Missing authorization (CWE-862) in HAVELSAN's Sef - AI Chatbot Platform allows an authenticated, low-privileged user to reach functionality that is not properly constrained by access control lists, resulting in unauthorized access to data (confidentiality impact only, no integrity or availability effect). The vulnerability affects all versions before 2.1 and carries a moderate CVSS 3.1 base score of 5.3 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N), meaning exploitation requires valid credentials and additional non-trivial conditions - the high attack complexity reflects the need for specific request state, timing, or knowledge of protected object identifiers rather than a single trivial request. There is no public exploit code and no confirmed active exploitation at time of analysis; the issue was reported by TR-CERT and is documented in the Turkish national CERT advisory TR-26-1241.
Account enumeration in Softtr Informatics Trading Limited Company's E-Commerce Pack lets unauthenticated remote attackers determine whether specific user accounts exist by observing differing responses from login, registration, or password-recovery functions. All versions up to and including the 2026-10-02 release are affected, and exploitation requires only network reachability to an instance that actually fronts a user-account system on the public internet - no credentials or user interaction are needed (CVSS:3.1/AV:N/AC:L/PR:N/UI:N). Impact is limited to confidentiality of account-existence data (C:L, no integrity or availability effect), so this is a low-to-moderate priority information-disclosure issue and reconnaissance aid rather than a direct compromise path; no public exploit code or confirmed active exploitation has been identified at time of analysis, and EPSS data was not provided.
Server-side request forgery (SSRF) in UTMStack before 11.2.16 is a genuine but moderate-severity issue rather than a top-tier emergency: an authenticated user who can reach the POST/PUT /api/identity-providers endpoint can supply a crafted metadata URL that IdentityProviderService.validateMetadataUrl() accepts without validating target host, IP, or scheme, causing the server to issue attacker-directed requests to internal or cloud metadata hosts. The practical consequence is internal network reconnaissance and port scanning, plus exposure of cloud instance-metadata services such as 169.254.169.254 when UTMStack is deployed in a cloud environment; impact is otherwise confined to confidentiality (scope-changed C:L/I:N/A:N) and is gated by the requirement for a valid UTMStack account (PR:L). No public exploit code has been identified at time of analysis, there is no CISA KEV listing, and the vendor has released version 11.2.16 as the fixed version.
Privilege escalation in Ghost CMS (TryGhost Ghost) versions 0.5.0 through before 6.64.0 allows an authenticated Editor or Super Editor to assign their own elevated role to other staff accounts, promoting existing Author and Contributor users to Editor or Super Editor without holding the authority to do so. Exploitation is gated by the attacker already holding an Editor or Super Editor account (PR:L in the assessed CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, vendor CVSS 4.0 score 5.3), so anonymous outsiders cannot abuse it, and the effect is limited to integrity rather than confidentiality or availability. A vendor-supplied patch is available and no public exploit code has been identified at time of analysis.
Unauthenticated information disclosure in the Request a Quote WordPress plugin (versions through 2.5.6) lets any remote attacker retrieve the contact details stored for quote-request submissions - including entries the site owner has not published - by calling an AJAX handler that is exposed to logged-out visitors without any authorization check. No authentication, nonce, capability, or user interaction is required, and the impact is limited to confidentiality of this plugin's stored quote data (CVSS 3.1 base 5.3, AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N); there is no write access, privilege escalation, or availability impact. No public exploit identified at time of analysis and no confirmed active exploitation.
Information disclosure in the Giveaways and Contests by RafflePress WordPress plugin before 1.12.27 exposes the reCAPTCHA secret key to unauthenticated visitors on any active giveaway page that has reCAPTCHA configured. Retrieval requires no authentication, no user interaction, and no special tooling because the plugin embeds the secret key in the public giveaway settings rather than keeping it server-side. No public exploit code has been identified at time of analysis, and the issue is configuration-dependent: sites running a vulnerable version without an active reCAPTCHA-enabled giveaway are not exposed.
