Pulp Ansible's bearer-token refresh for collection remotes can disclose access tokens to an authenticated attacker who can create or sync a remote and point it at a malicious server. The attacker must then reuse the token at the issuing service, and exploitation is only possible if another token download for a different remote has run on the same worker process, meaning shared, multi-tenant deployments are primarily at risk. No public exploit code exists, and the assessed attack complexity is high (AC:H), so this is a moderate-priority information disclosure issue rather than a top-tier emergency.
Authenticated users with permission to create and sync container remotes in Pulp can obtain upstream registry credentials-usernames, passwords, or bearer tokens-stored for other remotes because the pulp-container worker reuses authentication material across sync operations. This affects deployments built on Red Hat Ansible Automation Platform 2, Red Hat Satellite 6, and Red Hat Update Infrastructure 4/5, particularly multi-tenant environments where remotes share worker processes. No public exploit code or confirmed active exploitation has been identified; the flaw rates CVSS 6.5 (moderate) and requires no user interaction beyond the attacker's own sync, though it does require an authenticated user with remote-creation and sync privileges.
An authenticated Splunk Enterprise user without the 'admin' or 'power' roles can read substantially all search job information belonging to other users - including raw search query text, job metadata, result sets, and preview results - by supplying a user-controlled job identifier to a REST API endpoint that fails to validate job ownership. The flaw affects Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, and carries a CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), meaning the confidentiality impact is high but integrity and availability are untouched. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (not in CISA KEV); vendor patches are available, which reduces exposure for organizations that can upgrade promptly, though the requirement for valid low-privilege credentials limits risk to multi-user and shared-search deployments.
Improper entity validation in the deprecated Kubernetes services endpoint of @backstage/plugin-kubernetes-backend lets an authenticated Backstage user who already holds Kubernetes read permissions retrieve Kubernetes object metadata beyond their intended scope by submitting crafted entity data in the request body. The vulnerable handler trusted the caller-supplied entity reference instead of resolving it against the Backstage catalog, so the request was processed against an entity the user was not authorized for; the fix (0.21.8) parses the entity reference and performs a catalog lookup, returning 403 when no matching entity exists. Exposure is limited to read-only Kubernetes object metadata across configured clusters with no integrity or availability impact, and no public exploit code has been identified at time of analysis; exploitation is constrained to the legacy deprecated services endpoint and requires a crafted request that evades validation (AC:H).
Heap buffer overflow in ImageMagick's distributed pixel cache (DPC) server (versions prior to 7.1.2-31) allows an unauthenticated adjacent-network attacker to crash the server by sending crafted pixel data that causes an integer overflow in the packet size calculation. Exploitation requires the target to run the opt-in DPC clustering feature, which is not enabled by default and is not reachable via normal image processing paths. No public exploit identified at time of analysis. This is a moderate availability-only issue (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H per independent assessment).
Path traversal in the Apache Impala 'trusted_jar_paths' configuration allows an authenticated user to load an attacker-uploaded JAR from outside a trusted directory by supplying a relative path whose prefix matches a configured trusted path, resulting in code execution under Impala's process privileges. Only Impala 4.5.2 (before 4.5.3) is affected, and exploitation is conditional: the administrator must have set a non-empty 'trusted_jar_paths' value, the attacker must hold privileges to run DDL such as CREATE DATA SOURCE or CREATE TABLE to place a JAR on the same local or remote filesystem, and the URI schema itself cannot be overridden. Apache rates the issue 'important'; the independent assessment assigns CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H (authenticated, high complexity, scope-changed), and there is no KEV listing, no EPSS score, and no public exploit code identified at time of analysis.
