Command injection in the HPE Aruba ClearPass Policy Manager OnGuard agent allows an attacker holding a valid authenticated session within a ClearPass-managed environment to inject and execute arbitrary operating-system commands, which per the vulnerability description run with elevated privileges on the affected Windows endpoint. Only deployments that have installed the OnGuard posture/health agent on Windows hosts are exposed; non-Windows endpoints and environments not using OnGuard are out of scope. HPE rates this medium severity (CVSS 6.5), and our independent assessment keeps the severity in that band while noting that, once the authentication prerequisite is satisfied, the impact on the endpoint is high because the injected commands inherit elevated rights (assessed confidentiality, integrity and availability all High). No public exploit code has been identified and CISA KEV does not list this issue, so there is no confirmation of active exploitation at time of analysis.
Qualcomm Snapdragon kernel driver IOCTL handling contains a memory corruption (out-of-bounds write) that a local attacker with low-privilege code execution can trigger by supplying invalid parameters, leading to potential integrity impact and denial of service. This is a moderate-severity local issue (CVSS 6.6) rather than a drop-everything priority. No public exploit code or active exploitation has been identified at time of analysis.
Authenticated path traversal in IBM Langflow OSS 1.0.0 through 1.12.2 lets a remote attacker who already holds a valid low-privilege account or session reach files outside the intended restricted directory, exposing sensitive information hosted on or reachable from the Langflow instance (CWE-22). The flaw is network-reachable with low attack complexity and no user interaction required, but it is explicitly not unauthenticated - an attacker must first be able to log in, so internet-exposed deployments with self-service registration or shared credentials carry the greatest realistic risk. At the time of analysis no public exploit code has been identified and there is no confirmed active exploitation (not in CISA KEV); IBM has published a fix through its support advisory.
Denial of service in the WordPress plugin WPBase Cache (versions 5.5.6 and earlier) allows an authenticated user holding the Subscriber role - the lowest authenticated WordPress role - to consume server resources without limit and degrade or take the site offline. The attack is network-reachable, low complexity, requires no user interaction, and affects only availability (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, 6.5 Medium), so sites that have disabled user registration or that do not run the plugin are not exposed to anonymous attackers. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the practical exposure depends on whether the target site permits self-registration or an attacker already holds subscriber credentials. Reported by Patchstack, with no vendor-fixed version confirmed in the available advisory data.
Sensitive information disclosure in AOS-S (HPE Aruba switching platform) could let a remote attacker read confidential data from an affected device's management surface, as documented in HPE advisory hpesbnw05156en_us. The vendor description characterizes the attacker as unauthenticated, while the published CVSS 3.1 vector carries PR:L (some privilege required); our independent assessment resolves the vector to PR:N with a resulting score of 7.5, but that authentication precondition remains genuinely unresolved and materially changes exploitability, so it should be verified against the advisory before risk is finalized. Exploitation is confined to confidentiality (C:H) with no integrity or availability impact, and no public exploit code or CISA KEV entry was identified at time of analysis, placing this in a moderate, patch-and-segment priority tier.
Denial of service in Elasticsearch allows an authenticated user holding read access to just a single index to terminate a cluster node by submitting a search request whose aggregation definitions are deeply and maliciously nested. Processing the request drives unbounded recursive execution that exhausts the node's resources and crashes the affected process, which does not recover on its own and requires manual intervention to restore service. The flaw is scored CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), is availability-only, and no public exploit code or confirmed active exploitation was identified at time of analysis; the practical barrier is the authenticated read privilege prerequisite rather than remote reachability.
A buffer overflow in an affected interface of HPE Aruba AOS-S (ArubaOS-Switch) networking devices lets an authenticated remote attacker crash or destabilize the switch, producing a denial-of-service condition. Successful exploitation requires valid credentials on the device (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base score 6.5), so the realistic risk is management-plane disruption and loss of network availability rather than data compromise or code execution - the assessed impact is availability-only (A:H) with no confidentiality or integrity effect. There is no indication of confirmed active exploitation or of publicly available exploit code at the time of analysis, and the issue is rated moderate priority; specific affected firmware builds and configuration preconditions must be confirmed against HPE advisory hpesbnw05156en_us.
