Arbitrary file creation or truncation in Apache Jackrabbit's WebDAV/DavEx client (jackrabbit-spi2dav) occurs when a malicious or intercepted remote server supplies externally controlled input that causes the client to instantiate classes from its classpath. Affected versions are 2.23.0 through 2.23.5, 2.22.0 through 2.22.4, and 2.20.0 through 2.20.17, but only applications using jackrabbit-spi2dav directly or through jackrabbit-jcr2dav to connect to a remote repository are impacted; Jackrabbit servers are not vulnerable. The vendor CVSS 4.0 base score is 6.9 (medium) with an unauthenticated network vector, and the independent assessment rates CVSS 3.1 as AC:H with integrity-low impact only (C:N/I:L/A:N) because the attacker must control the remote server or intercept the connection; no public exploit code has been identified at time of analysis.
Pre-authentication CPU exhaustion affects wolfSSH servers through 1.5.0 that are built with Diffie-Hellman group-exchange SHA256 support, letting a remote unauthenticated client force the server to execute client-role key-exchange logic. After negotiating diffie-hellman-group-exchange-sha256, the attacker sends SSH_MSG_KEX_DH_GEX_GROUP (31) - a message only a client should send - and the server runs the client-side handler DoKexDhGexGroup(), performing two 8-round Miller-Rabin primality tests on an attacker-supplied prime of up to 8192 bits and then generating a Diffie-Hellman key pair in the attacker's group. The flaw yields only availability impact (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) with no memory corruption or data exposure; no public exploit code has been identified at time of analysis and it is not confirmed as actively exploited.
Server-side request forgery in LMCache through 0.5.5 allows unauthenticated remote attackers to bypass the frontend monitoring service's proxy allowlist by registering arbitrary host entries through POST /api/proxies, then relaying requests to internal systems via /proxy or /proxy2 and reading the responses back. Successful abuse also permits tampering with catalogued nodes and stopping the heartbeat mechanism, but the impact is bounded to limited information disclosure, limited integrity impact, and availability disruption rather than full host takeover. Exploitation is unauthenticated (PR:N, CWE-306) and requires only network reachability to the frontend monitoring service, so real-world risk depends heavily on whether that service is exposed beyond trusted internal ML-serving infrastructure; no public exploit code or confirmed active exploitation was identified at time of analysis.
Prototype pollution in the npm package traverse (versions 0.3.6-0.3.9, 0.4.0-0.4.6, 0.5.0-0.5.2, and 0.6.0-0.6.11) lets unauthenticated remote attackers add or overwrite properties on String.prototype, Number.prototype, or Boolean.prototype when an application passes an attacker-controlled path array to set(), as when a path is built directly from an untrusted JSON body. Exploitation is gated entirely on that anti-pattern: the path must cross or end on a primitive value, and plain JSON data is not sufficient to reach the far higher-impact Object.prototype, which requires a non-data path segment such as an object whose toString returns a different value on each call or a Proxy that accepts an assignment without storing it. Impact is limited to low integrity and low availability with no confidentiality effect (vendor CVSS 4.0 score 6.9 Medium; independently assessed CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L), with no public exploit identified at time of analysis and confirmed fixes available from the vendor in 0.3.10, 0.4.7, 0.5.3, and 0.6.12.
Cross-origin cookie injection in AsyncHttpClient (AHC) Java library before 3.0.13 and 2.16.1 allows an attacker-controlled host beneath a registry-level public suffix such as co.uk to set a cookie for that suffix itself, which the shared ThreadSafeCookieStore then replays to unrelated hosts under the same suffix. The failure lies in ThreadSafeCookieStore, which performs domain matching but never applies the RFC 6265 Section 5.3 step 5 rule that rejects a Domain attribute naming a public suffix; the practical result is that session-relevant cookie values can be injected or overwritten across origins sharing that registry. Impact is integrity-only (I:H, no confidentiality or availability loss) and exploitation is scenario-dependent, requiring one cookie store shared across requests to both an attacker host and a victim host under the same suffix, which is why the assessed vector carries High attack complexity and a present Attack Requirement. No public exploit code or active exploitation was identified at time of analysis; fixes are released as version 3.0.13 and 2.16.1.