Denial of service in ImageMagick's distributed pixel cache (DPC) server before 7.1.2-32 allows an unauthenticated attacker on the same network segment to repeatedly open connections to the DPC listening socket and exhaust its available connection slots, degrading or halting distributed cache service on the host. The issue is limited to deployments that have explicitly enabled and network-exposed the DPC server - it is not part of default ImageMagick usage - and the assessed impact is availability-only (CVSS 3.1: AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, score 4.3); no data disclosure or modification is possible. No public exploit code has been identified at time of analysis and the flaw is not listed as confirmed actively exploited (CISA KEV), while the vendor-released fix is available in ImageMagick 7.1.2-32.
Keycloak's SMTP email configuration can silently fall back to unencrypted communication when STARTTLS is enabled, allowing an attacker who can intercept and tamper with traffic between the Keycloak server and its mail relay to capture SMTP credentials and email message content in cleartext. Affected deployments include Red Hat Build of Keycloak and Red Hat Single Sign-On 7 (CVSS 6.5, AV:N/AC:H/PR:N/UI:N), but exploitation is conditional: it requires a man-in-the-middle position on the SMTP path and an instance configured for opportunistic STARTTLS rather than implicit TLS. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Any authenticated workspace member on PraisonAI Platform 0.1.8 and earlier can delete dependency edges attached to owner-created issues by routing the request through a member-owned related issue, because the DELETE dependency endpoint checks delete permission only against the caller-selected issue ID. Exploitation requires a valid member account (CVSS PR:L), a shared workspace, and a pre-existing dependency edge linking a member-owned issue to an owner-created issue; impact is limited to unauthorized removal of dependency relationships, with no data exposure or service disruption. No public exploit code was identified at time of analysis, and this is a moderate missing-authorization flaw rather than a high-urgency priority.
Cross-user integrity corruption in wger versions prior to 2.6 allows authenticated attackers to inject arbitrary workout log entries into another user's SlotEntry by exploiting a missing ownership check. A crafted POST to /api/v2/workoutlog/ with the victim's SlotEntry ID is accepted and persisted, silently folding the injected data into the victim's progressive-overload calculations and corrupting auto-generated weight and repetition targets. This IDOR (CWE-639) is rated medium severity (CVSS 6.5, PR:L), with a public proof-of-concept in the advisory; version 2.6 contains the vendor patch. Exploitation is bounded to multi-user instances and affects only data integrity-no read access, code execution, or availability impact.
Arbitrary file write via path traversal in VisiData's unzip_http RemoteZipFile extraction routine allows an attacker who supplies a crafted .zip archive over a URL to write files outside the intended extraction directory on the victim's machine. The flaw is tied to the development commit 38b21f78 (CWE-22) and is rated CVSS 3.1 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N); no privileges are required on the attacker's side, but the victim must open the attacker-provided remote archive and explicitly invoke the extract functionality. There is no CISA KEV listing and no public exploit identified at time of analysis, so this is a moderate-priority issue contingent on user interaction rather than an actively exploited emergency.
Stored cross-site scripting in the Happy Addons for Elementor WordPress plugin (versions through 3.50.0) allows an authenticated low-privilege user to plant JavaScript that runs in the browser of any higher-privileged user who views the affected page. Rated CVSS 6.5 (Medium), the flaw requires an existing contributor-level account plus victim interaction, so it is not exploitable by anonymous remote attackers against a default installation. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and no fixed version is documented in the available advisory data.
Stored cross-site scripting in the BdThemes Prime Slider plugin for WordPress (versions through 4.6.2) allows authenticated users with contributor-level access or higher to inject persistent JavaScript into slider widgets, which executes in the browser of any higher-privileged user who views the affected page. This medium-severity flaw (CVSS 6.5, vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) requires a valid low-privileged account and victim interaction, and no public exploit code or active exploitation has been identified at time of analysis.
