Cross-site scripting in the Repasat application lets an authenticated low-privileged user inject script payloads through the 'nomRuta' parameter of the /es/routes/update/693 route-update endpoint, which then execute in the browser of any victim who loads the affected page. Exploitation requires two prerequisites - a valid low-privilege account (CVSS PR:L) and victim interaction with the crafted content (UI:A) - and the resulting impact is confined to the victim's browser session, such as session or token theft and actions performed as the victim, rather than compromise of the server host. No public exploit code has been identified at time of analysis and there is no evidence of active exploitation; the issue rates as a medium-to-low priority rather than an urgent one.
Stored/reflected cross-site scripting in the Repasat application (CWE-79) lets an attacker with a valid account and carrier-management privileges inject arbitrary script into the 'nomTransportista' parameter submitted to the '/es/carriers/update' endpoint, which then executes in the browser of any user who views the page rendering that carrier name. Exploitation is bounded by two prerequisites: the attacker must be authenticated with sufficient rights to submit the carrier-update form (CVSS vector PR:L), and the victim must actively interact with the affected view (UI:A), so impact is confined to the victim's browser session rather than the server (scope-confined C:L/I:L per the independent assessment). Severity is medium (CVSS 4.0 base 4.8; 3.1 assessment AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), and no public exploit code or confirmed active exploitation was identified at time of analysis; no EPSS score was provided in the source data.
Stored cross-site scripting in the Repasat application lets an authenticated user with access to the geozone editing function inject script through the 'nomZonaGeo' parameter at '/es/geozones/update/149979', which executes in a victim's browser when the affected page is rendered. Exploitation requires a valid account (CVSS PR:L) and victim interaction (UI:A), so impact is confined to the victim's browser session rather than the server; no public exploit code and no active exploitation were identified at time of analysis. The vendor-reported CVSS 4.0 score is 4.8, and our assessed CVSS 3.1 vector (S:C/C:L/I:L/A:N) keeps this at medium severity with low real-world priority.
Cross-site scripting in the Repasat application lets an authenticated low-privilege user inject script through the 'nomTipoCli' parameter handled by the /es/clientypes/update/109441 endpoint, with the payload running in the browser of any victim who subsequently views the affected client-type content. Exploitation requires both a valid low-privilege session and a victim who actively interacts with the crafted page, and the impact is confined to that browser context (no availability impact and no cross-system scope), which is why the assessed CVSS 3.1 vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N yields a Medium severity (4.8 under CVSS 4.0). No public exploit code and no confirmed active exploitation were identified at time of analysis, and every Repasat build below the vendor's 'Abril' patch (20260402) is affected.
Authenticated cross-site scripting in the Repasat application allows low-privileged users to inject malicious scripts via the 'nomGrupoEmpresarial' parameter, which execute in a victim's browser when they view the affected corporate group update page at /es/corporategroups/update/246. Exploitation requires a valid account with access to the corporate groups update function and active interaction from a victim user; the impact is limited to client-side script execution with no server compromise or availability effect. This medium-severity flaw (CVSS 4.0 base score 4.8) has no public exploit code or confirmed active exploitation identified at time of analysis.
Stored cross-site scripting in the Repasat application allows an authenticated user with low-level privileges to inject arbitrary script through the 'name' parameter of the /es/attachmenttypes/update/{id} endpoint, which then executes in the browser of any user who renders the affected attachment-type record. The INCIBE advisory (EUVD-2026-91319) scores it 4.8 under CVSS 4.0; our independent review maps it to CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, i.e. an authenticated, interaction-dependent issue whose impact stays inside the victim's browser and does not extend to server compromise. No public exploit identified at time of analysis and the flaw is not confirmed actively exploited (no CISA KEV listing), so this is a low-to-moderate priority issue rather than a top-tier threat, affecting all Repasat versions prior to the 'Abril' patch (build 20260402).