Improper input validation in the @backstage/plugin-techdocs-backend static content router (versions prior to 2.2.4) lets an authenticated Backstage user reach TechDocs static files outside the entity they are authorized to view when the Azure Blob Storage publisher provider is configured and entity-level permissions are enabled, resulting in high-confidentiality information disclosure. The flaw is a path traversal (CWE-22) reachable over the network by a low-privileged account, rated CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N); Azure-Blob-Storage-only scope and the required authenticated session keep realistic risk moderate. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor-released fix is @backstage/plugin-techdocs-backend 2.2.4, published in the Backstage monorepo release v1.54.6.
Broken access control in the Delete All Comments WordPress plugin through version 7.1 allows any authenticated subscriber-level account to invoke bulk comment-deletion functionality without the required capability check, causing high availability impact to comment data on affected sites. The assessed CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H confirms remote, low-privilege exploitation with no user interaction, while confidentiality and integrity are unaffected; this is a moderate, not critical, priority. No CISA KEV confirmation and no public exploit identified at time of analysis are present in the supplied intelligence, and exploitation is realistic mainly where self-registration or obtainable subscriber credentials exist.
Unauthenticated settings modification in the PayPlug for WooCommerce (Official) WordPress plugin at versions up to and including 3.1.0 lets any network-reachable attacker invoke the plugin's settings-change functionality without credentials or user interaction, altering configuration data on affected WooCommerce stores (CVSS 6.5, PR:N/UI:N with limited integrity and availability impact). The root cause is a missing authorization check (CWE-862), which means the plugin exposes a settings endpoint that does not verify capability or nonce before applying changes. At time of analysis there is no public exploit code and no confirmed active exploitation (not in CISA KEV); successful abuse remains limited to sites that have this specific plugin installed, active and reachable at an affected version, and the impact is scoped to settings modification rather than full site compromise.
Unauthenticated broken access control in the Autoship Cloud for WooCommerce Subscription Products plugin through version 2.17.0 lets remote attackers reach plugin functionality that should require authorization, allowing unauthorized actions that degrade the integrity and availability of subscription-related operations (CVSS 6.5, C:N/I:L/A:L). The assessed vector (AV:N/AC:L/PR:N/UI:N) confirms the flaw is exploitable without credentials or user interaction, so the only real prerequisites are that a vulnerable plugin version be installed, active, and reachable over the network on a WordPress/WooCommerce site. No CISA KEV entry and no public exploit code were identified at time of analysis, so this is a moderate, patch-on-schedule issue rather than a top-tier emergency.
Authenticated path traversal in the Piotnet Addons for Elementor WordPress plugin (versions up to and including 7.1.71) lets a Contributor-level account read and download arbitrary files from the host, exposing wp-config.php credentials, backups, and other sensitive data (CVSS 3.1: 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). The flaw is confidentiality-only - an attacker gains no ability to write, modify, or disrupt the site - and it requires a valid Contributor login, so exposure is concentrated on sites that allow open registration or hand Contributor roles to untrusted users. There is no CISA KEV entry and no public exploit code identified at time of analysis, and Patchstack is the reporting source through its WordPress vulnerability database.
Missing authentication in the csm-authorization-tenant gRPC service (TenantService) shipped with Dell Container Storage Modules (CSM) allows an unauthenticated attacker on the adjacent network to create tenant entities, inject roles across tenant boundaries, and modify storage access-control flags on any deployment running CSM authorization prior to 1.18.0. The flaw is rated CVSS 7.1 (AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N) reflecting high integrity impact with no authentication and no user interaction required, though it is only reachable from an adjacent network segment rather than the public internet. There is no public exploit identified at time of analysis and no CISA KEV listing; multiple signals point to a moderate, not top-tier, priority, with exposure concentrated in clusters that actually deploy the CSM authorization module and do not segment its gRPC control plane from untrusted pods or hosts.
