Information disclosure in Google Chrome's SVG rendering engine allows remote attackers to obtain sensitive data from the browser by convincing a victim to open a crafted HTML page that embeds or references a malicious SVG, affecting Chrome versions prior to 154.0.8037.97. Exploitation is gated by mandatory user interaction (the victim must load the attacker-controlled page), but requires no authentication or special privileges and works against default Chrome configurations; the integrity and availability of the system are unaffected, while confidentiality impact is high. As of analysis there is no CISA KEV listing and no public exploit code identified, and the EPSS score is very low (0.17%, ~6th percentile), so near-term mass exploitation is unlikely, though the flaw remains relevant given Chrome's ubiquity. Vendor-released patch: 154.0.8037.97.
Airano MCP Bridge, a WordPress plugin, ships an MCP bridge action that performs privileged operations without validating the caller's capabilities, so any authenticated low-privilege user (for example a Subscriber) can invoke it and modify data that should be reserved for administrators. The flaw affects all versions up to and including 2.11.0, is remotely reachable over the network with low attack complexity and no user interaction, and is rated CVSS 3.1 base 6.5 with high integrity impact but no confidentiality or availability impact. No public exploit code and no confirmed active exploitation were identified at time of analysis, and exploitation is gated on the attacker already holding a valid account on the target site.
Missing authorization in the WebSamurai WordPress plugin (versions up to and including 1.0.7) lets an attacker who already holds a low-privilege authenticated account on the target site invoke a plugin action that lacks a proper capability check, altering site data without permission. Because the CVSS vector is PR:L, exploitation requires a valid low-privilege WordPress session rather than being unauthenticated, and the assessed impact is integrity-only (C:N/I:H/A:N) with no disclosure or denial of service. No public exploit code and no confirmed active exploitation were identified at time of analysis, so real-world exposure is concentrated on sites that permit untrusted user registration or otherwise host low-trust accounts.
Stored cross-site scripting (XSS) in the ThemeREX Addons WordPress plugin, affecting all versions through 2.46.0, allows an authenticated attacker with at least low-level posting privileges to inject malicious JavaScript that executes in the browser of a privileged user who views the compromised page. The vulnerability has a CVSS 3.1 base score of 6.5 and requires victim interaction; no public exploit code or active exploitation has been identified at the time of analysis. Impact is limited to browser-context script execution and does not result in server-side compromise.
Missing authorization controls in AVEZ Electronics Communication Training and Consultancy Trade Inc.'s Learning Management System (LMS) allow an authenticated low-privilege user to reach resources and records beyond their assigned privilege level, resulting in disclosure of confidential data. The flaw (CWE-862) is remotely exploitable over the network with low attack complexity, but requires a valid authenticated session (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), so fully unauthenticated outsiders cannot trigger it directly; impact is confined to confidentiality, with no integrity or availability effect. All LMS instances at or before the 2026-09-18 version baseline are in scope, and no public exploit code has been identified at time of analysis, though no vendor-released patch has been confirmed either.
Stored cross-site scripting in the Download Manager plugin for WordPress (codename065, all versions up to and including 3.3.70) allows any authenticated user with subscriber-level access or above to persist arbitrary JavaScript through the profile Display Name field, which then executes in the browser of any user - including administrators - who views the affected page or the plugin's download statistics/history screens. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) confirms the attacker must be authenticated (PR:L) but no victim interaction is required beyond rendering the injected content, and the scope change (S:C) reflects cross-privilege execution in the administrative context. Exploitation is strictly conditional: the site must expose the [wpdm_edit_profile] shortcode on a front-end page reachable by Subscriber-level accounts, which in practice usually means open self-registration is enabled; sites lacking that shortcode placement or with registration disabled are not exploitable through this path. No public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis, and no EPSS score was supplied, so this should be treated as a moderate, conditionally exploitable issue rather than an urgent one.
Stored cross-site scripting in the Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin for WordPress (all versions up to and including 6.1.1) allows an authenticated attacker to inject arbitrary JavaScript through the 'lsd[remark]' listing parameter, which is then persisted and executed in the browser of any user who later views the affected page. Because the listing-creation branch of the plugin's AJAX handler omits a capability check and the required nonce is publicly emitted on any page containing the [listdom-dashboard] shortcode, the practical prerequisite collapses to merely holding any account on the site - a Subscriber account suffices, making sites with open user registration (typical for directory and classifieds deployments) the primary exposure. There is no public exploit identified at time of analysis and the flaw is not confirmed as actively exploited (CISA KEV); the CVSS 3.1 score is 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N).