Stored cross-site scripting in the WordPress plugin Quiz And Survey Master (quiz-master-next, by ExpressTech) through version 11.2.7 allows an authenticated low-privilege user to persist malicious markup that executes in the browser of whoever later views the affected quiz or survey content. The plugin stores user-supplied input in quiz and survey fields and renders it back without adequate neutralization, so a contributor-level account that can submit quiz/survey data can target higher-privileged viewers such as administrators reviewing entries; the assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, giving a medium-severity score of 6.5, reported by Patchstack. No public exploit code identified at time of analysis, and the issue is not listed in CISA KEV; because the attacker needs a working WordPress account and the victim must open the crafted page, exploitation is a realistic but non-trivial, interaction-dependent risk for sites that expose quiz/survey submission to low-privilege roles.
Stored cross-site scripting in the WP Media Rocket Lazy Load WordPress plugin (versions through 2.4.0) allows an authenticated low-privileged user to inject persistent JavaScript that executes in the browser of any visitor, including administrators, who later views the affected page. The issue is rated CVSS 6.5 (medium) with mandatory victim interaction and a changed scope; no public exploit code or confirmed active exploitation was identified in the available intelligence at time of analysis.
Stored cross-site scripting in Element Pack Elementor Addons (bdthemes-element-pack-lite) through version 8.8.6 allows a low-privileged authenticated WordPress user to plant persistent script payloads inside Elementor widget content, which then execute in the browser of any higher-privileged user - typically an administrator or editor - who later renders the affected page. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, score 6.5) confirms that reachability is network-based but the attack requires a pre-existing contributor-or-higher account plus victim interaction, so single-admin sites are far less exposed than multi-author, editorial, or client-managed WordPress deployments. No public exploit code and no CISA KEV entry were identified at time of analysis, and this is assessed as a moderate, not top-tier, priority.
Stored cross-site scripting in the WordPress Media Library Assistant plugin (all versions through 3.41) allows an authenticated attacker with low-level privileges to plant persistent JavaScript that runs in the browser of a higher-privileged user who later views the affected page. Rated medium severity (CVSS 6.5), exploitation is gated by two prerequisites: a valid low-privilege WordPress account able to submit input into a Media Library Assistant field (PR:L) and a victim - typically an administrator or editor - who subsequently loads the page where the payload renders (UI:R), so sites that restrict account registration or avoid granting untrusted users content-entry roles are materially less exposed. No confirmed active exploitation (CISA KEV listing absent) and no public exploit code identified at time of analysis; the flaw is reported through Patchstack.
Stored cross-site scripting (XSS) in Element Pack Elementor Addons through version 8.8.6 allows authenticated users with low-level privileges to inject malicious scripts into pages via vulnerable widgets or input fields. The injected payload executes when a higher-privileged user views the compromised page, potentially leading to session hijacking or site takeover. No public exploit identified at time of analysis, and no vendor-released patch is specified in the provided data.
Symbolic-link traversal during archive unpacking in Red Hat's source-to-image (S2I) tooling lets an attacker who can supply or otherwise influence the builder image consumed by a build create links that resolve to absolute paths outside the extraction directory, allowing file reads or modifications beyond the intended sandbox on the host. The flaw is rated CVSS 3.1 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), so exploitation is not an unauthenticated drive-by: the attacker needs the privileges required to introduce or reference a malicious builder image, and only environments that run S2I builds against untrusted or attacker-influenced images are realistically exposed. The scope is marked Changed because the payload escapes the build container boundary, but confidentiality and integrity impact are each only Low; no public exploit code and no confirmed active exploitation were identified at time of analysis.
wolfSSH through 1.5.0, when compiled with the --enable-fwd (WOLFSSH_FWD) TCP/IP forwarding option, fails to apply its forwarding policy callback or any channel-count cap to incoming forwarded-tcpip channel opens, so a malicious SSH peer can force unbounded per-channel buffer allocation and exhaust endpoint memory. The same code path leaves wolfSSH clients validating nothing: a forwarded-tcpip open is not checked against the forwards the client actually registered via tcpip-forward, contrary to RFC 4254 section 7.2, and a server should never receive a forwarded-tcpip open at all. Impact is limited to availability (memory exhaustion, assessed CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L; vendor CVSS 4.0 base 6.3), the forwarding feature must be explicitly enabled at build time, and no public exploit code was identified at time of analysis. No vendor-released tagged fix version is confirmed from the provided data; upstream patch commits exist.