Unauthenticated remote attackers can forge payment gateway callbacks against WordPress stores running the Paytm Payment Gateway plugin before 2.8.9, marking arbitrary unpaid orders as paid and reducing stock levels. The bypass (CWE-287) stems from the plugin skipping origin verification of callbacks while the merchant secret key is unset - the default state immediately after activation - so each affected site is exposed only during the post-activation, pre-configuration window. CVSS 3.1 scores it 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) and no public exploit has been identified at time of analysis, making this a moderate, context-dependent risk rather than a top priority.
Cross-site request forgery in the admintag action of YesWiki before 4.6.7 allows an attacker requiring no privileges (CVSS 4.0 PR:N, UI:P) to trick a logged-in administrator into clicking a crafted GET link that bulk-deletes tag associations via a wide id range in the delete_tag parameter. The attack works only because the request is issued as a top-level navigation, which lets the SameSite=Lax administrator cookie be sent; background cross-site requests such as iframes or XHR are blocked by SameSite=Lax, and the admin must have an active session and interact with the link. Impact is confined to integrity and availability of tag triples (C:N/I:L/A:L) rather than broader data or code compromise, and no public exploit code has been identified at time of analysis.
Stored cross-site scripting in MISP versions below 2.5.48 allows an attacker who can create or modify events on a linked (remote) MISP server to embed HTML or JavaScript in an event identifier, which is then rendered unescaped in the local instance's remote event preview index and executes in the browser session of any authenticated user who opens that page. The flaw is rated CVSS 5.3 (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N; independent assessment CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), meaning the attacker must be authenticated on the remote server and the payload only fires once a victim navigates to the vulnerable preview view, so exploitation requires a fully pre-established trust chain rather than unauthenticated access. This is a moderate-severity stored XSS (CWE-79) with no signals of elevated real-world risk: there is no CISA KEV listing and no public exploit identified at time of analysis, and the vendor has released a fix.
Information disclosure in the WordPress plugin Smart One Click Setup - Complete Demo Import & Export through version 1.4.3 allows unauthenticated remote attackers to retrieve sensitive data that the plugin embeds into the content it sends to clients. Per the independent assessment, exploitation requires no special conditions beyond the plugin being installed and active - the vector is AV:N/AC:L/PR:N/UI:N with a confidentiality-only impact (C:L) and no effect on integrity or availability - and no public exploit code has been identified at time of analysis, so this is best treated as a low-to-moderate priority finding whose exposure is gated primarily by whether the affected plugin is deployed. No CVE has been confirmed as actively exploited (CISA KEV) and no EPSS score was supplied with the available intelligence.
Cross-site request forgery in YesWiki before 4.6.7 allows a remote unauthenticated attacker to delete or permanently purge page attachments by luring a logged-in page owner or administrator into a top-level GET navigation that invokes the filemanager page handler with do=del, erase, or emptytrash. Exploitation requires the victim to have an active privileged session and to perform the crafted navigation, and the resulting impact is limited to integrity and availability of page attachments; there is no confidentiality exposure or code execution. No public exploit code was identified at time of analysis, and the vendor has released a patch.
Cross-site request forgery in YesWiki before 4.6.7 lets unauthenticated remote attackers silently revert wiki pages to older or vandalized revisions by luring a write-capable user into a top-level navigation that invokes RevisionsHandler with the restoreRevisionId parameter. The flaw is a state-changing GET request that lacks CSRF token validation; successful exploitation requires an authenticated victim with page-edit rights and only impacts page integrity, not confidentiality or availability. No public exploit identified at time of analysis; a vendor patch is available in version 4.6.7.
Unauthenticated remote attackers can retrieve embedded sensitive data from WordPress sites running the Shahjada Download Manager plugin versions up to 3.3.71 by exploiting an authorization bypass through a user-controlled key (CWE-639). The vulnerability allows access to data that should be restricted, though impact is limited to confidentiality (C:L) with no integrity or availability impact. No public exploit code or active exploitation has been identified at time of analysis.