Cross-site scripting in the Repasat application allows an authenticated low-privileged user to inject script that executes in a second, logged-in victim's browser when they load the affected '/es/datatables/getemployeetypesdatatable' endpoint, enabling session token theft and actions performed as the victim. Exploitation is not a drive-by: it requires a valid low-privileged account (CVSS vector PR:L) plus victim interaction (UI:A), and the impact is confined to the client-side browser context with no server-side code execution and no availability impact. Scored 4.8 (Medium) under CVSS 4.0, the flaw carries no CISA KEV listing and no public exploit code was identified at time of analysis, so treat it as a real but precondition-heavy weakness rather than an imminent mass-exploitation risk.
Cross-site scripting in the Repasat application lets an authenticated attacker inject script through the 'nomListaValidacion' parameter processed by the /es/validationslists/assignList/Employee/45659 endpoint, so that a logged-in victim who renders or submits the crafted content executes arbitrary JavaScript in their own browser session. Affected deployments are those exposing the Repasat web application and its validation-list assignment functionality, tracked generically by the CPE cpe:2.3:a:repasat:repasat_application (all versions, no version range published). Exploitation is not unauthenticated and not non-interactive: it requires a valid session plus victim interaction, and the independent assessment rates this as medium severity (CVSS 4.0 base 4.8; CVSS 3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N); no public exploit identified at time of analysis, and the flaw has not been confirmed actively exploited (CISA KEV).
Local argument injection in gotop 3.0.0 allows an attacker who already holds an account and shell on the same host to terminate every process owned by a targeted user, because the tool forwards an attacker-controlled process name directly to pkill and the name is parsed as a command-line option. Exploitation depends on the victim actively selecting the maliciously named process in gotop's process-kill feature (UI:R, local only), so the impact is confined to availability on shared multi-user systems. The project is no longer actively supported and CERT-PL reports the issue has not been fixed; no public exploit identified at time of analysis, and the independent assessment rates it low severity (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L, CWE-88).
Cross-site scripting in MISP's remote event preview page allows a malicious or compromised linked MISP server to execute arbitrary JavaScript in an authenticated analyst's browser session. When a federated server link is configured and MISP.tagging is enabled, the tag element's inline onclick attribute embeds the event tag ID inside a JavaScript string literal using only HTML escaping, so a crafted tag ID containing a single quote breaks out of that literal and injects attacker-controlled script. The payload does not fire on page load - the victim must open the remote event preview and click the affected tag - and it is restricted to non-default federated deployments with a hostile peer, yielding a medium/low real-world priority; no public exploit code or confirmed active exploitation was identified at time of analysis, and the raw CVSS 4.0 base score is only 4.8 (MEDIUM).
Stored/reflected cross-site scripting in the Repasat application lets an authenticated low-privileged user inject a script payload through the 'nomTamano' parameter submitted to the '/es/companysizebills/store' endpoint, and that payload then executes in the browser of any user who later renders the affected page. Exploitation requires an authenticated session (CVSS 4.0 PR:L) plus a second victim performing user interaction (UI:A), which keeps impact confined to the victim's browser session inside Repasat rather than the underlying server or other systems. CVSS 4.0 base score is 4.8 (medium); no public exploit identified at time of analysis, no confirmed active exploitation (not in CISA KEV), and no EPSS signal was supplied with the source data.
Cross-site scripting in the Repasat application allows an authenticated, low-privilege user to inject script through the 'nomMotivo' parameter of the '/es/lostmotives/store' endpoint, which then executes in the browser of any user who later views the affected page. Exploitation requires two conditions in combination - a valid low-privilege account able to submit data to that endpoint, and a victim who actively loads the page that renders the injected value (CVSS 4.0 PR:L/UI:A), which materially limits real-world reach and makes this a low-to-moderate priority issue rather than a remote unauthenticated flaw. Impact is confined to the victim's browser session and application data context; there is no server-side code execution and no availability impact, and no public exploit code or CISA KEV entry has been identified at time of analysis. The assigned CVSS 4.0 base score is 4.8, with our independent assessment settling at CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N.