Use-after-release in Google Chrome's FontAccess (Local Font Access API) lets an attacker who has already compromised the renderer process bypass web origin policy by luring a victim to a crafted HTML page in Chrome versions prior to 155.0.8059.39. Successful exploitation yields no confidentiality loss but a high integrity impact, as the attacker can subvert origin boundaries from inside an already-broken renderer; the required renderer compromise is a hard prerequisite and makes this a defense-in-depth, medium-severity issue rather than a standalone remote entry point. No public exploit identified at time of analysis, EPSS is low at 0.31% (22nd percentile), and Google has released a fixed build. The CVSS vector shows PR:N/UI:R, meaning unauthenticated attackers are relevant but victim interaction (loading the page) is mandatory; our own assessment rates attack complexity as High rather than Low given the prerequisite renderer foothold.
Denial of service in Elasticsearch allows an authenticated user (CVSS vector PR:L) who holds read access to a single index to crash a node by defining a scripted runtime field whose script output builds a deeply nested geometry value; because serialization of script-generated geometry lacks the nesting-depth limit applied to text-supplied geometry, recursion exhausts the stack and the node terminates, and on some deployments it does not recover without manual intervention. The issue is availability-only (C:N/I:N/A:H, CVSS 6.5) with no data exposure, and no public exploit code was identified at time of analysis. Fixes are released in Elasticsearch 8.19.23, 9.4.8, and 9.5.5 per ESA-2026-198, so this is a moderate-priority patching item rather than an emergency, but clusters that allow untrusted users to read indices while scripting/runtime fields are enabled should treat it as more urgent.
Denial of service in Elasticsearch lets an authenticated user who holds connector management privileges exhaust node heap memory by creating a connector resource with an excessively large description field and then causing that resource to be accessed or read, crashing the affected node. The path is network-reachable but requires PR:L authorization, and the impact is limited to availability with no data confidentiality or integrity loss. No public exploit code has been identified at time of analysis, and Elastic has released fixed versions 8.19.2, 9.0.6, 9.1.4, and 9.2.1 in advisory ESA-2026-195.
Denial of service in Elasticsearch allows authenticated users holding the manage_index_templates cluster privilege to exhaust node heap by registering multiple index-template resources with metadata near the per-resource size limit and then triggering a combined retrieval that materializes all metadata in memory simultaneously. Affected versions include Elasticsearch releases prior to 9.4.7, 9.5.3, and 8.19.23, as addressed in ESA-2026-192. No public exploit code has been identified at time of analysis, and exploitation requires the specified privilege, limiting the attack to trusted operators or compromised privileged accounts.
Denial of service in Elasticsearch 9.x lets an authenticated attacker holding only low-privilege credentials terminate a node by submitting a request that drives uncontrolled recursion and excessive memory allocation, taking down cluster availability. The CVSS 6.5 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) confirms availability-only impact with no data exposure or modification, reachable over the network with no user interaction or non-default configuration - though authentication at a low privilege level is required, so exposure is limited to insiders, compromised credentials, or over-permissive accounts. Exploitation status is no public exploit identified at time of analysis (no CISA KEV listing, EPSS not available), making this a moderate, availability-only risk rather than a top-tier emergency; vendor fixes are published as Elasticsearch 9.4.8 and 9.5.5 in ESA-2026-190.
Denial of service in Elasticsearch 8.x and 9.x lets an authenticated user with only low privileges crash cluster nodes by submitting a specially crafted query that drives uncontrolled memory growth in the query processing engine, ending in an out-of-memory termination. Because the trigger can be repeated - including through queries embedded in shared resources such as saved searches or stored queries - the result can escalate from a single node restart to persistent cluster unavailability, though there is no data disclosure or modification path. The flaw is rated CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), and no public exploit code has been identified at time of analysis.