Unauthenticated attackers can delete arbitrary slider images and replace the entire OrdaSoft Touch Slider database tables site-wide via the module's AJAX handler in versions below 5.4.6. The handler modOsTouchSliderHelper::getAjax() lacks any JFactory::getUser(), authorise(), or CSRF-token check, so exploitation requires no session or task parameter and works against default configurations where the module is installed and enabled. No public exploit identified at time of analysis.
Unauthenticated remote attackers can leak residual stack memory from Coturn 4.10.0 by sending a TURN Allocate request with no credentials, which causes the server to copy uninitialized stack bytes into the ERROR-CODE reason phrase of its response. The disclosed fragments can include pointer values that weaken ASLR and assist precise version fingerprinting, but the leak is bounded to whatever fits in the reason phrase, is probabilistic depending on residual stack contents, and provides no write or code-execution capability on its own. The issue is rated moderate severity (vendor/third-party CVSS 6.9; independent assessment CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), there is no confirmed active exploitation (CISA KEV) and no public exploit code identified at time of analysis, and a vendor patch is available in Coturn 4.11.0.
Heap memory corruption in the X.Org X server (prior to 21.1.25) and Xwayland (prior to 24.1.14) arises from a cluster of flaws disclosed in the October 2026 X.Org security advisory, for which CVE-2026-93524 serves as the coordinating identifier. An authenticated local X client that can already open and authenticate to the display socket can trigger double-free, use-after-free, numeric-truncation and heap buffer overflow conditions across the XKB, Present, XInput, GLX and XFixes extensions, causing server crashes and - where heap layout protections are defeated - potentially arbitrary code execution. The assessed vector is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H; no public exploit code, EPSS score or CISA KEV listing was present in the source data, so no public exploit is identified at time of analysis, and the advisory text does not state the specific trigger conditions for CVE-2026-93524 itself.
Cookie-store handling in AsyncHttpClient (AHC) versions 2.1.0 through 2.16.1 and 3.0.0 through 3.0.13 lets a shared client instance attach one user's stored cookies to another user's request, causing the outbound request to execute under the wrong session. The enabled-by-default cookie store replaces a Cookie header set explicitly via setHeader or addHeader whenever the store holds any cookie for the origin, a gap that survives the earlier CVE-2024-53990 fix (which only covered cookies supplied through addCookie). Exploitation is conditional rather than broadly weaponizable: it requires a multi-tenant shared client, an authenticated participant (CVSS PR:L), at least one caller supplying the Cookie header directly, and a stored cookie for the same origin, with timing/ordering dependence reflected in the high attack complexity (AC:H) of the assessed CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N vector; no public exploit identified at time of analysis and no CISA KEV listing. A vendor-released patch, version 3.0.14, is available.
The cluster-samples-operator in Red Hat OpenShift Container Platform 4 assigns an overly permissive RBAC Role (coreos-pull-secret-reader) that grants get/list/watch on all Secrets in the openshift-config namespace, exceeding the operator's requirement for only the pull-secret Secret. This excessive-privilege weakness (CWE-250) does not provide initial access; an attacker must first compromise the operator pod or its service-account token through a separate vulnerability, after which they can read sensitive cluster secrets such as OAuth identity provider credentials and cloud provider credentials. No public exploit code is identified, and the issue is a defense-in-depth concern rather than a directly exploitable flaw (assessed CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).