Authenticated server-side request forgery (SSRF) in ThemeREX Addons versions up to 2.46.0 allows any logged-in WordPress user with low privileges to force the server to make arbitrary HTTP requests, potentially reaching internal services or cloud metadata endpoints. The CVSS 6.4 rating reflects limited confidentiality and integrity impact, and exploitation requires the plugin to be active and an attacker to hold a valid low-privilege account. No public exploit identified at time of analysis.
GNU GRUB 2.x does not validate the MMIO base address passed to its serial command, allowing a local attacker with high privileges (PR:H) who controls GRUB's configuration to write limited non-arbitrary data to an arbitrary memory address and reset the grub_file_verifiers list, thereby loading unsigned GRUB modules while GRUB still reports lockdown as enabled. The issue only matters when Secure Boot and GRUB lockdown mode are active; it is not remotely reachable (AV:L) and requires high attack complexity (AC:H) to select a base address that yields the needed writes. A vendor fix is available as an upstream commit, but no released patched version is independently confirmed, and no public exploit identified at time of analysis.
Prototype pollution in the JavaScript bindings of Apache Thrift (all versions before 0.25.0) allows unauthenticated remote attackers to corrupt object prototype attributes when an application deserializes attacker-influenced Thrift messages through generated JS code. Impact is integrity-only and limited - the vendor-assigned CVSS 4.0 base score is 6.3, while our independent CVSS 3.1 assessment rates it AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N, reflecting that exploitation requires the JS binding to be in the data path and specific object properties to be reachable. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; Apache has released a fix in version 0.25.0, which also requires regenerating JS code to be effective.
A missing release of memory (CWE-401) in Apache Thrift C++ bindings before 0.25.0 allows remote, unauthenticated attackers to cause gradual memory exhaustion and a low-impact denial of service by repeatedly exercising the vulnerable code path. Exploitation requires a service that uses the affected C++ bindings, is network-reachable, and processes enough requests to accumulate the leak to a service-affecting level; non-C++ bindings are unaffected. No public exploit code or active exploitation has been identified at time of analysis, and the impact is confined to availability with no data exposure or code execution.
Denial of service in Apache Thrift's PHP bindings before version 0.25.0 allows unauthenticated remote attackers to exhaust server resources via unbounded allocation during deserialization of incoming data (CWE-770). The vulnerability requires a non-default or situational precondition (AT:P per CVSS 4.0) and impacts only availability, with no data compromise. No public exploit code or confirmed active exploitation has been identified at time of analysis; the vendor advises upgrading to 0.25.0.
Uninitialized-resource handling in the Apache Thrift C++ WebSocket server causes the server to return incorrect status codes and potentially leak stale memory contents in responses. All Apache Thrift releases before 0.25.0 are affected, but only deployments that actually run the C++ WebSocket server transport are exposed - the default binary and framed socket transports are not in scope. Exploitation is remote and requires no authentication or user interaction, but an attack-requirement precondition (AT:P in the vendor CVSS 4.0 vector, a specific server state or timing condition) makes it unreliably repeatable, and impact is limited to low integrity effects with no confirmed confidentiality or availability loss; no public exploit identified at time of analysis. This is a moderate-severity, low-priority issue rather than an urgent one, and the vendor-released fix is Apache Thrift 0.25.0.
Uninitialized-resource handling in Apache Thrift's c_glib (C/GLib) bindings before 0.25.0 allows unauthenticated, network-reachable attackers to read stale memory contents or receive incorrect status codes from a service built with those bindings, producing limited information disclosure and low availability impact with no integrity impact. There is no public exploit identified at time of analysis, and independent assessment rates this moderate rather than urgent because exposure is narrow (only processes compiled against the c_glib binding are implicated, not Java, Python, C++, Go, or other bindings) and the CVSS attack-requirement metric (AT:P in the CVSS 4.0 vector, AC:H in the assessed CVSS 3.1 vector) signals that a specific request/protocol condition must be met before the vulnerable path triggers.