Directory traversal in the OpenSSH sftp client before 10.6 can cause files to be written to unintended locations when a user performs a recursive copy operation against an attacker-controlled or compromised SFTP server. Exploitation requires the victim to initiate a recursive transfer such as get -r or put -r, and the malicious server supplies crafted path/filename entries containing traversal components; this is a client-side trust issue, not a flaw in an exposed sshd service. No public exploit identified at time of analysis, and the assessed CVSS 3.1 score is 4.2 with high attack complexity and user interaction required.
Unauthenticated broken access control in the 10Web Social Photo Feed WordPress plugin (versions 1.4.35 and earlier) allows remote attackers to reach plugin functionality that should require authorization, giving limited read and write access to plugin-controlled data rather than full site compromise (CVSS 6.5, CWE-862, C:L/I:L/A:N). The CVSS vector confirms no authentication (PR:N) and no user interaction (UI:N) are needed, and the attack is network-reachable at low complexity, so any site with the vulnerable plugin active is exposed without credentials. Exploitation is bounded by the Low confidentiality and integrity impact and by the need for the specific plugin/version; no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV.
Authenticated users of Backstage TechDocs can bypass entity-scoped authorization and read documentation belonging to other entities by requesting a crafted /static/docs/... URL containing percent-encoded parent-directory (%2e%2e) segments. The issue is confined to deployments that combine the external TechDocs builder with an external storage provider (S3, GCS, etc.) and have the Backstage permission framework enabled; setups without the permission framework are unaffected because TechDocs content is intentionally readable by all authenticated users, and the default local builder/storage path is not exposed. Exploitation requires an authenticated account that already has access to at least one TechDocs site (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, 6.5), exposure is therefore limited to confidentiality of docs across entity boundaries, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Filesystem path traversal in the Backstage TechDocs local publisher (@backstage/plugin-techdocs-node) can expose host files - such as /etc/passwd - to authenticated users of the documentation serving endpoint when the backend is configured with techdocs.publisher.type: 'local'. Exploitation requires a documentation source tree that already contains a symbolic link pointing outside the intended output directory, a precondition the vendor states does not arise through normal MkDocs operation, plus an authenticated user able to reach the endpoint (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.3, confidentiality-only impact). Cloud publishers (S3, GCS, Azure Blob Storage) are explicitly not affected, and no public exploit code has been identified at time of analysis; the issue is fixed in @backstage/plugin-techdocs-node 1.15.4.
Arbitrary file read in the Backstage TechDocs node plugin (@backstage/plugin-techdocs-node) prior to 1.15.4 allows an authenticated user who can register documentation sources to escape the intended documentation boundary. Because TechDocs only validated symlinks inside the docs_dir, an attacker-controlled source tree containing a symlink that resolves outside the tree (e.g. to /etc/passwd) plus an MkDocs snippets include directive ('--8<--') could pull that out-of-bounds file into the generated documentation, exposing anything readable by the build process. Exploitation requires authenticated access (PR:L), a crafted symlink/snippet chain (AC:H), and a deployment that builds docs from user-registerable sources; impact is confidentiality-only (C:H/I:N/A:N, CVSS 5.3), and no public exploit was identified at time of analysis.
Sensitive information disclosure in Kibana 9.4.x and 9.5.x allows an authenticated user with limited Fleet management privileges to read private cryptographic key material that should be restricted to Fleet settings administrators. The exposed material can include Fleet Server host-connection keys, potentially enabling impersonation of trusted Fleet infrastructure in deployments where those keys are actively used; no public exploit identified at time of analysis. Vendor fixes are available in Kibana 9.4.8 and 9.5.5 per Elastic Security Advisory ESA-2026-193.