Local, low-privileged users on Windows hosts running Veeam Agent for Microsoft Windows can terminate arbitrary processes on the system - including security agents, endpoint protection services, and backup components - because the agent's process-control functionality performs no authorization check on the caller (CWE-862, Missing Authorization). Rated 6.8 by the vendor and assessed as medium severity (CVSS:3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), the flaw is strictly local, requires a pre-existing authenticated low-privileged account, needs no user interaction, and affects only availability - no confidentiality or integrity impact is possible through this path. There is no public exploit identified at time of analysis and the issue is not in CISA KEV; realistic risk climbs only on hosts where killing specific processes (for example EDR agents or the backup service itself) materially degrades protection or disrupts operations.
Use-after-free in the Present extension of X.Org X server before 21.1.25 and Xwayland before 24.1.14 lets an authenticated X client crash the display server and potentially expose limited process memory. An attacker with the ability to open an X display connection creates cross-window Present notify entries pointing at a separate target window and then destroys that window, so the freed per-window notify list is traversed after present_clear_window_notifies() releases the window's private data without unlinking the entries; both the Present and SYNC extensions must be enabled, which they are by default. The issue is a local, low-privilege, user-interaction-free memory-safety bug (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H), and no CISA KEV listing, EPSS score, or public exploit code was identified at time of analysis.
Missing capability checks in the CP Media Player WordPress plugin before 1.3.4 let any authenticated user holding Contributor-level access create, modify, duplicate, and delete the site-wide media player configurations, and change at least one plugin setting that should be administrator-only. Exploitation requires a logged-in WordPress account with Contributor privileges on a site running the vulnerable plugin, with no user interaction required; publicly available exploit code exists, and there is no indication of active exploitation. This is an integrity-only, low-severity broken access control issue - our independent assessment scores it CVSS 3.1 2.7 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) - and every signal points to low real-world priority rather than an urgent threat.
Path traversal in IBM Langflow OSS 1.0.0 through 1.12.2 lets a remote attacker who holds a valid Langflow account read files outside the intended restricted directory, exposing sensitive data at high confidentiality impact (CVSS 6.5, CWE-22). The flaw is network-reachable, low-complexity and requires no victim interaction, but it cannot be triggered anonymously: the CVSS vector (PR:L) means the attacker must already be able to authenticate to the instance, so risk concentrates on internet-exposed or multi-tenant deployments with loose account provisioning. IBM has published a vendor patch (referenced in its support advisory), and no public exploit code was identified at time of analysis; no KEV listing was provided in the intelligence for this CVE.
Information disclosure in IBM Langflow OSS 1.0.0 through 1.12.2 allows a remote, authenticated attacker holding only low-privilege credentials to obtain sensitive information that should not be reachable from their account, resulting in a high confidentiality impact with no effect on integrity or availability. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) confirms credentials are required and that no user interaction is needed, while the scope-change metric indicates the exposed data can affect resources beyond the vulnerable component itself. Patch available per vendor advisory; no public exploit identified at time of analysis, and no CISA KEV or EPSS signal was provided. This is a credible mid-tier priority rather than an emergency, and the practical risk hinges on how many low-privilege accounts exist and whether the instance is reachable from untrusted networks.
Path traversal in IBM Langflow OSS 1.0.0 through 1.12.2 allows an authenticated remote attacker to read files outside the intended directory, causing high-impact confidentiality loss (CVSS 6.5, C:H/I:N/A:N) without modifying data or disrupting service. Exploitation requires low-privileged credentials (PR:L) but is network-reachable, low-complexity, and needs no user interaction, so multi-tenant or self-registration deployments face elevated risk because obtaining an account is trivial; the flaw is a moderate-severity information-disclosure issue with middle-tier real-world priority. No public exploit code or confirmed active exploitation is identified at time of analysis, and IBM has published a vendor patch advisory.
OS command injection in the web-based management API of Cisco Application Policy Infrastructure Controller (APIC) allows an attacker who already holds valid administrative credentials to run arbitrary commands as root on the underlying controller operating system. Exploitation is remote and requires no user interaction, but the PR:H rating in the CVSS vector confirms the high privilege bar: only authenticated admins can reach the vulnerable code path, so realistic exposure is limited to insider abuse, stolen or shared admin accounts, or APIC management interfaces reachable from untrusted networks. No public exploit code has been identified at time of analysis and there is no CISA KEV entry; Cisco's base score of 6.5 understates the assessed impact, since the independent re-scoring (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) also credits full loss of availability on the controller.
