; CVSS 4.0 base 5.3). The flaw is CWE-319 (cleartext transmission of sensitive information) and stems from the absence of transport encryption on the robot control link rather than from a software logic error, so exploitation requires RF proximity to an operating robot on the same 802.11 network and does not need credentials or user interaction. No public exploit code or confirmed in-the-wild exploitation has been identified at time of analysis (not listed in CISA KEV), and the practical risk is bounded mainly by the mandatory adjacency requirement, which narrows realistic exposure to active fielded deployments; the issue was disclosed by Mandiant as MNDT-2026-0030 and tracked in the EU as EUVD-2026-91051.
Cleartext transmission of application traffic in the Joyland AI Android app exposes data to on-path attackers positioned on the same LAN or Wi-Fi segment, because the app explicitly opts into cleartext HTTP on Android 9+ where the platform default blocks it. Only data the app actually sends over plain HTTP is exposed, and the exposure is passive disclosure - no code execution, account takeover, or data modification results - with authentication not required (CVSS vector PR:N) and confidentiality impact scored low. No public exploit code has been identified at time of analysis (no public exploit identified at time of analysis), and no CISA KEV listing or EPSS signal was provided; the practical attack prerequisite is an adjacent-network or on-path foothold, which excludes remote internet-only attackers.