A missing authorization check in Amazon Athena engine version 3 request handling allowed an authenticated AWS principal to retrieve limited query metadata - specifically AWS account identifiers and SQL statement text - belonging to other AWS accounts. The exposure was confined to that narrow metadata set: query results, credentials, and Amazon S3 data were not reachable, and AWS states no customer metadata was accessed. Exploitation required a valid authenticated AWS identity with Athena access (CVSS vector PR:L), no public exploit code has been identified, and AWS has already remediated the condition server-side on September 1, 2026, so the service is no longer exploitable and no customer action is required.
Improper write restrictions in the App Key Value Store (KV Store) collections used by Splunk Secure Gateway let any authenticated Splunk user who does not hold the 'admin' or 'sc_admin' role modify alert and mobile-device recipient records, which downstream alerting and subscription workflows then consume. The flaw affects Splunk Enterprise below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, and Splunk Secure Gateway below 3.10.11, 3.9.25, and 3.8.72, with an assessed CVSS of 6.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, CWE-732). No public exploit code has been identified at time of analysis and there is no KEV confirmation of active exploitation; risk is concentrated in deployments that actually run Secure Gateway, and impact is bounded to the integrity and confidentiality of Secure Gateway alert/subscription data rather than arbitrary Splunk data or host-level access.
Email spoofing is possible through OVHcloud's shared mail servers, allowing any authenticated OVH email user to forge the sender address to impersonate any OVH-hosted domain that uses the default SPF record include:mx.ovh.com. This vulnerability affects OVHcloud's email service and is assessed as a moderate, bounded risk because exploitation requires a valid account and is mitigated by DMARC with DKIM alignment. The issue stems from an insecure default SPF configuration that authorizes the shared mx.ovh.com infrastructure for all domains using the default record.
Heap-based buffer overflow in GIMP's PCX export plug-in allows a local attacker to corrupt memory when a user opens or creates an image with extremely large width and height and exports it to PCX format. The flaw, tracked as CVE-2026-106065 with a CVSS score of 6.3 (AV:L/AC:H/PR:N/UI:R), stems from 32-bit integer overflow in the width*height size calculation while GEGL operations use the full extent. Affected GIMP packages ship with Red Hat Enterprise Linux 6 through 10; no public exploit code or active exploitation has been identified at time of analysis.
Heap-based buffer overflow in GIMP's 'Hot' color filter plug-in allows a crafted, extremely large image to corrupt heap memory when the filter is invoked, giving an attacker the ability to crash the plug-in and potentially achieve code execution within the running user's session (CWE-119). The flaw is reachable only locally and requires the victim to open an attacker-supplied image with dimensions so large that the width * height allocation arithmetic overflows 32-bit integers, then actively run the Hot filter on it - hence the assessed vector AV:L/AC:H/PR:N/UI:R with high integrity and availability impact but no confidentiality impact. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score provided, so this is a targeted, social-engineering-dependent client-side issue rather than an automatable, mass-exploitation threat. Red Hat hosts the primary advisory (access.redhat.com/security/cve/CVE-2026-106067) with tracking in Bugzilla 2547461, and GIMP packages across Red Hat Enterprise Linux 6 through 10 are enumerated as affected via CPE.
Exporting an oversized image through GIMP's raw data export plug-in can under-allocate a heap buffer and cause an out-of-bounds write on the heap, with the failure originating in an integer overflow in the g_malloc() size computation (width × height × bytes-per-pixel). Per the CVSS 3.1 vector (AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H), exploitation is local-only, requires the victim to actively start the export, requires no privileges (PR:N), and is gated by high attack complexity because the image dimensions must be crafted so the size arithmetic wraps; the assessment rates confidentiality impact as none and integrity/availability impact as high. No public exploit code and no confirmed active exploitation (no CISA KEV listing) were identified at time of analysis, and the EPSS-style signals provided are consistent with a moderate-priority rather than critical issue, since the plug-in is standard GIMP functionality but the trigger depends on user-driven export of deliberately large images.