Opening a crafted workbook with the Excelize Go library (versions 2.1.0 through 2.11.0) triggers an integer-overflow panic that crashes the process, producing a denial of service. A Zip64 entry whose declared uncompressed size falls between 2^63 and 2^64-1 wraps to a negative int64, slips past the library's size-limit checks, and is passed to an allocation as a negative capacity; the crash occurs on the standard open/read path with default options and no credentials. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, 6.5) reflects that remote attackers can deliver the file but the victim application must be induced to parse it, and that only availability is affected - there is no data exposure or modification, and no public exploit has been identified at time of analysis.
Code injection in ImageMagick's PostScript and PDF output coders allows attacker-controlled text such as an image label to be written into generated PostScript/PDF output without escaping, so an injected PostScript operator can execute when that output is later rendered by an interpreter such as Ghostscript. Affected are ImageMagick 7.x before 7.1.2-31 and 6.x before 6.9.13-56; exploitation is not confirmed actively exploited (CISA KEV) and no public exploit code is identified at time of analysis. The assessed severity is medium (independent CVSS 5.3 / evaluated vector CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H): the attack is remote and requires no authentication, but exploitation demands a high-complexity chain in which a conversion writes a label out through the ps, ps2, ps3, or pdf coder and the resulting file is subsequently rendered.
Path traversal in Backstage's optional @backstage/plugin-scaffolder-backend-module-confluence-to-markdown package (versions before 0.3.25) allows an authenticated user who can execute a template using the confluence:transform:markdown action and control the repository file location to write generated content outside the task workspace, potentially overwriting files writable by the Backstage backend process. The vulnerability is rated CVSS 7.1 with high integrity and low availability impact but no confidentiality impact; exploitation requires the module to be installed and enabled, and the attacker must supply directory-traversal sequences in the repoUrl input. The issue is fixed in version 0.3.25 (Backstage release v1.54.6), and no public exploit has been identified at time of analysis.
Path traversal in the Backstage Confluence-to-Markdown scaffolder module can let an authenticated Backstage user who runs a template with attacker-influenced Confluence content cause file writes outside the intended image directory, affecting integrity and potentially availability of the scaffolder workspace. The vulnerable package is @backstage/plugin-scaffolder-backend-module-confluence-to-markdown before 0.3.25; exploitation requires the optional module to be deployed and wired into a template, plus an attacker able to create or modify Confluence attachment metadata. There is no public exploit identified at time of analysis, and the issue is fixed in version 0.3.25 and Backstage release v1.54.6.
Sensitive-file disclosure in the export policies feature of Cisco Application Policy Infrastructure Controller (APIC) allows an authenticated remote administrator to submit crafted values in specific UI fields and read files from the device's underlying filesystem, including cryptographic key material. The flaw carries a moderate CVSS score of 6.5 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N) and is not remotely exploitable without credentials: valid administrative access is mandatory, and the CVSS vector confirms the high privilege requirement (PR:H) with no user interaction. Because the exposed key material may be usable to escalate to root on the affected APIC and on managed switches in the ACI fabric, the fallout of a successful attack can extend well beyond a single controller; no public exploit code or confirmed active exploitation was identified at time of analysis, and there is no CISA KEV listing.
Server-side request forgery in Splunk Enterprise (below 10.4.3, 10.2.7, and 10.0.10) lets an authenticated user who holds a role with the read_o11y_content capability redirect an outbound request made by the Splunk App for Splunk Observability Cloud to an attacker-controlled host, thereby disclosing the configured Observability Cloud API token. The flaw exists because the app does not fully validate the destination of outbound requests; the request is triggered through the REST API, requires no user interaction, and is rated CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), indicating a high-confidentiality but no integrity or availability impact. Exploitation is gated by a non-default capability, by the presence of the Observability Cloud app, and by an environment where an API token is configured; Splunk Enterprise 9.4.x is explicitly unaffected. No public exploit code and no confirmed active exploitation were identified at time of analysis, and a vendor patch is available.
