Unauthenticated devices on the same local network segment as a TP-Link Tapo C120 v1 or Tapo C200 V5 camera can invoke the HTTPS onboarding scan function and pull back metadata about nearby wireless access points, including SSIDs, BSSIDs, authentication and encryption modes, and signal-strength readings (CWE-306, missing authentication for a critical function). The flaw is only reachable after the camera has completed initial setup and requires the attacker to already have adjacent-network access (CVSS:4.0 AV:A/PR:N/UI:N, base 5.3; our own assessment scores it CVSS:3.1 3.1 AV:A/AC:L/PR:N/UI:N with C:L only), so it is not internet-exploitable and yields reconnaissance-grade wireless topology data rather than code execution, credential theft, or camera/video access. There is no KEV listing and no public exploit identified at time of analysis, and TP-Link has published firmware updates for both hardware revisions. This is a genuine but low-to-moderate priority issue, not a critical one, and the practical risk depends entirely on how hostile or shared the camera's LAN/Wi-Fi segment is.
Bypassing the CAPTCHA protection in the hCaptcha for WP plugin (hcaptcha-for-forms-and-more) up to version 5.3.0 allows unauthenticated remote attackers to submit forms without solving the challenge, defeating the anti-bot gate on login, registration, comment, WooCommerce, or contact forms. This authentication bypass by spoofing (CWE-290) is rated CVSS 5.3 and has limited impact, as it does not directly compromise data or the site. No public exploit code has been identified at time of analysis, and exploitation requires hCaptcha to be actively enabled on at least one form.
Unauthenticated information disclosure in the WPExperts CF7 Apps WordPress plugin (slug contact-form-7-honeypot) at version 3.7.2 and earlier lets a remote attacker retrieve sensitive data that the plugin inserts into data it sends out, typically form submission payloads or notification content. Per the assessed vector (AV:N/AC:L/PR:N/UI:N) no authentication or user interaction is required and default configurations are affected, but the flaw is confidentiality-only and low impact (C:L, no integrity or availability effect), so real-world severity depends on what a given site's forms and configuration actually expose. No public exploit identified at time of analysis, and CR7 Apps is not listed as confirmed actively exploited (CISA KEV); the risk is best characterized as a low-to-medium priority information disclosure rather than a critical incident.
Unauthenticated remote attackers can read data that should be access-controlled on WordPress sites running the Metagauss ProfileGrid plugin (profilegrid-user-profiles-groups-and-communities) through version 6.0.0.2 by supplying or guessing an object/user identifier that the plugin fails to validate against the requester's ownership or privileges. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) indicates no authentication, privilege, or user interaction is required, but impact is limited to confidentiality (C:L), with the practical constraint that the attacker must know or be able to enumerate a valid identifier. No confirmed active exploitation (KEV) and no public exploit code have been identified from the available data, and the independent assessment rates the overall priority as modest rather than urgent.
Sensitive information disclosure in Pie Register WordPress plugin versions through 3.8.4.13 allows remote, unauthenticated attackers to retrieve embedded data from affected sites. The vulnerability (CWE-201) has a CVSS score of 5.3 and requires no special conditions beyond the plugin being active, though the specific data exposed is not detailed in the advisory; this is a genuine but low-urgency issue. No public exploit code has been identified at time of analysis, and the impact is confined to confidentiality (C:L) with no integrity or availability effects.
Unauthorized affiliate action execution is possible in AFFI - Affiliate Marketing for WooCommerce through version 1.0.9 because an access-control check is missing, allowing unauthenticated remote attackers to perform a low-integrity action per CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. No public exploit code or CISA KEV entry was identified at time of analysis, so this is assessed as a modest-severity, integrity-only issue rather than an actively exploited urgent threat. The practical risk is abuse of the plugin's affiliate functionality on sites running the affected version.
Majestic Support plugin through 1.2.0 for WordPress allows remote unauthenticated attackers to perform unauthorized low-integrity actions because a plugin endpoint omits an authorization check. Only integrity is affected, with no confidentiality or availability impact expected, and no public exploit identified at time of analysis.