Stored cross-site scripting in the Repasat application lets an authenticated user inject a malicious payload through the 'nomServicioPrestado' parameter submitted to the /es/providedservices/store endpoint, which is then rendered in the browser of any user who opens the affected service record. Because the attacker must hold valid application credentials with permission to create or modify provided-service entries (PR:L) and a separate victim must view the poisoned record for the script to fire (UI:A), exploitation is limited to script execution inside the victim's browser session and does not compromise the server. No public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV); no EPSS score was supplied in the source data, and the moderate CVSS 4.0 base of 4.8 reflects the privilege and user-interaction prerequisites.
Stored cross-site scripting in the Repasat application's delegation creation feature allows an authenticated attacker to inject malicious JavaScript into the 'nomDelegacion' parameter, which then executes in the browser of any user who views the affected delegation page. Exploitation requires a low-privileged authenticated session (PR:L) and active user interaction from a victim (UI:A); the attacker cannot act unauthenticated. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and the CVSS base score is 4.8 (CVSS 4.0).
Cross-site scripting in the Repasat application lets an attacker with at least low-privilege authenticated access inject a crafted payload into the 'nomCompetidor' parameter of the '/es/competitors/store' endpoint, causing arbitrary script to run in a victim's browser when the affected content is viewed. The vendor/NVD CVSS 4.0 base score is 4.8 and our independent assessment rates it medium severity (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), reflecting that exploitation requires valid credentials plus a separate victim interaction and that impact is confined to the victim's browser session rather than the server or host. No public exploit code or confirmed in-the-wild exploitation has been identified (not listed in CISA KEV), though the supplied tags include an 'RCE' label that the description and assessment do not substantiate - this is an XSS issue, not demonstrated remote code execution.
Stored/reflected cross-site scripting in the Repasat application allows an attacker holding valid low-privilege credentials to inject arbitrary script through the 'nomTamano' parameter at the '/es/companysizemployees/update' endpoint, which then executes in the browser of a user who loads the affected page. The flaw is rated 4.8 (Medium) by the vendor/INCIBE under CVSS 4.0 and requires an authenticated session (CVSS PR:L) plus active victim interaction (UI:A); there is no public exploit identified at time of analysis and the CVE is not reported as confirmed actively exploited (CISA KEV). Impact is confined to the victim's browser context - no server-side code execution, no loss of confidentiality or integrity at the server, and no availability impact.
Authenticated attackers with low privileges can inject malicious scripts into the Repasat application's '/es/origins/store' endpoint via the 'nomOrigen' parameter, resulting in stored or reflected cross-site scripting (CWE-79) that executes when a victim user loads a page rendering the injected payload. Rated CVSS 4.0 4.8 (Medium), exploitation requires both an authenticated account and active user interaction, and no public exploit code has been identified at time of analysis. INCIBE published an advisory for this flaw.
An open redirect (CWE-601) in the WordPress plugin Aculect AI Companion, affecting all versions through 0.8.1, lets remote attackers craft a link that bounces a victim to an arbitrary external site after they click it. The flaw is reachable over the network without authentication (PR:N) but requires user interaction (UI:R) per the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N, giving a moderate base score of 4.7 with only low confidentiality impact and no integrity or availability impact. Because exploitation is limited to redirection and phishing rather than data access or code execution, and the plugin has a small deployment footprint, real-world risk is modest; no public exploit code has been identified at time of analysis and the CVE is not in CISA KEV.
Embedded sensitive data exposure in the Monetizemore Advanced Ads WordPress plugin (versions through 2.0.26) allows an authenticated low-privilege user to retrieve sensitive data embedded in plugin-controlled objects by manipulating a user-controlled key or identifier. The flaw is a CWE-639 authorization bypass (IDOR-style) rated CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), meaning exploitation is network-reachable but requires at least low-tier authenticated credentials and yields confidentiality-only impact. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis; the issue was reported through the Patchstack vulnerability disclosure program.