Angular SSR's CommonEngine (in @angular/ssr/node, and in @angular/ssr for versions 17 through 18) can disclose a sibling prerendered HTML page on Windows when a relative request URL containing a backslash parent-traversal segment is passed to CommonEngine.render, affecting versions prior to 20.3.36, 21.2.23, and 22.1.7. Exploitation is unauthenticated and requires no user interaction (PR:N/UI:N) but is restricted to Windows deployments that pass relative request URLs, have a sibling output directory whose name shares the configured public-directory prefix, and hold a qualifying prerendered Angular page bearing the SSG marker; no public exploit code and no confirmed active exploitation were identified at time of analysis. Independent assessment rates the real-world risk low-to-moderate despite the 6.3 CVSS 4.0 base score, because these stacked platform and directory-layout prerequisites (captured as AT:P) sharply narrow exposure, and the flaw does not permit arbitrary file read - only disclosure of the adjacent prerendered SSG HTML page.
Unpublished draft content can leak to unauthenticated visitors of Next.js sites running versions 16.3.0 through 16.3.7 when Cache Components or the experimental.useCache flag is enabled: pending 'use cache' fills for the same key are shared without isolating Draft Mode requests from regular ones, so an overlapping regular request can be served an editor's unpublished content, and that draft-dependent content can then persist in a prerendered page until revalidation. Exploitation is a narrow timing race that additionally requires an editor to be concurrently using Draft Mode for the same cache key, which is reflected in the high attack-complexity rating (CVSS 4.0 base 6.3, AV:N/AC:H/AT:P/PR:N/UI:N/VC:L); there is no public exploit identified at time of analysis and no evidence of active exploitation. The issue is fixed in Next.js 16.3.8.
Next.js versions 15.0.0 through 15.5.26 and 16.0.0 through 16.3.7 can be coerced into poisoning a shared response cache entry, allowing cross-user content substitution or a persistent denial of service until the poisoned entry is revalidated. The flaw only manifests in applications that combine a root-level catch-all page (for example a top-level [[...slug]] route) with statically generated or Incremental Static Regeneration routes, where the response cache key is not scoped tightly enough to the source route; a single unauthenticated crafted request can collide on that key. Exploitation is real but narrow and gated by high attack complexity and an attack prerequisite (CVSS:3.1/AV:N/AC:H/PR:N/UI:N), so this is assessed as a genuine but moderate-priority issue rather than an emergency; no public exploit code or confirmed active exploitation has been identified at time of analysis. An independent assessment rates impact as low integrity and low availability with scope change (S:C/I:L/A:L), and the supplier CVSS 4.0 vector scores 6.3.
Response-cache confusion in self-hosted Next.js (15.0.0 up to but not including 15.5.27, and 16.x up to but not including 16.3.8) lets an unauthenticated remote request key a cached Pages Router response without sufficiently binding it to the originating source route, so one page's cache entry can be overwritten with content from a different route and every subsequent visitor to the affected page is served the wrong content until the entry revalidates. Scope is narrow: only self-hosted apps using the Pages Router with statically generated (SSG) or Incremental Static Regeneration (ISR) pages are exposed - applications deployed on Vercel are explicitly not affected, and App Router-only or uncached/dynamic setups are out of scope. The assessed vector (AV:N/AC:H, PR:N, UI:N, integrity-only impact) and the fact that no public exploit code has been identified at time of analysis keep this a moderate-severity correctness/integrity problem rather than an urgent one; vendor patches are available as 15.5.27 and 16.3.8.
Mining nodes running Zebra, the Zcash Foundation's Rust implementation of a Zcash node, at versions before 6.1.0 can be manipulated into building oversized block templates that the network rejects, wasting the miner's proof-of-work. The ZIP-317 block template selector fails to include block header and transaction-count bytes in its size budget, so a remote, unauthenticated attacker who can get valid, selectable transactions into the victim miner's mempool can shape the template across the maximum block size boundary. Impact is availability-only (assessed CVSS:3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L; vendor score 6.3), the attack demands precise mempool shaping and timing, and no public exploit code or CISA KEV entry was identified at time of analysis.