Unauthenticated remote attackers can exploit missing authorization checks in the Unlimited Elements for Elementor (Free Widgets, Addons, Templates) WordPress plugin, affecting all versions through 2.0.20. Because the vulnerable endpoint performs no proper access-control validation, a request sent without authentication can reach restricted functionality or data, though the assessed impact is limited to low confidentiality loss with no integrity or availability effect, giving a CVSS 3.1 base score of 5.3. There is no indication of confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; the primary prerequisite is simply that an affected, active installation of the plugin be reachable over the network.
Missing authorization in Gemini Labs Site Reviews WordPress plugin through 8.3.2 lets unauthenticated remote attackers trigger an improperly access-controlled action, potentially modifying site data with limited integrity-only impact; confidentiality and availability are not affected per the assessed CVSS vector. The flaw is CWE-862 and requires no authentication, no user interaction, and no special privileges in default configurations, making it remotely reachable on sites where the plugin is active. No public exploit or confirmed active exploitation is indicated by the available data, and no fixed version is named in the provided intelligence; Patchstack reported the issue.
WP Ultimate CSV Importer plugin for WordPress, through version 9.1, exposes embedded sensitive data to unauthenticated network attackers. The plugin inserts sensitive information into sent data, allowing retrieval of partial confidential information without authentication, user interaction, or special configuration. The impact is confidentiality-only and low-to-moderate, with no public exploit code identified at time of analysis.
Authenticated users on MISP instances before 2.5.48 can read restricted discussion thread titles and quoted post content, and can inject new posts into threads they are not authorized to participate in, because PostsController::add validated only the thread's organization-only distribution flag instead of the full thread access control list (sharing-group membership and associated event visibility). Exploitation requires a valid MISP account (the CVSS vector shows PR:L, so it is not exploitable unauthenticated) plus knowledge or enumeration of a target thread ID, but no user interaction. No public exploit code has been identified at the time of analysis, and the impact is confined to confidentiality and integrity of discussion content, making this a genuine but modest-severity authorization flaw rather than a critical one.
Authorization scope leakage in Apache APISIX 2.3.0 through versions before 3.7.0 allows an authenticated attacker to have a prior request's Keycloak authorization scope bleed into a later request on the same route, producing unintended authorization expansion and inconsistent access-control decisions. Exploitation requires the route to be running the authz-keycloak plugin in a supported configuration and depends on request timing/ordering across a shared route state rather than a single self-contained request, which keeps this a modest-severity access-control defect rather than a broad compromise path. The vendor has released a fix in 3.7.0; no public exploit code was identified and the issue is not confirmed as actively exploited (no CISA KEV listing) at time of analysis.
FluentForm WordPress plugin versions through 6.2.14 allow a remote, unauthenticated attacker to remove or alter intended client-side form functionality due to an incorrect behavior order flaw (CWE-696). The assessed impact is limited to integrity of client-side behavior (I:L) with no data disclosure, server compromise, or availability loss, and no public exploit or active exploitation has been identified at time of analysis.
Cross-site request forgery in the post feedback function of Ghost CMS lets an attacker submit feedback on behalf of any logged-in member who visits a crafted link, affecting versions 5.19.0 up to (but not including) 6.57.1. The attacker needs no account on the target site, but the attack only works against a victim who is an authenticated member with an active session and who follows the malicious page, and the resulting impact is integrity-only - unwanted feedback entries with no confidentiality or availability effect (CVSS 3.1: 5.3). No public exploit code was identified at time of analysis, and the vendor has released a fix in Ghost 6.57.1.
Information disclosure in Ghost CMS affects versions 5.125.1 up to but not including 6.57.1, where the Admin Feedback endpoint omits a proper authorization check and lets an authenticated staff user retrieve member records they should not be able to see. The flaw is credential-gated (assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), needs no user interaction, and is limited to confidentiality of member data with no integrity or availability impact, which is why the published 5.3 base score reflects a moderate rather than emergency-level risk. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, so realistic exposure depends mainly on how many staff accounts an instance provisions and how sensitive its member records are.
A race condition in Ghost CMS's staff invitation acceptance flow (affecting versions 0.5.0 through 6.22.x) allows someone holding a valid invitation token to create more than one user account from that single-use invite by firing concurrent acceptance requests before the token is marked consumed. The impact is integrity-only and low (independent assessment: CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, matching the published 5.3), since exploitation is opportunistic rather than deterministic and requires a legitimately issued staff invite token; no public exploit code or confirmed active exploitation was identified at time of analysis. Ghost 6.23.0 contains the vendor fix.