Reflected cross-site scripting in Loglama.net's TurkHotspot captive-portal software allows an attacker positioned on an adjacent network segment to inject script into a victim's browser session inside the portal context when the victim loads a crafted link. All versions up to and including those released as of 2026-10-02 are affected (CPE cpe:2.3:a:loglama.net:turkhotspot:*), and the assessed CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, base 5.2) shows exploitation requires adjacent-network reachability plus victim interaction, with impact limited to low confidentiality and integrity effects and no availability impact. No public exploit identified at time of analysis, and because Loglama.net did not respond to the coordinated disclosure there is no vendor-released patch identified at time of analysis, leaving the flaw a moderate-severity concern whose real-world risk is tempered by the adjacency and user-interaction prerequisites.
Reflected cross-site scripting in YesWiki (all versions before 4.5.3 per EUVD, with the vendor's GitHub Security Advisory stating the fix lands in 4.6.0) lets remote attackers inject JavaScript via unsanitized parameters such as incomingurl, id, file, tags and template, and publicly available exploit code exists in the GHSA proof-of-concept links. Successful exploitation requires the victim to open an attacker-crafted URL (UI:A), after which script runs in the context of the YesWiki origin and can hijack sessions or fire authenticated requests against backend functionality; the listpages/tags and bazariframe/template vectors are explicitly reachable without authentication (PR:N). No confirmed active exploitation (CISA KEV) has been reported, and the assessed impact is bounded to the victim's browser session, making this a medium-severity, moderate-priority issue rather than an urgent one.
Reflected cross-site scripting in YesWiki versions prior to 4.6.7 lets an unauthenticated remote attacker inject JavaScript through the 'field' parameter of the mail handler, breaking out of the ajax-mail-form action attribute and executing script in the victim's browser context. Exploitation is not autonomous: the CVSS:4.0 vector carries UI:A and the assessed CVSS:3.1 vector carries UI:R, so a victim must click an attacker-crafted link, making this a phishing-style, social-engineering-dependent attack that does not require the attacker to hold any account (PR:N). The vendor/CVSS 4.0 base score is 5.1 and no public exploit code or confirmed active exploitation was identified at time of analysis; scope is changed (S:C) with only low confidentiality and integrity impact, and the primary mitigating factor is the mandatory victim interaction.
Stored cross-site scripting in the YesWiki wiki platform (all versions before 4.6.7) allows an authenticated user who can submit Bazar entries to upload an SVG file containing embedded script, because the Bazar FileField handler checks only the file extension and never routes the upload through HtmlPurifierService::cleanFile. The payload is stored verbatim and later served inline with the image/svg+xml content type from the wiki origin, so script executes in that origin when a victim - typically an administrator - opens or views the file, exposing session cookies and account context. Exploitation is constrained by the need for a low-privileged authenticated account plus a victim's interaction (CVSS 4.0 base 5.1, Medium; CVSS 3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), and no public exploit code or confirmed active exploitation was identified at time of analysis; a vendor fix is available in 4.6.7.
Cross-site scripting in MISP’s ID Translator feature (before version 2.5.48) lets a malicious linked MISP server return a crafted event ID that executes arbitrary JavaScript in the browser of any authenticated user who views the ID Translator page, leading to session hijacking or credential theft. Exploitation requires a configured linked server, a compromised remote instance, and victim interaction (UI:R); it is unauthenticated from the attacker’s perspective (PR:N) but does not affect availability. No public exploit or active exploitation is identified, and the vendor has released a patch (commit bd5e80c84) that casts remote event IDs to integers and applies output encoding.