Integer overflow in Google Chrome's Compositing component affects all builds prior to 154.0.8037.97 and allows remote attackers to leak cross-origin data when a victim navigates to a crafted HTML page (CVSS 4.3, AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N). The flaw is unauthenticated from a network perspective but requires user interaction - the victim must actively load attacker-controlled content - and it is confined to confidentiality impact, with no integrity or availability effect; no public exploit code has been identified at time of analysis and it is not listed in CISA KEV. EPSS probability is low at 0.18% (6th percentile) and CISA's SSVC rates exploitation as none and automatable as no, so this is a moderate-priority patch rather than an emergency one.
Cross-origin data leakage in Google Chrome versions prior to 154.0.8037.97 stems from an integer overflow in the Skia 2D graphics engine that a remote attacker can trigger by convincing a victim to load a crafted HTML page, allowing data belonging to other origins to be read. The flaw is remotely reachable by unauthenticated attackers per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N), but it mandates user interaction (UI:R) and carries only low confidentiality impact with no integrity or availability effect, for an overall CVSS of 4.3. EPSS is just 0.17% (6th percentile) and there is no public exploit identified at time of analysis, while Chromium's own 'High' severity label reflects the impact class rather than demonstrated exploitability; a vendor patch is available in Chrome 154.0.8037.97.
Information disclosure in the Kentico Xperience 13 administration API (all releases before 13.0.216) allows any authenticated administrator to read objects that belong to, or are scoped to, other users because the API endpoints perform no per-object authorization check. The issue is rated only CVSS 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), meaning a valid low-privilege admin session is mandatory and the impact is confined to reading data - there is no modification, deletion, or availability effect and no anonymous exploitation path. No public exploit code has been identified at time of analysis, and the vendor has released hotfix 13.0.216.
Missing authorization in the ThimPress LearnPress WordPress plugin through version 4.4.9.1 lets an authenticated low-privilege user perform plugin actions that should require higher privileges, giving a bounded integrity-only impact (CVSS 4.3). Exploitation requires a logged-in account on a site running the affected plugin - anonymous visitors cannot trigger it per the assessed vector (AV:N/AC:L/PR:L/UI:N), and there is no data disclosure or denial-of-service effect. No public exploit identified at time of analysis, and the issue is not in CISA KEV.
Authenticated users holding only minimal privileges such as Subscriber can overwrite the site-wide linked-service-account and API configuration option in the Popup Maker WordPress plugin through version 1.4.5, because the plugin's account-connection action verifies a nonce but performs no capability check. Rated CVSS 3.1 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), this is a moderate, authentication-gated broken-access-control flaw (CWE-284) with limited integrity impact and no confidentiality or availability loss; no public exploit code and no CISA KEV entry were identified at time of analysis. The practical exposure is greatest on sites that permit open user registration, since an external attacker can self-provision the Subscriber account needed to reach the vulnerable code path, whereas closed sites would require an existing low-privilege insider account.
Broken access control in SuperAGI v0.0.14 and earlier lets any authenticated user in one organization create, schedule, edit, stop, or delete agents belonging to a different organization's project. The controller endpoints (/api/agents/create, /api/agents/schedule, /api/agents/delete, /api/agents/edit_schedule, /api/agents/stop_schedule) accept a project_id parameter but never verify that the referenced project belongs to the caller's organization, so an attacker who knows or can enumerate a foreign project_id can tamper with and disrupt another tenant's agents. CISA's SSVC assessment records that publicly available exploit code exists (Exploitation: poc), while the impact is rated partial because there is no confidentiality read primitive; this is a moderate, authenticated IDOR-style flaw that only matters on shared, multi-tenant deployments and is a non-issue on single-org installations.
Server-side request forgery (SSRF) in Zilliz Attu before 3.0.0 allows remote attackers to proxy requests to private IP addresses via the Playground feature. This is a moderate-severity, not high-priority, issue: exploitation requires network access to an Attu instance's Playground feature, which proxies user-supplied requests without validating the destination; the CVSS vector indicates unauthenticated access (PR:N) with no user interaction, but real-world authentication enforcement is not confirmed. No public exploit identified at time of analysis.