Authenticated low-privilege staff users on Ghost sites can read Admin API keys that should only be visible to higher-privileged accounts, handing them credentials intended for trusted integrations. The exposure affects the Ghost npm package from 3.23.0 through 6.22.x and is resolved in 6.23.0, with the CVSS vector (PR:L, AV:N, no UI) confirming that a valid staff login on a remote instance is the only prerequisite. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the independent assessment rates this as a genuine but modest-severity information-disclosure and privilege-escalation risk driven by insider or compromised-staff scenarios rather than unauthenticated remote attack.
Authenticated low-privilege staff users on Ghost CMS versions 4.3.0 through 6.57.x can abuse staff tokens to modify posts beyond the permissions granted to their role, effectively bypassing the post-editing restrictions that separate Authors and Contributors from higher-privileged editors. Exploitation requires a valid, already-provisioned staff account (PR:L in both the reported and independently assessed vectors), so it is not reachable by anonymous internet users, and the impact is confined to unauthorized content modification (integrity) with no data disclosure or availability loss. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so this is a moderate, authenticated-only authorization flaw rather than a widespread-exploitation priority; a vendor patch is available from Ghost in version 6.58.0.
Staff invite acceptance in Ghost before 6.62.0 allows the holder of a valid invite token to create their account with an arbitrary, attacker-chosen email address instead of the address the invite was issued to, breaking the binding between an invited identity and the resulting staff account. Exploitation is authenticated (CVSS PR:L) and depends on a legitimate invite token already existing and having been leaked, forwarded, or otherwise exposed - a remote unauthenticated attacker cannot mint an invite and trigger this on their own - and the assessed impact is integrity-only with no confidentiality or availability loss (CVSS:3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), making this a low-to-moderate risk issue despite the 'authentication bypass' label. No public exploit identified at time of analysis; the vendor has released a fix in Ghost 6.62.0.
Order payment integrity in the Payments for Hubtel WordPress plugin before 1.0.2 can be bypassed because the plugin's payment callback/notification (IPN) handler does not verify that incoming notifications actually originate from the payment provider, allowing unauthenticated remote attackers to mark arbitrary orders as paid without any money changing hands. Any WordPress site running the affected plugin is exposed by default, since the callback endpoint must remain network-reachable for the legitimate provider; the only practical prerequisite is referencing a valid or guessable pending order ID. Rated CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), this is a moderate integrity-only flaw - no CISA KEV listing, no public exploit identified at time of analysis, and EPSS data was not supplied; the vendor has released a fix in 1.0.2.
Unauthenticated information disclosure in the Payments for Hubtel WordPress plugin (all versions before 1.0.2) allows remote attackers to retrieve the order key of an arbitrary order through the plugin's public payment-callback request and then view that order's contents. The flaw is an authorization bypass through user-controlled key (CWE-639): the callback handler redirects the requester without verifying they are permitted to view the order, so an attacker needs only to reach the callback endpoint and reference or guess a valid order identifier. It is a genuine but modest-severity issue (CVSS 3.1 base 5.3, AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), with no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis; the practical limit is that it grants read-only exposure of one order at a time and does not permit modification, privilege escalation, or service disruption.
Unauthenticated attackers who obtain a valid signed click-tracking URL from the Newsletter - Send awesome emails from WordPress plugin (all versions up to and including 9.3.9) can receive a subscriber's permanent raw authentication token in a Set-Cookie response header and use it to export that subscriber's full PII record, rewrite their stored profile, or silently unsubscribe them. Exploitation requires possession of one leaked signed link - such links are embedded in every external link of every newsletter, carry no timestamp, and never expire until the site's relink key rotates - but no nonce, password, authentication, or email challenge is needed once the URL is observed. Rated CVSS 5.3 (AV:N/AC:L/PR:N/UI:N, with confidentiality and integrity impact of Low per independent assessment); no CISA KEV listing and no public exploit code identified at time of analysis, making this a bounded data-privacy and account-manipulation issue rather than a server-compromise emergency.
