Pandora FMS installations running version 777 or later expose monitoring module history to cross-group reads: an authenticated low-privilege user can retrieve the history of modules belonging to groups they are not authorized to access, bypassing the platform's group-based access control boundary. The underlying flaw is a broken-object-level-authorization issue (CWE-639) with confidentiality-only impact - attackers can read data, but cannot modify, delete, or disrupt it - and exploitation requires a valid account with low privileges (PR:L per the CVSS vector), so unauthenticated attackers are not affected. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; practical risk is highest in multi-tenant or segregated-team deployments where group separation is a real security boundary, and is negligible in single-group installations where there is no boundary to cross.
Authorization bypass in MISP's event flattening feature lets an authenticated user who can view a community-distributed event retrieve attributes that belong to organisation-only objects (distribution level 0) or objects restricted to a specific sharing group they are not a member of. MISP versions below 2.5.48 drop the Object containment from the query when the flatten option is used and return those object attributes as top-level event attributes without re-applying the object's own distribution or sharing-group access check, resulting in unauthorized disclosure of sensitive threat intelligence. This is a genuine but access-gated information-disclosure flaw, not a high-urgency internet-wide threat: exploitation requires a valid authenticated account, an event the user's organisation can already see via community distribution, and that event containing at least one object whose distribution is more restrictive than the event itself; no public exploit identified at time of analysis.
Reflected cross-site scripting in the Five Star Restaurant Reviews WordPress plugin (all versions before 2.3.14) lets unauthenticated attackers inject arbitrary JavaScript into an HTML tag via a crafted request that a victim must be socially engineered into submitting, with the script then running in that victim's browser - including a logged-in administrator, where it executes with administrative privileges. The vendor has shipped version 2.3.14 to correct the missing output escaping (CWE-79); no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis. The vendor CVSS 3.1 vector (7.1: AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) reflects network reachability, low attack complexity, no required privileges, mandatory user interaction, and a scope change caused by script execution in the victim's browser rather than the plugin's own context; our assessment keeps the same vector but sets the availability impact to none (A:N).
Authenticated Octopus Server users who hold a limited, environment-scoped permission set can execute arbitrary scripts against environments that their scoped authorization does not cover, yielding high integrity impact (VI:H) on deployment targets they should not control. Exploitation requires a valid account with at least some scoped permission plus access to the Octopus management interface (CVSS 4.0 7.1, PR:L, no user interaction), which makes this an authorization-enforcement failure rather than a true authentication bypass despite the 'Authentication Bypass' tag. No public exploit code and no confirmed active exploitation were identified at time of analysis.
Authenticated WordPress administrators can abuse the Prime Mover plugin before 2.2.1 to delete arbitrary directories outside the intended extraction path by importing a crafted WPRIME/TAR package whose wprime-config.json contains manipulated tar_root_folder values, ultimately tricking primeMoverDoDelete() into removing critical directories such as wp-admin, which can render the site inoperable. Exploitation requires a high-privileged WordPress administrator account (CVSS PR:H) that performs the package import, so this is not reachable by unauthenticated or low-privileged users; no user interaction beyond the admin's own import action is required. This is a moderate, not top-tier, priority issue: no public exploit code has been identified and there is no CISA KEV listing, though the confidentiality impact is nil while integrity and availability impacts are high, and the vendor has released a fix in version 2.2.1.
Cross-project approval forgery in n8n's Send-and-Wait approval feature allows an authenticated attacker with workflow-creation permissions to mint valid signed resume URLs for approval gates in projects they cannot access by supplying caller-controlled node IDs that contain unresolved path-traversal sequences. Affected releases are n8n before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1; the issue is meaningful primarily in multi-project or multi-tenant deployments where project isolation is relied upon as a security boundary. The independent assessment rates this as a genuine but moderate-severity issue with low likelihood of mass exploitation; no public exploit identified at time of analysis, and vendor patches are available.