Unauthenticated remote attackers can win a timing race against the booking/availability logic in WPdevelop's Booking Calendar WordPress plugin through version 11.8.4, producing inconsistent or corrupted booking state (integrity-only, CVSS 3.1 score 3.7). The scored vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N) reflects that no credentials or user interaction are required, but success is non-deterministic and normally demands many rapid parallel requests to the public booking submission flow, with no data disclosure or availability impact. This is a low-severity, low-real-world-priority issue: there is no CISA KEV listing and no public exploit identified at time of analysis.
Code execution concealment in MathWorks Simulink before R2026b allows an attacker-crafted .slx model to include blocks that are never visible in the Simulink Editor yet execute when the model is opened. Exploitation is local and requires a victim to open an untrusted model, with high attack complexity and low confidentiality/integrity impact (CVSS 3.6), so the practical risk is low despite the code-execution wording. The supplied data shows a public technical disclosure of the concealed-block technique but no CISA KEV confirmation, and no public exploit identified at time of analysis.
Sensitive information exposure in the Otter Blocks WordPress plugin (all versions up to and including 3.2.6) allows any authenticated user with subscriber-level access or above to retrieve the email addresses and submission dates of the five most recent form submitters, along with the site's total form submission count, by manipulating the 'otter_form_widget_filter' parameter. The vulnerable widget is registered whenever the themeisle_blocks_form_emails option is non-empty - the normal state on any site that has saved a Form block - so the exposure is live on standard sites using the plugin's form feature. No public exploit identified at time of analysis, and no evidence of active exploitation; the exposed data set is small and fixed, and the independent assessment rates real-world risk as consistently low (low-severity information disclosure under CVSS 3.1, assessed vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
Missing authorization in the Motors WordPress plugin before 1.4.124 lets an authenticated user with subscriber-level access or higher set metadata on posts they do not own, including overwriting WooCommerce product prices, by invoking one of the plugin's listing management actions. The attack path only exists when the site has WooCommerce active and the plugin's paid featured-listing option enabled, neither of which is a default configuration, so default or non-WooCommerce installations are not exploitable. No public exploit code or confirmed active exploitation has been identified at time of analysis (CISA KEV does not list this CVE), and the assessed severity is low at CVSS 3.1 (AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N), reflecting integrity-only impact and heavy prerequisite constraints.
Trivy versions before 0.71.0 allow directory traversal through Terraform filesystem functions during misconfiguration scanning of untrusted input, potentially exposing sensitive files located outside the scan root. An attacker able to supply a malicious Terraform configuration (e.g., via a third-party pull request) can use relative paths like '../secret' in file() or filebase64() to include the contents of files above the scan directory in scan output. Exploitation requires the sensitive file to exist at a guessable traversal path and is confined to information disclosure (C:L) with high attack complexity; no public exploit has been identified at time of analysis.
Cross-site request validation weakness in the Next.js `next dev` development server (versions 16.0.0 through 16.3.7) allows a malicious website, when visited by a developer who is simultaneously running the dev server, to reach the Model Context Protocol endpoint at /_next/mcp and read development-only metadata: the project's disk location, source-code snippets embedded in error reports, the application's route inventory, and development logs. The CVSS 4.0 score is only 2.3 (assessed as CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N by our review) because exploitation requires the victim to actively run the affected dev server and browse to an attacker-controlled page during that session, and because the impact is limited to read-only disclosure with no code execution or data modification. Production and built deployments do not serve this endpoint at all, so only developer workstations during active local development are exposed; no public exploit code was identified at time of analysis and the issue is not known to be actively exploited. A vendor-released patch is available in Next.js 16.3.8.
Ghost CMS versions from 0.7.2 up to (but not including) 6.64.0 leak password-hash ordering information to authenticated, staff-level users through the Admin API, allowing an insider or a holder of a compromised staff account to learn how other staff members' password hashes are sorted relative to one another. Exploitation requires authenticated staff access with Admin API reachability (PR:L), is rated high complexity (AC:H) because it depends on repeated, carefully crafted queries and the analysis of response discrepancies, and is bounded in impact: per the vendor advisory and independent assessment, the hashes themselves are not disclosed and practical password recovery is not enabled. No public exploit code and no confirmed active exploitation were identified at time of analysis, consistent with the very low CVSS 4.0 score of 2.3 and the assessed CVSS 3.1 vector of AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N.