Concurrent HTTP POST requests to MISP's email OTP login endpoint can both authenticate using the same one-time password, breaking the single-use guarantee and establishing duplicate sessions. Affected versions before 2.5.48 are vulnerable when email OTP login is enabled; exploitation requires the attacker to already hold a valid, unexpired OTP (via interception or social engineering) and to time two requests within the narrow race window. No public exploit code or active exploitation has been identified, and the independent assessment rates this as a genuine but low-urgency integrity issue (CVSS 3.1 base 3.6, high attack complexity) because success merely duplicates a session the OTP already granted.
Integer overflow in GIMP's GIF export plug-in leads to a heap-based buffer overflow when a user exports an image whose width and height are large enough to wrap the 32-bit pixel-buffer size calculation, resulting in an out-of-bounds write that can crash the application or corrupt memory. Affected software is the GIMP package as distributed in Red Hat Enterprise Linux 6, 7, 8, 9 and 10, and exploitation is local (AV:L) with high attack complexity (AC:H) and mandatory user interaction (UI:R) while requiring no privileges (PR:N) - the attacker must induce a user to export an image with extreme dimensions. No public exploit identified at time of analysis, and the independent assessment rates this a moderate-severity, genuinely low-urgency issue rather than a top priority.
Local denial of service in m17n-lib can crash applications on Red Hat Enterprise Linux 6 through 10 when they process specially crafted or truncated UTF-8 input. The flaw is a NULL pointer dereference reachable with a local attack vector and no authentication or user interaction, and it only affects availability, not confidentiality or integrity. No public exploit or confirmed active exploitation has been identified at time of analysis, and the issue is assessed as a moderate-severity local DoS rather than a high-priority remote threat.
Heap use-after-free in m17n-lib's input-method handling allows a local user who supplies specially crafted text to an application using m17n-based input engines to crash that application, producing a denial of service; arbitrary code execution is described as a potential, unverified outcome rather than a demonstrated one. The flaw is rated CVSS 6.2 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), so exploitation is local with no privileges required (PR:N) and no user interaction, and the only confirmed impact is availability loss with no confidentiality or integrity effect. Red Hat tracks the issue for Red Hat Enterprise Linux 6 through 10, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Sustained CPU consumption in m17n-lib allows an unauthenticated local attacker to hang applications that parse attacker-influenced text, because a crafted invalid UTF-8 byte sequence drives the library's text-parsing routine into a non-terminating loop (CWE-835) and pins a CPU core indefinitely, producing a denial of service (CVSS 6.2, AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Only systems where an application actually routes externally supplied text through m17n-lib's parsing path are exposed; hosts that never load the library are unaffected, and there is no code execution, data leakage, or integrity impact. There is no public exploit identified at time of analysis, and no vendor-released patch identified at time of analysis; Red Hat is tracking the issue under CVE-2026-107168 with Bugzilla 2547409.
Cross-project queue access in OpenStack Zaqar's WebSocket transport lets an authenticated user who holds a valid Keystone token for one project substitute a different project's UUID in subsequent requests, then enumerate, inspect, create, or delete queues belonging to that other tenant. Only deployments that deliberately enable the WebSocket transport together with Keystone authentication are exposed; the more widely used REST transport and non-Keystone setups are explicitly out of scope. Publicly available exploit code exists (SSVC exploitation: poc), the vendor has released a fix in 23.0.1, and the assessed impact is low confidentiality but high integrity and availability loss within the targeted project.