Stored cross-site scripting in YesWiki before 4.6.7 allows authenticated users with page-edit or comment-posting privileges to inject an event handler into rendered markdown image markup, causing JavaScript to execute in the browsers of anyone who later views the poisoned page - including administrators. The flaw lives in the wakka formatter (formatters/wakka.php), where a quote character inside a markdown image URL breaks out of the src attribute and permits an onerror handler to be attached; exploitation is gated on a victim rendering the stored content (passive interaction), matching the assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. Vendor-supplied CVSS 4.0 rates it 5.1 (medium), a fixed release (4.6.7) is available from the vendor, and no public exploit code has been identified at time of analysis.
Server-side request forgery (SSRF) in HAVELSAN's Sef AI Chatbot Platform before version 2.1 allows an authenticated attacker with high privileges (PR:H) to cause the server to make requests to arbitrary URLs, potentially reading internal resources reachable from the server. This moderate-severity flaw (CVSS 4.9) is network-reachable without user interaction, but requires a privileged session, limiting exploitation to trusted or compromised elevated accounts. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Stored cross-site scripting in the Repasat application allows an authenticated, low-privileged user to inject script content through the 'nomCompetidor' parameter processed at the '/es/competitors/store' endpoint, where the value is persisted and later rendered to other users. Payload execution happens in the victim's browser session once that page is viewed, yielding limited confidentiality and integrity impact confined to the browser context with no direct server compromise; successful exploitation requires both a valid low-privileged account (CVSS vector PR:L) and victim interaction (UI:A/UI:R). No public exploit code has been identified at time of analysis, and no vendor-released patch is documented in the available intelligence, making this a genuine but low-to-moderate priority issue rather than an emergency; the primary reference is the INCIBE advisory covering multiple Repasat application vulnerabilities.
Cross-site scripting in the Repasat application lets an authenticated low-privileged user inject script payloads through the 'nomRuta' parameter of the /es/routes/update/693 route-update endpoint, which then execute in the browser of any victim who loads the affected page. Exploitation requires two prerequisites - a valid low-privilege account (CVSS PR:L) and victim interaction with the crafted content (UI:A) - and the resulting impact is confined to the victim's browser session, such as session or token theft and actions performed as the victim, rather than compromise of the server host. No public exploit code has been identified at time of analysis and there is no evidence of active exploitation; the issue rates as a medium-to-low priority rather than an urgent one.
Stored/reflected cross-site scripting in the Repasat application (CWE-79) lets an attacker with a valid account and carrier-management privileges inject arbitrary script into the 'nomTransportista' parameter submitted to the '/es/carriers/update' endpoint, which then executes in the browser of any user who views the page rendering that carrier name. Exploitation is bounded by two prerequisites: the attacker must be authenticated with sufficient rights to submit the carrier-update form (CVSS vector PR:L), and the victim must actively interact with the affected view (UI:A), so impact is confined to the victim's browser session rather than the server (scope-confined C:L/I:L per the independent assessment). Severity is medium (CVSS 4.0 base 4.8; 3.1 assessment AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), and no public exploit code or confirmed active exploitation was identified at time of analysis; no EPSS score was provided in the source data.
Stored cross-site scripting in the Repasat application lets an authenticated user with access to the geozone editing function inject script through the 'nomZonaGeo' parameter at '/es/geozones/update/149979', which executes in a victim's browser when the affected page is rendered. Exploitation requires a valid account (CVSS PR:L) and victim interaction (UI:A), so impact is confined to the victim's browser session rather than the server; no public exploit code and no active exploitation were identified at time of analysis. The vendor-reported CVSS 4.0 score is 4.8, and our assessed CVSS 3.1 vector (S:C/C:L/I:L/A:N) keeps this at medium severity with low real-world priority.