Stored cross-site scripting in SourceCodester Student Result Management System 1.0 lets an attacker who can create an announcement record inject JavaScript through the 'title' or 'announcement' fields of script/academic/core/new_announcement.php, which then executes in the browser of any user who later views the rendered announcement. The exploitation prerequisite is low-privileged authenticated access to the announcement-posting function plus victim interaction (the target must load the affected page), and the authoritative assessment confirms impact is confined to the victim's browser session (assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), with no server-side confidentiality or availability impact. Publicly available exploit code exists and disclosure has been coordinated through VulDB, but there is no indication of confirmed active exploitation (no CISA KEV listing) and no vendor-released patch identified at time of analysis, keeping this a genuinely low-priority issue despite the public disclosure.
Missing authorization in the cal.diy (Cal.com) PBAC Permission Engine lets any authenticated low-privilege user read and modify bookings that do not belong to them, because the doesUserIdHaveAccessToBooking function in BookingAccessService.ts relies on a PermissionCheckService whose permission checks were replaced by stubs that unconditionally return true. All builds up to and including 6.2.0 are affected, and publicly available exploit code exists, though the CNA-assigned CVSS 4.0 base score is only 2.1 (Low) because per-request confidentiality, integrity and availability impact is limited and a valid account on the target instance is required. No patched release is available yet: the fix is proposed in pull request #30253, which is still awaiting acceptance, so defenders cannot remediate by upgrading at time of analysis.
Denuvo Anti-Tamper (through 2026-03-04) can be bypassed by locally authenticated administrators with kernel-level privileges who load a hypervisor driver that intercepts CPUID instructions and spoofs hypervisor-absence results, defeating the anti-tamper check on AMD (SimpleSvm.sys) and Intel (hyperkd.sys, hyperhv.dll) platforms. The vulnerability has a CVSS score of 1.9 (AV:L/AC:H/PR:H) and only affects the integrity of the DRM check on the attacker's own system, with no third-party victim or escalation. No public exploit identified at time of analysis.
Improper restriction of XInclude resource resolution in Copernik XML Factory through 0.1.1 allows an attacker-controlled XML document to resolve xi:include hrefs when the stock JDK provider is in use, resulting in local file disclosure and server-side request forgery against internal HTTP endpoints. Only applications that obtain a factory from XmlFactories.newDocumentBuilderFactory() or XmlFactories.newSAXParserFactory() (or harden an externally supplied XMLReader via XmlFactories.harden()), run without Apache Xerces (xercesImpl) on the classpath, explicitly enable XInclude with setXIncludeAware(true) or the equivalent reader feature, and parse XML from an untrusted source are affected; the Xerces provider and the Android provider are not affected. No CVSS vector, EPSS score, or CISA KEV entry was provided, so no public exploit or active exploitation was identified at time of analysis, although the defect is confirmed and fixed by upstream commits and the 0.1.2 release.
Response-body inspection can be silently evaded in the affected Ubuntu-packaged component tracked as GHSA-vmg8-j66p-vgvw when an HTTP response declares its Content-Type using non-canonical character casing, causing the inspecting logic to fail its canonical comparison and skip the body it was meant to examine. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N) shows a network-reachable bypass with no confidentiality or availability impact, a low integrity impact, and a Scope-Changed rating that reflects the defeated check protecting resources beyond the vulnerable component itself. Exploitation requires the attacker to influence the Content-Type value of a response, typically by controlling or compromising the upstream/origin server whose traffic flows through the inspecting component; no public exploit code has been identified at time of analysis and no CISA KEV entry was included in the source data, so active exploitation is unconfirmed. The specific affected product name, version range, and configuration preconditions are not established by the available data, and authentication requirements are likewise not confirmed from the input.