Reflected cross-site scripting in the Fanvil x7a IP phone firmware (2.6.0.1182) allows a remote, unauthenticated attacker to inject HTML and JavaScript into the device log component, which then executes in the browser of any user who opens the affected log view - in practice an administrator using the phone's web management interface. The CVSS 3.1 base score is 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), reflecting that exploitation requires user interaction (the victim must render the log page) while the injected script runs in a scope beyond the vulnerable component, though confidentiality and integrity impact is limited to the viewer's browser session rather than the underlying device OS. No public exploit code has been identified at time of analysis and the issue is not listed on CISA KEV, so risk is currently tied to exposure of the management interface rather than observed exploitation.
Reflected cross-site scripting in the Fanvil X7A IP phone's device log component (firmware 2.6.0.1182) lets an attacker inject HTML into log data that the web interface renders without sanitization, so malicious JavaScript executes in the browser of whoever views that log page. The attack is network-reachable but requires user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, 6.1), and in practice an operator likely has to open the log view from the phone's administrative web interface, which narrows real-world exposure. Risk signals are low: EPSS is 0.18% (7th percentile), there is no CISA KEV entry, and no public exploit code has been identified at time of analysis - only a third-party vulnerability disclosure writeup.
Stored cross-site scripting in the Aurora Heatmap WordPress plugin affects all versions up to and including 1.7.2 and lets unauthenticated attackers inject arbitrary JavaScript through the plugin's 'url' parameter, with the payload firing in an administrator's browser whenever that admin clicks the injected heatmap link. The flaw is rated CVSS 3.1 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), meaning no authentication is needed to plant the payload but a successful attack depends on an administrator later interacting with the malicious link; impact is limited to information disclosure and limited integrity within the admin's browser session, with no availability impact. There is no public exploit identified at time of analysis, and the plugin should be treated as untrusted until a fixed build is confirmed. An upstream Trac changeset (3712276) indicates code changes addressing the issue, but no patched release version has been independently confirmed.
Stored cross-site scripting in the SonicWall SMA1000 Appliance Management Console (AMC) allows an attacker who already holds administrator credentials to persist arbitrary JavaScript that then executes in the browser session of another privileged AMC user under the vendor's stated 'specific conditions.' The flaw affects SMA1000 12.4.3-03526 (platform-hotfix) and 12.5.0-02952 (platform-hotfix) along with all older builds, and is rated moderate severity at CVSS 6.1 with low confidentiality/integrity impact and no availability impact. The only hard gate is authentication: an independent assessment places the requirement at PR:H, meaning the attacker must already be an AMC administrator, and exploitation also requires a victim to view the poisoned page (UI:R). No public exploit code has been identified, CISA's SSVC framework records exploitation as none and automation as not feasible, and the available signals converge on LOW real-world priority rather than an urgent threat.
Authenticated Backup Viewer accounts in Veeam Backup & Replication can modify the Enterprise Manager master key and stored antivirus-update credentials due to missing authorization (CWE-862), affecting deployments with Enterprise Manager and that low-privilege role. The issue is medium severity (CVSS 4.0 score 6.1) and requires valid Backup Viewer credentials plus an additional attack precondition, so it is not anonymous or unauthenticated exploitation; no public exploit identified at time of analysis. Veeam KB4934 is the referenced advisory for affected and fixed builds.
Persistent denial of service in Absolute Secure Access servers prior to 14.60 allows authenticated attackers to exhaust proxy sub-system resources by sending malformed data, requiring a valid session and an additional environmental precondition outside the attacker's direct control. The flaw is a CWE-400 uncontrolled resource consumption issue with impact limited to availability; confidentiality and integrity are unaffected. No public exploit code has been identified at time of analysis, and the vendor has released a patch in version 14.60.
Missing authentication in the smart_proxy_dynflow remote-execution callback handlers lets an unauthenticated network attacker forge progress and completion reports for a running job, causing the job to be recorded as a success or a failure with attacker-supplied output. The flaw (CWE-306) applies only when Red Hat Satellite 6 remote execution is configured in pull or pull-mqtt mode, and the attacker must already know the identifier of a live job and submit the forged report during that job's execution window, which is why the assessed severity is moderate (CVSS 5.9, AC:H, integrity-only). No public exploit code and no confirmed active exploitation were identified at time of analysis.