Server-side request forgery in Ghost (TryGhost) versions 1.18.0 through 6.27.0 allows an authenticated staff-level user with permission to create or edit webhooks to make the Ghost server send requests to internal network resources, including cloud metadata services. Vendor scoring is CVSS 5.1 with PR:H, reflecting that the attacker must already hold privileged access; no public exploit code was identified at time of analysis and there is no CISA KEV listing.
Prototype replacement in stream-json before 3.6.0 lets a JSON key literally named __proto__ overwrite the prototype of an assembled object, because Assembler and FlexAssembler wrote properties with plain assignment and thereby invoked the inherited setter instead of creating an own data property. Applications that read authorization, feature-flag, or control-flow values through prototype inheritance from a parsed object - or that call Object.prototype methods on it - can consume attacker-controlled inherited properties or hit runtime errors when the prototype is null; the global Object.prototype is never polluted, so impact is confined to the individual parsed object (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L, low integrity and availability impact only). No public exploit code was identified at time of analysis and the issue is not in CISA KEV, but the flaw is genuine and its real-world exposure hinges on a disputed threat model: the maintainer documents intended input as locally owned dumps, exports, and logs (AV:L) while the reporter treats untrusted JSON parsing as part of the library contract, and no authentication or user interaction is required once hostile JSON reaches the parser (PR:N/UI:N).
Stack-based buffer overflow in OpenSC's SetCOS smart-card driver (setcos_construct_fci_44 in src/libopensc/card-setcos.c) lets attacker-influenced file attribute data overwrite a fixed-size stack buffer during a file-creation operation. OpenSC builds through 0.27.1 that compile in the SetCOS driver are affected; per the assessed CVSS:3.1 vector (AV:L/PR:L/UI:R) this is a local, low-privilege issue that requires user interaction, such as a user running OpenSC tooling against a malicious or manipulated SetCOS card, with limited confidentiality, integrity and availability impact. Although the upstream fix is publicly visible as a GitHub commit and pull request, no public exploit code or confirmed active exploitation was identified at time of analysis.
Stored cross-site scripting in the Prime Mover WordPress plugin before 2.2.1 allows an authenticated low-privilege attacker who can write a crafted package into the plugin's prime-mover-export-files directory to execute arbitrary JavaScript in an administrator's browser. The malicious site_title value inside a package's footprint.json is rendered unescaped by the column_site_title() method in PrimeMoverBackupMenuListTable.php whenever an admin opens the Prime Mover Packages list table, and no package restoration is required for the payload to fire. Exploitation is bounded rather than drive-by: the attacker needs a prior write foothold on that directory and the payload is inert until a privileged user views the specific admin screen; no public exploit code has been identified at time of analysis, there is no CISA KEV listing, and no EPSS score was supplied in the available data.
Improper issuer validation in Apache APISIX 3.12.0 through 3.18.0 lets an attacker who already holds a valid token for one issuer get that token accepted on an API route restricted to a different issuer, when the openid-connect plugin is configured for remote introspection against an authorization server that serves multiple issuers. The exposure is configuration-dependent: single-issuer auth servers, routes that do not use the openid-connect plugin, and deployments using local JWT validation instead of remote introspection are not affected, and versions 3.19.0 and later are patched. No public exploit code has been identified at time of analysis, and there is no confirmed active exploitation (CISA KEV); the CVSS 4.0 base score is 5.1 with subsequent-system confidentiality impact, reflecting a genuine but conditional authentication-boundary weakness rather than a widespread emergency.
Path traversal in the Ghost CMS ImageSize service (versions 6.14.0 through releases prior to 6.27.0) lets an authenticated staff user with elevated privileges read arbitrary local files from the server outside the intended data/storage directories. Exploitation is network-reachable and requires no user interaction, but is gated behind valid staff credentials, so the impact is bounded to file disclosure (confidentiality only, with no integrity or availability effect). No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (CISA KEV), making this a moderate, authentication-gated risk (CVSS 5.1) that the vendor has fixed in Ghost 6.27.0.