Server-side request forgery in UTMStack before 11.2.16 lets any authenticated user (even a low-privilege one) coerce the web-pdf microservice into fetching an arbitrary URL by supplying an unvalidated url parameter to GET /api/generate-pdf-report, with the fetched response rendered back into the returned PDF. A successful attack exposes internal-only resources the container can reach - backend APIs, the OpenSearch cluster, or a cloud instance-metadata endpoint (169.254.169.254) - making credential theft the highest-impact outcome on cloud-hosted deployments; there is no code execution, no data modification, and exploitation requires a valid UTMStack session (CVSS vector PR:L, so authentication is required). No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (not in CISA KEV); the CVE carries a CVSS 4.0 score of 6.3, while our independent CVSS 3.1 assessment (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) rates it High, with real-world impact gated by the server's network reachability to the targeted internal resource and, for the metadata path, by the instance running in a cloud environment.
The `next dev` development server in Next.js 16.0.0 through 16.3.7 improperly restricts cross-site requests to its Model Context Protocol (MCP) endpoint at `/_next/mcp`, allowing a malicious website visited by a developer to read sensitive local project data including disk paths, source code snippets from error reports, route inventories, and development logs. The vulnerability is limited to development environments - production deployments do not serve this endpoint - and exploitation requires an active `next dev` session plus the developer navigating to attacker-controlled content (CVSS 4.0 AT:P prerequisite). Unauthenticated (PR:N) but requiring user interaction; no public exploit identified at time of analysis. CVSS 4.0 base score 6.3 (Medium), fixed in Next.js 16.3.8.
Peer-set erosion in Zcash Foundation's Zebra (zebrad) node software, versions 4.5.0 through releases prior to 6.3.0, lets a connected P2P peer turn a syncing node's own ban logic against honest peers: the node loses track of which peer supplied block hashes in FindBlocks responses, so when a requested block arrives more than 50,000 heights above its tip, the 100-point misbehavior threshold (the ban threshold) is charged to an innocent peer instead of the attacker. Unauthenticated remote attackers need only ordinary network peering (PR:N), but the victim must be actively mid-sync and well behind the chain tip and the far-ahead condition must be met, making exploitation conditions-dependent (AC:H, AT:P) rather than universally triggerable. The result is a degraded peer set and elevated eclipse risk for the affected node rather than a consensus break; no public exploit code was identified at time of analysis and active exploitation is not confirmed. This is a genuine but moderate-severity peer-to-peer integrity/availability issue, not a high-urgency emergency.
Path traversal in Logback-classic (0.9.14 through 1.6.4) allows remote unauthenticated attackers to create and append log files outside the intended directory when a FileAppender path is built from an attacker-influenced MDC value, such as an HTTP header. Exploitation requires a non-default configuration where a SiftingAppender uses an MDC discriminator for the file path; no public exploit identified at time of analysis, and the vendor has released a patch in version 1.6.5. The reporter assigned a CVSS 4.0 score of 6.3, reflecting medium severity with limited integrity and availability impact.
Account takeover in YesWiki versions before 4.6.7 is possible because password-reset tokens never expire, allowing anyone who obtains an unused reset link - from mailboxes, logs, backups, or browser history - to replay it through checkEmailKey() and set a new password without authentication. The vulnerability is rated moderate (CVSS 6.3) and requires out-of-band access to a valid-but-unused reset URL, as reflected in the high attack complexity and present attack target metrics. No public exploit code or active exploitation has been identified, and a vendor patch is available.
Resource exhaustion in Zcash Zebra (zebrad) 4.4.1 and earlier allows unauthenticated remote P2P peers to tie up blocking-pool threads by sending getblocks or getheaders messages with block-locator vectors far larger than the protocol's 101-entry limit, degrading block validation, RPC, and mempool lookups. The root cause is an uncapped locator length (accepting up to 65,535 hashes derived from the generic MAX_PROTOCOL_MESSAGE_LEN allocation bound) with each hash triggering a chain lookup on a blocking-pool thread. Practical impact is bounded: it requires roughly 2 MiB of attacker bandwidth per request and multiple sustained/Sybil peers, existing backpressure (load shedding, per-peer sequential processing, connection limits) constrains the effect, nodes that do not accept inbound connections are unaffected, and there is no public exploit identified at time of analysis; the independent assessment rates this a modest-priority availability weakness, not a node crash. Vendor patches are available and the fix has been merged upstream.