Cross-site scripting in the Repasat application lets an authenticated low-privilege user inject script through the 'nomTipoCli' parameter handled by the /es/clientypes/update/109441 endpoint, with the payload running in the browser of any victim who subsequently views the affected client-type content. Exploitation requires both a valid low-privilege session and a victim who actively interacts with the crafted page, and the impact is confined to that browser context (no availability impact and no cross-system scope), which is why the assessed CVSS 3.1 vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N yields a Medium severity (4.8 under CVSS 4.0). No public exploit code and no confirmed active exploitation were identified at time of analysis, and every Repasat build below the vendor's 'Abril' patch (20260402) is affected.
Authenticated cross-site scripting in the Repasat application allows low-privileged users to inject malicious scripts via the 'nomGrupoEmpresarial' parameter, which execute in a victim's browser when they view the affected corporate group update page at /es/corporategroups/update/246. Exploitation requires a valid account with access to the corporate groups update function and active interaction from a victim user; the impact is limited to client-side script execution with no server compromise or availability effect. This medium-severity flaw (CVSS 4.0 base score 4.8) has no public exploit code or confirmed active exploitation identified at time of analysis.
Stored cross-site scripting in the Repasat application allows an authenticated user with low-level privileges to inject arbitrary script through the 'name' parameter of the /es/attachmenttypes/update/{id} endpoint, which then executes in the browser of any user who renders the affected attachment-type record. The INCIBE advisory (EUVD-2026-91319) scores it 4.8 under CVSS 4.0; our independent review maps it to CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, i.e. an authenticated, interaction-dependent issue whose impact stays inside the victim's browser and does not extend to server compromise. No public exploit identified at time of analysis and the flaw is not confirmed actively exploited (no CISA KEV listing), so this is a low-to-moderate priority issue rather than a top-tier threat, affecting all Repasat versions prior to the 'Abril' patch (build 20260402).
Cross-site scripting in the Repasat application allows an authenticated low-privileged user to inject script that executes in a second, logged-in victim's browser when they load the affected '/es/datatables/getemployeetypesdatatable' endpoint, enabling session token theft and actions performed as the victim. Exploitation is not a drive-by: it requires a valid low-privileged account (CVSS vector PR:L) plus victim interaction (UI:A), and the impact is confined to the client-side browser context with no server-side code execution and no availability impact. Scored 4.8 (Medium) under CVSS 4.0, the flaw carries no CISA KEV listing and no public exploit code was identified at time of analysis, so treat it as a real but precondition-heavy weakness rather than an imminent mass-exploitation risk.
Cross-site scripting in the Repasat application lets an authenticated attacker inject script through the 'nomListaValidacion' parameter processed by the /es/validationslists/assignList/Employee/45659 endpoint, so that a logged-in victim who renders or submits the crafted content executes arbitrary JavaScript in their own browser session. Affected deployments are those exposing the Repasat web application and its validation-list assignment functionality, tracked generically by the CPE cpe:2.3:a:repasat:repasat_application (all versions, no version range published). Exploitation is not unauthenticated and not non-interactive: it requires a valid session plus victim interaction, and the independent assessment rates this as medium severity (CVSS 4.0 base 4.8; CVSS 3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N); no public exploit identified at time of analysis, and the flaw has not been confirmed actively exploited (CISA KEV).
Local argument injection in gotop 3.0.0 allows an attacker who already holds an account and shell on the same host to terminate every process owned by a targeted user, because the tool forwards an attacker-controlled process name directly to pkill and the name is parsed as a command-line option. Exploitation depends on the victim actively selecting the maliciously named process in gotop's process-kill feature (UI:R, local only), so the impact is confined to availability on shared multi-user systems. The project is no longer actively supported and CERT-PL reports the issue has not been fixed; no public exploit identified at time of analysis, and the independent assessment rates it low severity (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L, CWE-88).