Reflected cross-site scripting in MISP before 2.5.48 lets an attacker execute arbitrary JavaScript in an authenticated site administrator's browser by luring that admin to a crafted URL whose taxonomy tag name parameter is echoed unescaped into the legacy add_tag and disable_tag confirmation views. Exploitation requires no credentials or prior access to the instance (PR:N), but it cannot be self-triggered: the payload only fires in the victim admin's session after active user interaction with a malicious link (UI:A), so convincing phishing is the decisive limiting factor. There is no CISA KEV listing and no public exploit code identified at time of analysis, and the vendor has released a patch (fixed in 2.5.48, commit 9619083c8), making this a genuine but low-to-moderate priority issue rather than an exploitable-at-scale flaw.
Hard-coded credentials in Johnson Controls EasyIO FS32 firmware before 3.0b63 allow an attacker with adjacent-network access to use embedded login secrets and cause a high availability impact on the controller; the assessed CVSS 3.1 vector is AV:A/AC:L/PR:N/UI:N with only availability affected (C:N/I:N/A:H). This is not remotely internet-exploitable, the vendor notes an additional precondition (CVSS 4.0 AT:P), and no public exploit identified at time of analysis, making it a moderate, context-dependent risk. Johnson Controls lists the fix as EasyIO FS32 firmware 3.0b63 and later, with the advisory at its trust center.
Revoking runtime permissions from other apps is possible on Motorola devices running Motorola Setup App versions before the 2026-01-01 fixed release, because an exported Setup App component lacks a guarding permission (CWE-862). A local, low-privilege malicious app already installed on the same device can trigger this without user interaction (CVSS 4.8, PR:L/UI:N); remote exploitation is not possible, and there is no data disclosure. No public exploit code identified at time of analysis, and the vendor has made a patch available.
Predictable machine-account passwords produced by the adjoin utility in Fortra BoKS Server Agent can be guessed by a remote, unauthenticated attacker who can estimate when the password was generated, because the utility's generation routine yields significantly less entropy than intended. Rated CVSS 4.8 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N), the exposure is limited to AD-integrated deployments that ran an Active Directory join or machine-account password renewal through adjoin; the timing dependency required to narrow the password space is the principal barrier, reflected in the high attack-complexity metric. There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, and the impact is confined to predicting that specific machine-account credential rather than achieving direct host compromise.
Stored cross-site scripting in the Entradium event-ticketing platform allows an authenticated event organizer to inject JavaScript into the Help text and Title parameters of the /events/<event_name>-<event_city>/custom_form/edit endpoint when creating or editing forms tied to an event's ticket sales; the payload persists and executes in the browser of any user who subsequently loads that event's public ticket-purchase page. Rated CVSS 4.8 (CVSS 4.0) and assessed independently as AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, the issue is bounded by the low-privileged organizer account required for injection and the victim-visit condition needed for execution, yielding low confidentiality and integrity impact scoped to the affected event page. No public exploit identified at time of analysis, and no vendor-released patch identified at time of analysis.
Stored cross-site scripting in Entradium lets an authenticated promoter inject JavaScript into the Business Name field at the /promoters/edit endpoint, and that payload executes in the browser of anyone who later loads the promoter's public profile page. Because the injection point is a field the attacker already controls, the payload only reaches visitors of that specific promoter page rather than arbitrary chosen victims, and it requires victim interaction (the page must be loaded) - authentication as a promoter is required (PR:L in the assessed vector). No public exploit code or confirmed active exploitation was identified at time of analysis, and the low CVSS 4.0 base score (4.8) reflects limited confidentiality and integrity impact.
Stored cross-site scripting in Entradium (by Crocantickets) allows an authenticated attacker with privileges to create event discounts to inject JavaScript into the Name or Field parameters of the /tools/discount_wizard/discount_config endpoint; the payload executes when a victim views an event's discount list page, potentially leading to session data theft if the victim interacts with a crafted URL. The vendor-assigned CVSS 4.0 score is 4.8 (MEDIUM), consistent with the independent assessment that this is a low-to-moderate priority issue requiring authentication and user interaction. No public exploit code or active exploitation has been identified at time of analysis.
Stored and reflected cross-site scripting in Entradium (by Crocantickets) lets an authenticated promoter-level account inject JavaScript through the event creation/editing workflow: the City parameter at /events/<event_name>/edit_general is stored and executes on the event's public page, while the Description parameter at /events/<event_name>/edit-general is reflected when required fields are left blank and the resulting crafted URL is delivered to a victim. Both variants require victim interaction (viewing the public event page or clicking the attacker-supplied link) and a promoter-level account, which keeps realistic exploitability low to moderate; the vendor CVSS 4.0 base score is 4.8, and the independent assessment scores it CVSS 3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. No public exploit identified at time of analysis, and there is no confirmed actively exploited (CISA KEV) status. Successful exploitation could allow theft of session data from users who view the affected event page or follow the crafted link.