Stored SQL injection in the BuildKit WordPress plugin before 1.0.29 allows an authenticated Contributor-level user to submit content that is persisted without proper sanitization or escaping and later used in a SQL query, executing when the content is published and viewed by an unauthenticated visitor. Successful exploitation can expose sensitive database data (C:H, I:N, A:N under the assessed vector), but it requires a Contributor account and a publish-and-view step; no public exploit identified at time of analysis, and a vendor patch is available. This is a second-order/stored SQL injection (CWE-89) affecting only BuildKit versions before 1.0.29.
Cross-site scripting (XSS) in MISP's TAXII object viewer (versions before 2.5.48) allows an attacker who can publish or influence TAXII objects to execute arbitrary JavaScript in the browser of an authenticated MISP user who views the crafted object. Exploitation requires the victim's MISP instance to subscribe to a malicious or compromised TAXII feed and the user to actively open the specific object, making it a targeted attack rather than opportunistic. No public exploit identified at time of analysis, but the vendor has released a patch in version 2.5.48.
Reflected cross-site scripting in the WordPress plugin WP Statistics (VeronaLabs) affects all versions up to and including 14.16.14, allowing an unauthenticated attacker to inject arbitrary script through the query-parameter key of the request URI, which the plugin reflects into admin-side pages without adequate sanitization or output escaping. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, 6.1) confirms no attacker privileges are needed but that exploitation is gated by user interaction - the victim, realistically a logged-in administrator viewing an affected WP Statistics admin view such as the Referrals page, must be tricked into clicking an attacker-crafted link, so impact is per-victim and social-engineering dependent rather than a passive compromise. The issue is patched in version 14.16.15; no public exploit code or confirmed active exploitation was identified at time of analysis.
DOM-based cross-site scripting (XSS) in the All in One SEO WordPress plugin, versions up to and including 5.0.1.1, allows unauthenticated attackers to inject arbitrary web scripts via a crafted URL pathname, but successful exploitation requires a victim who holds the aioseo_manage_seo capability to open the SEO Preview panel in the WordPress admin toolbar while visiting the malicious URL. No public exploit code or active exploitation in the wild has been identified at time of analysis, and the substantial victim interaction and privilege requirements make this a moderate-risk, defense-in-depth issue rather than an urgent threat.
Reflected cross-site scripting in the Greenshift - animation and page builder blocks WordPress plugin (all versions up to and including 13.2.0) allows an unauthenticated remote attacker to inject arbitrary script that is echoed unescaped inside a <script type="module"> tag when the '{{GET:...}}' dynamic placeholder is used in an element block's Custom JS field. Exploitation is conditional rather than universal: a site administrator must previously have configured a block's Custom JS to include a {{GET:...}} placeholder and that JavaScript must contain the token 'import', and the victim must then be tricked into visiting an attacker-crafted link (assessed CVSS:3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N; base 6.1 per the vendor CVE record). No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, so the realistically exposed population is the subset of Greenshift ≤13.2.0 sites that use {{GET:}} placeholders in Custom JS containing 'import'.
Reflected cross-site scripting in the Avada theme for WordPress (Website Builder For WordPress & WooCommerce) affects all versions up to and including 7.16.1, allowing an unauthenticated attacker to inject arbitrary script into the post-editor metabox by convincing a user who can access that editor to click a crafted link carrying a malicious 'lang' query parameter. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, base 6.1) confirms the attack is network-reachable without attacker credentials but requires victim interaction, and the changed scope (S:C) reflects that the injected script executes in the victim's browser session rather than compromising the server directly. No public exploit code was identified at time of analysis and there is no CISA KEV entry, so this should be treated as a medium-severity, social-engineering-dependent flaw rather than an actively exploited one. Assessed risk: this is a reflected Cross-Site Scripting flaw (CWE-79) with a CVSS 3.1 base score of 6.1 (Medium).
RafflePress Giveaways and Contests WordPress plugin before 1.12.27 contains an open redirect (CWE-601) that allows unauthenticated attackers to manipulate a giveaway's parent page URL so that the plugin's confirmation and referral links redirect visitors to an arbitrary external site. Exploitation requires an active giveaway on the target site and user interaction (a victim clicking the crafted link), limiting the impact to phishing or malware staging rather than direct compromise of the WordPress host. No public exploit code or active exploitation has been identified at time of analysis.