Denial of service in Splunk Enterprise 10.x allows an authenticated user with only low-privileged roles to degrade or take down a REST API endpoint exposed by the Discover Splunk Observability Cloud app, because the app validates input with an inefficient regular expression that can be driven into excessive CPU consumption. Affected branches are 10.4.x below 10.4.3, 10.2.x below 10.2.7, and 10.0.x below 10.0.10; Splunk Enterprise 9.4.x is explicitly not affected, and the exposure only exists where the Observability Cloud preview app and its endpoint are present and reachable. Impact is confined to availability (no data disclosure or modification), no public exploit code has been identified at time of analysis, and the vendor has released fixes in 10.4.3, 10.2.7, and 10.0.10.
A negative index panic in the Go Excelize library (versions 2.8.0 through 2.11.0) allows unauthenticated remote attackers to cause a denial of service when an application reads cell styling from a crafted .xlsx file. The flaw arises because GetStyle's extraction predicates for fill, border, and font IDs only validate upper bounds, permitting negative fillId, borderId, or fontId values from attacker-controlled styles.xml to reach slice indexing and trigger a panic. No fixed version is available, though an upstream patch (PR #2367) exists; no public exploit has been identified, and exploitation requires the application to parse an untrusted file and call File.GetStyle (UI:R).
Malformed Excel workbooks can terminate Go processes that use Excelize's conditional-format extractor, because versions 2.7.0 through 2.11.0 index required child slices and dereference an optional colorScale element without validating rule structure. An unauthenticated remote attacker who can get a crafted spreadsheet ingested by a host application that subsequently calls GetConditionalFormats can trigger an out-of-range index or nil-pointer dereference that panics and terminates an unprotected process; user interaction is required to deliver the file and the impact is availability only. No public exploit code has been identified at time of analysis, and no released fixed version exists, although the upstream fix is visible in PR #2375 and commit be7a16390fa69c71d3ca618c741d1a2b5ed362cd.
SQL injection in the SPL2 module filtering feature of Splunk Enterprise (10.4.x below 10.4.3) lets an authenticated user who holds a role with the list_spl2_modules capability read data exposed by the affected REST API, including private SPL2 module definitions owned by other users. The flaw is rooted in unparameterized user input being passed into database queries that back SPL2 module filtering, so a crafted filter value escapes the caller's intended module visibility scope; the impact is confidentiality-only with no write or availability effect, and the CVSS 3.1 vector (6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) confirms the network-reachable but authenticated and low-privilege nature of the attack. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, but a vendor patch is available in Splunk Enterprise 10.4.3, and Splunk Enterprise 10.2.x, 10.0.x, and 9.4.x are explicitly not affected.
An out-of-bounds slice access in the Excelize Go library (versions 2.7.1 through 2.11.0) lets a crafted .xlsx workbook crash the host application, causing denial of service. When mergeCellsParser encounters a mergeCell element with an empty 'ref' attribute it returns an empty rectangle and passes it to cellInRange, which indexes four positions without a length check; any non-streaming cell API such as GetCellValue then panics on the first affected cell operation. The bug is remotely triggerable but requires the victim application to process an attacker-supplied spreadsheet and invoke an affected cell-reading API (CVSS 3.1: AV:N/AC:L/PR:N/UI:R, A:H only), and no public exploit or confirmed active exploitation is known at time of analysis.
Missing authorization checks on multiple Splunk Secure Gateway REST API endpoints allow any authenticated Splunk user who does not hold the 'admin' or 'power' roles to reach privileged Secure Gateway functionality and make the gateway sign attacker-controlled payloads. The issue affects Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10 and 9.4.15, as well as standalone Splunk Secure Gateway versions below 3.10.11, 3.9.25 and 3.8.72, and it requires a valid low-privilege Splunk account plus network reachability to the Secure Gateway REST API (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N per independent assessment; NVD publishes 6.5 with C:H/I:N). There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV), but a vendor patch is available and the integrity impact of forged signatures makes timely upgrade worthwhile.