Ubuntu package exposure for CVE-2026-102969 is currently undetermined: the only intelligence available is a vendor:ubuntu tracker attribution, with no upstream description, no CVSS score or vector, no CWE, and no affected component or version detail published at time of analysis. Because no exploitation prerequisites, authentication level, or attack surface can be derived from the record, no impact statement can be made and the risk cannot be meaningfully assessed from the provided data. No CISA KEV listing exists and no public exploit identified at time of analysis, but this reflects an absence of information rather than a confirmed absence of risk, so the record should be treated as an unassessed placeholder until the Ubuntu CVE tracker entry and the originating upstream advisory are retrieved.
Denial of service affects the XML request body processor, which dereferences an uninitialized parser context pointer when XML parser setup follows a failure or early-exit path, producing a crash rather than any confidentiality or integrity loss (assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). The specific hosting product, the exact feature or configuration that routes request bodies into this processor, and the affected version range are not identified in the available data, which reports only a GitHub Security Advisory (GHSA-jx3r-phvx-2jmj) filed by the vendor:ubuntu source. No public exploit code exists and there is no confirmed active exploitation (no CISA KEV listing, no EPSS probability supplied), so prioritization should be driven by whether the affected component is exposed to untrusted request bodies and whether XML body handling is enabled by default; note that the CVSS vector carries PR:N (unauthenticated) in the independent assessment, but the advisory itself does not confirm authentication requirements.
Risk cannot be meaningfully assessed from the available data. CVE-2026-91148 is referenced only by the vendor source "ubuntu" and arrives with no description, no CVSS score or vector, no CWE classification, no CPE identifiers, and no reference list, so the affected package, the vulnerable component, and the attack surface are all unknown. No public exploit identified at time of analysis, and authentication requirements are not confirmed from available data. The originating Ubuntu Security Notice (USN) must be retrieved from the Ubuntu security tracker before any defender-actionable statement about impact or exposure can be made.
An unidentified security defect in Ubuntu-packaged software is tracked as CVE-2026-102970, but the advisory data carries no description, no CVSS score, no CVSS vector, and no CWE classification, so the affected package, the attack vector, and the resulting impact cannot be established from the available intelligence. The single data point is the reporting source, vendor:ubuntu, which indicates the flawed code ships within at least one Ubuntu-maintained package rather than in an unrelated third-party product. No public exploit identified at time of analysis, and there is no KEV listing, so no active exploitation can be claimed. Risk cannot be meaningfully assessed because the core intelligence signals are entirely absent, and authentication requirements are not confirmed from available data; the corresponding Ubuntu Security Notice must be retrieved to identify the exact package and enabling conditions.
CVE-2026-102972 is recorded as a Ubuntu-sourced CVE (reported by vendor:ubuntu), but the supplied record contains no description, no CVSS score or vector, no CWE, no CPE identifiers, and no impact detail, so the affected package, version range, and attacker capability cannot be stated. Based on the available data there is no confirmed actively exploited status (no CISA KEV entry provided) and no public exploit code identified at time of analysis; EPSS data was not supplied. Risk cannot be meaningfully assessed from the provided data, and defenders should treat this entry as an unenriched tracking identifier until the full record is retrieved from the Ubuntu CVE tracker or NVD.
CVE-2026-102975 is an Ubuntu-reported security issue whose technical details remain unpublished: no description, CVSS score, CVSS vector, or CWE classification was supplied, so the vulnerable component, attack vector, and impact cannot be established from the available intelligence. The only attributable signal is the reporting source, vendor:ubuntu, which indicates the issue was filed or coordinated through Ubuntu's security process; no CISA KEV entry and no public proof-of-concept are associated with this record, so the exploitation status is best described as no public exploit identified at time of analysis. Because Ubuntu packages are typically downstream of upstream open-source projects, the affected package name, version range, and exposure surface will only become clear once the corresponding Ubuntu Security Notice (USN) and NVD record are populated, and until then no meaningful risk rating can be derived.