A crafted flat CSS selector can stall a synchronous parser thread in postcss-selector-parser versions prior to 7.1.6, because class and ID index lists are scanned repeatedly inside parsing passes that should be linear, producing quadratic (O(n^2)) parse cost. Only consumers that synchronously parse untrusted selector strings on an exposed request path are affected; the vendor explicitly notes ordinary build-time parsing of trusted sources is not affected. The issue is remotely triggerable by unauthenticated attackers where that precondition holds (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, 5.9), is availability-only with no confidentiality or integrity impact, and there is no public exploit code and no confirmed active exploitation (no KEV listing) at time of analysis. A vendor-released patch, version 7.1.6, is available.
Arbitrary file writes outside uv's installation prefix on Windows can occur when a user installs a crafted wheel in uv 0.12.7 through 0.12.17, potentially planting an executable in a directory already on the user's PATH. Exploitation is conditional-it requires a Windows host, a vulnerable uv version, and the victim actively installing the malicious wheel-so this is a medium-severity issue rather than an emergency; non-Windows systems are unaffected. Vendor-released patch: 0.12.18. No public exploit identified at time of analysis.
Database account usernames are silently emitted into telemetry traces by the OpenTelemetry JavaScript Contrib database instrumentation packages, which attach the `db.user` span attribute to every instrumented database operation by default, independent of the `enhancedDatabaseReporting` opt-in setting. Every deployment running the affected packages below their fixed versions - @opentelemetry/instrumentation-cassandra-driver before 0.66.0, -knex before 0.65.0, -mongoose/-mysql/-mysql2 before 0.67.0, -oracledb before 0.46.0, -pg before 0.73.0, and -tedious before 0.40.0 - that exports traces to a shared observability backend therefore leaks its database usernames, and indirectly hints about service topology, role assignment, and environment naming, to any actor with read access to that telemetry pipeline. Scored CVSS 5.8 (CWE-532), this is a default-configuration information-disclosure weakness rather than a remotely triggerable attacker compromise: no public exploit code has been identified at time of analysis, there is no confirmed active exploitation, and the only credential material exposed is account names - not passwords, query contents, or result data.
Unauthenticated HTTP proxying in Zilliz Attu before 3.0.0 lets remote attackers abuse the Playground feature as an open proxy or server-side request forgery (SSRF) pivot, forwarding arbitrary HTTP and HTTPS requests to URLs on the public internet with no credentials required. The flaw is CWE-306 (missing authentication for a critical function) and is rated CVSS 5.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N), meaning the attacker needs no authentication and no user interaction, and the main constraint is network reachability of the Attu management interface. Impact is bounded to proxied outbound requests rather than code execution or disclosure of Attu data, and there is no confirmed active exploitation (not listed in CISA KEV) and no public exploit code identified at time of analysis.
Path traversal in Nx's migration planner lets a hostile dependency write attacker-controlled bytes outside the temporary migration directory - or truncate an existing writable file - because the `nx-migrations.migrations` value read from a target package manifest is joined onto the temp directory without being validated as a contained relative path. The affected range is Nx 13.10.0 through 22.7.9 and 23.2.x before 23.2.1 (fixed in 22.7.10 and 23.2.1), and exploitation requires both a malicious package already present (a direct dependency or one injected through a trusted package's packageGroup) and the victim running `nx migrate` with the normal `nx@latest` handoff bypassed via NX_USE_LOCAL, NX_MIGRATE_USE_LOCAL, NX_MIGRATE_CLI_VERSION, --run-id, or the fallback after a temporary-install failure; the write occurs during migration planning, before the migration list is reviewed or --run-migrations is used. This is a moderate-risk path traversal (CWE-22) with a vendor-assigned CVSS 4.0 base score of 5.8 and an independent assessment of CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:L (high integrity impact, no confidentiality impact); no public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Denial of service in FreeType's CID-keyed font loader allows attackers to exhaust memory and CPU by supplying a crafted font that triggers repeated allocation and decryption of subroutine data across multiple font dictionaries, causing the consuming application or service to hang or terminate. The issue is rated CVSS 5.5 with availability-only impact (A:H, C:N/I:N) and is gated by user interaction - someone or some automated process must actually load and parse the malicious font, which can be delivered by embedding it in a document, web page, or other parsed content. No public exploit code and no confirmed active exploitation were identified at time of analysis, but the Red Hat advisory points to an upstream FreeType fix commit (f3ca71c9900fe860849b3163a6e2c1e765b291d9) and tracks the flaw under Bugzilla 2462295, so a patched release should be expected; the practical risk is highest for unattended font- or document-processing pipelines rather than interactive desktop use.