Reflected cross-site scripting in the MISP threat-intelligence platform allows an authenticated attacker to inject arbitrary JavaScript into the analyst data notes panel by supplying a crafted value in the 'seed' URL path parameter, which the application reflects unsanitized into inline JavaScript in the rendered page. The victim must already be logged into MISP and be persuaded to open the malicious link (for example via phishing), so exploitation depends on user interaction and prior authentication; impact is confined to the victim's browser session (session token or page-data theft, interface manipulation) rather than the server. The issue affects MISP builds prior to commit 58925dbf0 (post v2.5.48), where the parameter is forcibly cast to an integer; no public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor assessment rates overall risk as low.
Reflected DOM-based cross-site scripting in the Calculated Fields Form - AI Form Builder for WordPress plugin (all versions up to and including 5.5.1.3) allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by luring them to a crafted link, provided the targeted form contains a Text Area field configured with a 'url.<name>' Predefined Value and predefinedClick disabled - a documented, commonly used but per-form configuration the attacker does not control. With a CVSS of 4.7 (AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N), the practical risk against arbitrary installs is limited by that configuration prerequisite and the required user interaction, and the impact is scoped to the victim's session rather than the server. No public exploit code was identified at time of analysis and the vulnerability is not listed in CISA KEV.
Reflected cross-site scripting in the If-So Dynamic Content WordPress plugin (versions 1.8 through before 1.10.2) lets remote unauthenticated attackers inject arbitrary JavaScript into an AJAX response served as HTML, because a request-supplied value is reflected without output escaping. Exploitation is not passive: the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N) requires a victim to open an attacker-crafted link, so each target must be individually lured via phishing or social engineering, which confines practical impact to targeted campaigns. The issue is rated 4.7 (MEDIUM) with no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; a vendor patch is available.
Local user-mode threads in Zephyr RTOS builds that enable CONFIG_USERSPACE and CONFIG_SMBUS can invoke the smbus_smbalert_remove_cb() and smbus_host_notify_remove_cb() syscalls with an arbitrary pointer, silently unregistering SMBALERT or Host Notify callbacks that supervisor-mode code registered and thereby disabling alert handling system-wide; the same pointer can also be probed for valid kernel addresses because the syscall returns 0 on a hit versus -ENOENT on a miss. Exploitation is authenticated and local (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L, 4.4), requiring a user-mode thread that has already been granted the SMBus device object, and is limited to configurations using the Intel PCH SMBus driver with CONFIG_SMBUS_INTEL_PCH_SMBALERT or CONFIG_SMBUS_INTEL_PCH_HOST_NOTIFY, or the STM32 SMBus driver with CONFIG_SMBUS_STM32_SMBALERT; builds with CONFIG_ASSERT=y additionally turn a bogus pointer into a supervisor-mode fault and fatal system error, leaking which addresses are mapped. There is no impact on builds without CONFIG_USERSPACE or without an SMBus driver supporting SMBALERT/Host Notify, and no public exploit identified at time of analysis.
An authorization bypass in the Redux Framework WordPress plugin, affecting all versions up to and including 4.5.14, lets an authenticated subscriber-level user delete arbitrary media library attachments - including files owned by administrators - by supplying an attacker-chosen attachment_id. Exploitation depends on a non-default configuration: a Custom Fonts field must be registered on the user profile page via Redux_Users::set_profile(), which causes the required redux_custom_fonts nonce to be rendered into the Subscriber's wp-admin/profile.php and hands the attacker the token needed for the unprotected deletion action. The impact is limited to integrity (deletion of attachments) with no confidentiality exposure or code execution; no public exploit code has been identified at time of analysis, and the issue is not in CISA KEV. Vendor-released patch: 4.5.15.