Pulp Ansible's bearer-token refresh for collection remotes can disclose access tokens to an authenticated attacker who can create or sync a remote and point it at a malicious server. The attacker must then reuse the token at the issuing service, and exploitation is only possible if another token download for a different remote has run on the same worker process, meaning shared, multi-tenant deployments are primarily at risk. No public exploit code exists, and the assessed attack complexity is high (AC:H), so this is a moderate-priority information disclosure issue rather than a top-tier emergency.
Authenticated users with permission to create and sync container remotes in Pulp can obtain upstream registry credentials-usernames, passwords, or bearer tokens-stored for other remotes because the pulp-container worker reuses authentication material across sync operations. This affects deployments built on Red Hat Ansible Automation Platform 2, Red Hat Satellite 6, and Red Hat Update Infrastructure 4/5, particularly multi-tenant environments where remotes share worker processes. No public exploit code or confirmed active exploitation has been identified; the flaw rates CVSS 6.5 (moderate) and requires no user interaction beyond the attacker's own sync, though it does require an authenticated user with remote-creation and sync privileges.
An authenticated Splunk Enterprise user without the 'admin' or 'power' roles can read substantially all search job information belonging to other users - including raw search query text, job metadata, result sets, and preview results - by supplying a user-controlled job identifier to a REST API endpoint that fails to validate job ownership. The flaw affects Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, and carries a CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), meaning the confidentiality impact is high but integrity and availability are untouched. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (not in CISA KEV); vendor patches are available, which reduces exposure for organizations that can upgrade promptly, though the requirement for valid low-privilege credentials limits risk to multi-user and shared-search deployments.
Improper entity validation in the deprecated Kubernetes services endpoint of @backstage/plugin-kubernetes-backend lets an authenticated Backstage user who already holds Kubernetes read permissions retrieve Kubernetes object metadata beyond their intended scope by submitting crafted entity data in the request body. The vulnerable handler trusted the caller-supplied entity reference instead of resolving it against the Backstage catalog, so the request was processed against an entity the user was not authorized for; the fix (0.21.8) parses the entity reference and performs a catalog lookup, returning 403 when no matching entity exists. Exposure is limited to read-only Kubernetes object metadata across configured clusters with no integrity or availability impact, and no public exploit code has been identified at time of analysis; exploitation is constrained to the legacy deprecated services endpoint and requires a crafted request that evades validation (AC:H).
Heap buffer overflow in ImageMagick's distributed pixel cache (DPC) server (versions prior to 7.1.2-31) allows an unauthenticated adjacent-network attacker to crash the server by sending crafted pixel data that causes an integer overflow in the packet size calculation. Exploitation requires the target to run the opt-in DPC clustering feature, which is not enabled by default and is not reachable via normal image processing paths. No public exploit identified at time of analysis. This is a moderate availability-only issue (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H per independent assessment).
Path traversal in the Apache Impala 'trusted_jar_paths' configuration allows an authenticated user to load an attacker-uploaded JAR from outside a trusted directory by supplying a relative path whose prefix matches a configured trusted path, resulting in code execution under Impala's process privileges. Only Impala 4.5.2 (before 4.5.3) is affected, and exploitation is conditional: the administrator must have set a non-empty 'trusted_jar_paths' value, the attacker must hold privileges to run DDL such as CREATE DATA SOURCE or CREATE TABLE to place a JAR on the same local or remote filesystem, and the URI schema itself cannot be overridden. Apache rates the issue 'important'; the independent assessment assigns CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H (authenticated, high complexity, scope-changed), and there is no KEV listing, no EPSS score, and no public exploit code identified at time of analysis.