Improper authentication in onetwothreeneth HospitalManagementSystem (rolling release, code up to commit 9ef91ed6007314b6473110ed699dff76d158f61d) allows unauthenticated remote attackers to bypass authentication by manipulating the ID argument in php/sessions.php. The flaw is rated medium severity (CVSS 4.0 base 5.5, CWE-287) with limited confidentiality impact, and publicly available exploit code exists, though the project is niche and likely to have low real-world exploitation priority.
Stored cross-site scripting in the Autoptimize WordPress plugin (all versions up to and including 3.1.15.1) allows unauthenticated attackers to inject arbitrary JavaScript through the blog comment Author Name field, which is stored and later rendered without adequate escaping, executing in the browser of anyone viewing the affected page. The attack is tightly gated, however: an administrator must have enabled Autoptimize's 'Lazy-load images?' option, a disabled W3 Total Cache installation must still have w3-total-cache/w3-total-cache.php present on disk, a class named Minify_HTML must be loaded into scope by some other plugin, and a comment moderator must approve the malicious comment before the payload renders. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, so this is a low-priority, high-friction issue affecting only sites that happen to match that exact plugin and file combination; default WordPress plus Autoptimize installations are not exploitable.
An authenticated authorization bypass (IDOR) in the PublishPress Series WordPress plugin (organize-series), affecting versions through 3.1.3, lets a low-privileged logged-in user supply an attacker-chosen object key to reach and manipulate series resources that belong to other users. The flaw is rated CVSS 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L), meaning impact is limited to partial integrity and availability with no confidentiality loss, and exploitation requires a valid low-privilege account on a site running the vulnerable plugin. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); risk is moderate and depends on whether the site permits self-registration or otherwise grants untrusted users low-privilege accounts.
Unbounded key-derivation cost parameters in Bouncy Castle for Java before 1.86 allow a denial of service against applications that parse attacker-influenced cryptographic structures: PBKDF2 iteration counts, derived-key lengths, scrypt parallelization factor p, and OpenSSH v1 bcrypt round counts were read straight from untrusted input and used to drive the KDF before any password or MAC verification could reject the data. Affected code paths include the RFC 9579 PBMAC1 MAC calculator builders (JcePBMac1CalculatorBuilder, PKCS12PBEUtils.createPBMac1Calculator reached via PKCS12PfxPdu.isMacValid), the PKCS#8/PKCS#12 scrypt cost guards, the raw JCA PBKDF2 provider, and OpenSSH v1 private-key parsing in Bouncy Castle for Java, LTS (before 2.73.13) and FIPS (bcpkix-fips before 1.0.13 / 2.0.13 / 2.1.13). Impact is availability-only (CVSS:4.0 5.3; assessed CVSS:3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L): exploitation requires the victim application to passively process a malicious blob and is unauthenticated (PR:N), but no key material or data is exposed, and there is no public exploit identified at time of analysis.
Authorization bypass in the ThimPress LearnPress WordPress plugin (versions through 4.4.9) allows unauthenticated remote attackers to read sensitive learner, order, or course data by manipulating a user-controlled key in an insecure direct object reference (IDOR) pattern. Assessed as medium severity (CVSS 5.3) with confidentiality-only impact; no public exploit identified at time of analysis.
Unbounded process memory growth in the multidict C extension (versions 6.7.0 up to but excluding 6.9.1) lets unauthenticated remote attackers drive a denial of service by repeatedly invoking two items-view set operations. The reflected union 'operand | md.items()' and the subtraction 'md.items() - operand' each fail to release one key-identity reference and one value reference per operand element, and because these are strong references the garbage collector cannot reclaim them, so memory grows without bound as operations repeat. The issue is availability-only (CVSS 5.3: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L), patches only reachable in compiled C-extension builds with non-tuple, attacker-influenced operands, and there is no public exploit identified at time of analysis; the vendor-released fix is multidict 6.9.1.