Unauthenticated remote attackers can exploit NoSQL injection in the n8n MongoDB Chat Memory node to bypass sessionId validation and read or manipulate stored conversation histories belonging to other users, rated CVSS 4.0 base 7.0 (network-reachable, low complexity, PR:N) and assessed by us as CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. The exposure is conditional rather than default: exploitation requires a target instance to run a workflow that uses the MongoDB Chat Memory node and to have its sessionId-handling path reachable (the CVSS 4.0 AT:P attack requirement), so installations that never use that node are unaffected, and the real-world impact depends on the sensitivity of the conversation content stored. Patch is available from the vendor in n8n 1.123.80, 2.39.6 and 2.40.1, and no public exploit code has been identified at time of analysis.
Physical access to a range of ASUS Z390-era motherboards - Prime Z390-A, Prime Z390-A/H10, the ROG Maximus XI family (Hero, Hero Wi-Fi, Formula, Code, Extreme, Apex, Gene), ROG Strix Z390-E/F Gaming, Pro WS C246 ACE and WS Z390 Pro - allows an attacker to read and write arbitrary host memory by inserting a specially crafted device, because the platform fails to correctly initialize the protections governing device memory access. The CVSS v4.0 vector (AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, scope unchanged) confirms high confidentiality, integrity and availability impact with no authentication or user interaction required once hands-on access is obtained, but the decisive limiting factor is AV:P: the flaw is unreachable remotely or over a network and is realistically confined to evil-maid, supply-chain, repair-shop or shared-physical-access scenarios. ASUS is credited as the reporter and the vendor security advisory at https://www.asus.com/security-advisory is the authoritative reference; no public exploit identified at time of analysis.
Cross-site request forgery in the Lektor admin API lets unauthenticated remote attackers perform state-changing actions - writing arbitrary files via newattachment, deleting pages via deleterecord, wiping build output via clean/build, and triggering deployment via publish - when an operator visits a malicious web page while the admin server is running. The flaw affects Lektor 3.3.14 and 3.4.0b15 and stems from the complete absence of CSRF tokens, Origin/Referer validation, CORS configuration, or Host allowlisting; read endpoints can additionally be reached via DNS rebinding to disclose data. No public exploit code or confirmed active exploitation was identified at time of analysis.
SQL injection in the n8n Oracle Database node's Delete Table Drop operation lets an attacker break out of the table or schema identifier with a single quote and append arbitrary SQL, which then runs against the connected Oracle database with the privileges of the stored credential. Affected releases are n8n before 1.123.80, 2.0.0 through 2.39.5, and 2.40.0 (fixed in 2.39.6 and 2.40.1 respectively); the CVSS vector records PR:N, i.e. unauthenticated, but exploitation is conditional on a workflow that actually uses the Oracle Database node's Delete Table Drop operation with table or schema values sourced from attacker-influenceable input, which is why attack complexity is rated high (AC:H/AT:P) and the issue does not affect a default install with no such workflow. Vendor patches are available and no public exploit code or confirmed active exploitation was identified at time of analysis.
Apache HTTP Server before 2.4.69 can be forced into repeated re-authentication by unauthenticated remote attackers sending forged Authorization headers when Digest authentication is enabled with the non-default AuthDigestNcCheck directive. Successful exploitation causes a limited availability impact, denial of service through forced re-authentication, without compromising data confidentiality or integrity. No public exploit code was identified at time of analysis, and the flaw is constrained to the uncommon Digest-auth-plus-AuthDigestNcCheck configuration.
An out-of-bounds write in Apache HTTP Server's mod_proxy_html output filter affects versions 2.4.0 through 2.4.68 and can be triggered by a crafted HTML response body that the server parses and rewrites while proxying upstream content. The assessed vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H) indicates remote unauthenticated attackers can reach the flaw, but high attack complexity reflects a significant deployment prerequisite: mod_proxy_html must be explicitly loaded and actively rewriting proxied HTML, which is not a default configuration, and the attacker must be able to influence the upstream/backend response body being processed. The result is memory corruption with low confidentiality and integrity impact and a high availability impact, and no public exploit has been identified at the time of analysis; servers used solely as origin web servers, or proxies that do not enable mod_proxy_html, are not affected.