Authenticated attackers holding a Subscriber-level account or higher can exploit a missing authorization check in the WordPress plugin App for Cloudflare (versions 1.10.1 and earlier) to modify plugin settings without proper permissions. The vulnerability has a CVSS score of 6.5, requires low-privilege credentials on a site where the plugin is active, and results in unauthorized configuration changes with no confidentiality or availability impact. No public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV; sites that allow user self-registration or that have existing low-privilege accounts are most at risk.
Inconsistent repository filtering in Backstage's Bitbucket Server catalog backend module allows an authenticated Bitbucket Server user to inject catalog locations for repositories that the provider's configured filters are supposed to exclude. Only deployments of @backstage/plugin-catalog-backend-module-bitbucket-server (0.4.0 up to but not including 0.5.15) that use event-driven catalog updates AND configure projectKey, repoSlug, or skipArchivedRepos filters are affected; the attacker must have push access to a filtered-out repository that the Backstage integration credentials can still read. Impact is limited to unauthorized additions to the software catalog (integrity, not confidentiality or availability), no public exploit code has been identified at time of analysis, and exploitation requires valid Bitbucket Server authentication (PR:L) - so this is a genuine but moderate-priority authorization flaw rather than an emergency.
Information disclosure in IBM Langflow OSS versions 1.0.0 through 1.12.2 allows a remote authenticated attacker with only low-level privileges to obtain sensitive information, because authorization checks are not properly enforced on certain resources. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5) confirms network reachability and low attack complexity but also that a valid account is a prerequisite, so unauthenticated external attackers cannot exploit it directly; there is no integrity or availability impact. At time of analysis there is no public exploit identified, and the primary risk is for multi-tenant or publicly registrable Langflow deployments where obtaining a low-privileged account is trivial. IBM has published a vendor advisory covering this issue.
Low-privileged authenticated users of IBM Langflow OSS 1.0.0 through 1.12.2 can retrieve credentials that the platform fails to protect adequately, exposing stored secrets such as integration keys and API tokens to any account holder on the instance. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, base 7.7 High) confirms a network-reachable flaw requiring only low privileges and no user interaction, with a scope change and high confidentiality impact but no integrity or availability effect. Exploitation requires a valid authenticated session, which rules out anonymous internet attacks; no public exploit has been identified at time of analysis and IBM has published fixes via its support advisory, so the highest residual risk sits in multi-user or multi-tenant deployments where low-trust accounts coexist with high-value stored credentials.
Unauthenticated IDOR in the Wappointment appointment-booking plugin for WordPress (all versions through 2.7.7) allows remote attackers to access and tamper with appointment records they do not own by supplying or enumerating object identifiers that the plugin fails to authorize. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, base 6.5) confirms no authentication, privileges, or user interaction are needed, so any network-reachable WordPress site running the plugin at or below 2.7.7 is exposed; impact is bounded to partial confidentiality and integrity loss with no availability impact. No public exploit code and no CISA KEV listing were identified at time of analysis, and no EPSS score was provided, making this a moderate-priority issue rather than an emergency - though unauthenticated Internet exposure and the ease of identifier enumeration keep it worth prompt attention.
Unauthenticated settings modification in the TrueBooker appointment-booking WordPress plugin (versions 1.2.9 and earlier) lets remote attackers alter plugin configuration without logging in, rated CVSS 6.5 (Medium) with vector AV:N/AC:L/PR:N/UI:N, meaning no privileges, no user interaction, and low attack complexity are required against default installs. The flaw is a CWE-862 missing authorization condition that affects integrity (limited) and availability (limited) but not confidentiality, so the practical outcome is tampered or degraded booking/settings behaviour rather than data theft or code execution. Exposure is bounded by deployment scope - only WordPress sites running this specific ThemeTechMount plugin at a vulnerable version are at risk - and no public exploit code or confirmed active exploitation was identified at time of analysis; as of the Patchstack report (EUVD-2026-93042) no fixed version had been published.