Cross-site scripting in MISP's remote event preview page allows a malicious or compromised linked MISP server to execute arbitrary JavaScript in an authenticated analyst's browser session. When a federated server link is configured and MISP.tagging is enabled, the tag element's inline onclick attribute embeds the event tag ID inside a JavaScript string literal using only HTML escaping, so a crafted tag ID containing a single quote breaks out of that literal and injects attacker-controlled script. The payload does not fire on page load - the victim must open the remote event preview and click the affected tag - and it is restricted to non-default federated deployments with a hostile peer, yielding a medium/low real-world priority; no public exploit code or confirmed active exploitation was identified at time of analysis, and the raw CVSS 4.0 base score is only 4.8 (MEDIUM).
Stored/reflected cross-site scripting in the Repasat application lets an authenticated low-privileged user inject a script payload through the 'nomTamano' parameter submitted to the '/es/companysizebills/store' endpoint, and that payload then executes in the browser of any user who later renders the affected page. Exploitation requires an authenticated session (CVSS 4.0 PR:L) plus a second victim performing user interaction (UI:A), which keeps impact confined to the victim's browser session inside Repasat rather than the underlying server or other systems. CVSS 4.0 base score is 4.8 (medium); no public exploit identified at time of analysis, no confirmed active exploitation (not in CISA KEV), and no EPSS signal was supplied with the source data.
Cross-site scripting in the Repasat application allows an authenticated, low-privilege user to inject script through the 'nomMotivo' parameter of the '/es/lostmotives/store' endpoint, which then executes in the browser of any user who later views the affected page. Exploitation requires two conditions in combination - a valid low-privilege account able to submit data to that endpoint, and a victim who actively loads the page that renders the injected value (CVSS 4.0 PR:L/UI:A), which materially limits real-world reach and makes this a low-to-moderate priority issue rather than a remote unauthenticated flaw. Impact is confined to the victim's browser session and application data context; there is no server-side code execution and no availability impact, and no public exploit code or CISA KEV entry has been identified at time of analysis. The assigned CVSS 4.0 base score is 4.8, with our independent assessment settling at CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N.
Stored cross-site scripting in the Repasat application lets an authenticated user inject a malicious payload through the 'nomServicioPrestado' parameter submitted to the /es/providedservices/store endpoint, which is then rendered in the browser of any user who opens the affected service record. Because the attacker must hold valid application credentials with permission to create or modify provided-service entries (PR:L) and a separate victim must view the poisoned record for the script to fire (UI:A), exploitation is limited to script execution inside the victim's browser session and does not compromise the server. No public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV); no EPSS score was supplied in the source data, and the moderate CVSS 4.0 base of 4.8 reflects the privilege and user-interaction prerequisites.
Stored cross-site scripting in the Repasat application's delegation creation feature allows an authenticated attacker to inject malicious JavaScript into the 'nomDelegacion' parameter, which then executes in the browser of any user who views the affected delegation page. Exploitation requires a low-privileged authenticated session (PR:L) and active user interaction from a victim (UI:A); the attacker cannot act unauthenticated. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and the CVSS base score is 4.8 (CVSS 4.0).
Cross-site scripting in the Repasat application lets an attacker with at least low-privilege authenticated access inject a crafted payload into the 'nomCompetidor' parameter of the '/es/competitors/store' endpoint, causing arbitrary script to run in a victim's browser when the affected content is viewed. The vendor/NVD CVSS 4.0 base score is 4.8 and our independent assessment rates it medium severity (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), reflecting that exploitation requires valid credentials plus a separate victim interaction and that impact is confined to the victim's browser session rather than the server or host. No public exploit code or confirmed in-the-wild exploitation has been identified (not listed in CISA KEV), though the supplied tags include an 'RCE' label that the description and assessment do not substantiate - this is an XSS issue, not demonstrated remote code execution.
Stored/reflected cross-site scripting in the Repasat application allows an attacker holding valid low-privilege credentials to inject arbitrary script through the 'nomTamano' parameter at the '/es/companysizemployees/update' endpoint, which then executes in the browser of a user who loads the affected page. The flaw is rated 4.8 (Medium) by the vendor/INCIBE under CVSS 4.0 and requires an authenticated session (CVSS PR:L) plus active victim interaction (UI:A); there is no public exploit identified at time of analysis and the CVE is not reported as confirmed actively exploited (CISA KEV). Impact is confined to the victim's browser context - no server-side code execution, no loss of confidentiality or integrity at the server, and no availability impact.