Authentication bypass in the mod_auth_digest module of Apache HTTP Server 2.4.x allows a man-in-the-middle attacker to capture a victim's HTTP Digest authentication credentials and replay them to impersonate that user against the server. Exploitation is conditional: the server must have mod_auth_digest enabled and the non-default directive AuthDigestNonceLifetime must be explicitly set to 0, and the attacker must additionally occupy a network interception position to capture the digest exchange and send crafted requests that force garbage collection of the client's shared-memory nonce entry. The assessed vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N) reflects high confidentiality impact but a high attack-complexity and MITM prerequisite; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the source supplied no CVSS score or EPSS estimate.
An out-of-bounds write in Apache HTTP Server's optional mod_charset_lite module (affecting versions 2.4.0 through 2.4.68) can corrupt process memory when character-set translation is configured, potentially crashing the server or enabling limited data disclosure or modification. Exposure is narrow: mod_charset_lite is not loaded in default installations and must be explicitly enabled and bound to a content path via directives such as CharsetSourceEnc, CharsetDefault, or an associated input/output filter, which is why the assessed vector rates attack complexity as high (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L). Independent signals are otherwise sparse - no public exploit code, no CISA KEV listing, and no EPSS score were available - so no public exploit identified at time of analysis, and the practical severity hinges on whether the module is deployed.
Denial of service in Apache HTTP Server releases before 2.4.69, where the mod_xml2enc filter dereferences a NULL pointer when a proxied response declares a charset whose conversion partially succeeds and then fails, crashing the handling child process. Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L), the crash is reachable without credentials over the network, but exploitation is gated by a trust boundary: the request path must run proxied backend responses through mod_xml2enc (in practice mod_proxy_html content rewriting), and the attacker must control or have compromised that upstream backend server - ordinary external clients cannot directly trigger it. Impact is limited to availability (worker/child process termination with no confidentiality or integrity effect), and no public exploit code, KEV listing, or EPSS score was provided at time of analysis, so this is best treated as a low-to-moderate priority hardening item for reverse-proxy deployments that transform untrusted upstream content.
Forward proxy deployments of Apache HTTP Server through 2.4.68 that relay FTP traffic can be manipulated by an untrusted FTP server into opening a data connection to an arbitrary third-party host, because mod_proxy_ftp fails to validate the address returned in an FTP PASV reply. Only non-default configurations with forward proxying enabled (ProxyRequests On) and mod_proxy_ftp loaded are affected, and the primary impact is a misdirected outbound data connection rather than compromise of the proxy host itself. No KEV entry, EPSS score, or POC was supplied and no public exploit has been identified at time of analysis, so prioritization signals are limited and authentication requirements are not confirmed from the supplied data.
Inconsistent interpretation of HTTP responses in Apache HTTP Server's mod_proxy_uwsgi module lets a crafted backend uwsgi response that carries a Transfer-Encoding header be parsed differently by Apache than by the backend, enabling HTTP response smuggling and desynchronization between the proxy and downstream clients. Affected deployments are Apache HTTP Server 2.4.30 through 2.4.68 configured as a reverse proxy to a uwsgi backend via mod_proxy_uwsgi; installations that do not load or use mod_proxy_uwsgi are not affected. The assessed vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N) is network-reachable by unauthenticated remote attackers, but exploitation is gated by high complexity because the attacker must control or influence the backend uwsgi response - typically through a malicious or compromised backend application, or a response-header-injection flaw in it - so this is not reachable against a default Apache install. No public exploit code has been identified and there is no indication of confirmed active exploitation (no CISA KEV listing); impact is limited to low confidentiality and low integrity with a scope change, not full remote code execution or denial of service.
Concurrent Digest authentication requests against Apache HTTP Server before 2.4.69 can corrupt authentication state via a use-after-free in the mod_auth_digest module, yielding low integrity and availability impact with no confidentiality impact (per the assessed vector AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L). Unauthenticated remote clients can reach the flaw, but exploitation is gated by two non-default preconditions: AuthDigestNcCheck must be enabled or AuthDigestNonceLifetime set to 0, and the attacker must win a timing-dependent race by sending concurrent Digest requests - serial requests will not reliably trigger it. There is no public exploit identified at time of analysis, no EPSS score, no CISA KEV entry, and no vendor-supplied CVSS, so the sole source is the Apache advisory; the fix is version 2.4.69.