Sensitive-value disclosure in the @backstage/plugin-scaffolder-backend package prior to 4.1.0 lets an authenticated user who can create and read scaffolder tasks observe secret values in task logs and error messages. Exposure is conditional: it requires a deployment using the scaffolder permission framework with restrictive action permissions that actually deny an action, plus an affected template that passes a task secret, an environment secret, or a secret-derived 'each' key as input to that denied action. No public exploit code has been identified at time of analysis, and there is no confirmed active exploitation (CISA KEV); risk is moderate and highly configuration-dependent because default deployments without action-level denials and templates that do not route secrets through denied actions are unaffected.
Improper preservation of access restrictions in Backstage's @backstage/backend-defaults package lets an authenticated holder of a restricted external service credential (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L, rated 7.6) escalate privileges by routing requests through plugin-to-plugin delegation: the credential's permission-name or permission-attribute limits (for example action:read) are dropped when a plugin request token is minted on the credential's behalf, so a read-only principal can perform write operations on plugins it should only be able to read. Only deployments that both use @backstage/backend-defaults and configure external service credentials with accessRestrictions are exposed, and exploitation is scoped to plugins reachable through the delegation path. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (not in CISA KEV); fixed releases are @backstage/backend-defaults 0.16.1 and 0.17.8.
Uninitialized memory disclosure in Google Chrome's Video component (all versions prior to 155.0.8059.39) lets a remote attacker read memory inside the renderer sandbox by convincing a victim to load a crafted HTML page. Exploitation requires user interaction (UI:R) with no authentication (PR:N), and the resulting leak is confined to the sandboxed renderer, so it would realistically need to be chained with a separate sandbox-escape to reach host data. There is no public exploit identified at time of analysis, no CISA KEV listing, and EPSS is low at 0.24% (13th percentile); vendor-released patch 155.0.8059.39 resolves the issue, and CISA SSVC rates exploitation as 'none' with partial technical impact.
Inconsistent credential enforcement in the @backstage/plugin-proxy-backend package (versions 0.5.0 through 0.6.17) lets unauthenticated callers reach nested proxy upstreams that were explicitly configured to require credentials. When an operator defines an overlapping parent proxy path with credentials set to 'dangerously-allow-unauthenticated' and a nested child path under it with credentials set to 'require', the permissive parent exemption is applied to requests matched by the nested route, so the request is forwarded to the protected upstream and may be sent with static upstream credentials configured for that proxy. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N) marks this as unauthenticated but high-complexity because exploitation depends on a specific overlapping proxy configuration rather than default settings; no public exploit code has been identified and the issue is not confirmed actively exploited (no CISA KEV listing).
Stored cross-site scripting in the Front End PM WordPress plugin (versions 11.4.6 and earlier) lets an attacker holding a low-privileged Subscriber account inject script payloads through plugin input such as private messages or profile fields, which then execute in the browser of a higher-privileged user who views the content. The flaw is rated CVSS 6.5 (medium, AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L), meaning the attacker must be authenticated and the victim must actively open the tainted content, so exposure is concentrated on sites that permit open or self-service user registration. No public exploit code has been identified at time of analysis and the issue is not reported as actively exploited; Patchstack published the finding and no vendor fix version is confirmed in the available data.
Log-file information disclosure in Dell Container Storage Modules (CSM) versions prior to 1.18.0 allows a low-privileged but authenticated remote user to obtain sensitive data that the components write into their own log files (CWE-532). The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N (6.5) confirms confidentiality-only impact with no integrity or availability effect, and exploitation presupposes that the attacker already holds a valid account plus read access to the generated logs, making this a moderate rather than a top-tier priority. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Improper input validation in Google Chrome's Viz display/compositor component lets an attacker who has already compromised the renderer process bypass system access restrictions by enticing a victim to load a crafted HTML page, producing a high-integrity impact with no confidentiality or availability loss, and consistent with a sandbox defense-in-depth bypass rather than standalone code execution. The flaw affects Chrome builds prior to 155.0.8059.39 and was rated Chromium security severity Medium; it is not a remotely triggerable, unauthenticated compromise of a fully patched browser on its own, because the renderer must be pre-compromised first. There is no public exploit code identified at time of analysis, no CISA KEV listing, and the EPSS score is low at 0.22% (12th percentile), so this is a medium-severity patch-cycle item rather than an emergency one.