Denial of service in ImageMagick's distributed pixel cache (DPC) server before 7.1.2-32 allows an unauthenticated attacker on the same network segment to repeatedly open connections to the DPC listening socket and exhaust its available connection slots, degrading or halting distributed cache service on the host. The issue is limited to deployments that have explicitly enabled and network-exposed the DPC server - it is not part of default ImageMagick usage - and the assessed impact is availability-only (CVSS 3.1: AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, score 4.3); no data disclosure or modification is possible. No public exploit code has been identified at time of analysis and the flaw is not listed as confirmed actively exploited (CISA KEV), while the vendor-released fix is available in ImageMagick 7.1.2-32.
Keycloak's SMTP email configuration can silently fall back to unencrypted communication when STARTTLS is enabled, allowing an attacker who can intercept and tamper with traffic between the Keycloak server and its mail relay to capture SMTP credentials and email message content in cleartext. Affected deployments include Red Hat Build of Keycloak and Red Hat Single Sign-On 7 (CVSS 6.5, AV:N/AC:H/PR:N/UI:N), but exploitation is conditional: it requires a man-in-the-middle position on the SMTP path and an instance configured for opportunistic STARTTLS rather than implicit TLS. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Any authenticated workspace member on PraisonAI Platform 0.1.8 and earlier can delete dependency edges attached to owner-created issues by routing the request through a member-owned related issue, because the DELETE dependency endpoint checks delete permission only against the caller-selected issue ID. Exploitation requires a valid member account (CVSS PR:L), a shared workspace, and a pre-existing dependency edge linking a member-owned issue to an owner-created issue; impact is limited to unauthorized removal of dependency relationships, with no data exposure or service disruption. No public exploit code was identified at time of analysis, and this is a moderate missing-authorization flaw rather than a high-urgency priority.
Cross-user integrity corruption in wger versions prior to 2.6 allows authenticated attackers to inject arbitrary workout log entries into another user's SlotEntry by exploiting a missing ownership check. A crafted POST to /api/v2/workoutlog/ with the victim's SlotEntry ID is accepted and persisted, silently folding the injected data into the victim's progressive-overload calculations and corrupting auto-generated weight and repetition targets. This IDOR (CWE-639) is rated medium severity (CVSS 6.5, PR:L), with a public proof-of-concept in the advisory; version 2.6 contains the vendor patch. Exploitation is bounded to multi-user instances and affects only data integrity-no read access, code execution, or availability impact.
Arbitrary file write via path traversal in VisiData's unzip_http RemoteZipFile extraction routine allows an attacker who supplies a crafted .zip archive over a URL to write files outside the intended extraction directory on the victim's machine. The flaw is tied to the development commit 38b21f78 (CWE-22) and is rated CVSS 3.1 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N); no privileges are required on the attacker's side, but the victim must open the attacker-provided remote archive and explicitly invoke the extract functionality. There is no CISA KEV listing and no public exploit identified at time of analysis, so this is a moderate-priority issue contingent on user interaction rather than an actively exploited emergency.
Stored cross-site scripting in the Happy Addons for Elementor WordPress plugin (versions through 3.50.0) allows an authenticated low-privilege user to plant JavaScript that runs in the browser of any higher-privileged user who views the affected page. Rated CVSS 6.5 (Medium), the flaw requires an existing contributor-level account plus victim interaction, so it is not exploitable by anonymous remote attackers against a default installation. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and no fixed version is documented in the available advisory data.
Stored cross-site scripting in the BdThemes Prime Slider plugin for WordPress (versions through 4.6.2) allows authenticated users with contributor-level access or higher to inject persistent JavaScript into slider widgets, which executes in the browser of any higher-privileged user who views the affected page. This medium-severity flaw (CVSS 6.5, vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) requires a valid low-privileged account and victim interaction, and no public exploit code or active exploitation has been identified at time of analysis.