Cleartext database credential disclosure via man-in-the-middle interception affects pgjdbc (PostgreSQL JDBC Driver) versions 42.7.11 through 42.7.13 when the caller-supplied requireAuth connection property is set to exclude all six authentication methods the driver recognizes (for example requireAuth=!password,!md5,!gss,!sspi,!scram-sha-256,!none) or to a value containing no method at all (requireAuth=, a single comma). In that state the driver fails open and accepts whatever method the server requests, including cleartext password authentication, so an attacker who already holds an active man-in-the-middle position between the application and the PostgreSQL server can request cleartext authentication and capture the database password. Exposure is narrow: requireAuth has no default value, so deployments that never set the property are unaffected, and positive lists (requireAuth=scram-sha-256) or partial exclusions (requireAuth=!password,!md5) are enforced correctly; no public exploit identified at time of analysis and the issue is not in CISA KEV. Scoring is confidentiality-only at CVSS 5.9 with high attack complexity (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N), reflecting that both a specific client misconfiguration and a pre-existing network foothold are required.
Proxied plaintext WebSocket (ws://) requests issued through AsyncHttpClient before 3.0.12 or 2.16.1 leak the configured proxy's credentials to the origin WebSocket server. When an HTTP proxy requiring authentication is in use, the tunneled ws:// upgrade is built with the proxy's Proxy-Authorization header and an absolute-form request target, so the origin endpoint operator - or any party able to observe origin-bound traffic - can recover Basic credentials directly or capture a Digest challenge-response for offline cracking or replay. Exploitation depends on a non-default configuration (an authenticated HTTP proxy plus an application-initiated ws:// request), yields only proxy credentials rather than user or application data, and is rated CVSS 3.1 base 5.9; no public exploit code and no confirmed active exploitation have been identified at time of analysis.
HashiCorp Vault's PKI secrets engine ACME server, when running under the default directory policy, can issue certificates that contain identity claims the ACME challenges never validated, allowing an unauthenticated ACME client (CVSS vector PR:N/UI:N) to obtain a certificate for an identity it does not control and impersonate that identity toward systems that trust the affected Vault PKI mount. The issue is a configuration-dependent certificate-integrity flaw (CVSS 5.9, AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N) rather than an urgent remote-code or data-exposure bug: it requires a PKI mount with the ACME server enabled under the default directory policy and relying systems that actually trust certificates issued by that mount, otherwise the unverified identity has no effect. HashiCorp addressed it in Vault Community Edition 2.1.2 and Vault Enterprise 2.1.2, 1.21.12, 1.20.17, and 1.19.23; no public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS score was supplied in the available data.
Unauthenticated remote attackers can temporarily disrupt Cisco NX-OS devices by flooding a data-plane interface with a high rate of UDP or TCP connections, exhausting resources and causing packet loss that destabilizes routing and control-plane protocols. The denial-of-service condition is availability-only and self-clears once the traffic stops, but the CVSS 3.1 score of 5.8 reflects a scope change and low availability impact. No public exploit code or active exploitation has been identified at time of analysis.
EPG contract bypass in Cisco Nexus 9000 Series Fabric Switches running ACI Mode allows an unauthenticated, remote attacker to evade configured endpoint-group segmentation by sending IPv4 or IPv6 UDP packets with DHCP source and destination ports (67/68) through the device. The flaw is an improper access-control implementation (CWE-284) rated CVSS 5.8 with scope change and low integrity impact; no public exploit identified at time of analysis. Exploitation requires ACI mode and EPG contracts in use, and the attacker must have a network path through the switch; it does not directly disclose data or cause denial of service.