Denial of service in the mod_dav module of Apache HTTP Server 2.4.67 and earlier (EUVD lists affected versions as up to and including 2.4.68) allows remote attackers who hold an account permitted to create WebDAV locks to crash server child processes, degrading or interrupting service availability. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L, score 4.3) confirms the attacker must be authenticated with lock-creation privileges and that impact is limited to availability - there is no data exposure, integrity loss, or code execution. Only servers that have loaded and enabled mod_dav with lock support are reachable, so default Apache installations are not affected; no public exploit has been identified at time of analysis (CISA SSVC records Exploitation: none, Automatable: no). Vendor-released patch: Apache HTTP Server 2.4.69.
An authorization bypass in Red Hat Satellite's Katello RegistryProxiesController allows an authenticated low-privilege attacker to enumerate valid Users, Organizations, and Products across the instance via differential responses. The flaw stems from a missing return statement in the registry_authorize filter, which flags unauthorized requests but fails to halt execution, letting the request proceed into database validation filters that leak internal state. No public exploit identified at time of analysis; the vendor has released an errata (RHSA-2026:74503).
Input validation failures in HCL BigFix Service Management allow remote attackers to inject malformed data into the application, potentially causing injection attacks or errors in downstream processing systems. The CVSS vector (AV:N/AC:L/PR:N/UI:R) indicates network-accessible, low-complexity, unauthenticated access, but exploitation requires user interaction, so an attacker cannot complete the attack alone. Impact is limited to low integrity with no confidentiality or availability effect, making this a moderate-to-low real-world priority; no public exploit identified at time of analysis.
Authorization bypass in DeepTutor 1.4.0 allows an authenticated remote attacker with a valid account to trigger the regeneration of another user's session turn by supplying a victim's session_id to TurnRuntimeManager.regenerate_last_turn, compromising session integrity. Exploitation requires low privileges and knowledge of a valid session_id; the EPSS score is 0.15% and no public exploit identified at time of analysis.
Insecure cross-origin resource sharing (CORS) configuration in HCL iControl allows an attacker-controlled website to issue credentialed cross-origin requests against the product, letting the attacker read and exfiltrate sensitive data that is reachable within a victim's authenticated browser session. The vendor scores this 4.3 (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), while independent assessment also rates it 4.3 but with AV:N/AC:L/PR:N/UI:R - reflecting that although the attacker needs no server-side credentials of their own, the victim must be authenticated to iControl and must be lured to the attacker's page, so the practical prerequisite is user interaction rather than attacker authentication. Impact is confined to confidentiality (read/exfiltration; no integrity or availability effect), and no public exploit code or CISA KEV entry has been identified at time of analysis.
Authenticated low-privilege users can bypass authorization checks in the WordPress plugin Majestic Support through version 1.2.0, because the plugin accepts user-controlled object identifiers without verifying ownership or access-level permissions (CWE-639). Successful exploitation is limited to integrity impact-unauthorized changes to other users' support objects-with no confidentiality or availability effect per the assessed CVSS vector, and it requires a valid low-privilege account while the plugin is installed and active. This is a modest-severity authorization flaw rather than an urgent priority; no public exploit code or confirmed active exploitation was identified in the provided intelligence at time of analysis.
Authenticated users on JetBrains YouTrack instances running versions prior to 2026.2.19422 can trigger unauthorized reloads of translation catalogs because the endpoint enforcing that operation lacks a proper authorization check (CWE-862). Exploitation is bounded by the CVSS vector (AV:N/AC:L/PR:L/UI:N) - a valid low-privileged account is required, and the impact is confined to availability (A:L) with no data disclosure or modification (C:N/I:N). No public exploit code has been identified at time of analysis and there is no evidence of confirmed active exploitation; the overall real-world risk is low, and the vendor has shipped a fixed release.
Denial of service in geopy versions prior to 2.5.0 allows an unauthenticated remote attacker to consume excessive CPU by supplying a long, malformed coordinate string to geopy.Point, Point.from_string(), or a geocoder reverse() method invoked with a string argument. The root cause is catastrophic backtracking (CWE-1333) in the POINT_PATTERN regular expression; the fix in 2.5.0 adds a 256-character input cap that rejects oversized input immediately, while the numeric Point constructor is unaffected. Impact is availability-only (C:N/I:N/A:L) with no code execution or data exposure; no public exploit code was identified at time of analysis, and reachability depends on the host application exposing one of the string-parsing entry points to untrusted input.