Cleartext logging of the monitoring user's password in Canonical's postgresql-operator charm allows an attacker with read access to the Prometheus postgres_exporter logs to recover credentials granting read-only pg_monitor access to PostgreSQL. The flaw (CWE-532) affects charm revisions prior to 1189/1190 on the 14/edge track and prior to 1216/1217 on the 14/stable track, and exploitation additionally requires that a database connection error has occurred so the password is written to logs. This is a modest-severity information-disclosure issue (CVSS 5.3, PR:L) with no public exploit identified at time of analysis, fixed in the specified revisions via upstream patches.
Canonical MAAS exposes the region controller's RPC secret in plaintext through the vendor-data metadata endpoint, letting an unauthenticated attacker who can reach that endpoint and knows or guesses a target machine's MAAS system ID recover the shared secret used for rack-controller RPC authentication (CVSS 5.3 / assessed CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N). Exposure is conditional: it only affects instances where a machine was deployed with the non-default 'register as rack' (install_rackd) option enabled, and it further requires network reachability to the preseed/metadata server plus knowledge of the system ID. There is no confirmed active exploitation (no CISA KEV listing) and no public exploit code identified at time of analysis, but vendor patches exist in MAAS 3.4.10, 3.5.14, 3.6.5, 3.7.3, and 3.8.0, and the fix disables the vulnerable deploy-as-rack feature entirely.
Unauthorized disclosure of event metadata in MISP lets any authenticated user enumerate the titles, dates, and correlation counts of events they are not permitted to open. The related-events listing feature retrieved correlated events straight from the correlation table without re-checking the caller's access rights against each target event, and that table stores only a snapshot of distribution level and sharing group (with no published flag), so unpublished events and events whose distribution or sharing group changed after the correlation was recorded were still returned. Exploitation requires an authenticated account with access to at least one event plus pre-existing correlation entries crossing a sharing boundary, and it leaks metadata only - never attribute payloads; no public exploit was identified at time of analysis and the vendor has published a fix commit, making this a genuine but low-to-moderate priority exposure bounded to community members rather than anonymous internet attackers.
Unauthenticated remote attackers can enumerate and manipulate customer invoices in the WordPress plugin Appointment Booking Plugin - LatePoint | Calendar & Scheduling for WordPress through version 5.7.1, because the OsPaypalConnectController::create_order_for_transaction() handler is exposed as a public wp_ajax_nopriv_latepoint_route_call route and loads an OsInvoiceModel using a bare sequential integer invoice_id with no ownership or access-key check. An attacker who iterates invoice IDs can confirm the existence of invoices belonging to arbitrary customers and cause transaction-intent rows to be created against those invoices, and can overwrite the intent_key of any in-flight NEW-status transaction intent, breaking the Stripe/Razorpay checkout and webhook flows those customers are waiting on. No public exploit identified at time of analysis, and exploitation is limited in practice by the need to guess sequential IDs and by the fact that meaningful intent_key disruption requires a victim to be mid-checkout; the affected code path remains otherwise reachable without authentication and without user interaction.
Server-side request forgery and cross-site scripting in YesWiki before 4.6.7 allow an authenticated page editor to abuse the Bazar 'valeur' action to make the server fetch arbitrary URLs, including loopback and internal addresses, and to inject unescaped remote HTML that executes script in a victim's browser. Exploitation requires an editor-level account (CVSS PR:L) and, for the XSS half, a separate victim viewing the poisoned page, so anonymous remote exploitation is not possible; no public exploit identified at time of analysis. Risk is medium severity per the assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N, and a vendor-released fix is available in 4.6.7.
Improper access control in MISP's attribute search and paginated attribute listing endpoints discloses soft-deleted (retracted) threat intelligence attributes belonging to other organizations to any authenticated user who already holds read visibility of the event, yielding a confidentiality-only impact rated CVSS 5.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). Exploitation requires an authenticated MISP account (PR:L) and an explicit query for deleted attributes via the deleted-attributes search or the paginated attribute view with the deleted filter; the normal event detail view is not affected because it already restricts soft-deleted attributes to the owning organization and sync-permission users. All MISP versions prior to v2.5.48 are affected, the issue is rated a genuine but low-to-moderate priority information-disclosure problem rather than a critical emergency, no public exploit code identified at time of analysis and no confirmed active exploitation (CISA KEV) exists, and practical relevance is highest on multi-organization, federated, or community instances where cross-organization event visibility exists.