Social engineering plus a crafted Chrome extension can let an unauthenticated remote attacker bypass the web origin policy in Google Chrome versions prior to 155.0.8059.39 by exploiting a missing authorization check in DevTools, resulting in high integrity/origin-isolation impact without confidentiality or availability loss. The attack is not a drive-by against a default browser: it requires the victim to install the malicious extension (UI:R). No public exploit was identified at time of analysis, EPSS is low at 0.22% (11th percentile), and a vendor patch is available in 155.0.8059.39.
Web origin policy bypass in Google Chrome on iOS prior to 155.0.8059.39 allows remote attackers to cross origin boundaries and alter content the browser should treat as belonging to a different site, after a victim is persuaded through social engineering to load crafted network traffic (CVSS 6.5, C:N/I:H/A:N). No authentication is required (PR:N), but the mandatory user interaction (UI:R) keeps the attack non-automatable under CISA's SSVC assessment, and no public exploit code or confirmed active exploitation has been identified at time of analysis. Exploitation is further constrained by a low EPSS score of 0.21% (11th percentile) and by integrity-only impact that exposes no confidential data and causes no denial of service, which is why this is rated a genuine Medium-severity issue rather than a high-priority emergency.
Backstage's catalog backend (the @backstage/plugin-catalog-backend package) prior to 3.9.1 enforces its allowedLocationTypes restriction inconsistently, letting a disallowed location type be processed when it is inherited from the parent/origin location rather than declared directly. An authenticated user who can register or influence a Location entity in a deployment that has configured an allowedLocationTypes list can therefore trigger the backend to resolve a location type it was supposed to reject, potentially reading files on the backend host. This is a low-severity issue: it requires non-default configuration plus authenticated access and a specific inheritance edge case, and no public exploit code has been identified at time of analysis; the fix is in @backstage/plugin-catalog-backend 3.9.1 (Backstage release v1.54.6).
Stored/reflected cross-site scripting in WC Fields Factory 4.1.12 and earlier allows authenticated subscriber-level attackers to inject script that executes when a higher-privileged user views the affected field content. The plugin is a WooCommerce add-on for WordPress, and successful exploitation can lead to session theft, administrative actions performed in the victim's browser, or content manipulation, though the requirement for a subscriber account and victim interaction substantially narrows practical risk. CVSS 6.5; no public exploit identified at time of analysis, and no CISA KEV status is reported.
Authenticated subscriber-level cross-site scripting (XSS) in the Ohio Extra WordPress plugin up to version 3.6.8 allows attackers with a subscriber account or higher to inject arbitrary JavaScript that executes in the browser of a higher-privileged user who views the injected content. The independent assessment rates this as a moderate-risk issue (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) with no availability impact, requiring victim interaction and confined to browser-context script execution rather than server compromise. No public exploit code has been identified at time of analysis, and there is no confirmed active exploitation (CISA KEV).
Unauthenticated broken access control in the WP Event Solution (Eventin) WordPress plugin, versions 4.1.25 and earlier, allows any remote, network-reachable attacker to reach functionality that should require authorization, with the realistic outcome bounded to low-severity exposure or manipulation of event-related data rather than full site compromise. The flaw carries a vendor-style CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:N/UI:N), and our independent reassessment scopes the impact to low confidentiality only, with no authentication, user interaction, or non-default configuration required. There is no CISA KEV listing, so this is not confirmed actively exploited, and no public exploit code has been identified at time of analysis; the only public reporting is the Patchstack advisory, and the specific vulnerable endpoint is not disclosed, which limits operators' ability to target blocking rules precisely.