CVE-2026-102974 is an Ubuntu security-feed vulnerability record for which no public description, CVSS score, CVSS vector, or CWE classification was supplied, so the concrete impact cannot be characterized beyond identifying the affected distribution. The record originates from the Ubuntu vendor feed, indicating a packaged component shipped in Ubuntu (and in many cases its Debian and upstream sources) is involved, but the specific binary package, vulnerable code path, and deployment prerequisites remain unresolved. No public exploit code has been identified at time of analysis, no EPSS score or CISA KEV entry was provided, and authentication requirements are not confirmed from available data, meaning risk cannot be meaningfully scored until the corresponding Ubuntu Security Notice is retrieved.
Heap out-of-bounds read/write in FreeRADIUS's MS-MPPE key re-encryption path can corrupt memory when the server processes or forwards malformed MS-MPPE-Send-Key/Recv-Key attributes, potentially enabling code execution, data disclosure, or denial of service in RADIUS proxy, relay, or MS-CHAP key-exchange deployments. The independent assessment rates this AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, so exploitation requires network reachability plus a position in the RADIUS path or knowledge of the shared secret and is not anonymous internet-wide. No CISA KEV listing, public exploit code, EPSS score, or vendor patch version is present in the provided input; consult GHSA-wj29-mxmc-q98c for authoritative details.
Ubuntu Linux is the only identifiable product for CVE-2026-102977, which has been recorded solely via a vendor reference from the Ubuntu security team and carries no description, CVSS vector, CWE, or affected package list. Because the vulnerability class, attack vector, authentication requirements, and impacted component are all unknown, the practical impact on Ubuntu hosts and their derivatives cannot be characterized from the available data. No public exploit code has been identified at time of analysis, and the record shows no confirmed actively exploited (CISA KEV) status and no accompanying EPSS score, so this should be treated as an unassessed placeholder pending retrieval of the Ubuntu Security Notice and the corresponding NVD entry.
Weak TLS hostname verification in libcurl during outbound HTTPS fetches allows an adversary positioned on the network path to impersonate an arbitrary remote server and read or modify the traffic, because a certificate whose Common Name or Subject Alternative Name does not match the requested host is accepted when the application does not set CURLOPT_SSL_VERIFYHOST to its strict value. Affected are applications and utilities that perform HTTPS requests through libcurl with weakened hostname checking, a configuration pattern that is configuration-dependent rather than necessarily a libcurl default; the exact affected products and versions are not specified in the available data, which originates from the Ubuntu vendor report for GHSA-2vqc-36qp-ccmw. No CVSS, EPSS, or CISA KEV data is provided, and no public exploit was identified at time of analysis; the assessed vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) reflects high confidentiality and integrity impact but high attack complexity, since the attacker must already hold a traffic-interception position such as a rogue access point, ARP/DNS spoofing, a malicious upstream proxy, or control of a routing hop.
Incomplete HTML entity decoding in the affected HTML decoder allows filter-evasion: input that a security component believes has been decoded and neutralized can still reach a renderer as active markup, because certain HTML character references are not translated. The vulnerability is remotely reachable without authentication (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), but exploitation is not automatic - it requires an application or workflow that routes untrusted input through this decoder and then trusts the result for sanitization before the content is rendered, plus a victim who actually renders the under-sanitized output. Impact is therefore conditional and typically limited to low-integrity/low-confidentiality effects within the downstream rendering context rather than full host compromise. No public exploit code has been identified at time of analysis and there is no confirmed actively exploited (CISA KEV) status; EPSS and CVSS data were not supplied for this entry, and the absence of the exact product, version, and configuration means prioritization confidence is low.
CVE-2026-102966 is currently unassessable: the record carries no description, no CVSS score or vector, no CWE, and no patch or reference data, with the only provenance being that it was reported by vendor:ubuntu. As a result, the affected Ubuntu source package, the vulnerable component, the attack surface, and the privilege or interaction requirements are all unknown, and no statement can be made about what an attacker could achieve or which versions are exposed. No public exploit code, no proof-of-concept, and no CISA KEV entry are associated with this record at the time of analysis, but that absence reflects missing data rather than a positive assurance of safety.