Authenticated attackers with low privileges can inject malicious scripts into the Repasat application's '/es/origins/store' endpoint via the 'nomOrigen' parameter, resulting in stored or reflected cross-site scripting (CWE-79) that executes when a victim user loads a page rendering the injected payload. Rated CVSS 4.0 4.8 (Medium), exploitation requires both an authenticated account and active user interaction, and no public exploit code has been identified at time of analysis. INCIBE published an advisory for this flaw.
An open redirect (CWE-601) in the WordPress plugin Aculect AI Companion, affecting all versions through 0.8.1, lets remote attackers craft a link that bounces a victim to an arbitrary external site after they click it. The flaw is reachable over the network without authentication (PR:N) but requires user interaction (UI:R) per the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N, giving a moderate base score of 4.7 with only low confidentiality impact and no integrity or availability impact. Because exploitation is limited to redirection and phishing rather than data access or code execution, and the plugin has a small deployment footprint, real-world risk is modest; no public exploit code has been identified at time of analysis and the CVE is not in CISA KEV.
Embedded sensitive data exposure in the Monetizemore Advanced Ads WordPress plugin (versions through 2.0.26) allows an authenticated low-privilege user to retrieve sensitive data embedded in plugin-controlled objects by manipulating a user-controlled key or identifier. The flaw is a CWE-639 authorization bypass (IDOR-style) rated CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), meaning exploitation is network-reachable but requires at least low-tier authenticated credentials and yields confidentiality-only impact. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis; the issue was reported through the Patchstack vulnerability disclosure program.
Integer overflow in Google Chrome's Compositing component affects all builds prior to 154.0.8037.97 and allows remote attackers to leak cross-origin data when a victim navigates to a crafted HTML page (CVSS 4.3, AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N). The flaw is unauthenticated from a network perspective but requires user interaction - the victim must actively load attacker-controlled content - and it is confined to confidentiality impact, with no integrity or availability effect; no public exploit code has been identified at time of analysis and it is not listed in CISA KEV. EPSS probability is low at 0.18% (6th percentile) and CISA's SSVC rates exploitation as none and automatable as no, so this is a moderate-priority patch rather than an emergency one.
Cross-origin data leakage in Google Chrome versions prior to 154.0.8037.97 stems from an integer overflow in the Skia 2D graphics engine that a remote attacker can trigger by convincing a victim to load a crafted HTML page, allowing data belonging to other origins to be read. The flaw is remotely reachable by unauthenticated attackers per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N), but it mandates user interaction (UI:R) and carries only low confidentiality impact with no integrity or availability effect, for an overall CVSS of 4.3. EPSS is just 0.17% (6th percentile) and there is no public exploit identified at time of analysis, while Chromium's own 'High' severity label reflects the impact class rather than demonstrated exploitability; a vendor patch is available in Chrome 154.0.8037.97.
Information disclosure in the Kentico Xperience 13 administration API (all releases before 13.0.216) allows any authenticated administrator to read objects that belong to, or are scoped to, other users because the API endpoints perform no per-object authorization check. The issue is rated only CVSS 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), meaning a valid low-privilege admin session is mandatory and the impact is confined to reading data - there is no modification, deletion, or availability effect and no anonymous exploitation path. No public exploit code has been identified at time of analysis, and the vendor has released hotfix 13.0.216.
Missing authorization in the ThimPress LearnPress WordPress plugin through version 4.4.9.1 lets an authenticated low-privilege user perform plugin actions that should require higher privileges, giving a bounded integrity-only impact (CVSS 4.3). Exploitation requires a logged-in account on a site running the affected plugin - anonymous visitors cannot trigger it per the assessed vector (AV:N/AC:L/PR:L/UI:N), and there is no data disclosure or denial-of-service effect. No public exploit identified at time of analysis, and the issue is not in CISA KEV.