Path traversal in Quasar App Vite 3.1.0 through 3.2.0 allows a local attacker with low privileges (PR:L per the assessed CVSS vector) who can influence SSG page definitions to make `quasar build -m ssg` create new files or directories outside `build.distDir`; the assessed vector is CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N. Default deployments are not normally exploitable because Quasar configuration and SSG page definitions are trusted input, and the SSG renderer's no-overwrite behavior limits impact to new files rather than modification of existing files. No KEV status or public exploit was identified at time of analysis, and this is not remotely reachable against a running service; the vendor patch fixes the issue in @quasar/app-vite 3.3.0.
Memory exhaustion in the SSSD Kerberos Credential Manager (sssd-kcm) responder lets a local user or process that can reach the KCM UNIX domain socket deny service to credential caching. An attacker sends a request with an oversized length header and then stalls the connection, causing the responder to preallocate large buffers for each such request until its memory is depleted. Impact is limited to availability (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) on hosts where the kcm responder is enabled and its socket is reachable; EPSS is very low (0.18%, 7th percentile) and there is no public exploit identified at time of analysis.
Integer overflow in ImageMagick's pixel-cache allocation path (GetVirtualPixels / SetPixelCacheNexusPixels) lets a locally supplied crafted call with attacker-controlled width, height, and channel/metacontent values overflow MagickSizeType arithmetic and write past a heap buffer, crashing the affected process. All ImageMagick releases prior to 6.9.13-56 (6.x line) and 7.1.2-31 (7.x line) are affected; the assessed CVSS is 5.1 (AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H), meaning impact is confined to a denial of service with no confidentiality or integrity loss and no demonstrated code execution. Exploitation is local and high-complexity because a precise overflow condition must be induced; there is no CISA KEV listing and no public exploit code identified at time of analysis, and EPSS data was not provided in the available intelligence. Vendor-released patches exist in 6.9.13-56 and 7.1.2-31.
Out-of-bounds heap reads in GIMP's XMC (X cursor) thumbnail loader can crash the application or corrupt process memory when a victim opens a crafted XMC file, or when thumbnail generation is triggered for one by a file manager. The root cause is an integer overflow: the loader sizes a pixel buffer using width * height computed in 32-bit signed arithmetic, so an oversized product wraps to a small allocation that a later GEGL buffer read then indexes using the unwrapped dimensions. Exploitation is strictly local and user-interaction dependent (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, 5.5), with no network attack surface and no confidentiality or integrity impact; no public exploit code and no confirmed active exploitation were identified at time of analysis, and Red Hat tracks the issue across RHEL 6 through 10.
Path traversal in VisiData's EmailSheet extract_parts functionality lets a specially crafted .eml file write files to arbitrary locations on the filesystem using attacker-controlled filenames, producing a high integrity impact (C:N/I:H/A:N) on data the user account can write. Only the development snapshot identified by commit 38b21f78 is confirmed affected, so exposure is limited to users running that specific dev build rather than a numbered stable release. The CVSS 3.1 vector (5.5, AV:L/AC:L/PR:N/UI:R) describes a local attack with no privileges required but a mandatory user-interaction step: the victim must open the malicious message and invoke extract_parts, and accordingly there is no remote or automated trigger. At time of analysis there is no evidence of confirmed active exploitation (not listed in CISA KEV) and no public exploit code identified, making this a moderate, low-priority issue.
A use-after-free in the XInput2 passive grab handling of X.Org X server builds prior to xorg-server-21.1.25 and Xwayland prior to xwayland-24.1.14 allows an authenticated client that can add and remove XI2 master devices to crash the server or potentially achieve arbitrary code execution. The attacker creates a passive grab whose modifierDevice points at a master device, then calls XIRemoveMaster to free that device; the grab retains a dangling DeviceIntPtr that later input processing dereferences, corrupting the heap. Reaching the vulnerable code requires a valid client connection to the X server or Xwayland (typically local, since modern X servers do not listen on TCP by default) and the XI2 extension, which is enabled by default; no public exploit code and no CISA KEV entry have been identified at time of analysis.