Insecure direct object reference in the Faktur Pro for WooCommerce WordPress plugin (all versions up to and including 3.2.1) allows an authenticated WooCommerce customer to read other customers' invoice and order data by substituting a different user's object identifier in a request that fails to enforce per-user ownership checks. The flaw is rated CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N): exploitation is remote and low-complexity but requires a legitimate low-privileged customer account, and the confirmed impact is limited to confidentiality (high) with no integrity or availability effect. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the practical risk is further bounded by the plugin's niche deployment and the authentication precondition - anonymous visitors cannot trigger it.
An information disclosure flaw in the Omnibox component of Google Chrome for Android lets a remote attacker leak sensitive data through crafted network traffic, provided the victim first performs an attacker-influenced interaction (a social-engineering lure). Only Chrome on Android builds earlier than 155.0.8059.39 are affected; desktop and iOS Chrome are out of scope per the vendor advisory, and the impact is limited to confidentiality with no integrity or availability effect. Google rates the Chromium severity as Medium, EPSS is low at 0.20 percent (9th percentile), there is no CISA KEV listing, and no public exploit code was identified at time of analysis, though a vendor fix is available and should be applied through normal update channels.
Incorrect authorization in the Passwords component of Google Chrome on iOS lets a remote, unauthenticated attacker bypass web origin policy if a victim opens an attacker-controlled crafted HTML page (CVE-2026-106381, CWE-863). The flaw is confined to the iOS build of Chrome and to versions prior to 155.0.8059.39, which Google has addressed with a vendor-released patch; the assessed CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N, 6.5, Chromium severity Medium) scores high only for integrity impact, so the exposure is unauthorized cross-origin action or modification rather than confirmed credential disclosure. No public exploit code, proof-of-concept, or confirmed active exploitation was identified at time of analysis, and EPSS is low at 0.20% (9th percentile); the primary practical barrier is the required user interaction - driving a victim on iOS to load the malicious page.
Missing authorization in Chrome's Animation component (CWE-862) affects Google Chrome versions prior to 155.0.8059.39 and lets a remote, unauthenticated attacker bypass web origin policy when a victim loads a crafted HTML page. The attack is not passive: exploitation requires the user to navigate to attacker-controlled content (UI:R), but no credentials or non-default browser settings are needed, and success is bounded to an integrity impact (C:N/I:H/A:N) on the browser session rather than code execution or data theft. No public exploit code was identified and there is no confirmed active exploitation (no CISA KEV listing); EPSS is 0.20% (9th percentile), and a vendor patch is available, making this a moderate-priority, patch-and-move-on issue.
Google Chrome versions before 155.0.8059.39 contain a missing authorization check in the browser's SignIn component that a crafted, attacker-supplied Chrome extension can abuse to read sensitive sign-in information, making this primarily an information-disclosure issue rather than a full system compromise. Exploitation is not drive-by: it requires the victim to be socially engineered into installing the malicious extension (UI:R), and the attacker needs no prior privileges or credentials on the target (PR:N). No public exploit code or evidence of active exploitation was identified at time of analysis, and while the published CVSS score is 6.5, the independent assessment rates the realistic confidentiality impact as low, making this a moderate-but-not-urgent issue; unauthenticated remote attackers are the relevant threat model, but only where a user can be convinced to install an untrusted extension.
Memory disclosure in Google Chrome versions prior to 155.0.8059.39 lets a remote, unauthenticated attacker read contents of process memory inside the renderer sandbox by convincing a victim to open a crafted HTML page that exercises the WebAudio API. Exploitation is bounded by the required user interaction (CVSS UI:R) and does not escape the Chrome sandbox, so there is no integrity or availability impact, only confidentiality loss (C:H) scored at CVSS 6.5. Publicly available exploit code exists per the SSVC assessment, but the issue is not confirmed as actively exploited (not in CISA KEV) and EPSS is low at 0.19% (8th percentile), making this a moderate-priority patching item rather than an emergency.