Authenticated users holding only minimal privileges such as Subscriber can overwrite the site-wide linked-service-account and API configuration option in the Popup Maker WordPress plugin through version 1.4.5, because the plugin's account-connection action verifies a nonce but performs no capability check. Rated CVSS 3.1 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), this is a moderate, authentication-gated broken-access-control flaw (CWE-284) with limited integrity impact and no confidentiality or availability loss; no public exploit code and no CISA KEV entry were identified at time of analysis. The practical exposure is greatest on sites that permit open user registration, since an external attacker can self-provision the Subscriber account needed to reach the vulnerable code path, whereas closed sites would require an existing low-privilege insider account.
Broken access control in SuperAGI v0.0.14 and earlier lets any authenticated user in one organization create, schedule, edit, stop, or delete agents belonging to a different organization's project. The controller endpoints (/api/agents/create, /api/agents/schedule, /api/agents/delete, /api/agents/edit_schedule, /api/agents/stop_schedule) accept a project_id parameter but never verify that the referenced project belongs to the caller's organization, so an attacker who knows or can enumerate a foreign project_id can tamper with and disrupt another tenant's agents. CISA's SSVC assessment records that publicly available exploit code exists (Exploitation: poc), while the impact is rated partial because there is no confidentiality read primitive; this is a moderate, authenticated IDOR-style flaw that only matters on shared, multi-tenant deployments and is a non-issue on single-org installations.
Server-side request forgery (SSRF) in Zilliz Attu before 3.0.0 allows remote attackers to proxy requests to private IP addresses via the Playground feature. This is a moderate-severity, not high-priority, issue: exploitation requires network access to an Attu instance's Playground feature, which proxies user-supplied requests without validating the destination; the CVSS vector indicates unauthenticated access (PR:N) with no user interaction, but real-world authentication enforcement is not confirmed. No public exploit identified at time of analysis.
An unidentified security defect in Ubuntu-packaged software is tracked as CVE-2026-102970, but the advisory data carries no description, no CVSS score, no CVSS vector, and no CWE classification, so the affected package, the attack vector, and the resulting impact cannot be established from the available intelligence. The single data point is the reporting source, vendor:ubuntu, which indicates the flawed code ships within at least one Ubuntu-maintained package rather than in an unrelated third-party product. No public exploit identified at time of analysis, and there is no KEV listing, so no active exploitation can be claimed. Risk cannot be meaningfully assessed because the core intelligence signals are entirely absent, and authentication requirements are not confirmed from available data; the corresponding Ubuntu Security Notice must be retrieved to identify the exact package and enabling conditions.
Ubuntu Linux is the only identifiable product for CVE-2026-102977, which has been recorded solely via a vendor reference from the Ubuntu security team and carries no description, CVSS vector, CWE, or affected package list. Because the vulnerability class, attack vector, authentication requirements, and impacted component are all unknown, the practical impact on Ubuntu hosts and their derivatives cannot be characterized from the available data. No public exploit code has been identified at time of analysis, and the record shows no confirmed actively exploited (CISA KEV) status and no accompanying EPSS score, so this should be treated as an unassessed placeholder pending retrieval of the Ubuntu Security Notice and the corresponding NVD entry.
CVE-2026-102967 is an identifier reserved and tracked by the Ubuntu security team for which no public description, CVSS score, CWE classification, or CPE data is currently available, leaving the affected package, attack vector, and impact undetermined. Because the record is empty, authentication requirements are not confirmed from available data and no specific feature, protocol, or deployment mode can be identified as a prerequisite or limiting factor for exploitation. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV; risk cannot be meaningfully assessed until Ubuntu publishes its advisory.