Stored cross-site scripting in the WordPress plugin Quiz And Survey Master (quiz-master-next, by ExpressTech) through version 11.2.7 allows an authenticated low-privilege user to persist malicious markup that executes in the browser of whoever later views the affected quiz or survey content. The plugin stores user-supplied input in quiz and survey fields and renders it back without adequate neutralization, so a contributor-level account that can submit quiz/survey data can target higher-privileged viewers such as administrators reviewing entries; the assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, giving a medium-severity score of 6.5, reported by Patchstack. No public exploit code identified at time of analysis, and the issue is not listed in CISA KEV; because the attacker needs a working WordPress account and the victim must open the crafted page, exploitation is a realistic but non-trivial, interaction-dependent risk for sites that expose quiz/survey submission to low-privilege roles.
Stored cross-site scripting in the WP Media Rocket Lazy Load WordPress plugin (versions through 2.4.0) allows an authenticated low-privileged user to inject persistent JavaScript that executes in the browser of any visitor, including administrators, who later views the affected page. The issue is rated CVSS 6.5 (medium) with mandatory victim interaction and a changed scope; no public exploit code or confirmed active exploitation was identified in the available intelligence at time of analysis.
Stored cross-site scripting in Element Pack Elementor Addons (bdthemes-element-pack-lite) through version 8.8.6 allows a low-privileged authenticated WordPress user to plant persistent script payloads inside Elementor widget content, which then execute in the browser of any higher-privileged user - typically an administrator or editor - who later renders the affected page. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, score 6.5) confirms that reachability is network-based but the attack requires a pre-existing contributor-or-higher account plus victim interaction, so single-admin sites are far less exposed than multi-author, editorial, or client-managed WordPress deployments. No public exploit code and no CISA KEV entry were identified at time of analysis, and this is assessed as a moderate, not top-tier, priority.
Stored cross-site scripting in the WordPress Media Library Assistant plugin (all versions through 3.41) allows an authenticated attacker with low-level privileges to plant persistent JavaScript that runs in the browser of a higher-privileged user who later views the affected page. Rated medium severity (CVSS 6.5), exploitation is gated by two prerequisites: a valid low-privilege WordPress account able to submit input into a Media Library Assistant field (PR:L) and a victim - typically an administrator or editor - who subsequently loads the page where the payload renders (UI:R), so sites that restrict account registration or avoid granting untrusted users content-entry roles are materially less exposed. No confirmed active exploitation (CISA KEV listing absent) and no public exploit code identified at time of analysis; the flaw is reported through Patchstack.
Stored cross-site scripting (XSS) in Element Pack Elementor Addons through version 8.8.6 allows authenticated users with low-level privileges to inject malicious scripts into pages via vulnerable widgets or input fields. The injected payload executes when a higher-privileged user views the compromised page, potentially leading to session hijacking or site takeover. No public exploit identified at time of analysis, and no vendor-released patch is specified in the provided data.
Symbolic-link traversal during archive unpacking in Red Hat's source-to-image (S2I) tooling lets an attacker who can supply or otherwise influence the builder image consumed by a build create links that resolve to absolute paths outside the extraction directory, allowing file reads or modifications beyond the intended sandbox on the host. The flaw is rated CVSS 3.1 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), so exploitation is not an unauthenticated drive-by: the attacker needs the privileges required to introduce or reference a malicious builder image, and only environments that run S2I builds against untrusted or attacker-influenced images are realistically exposed. The scope is marked Changed because the payload escapes the build container boundary, but confidentiality and integrity impact are each only Low; no public exploit code and no confirmed active exploitation were identified at time of analysis.
wolfSSH through 1.5.0, when compiled with the --enable-fwd (WOLFSSH_FWD) TCP/IP forwarding option, fails to apply its forwarding policy callback or any channel-count cap to incoming forwarded-tcpip channel opens, so a malicious SSH peer can force unbounded per-channel buffer allocation and exhaust endpoint memory. The same code path leaves wolfSSH clients validating nothing: a forwarded-tcpip open is not checked against the forwards the client actually registered via tcpip-forward, contrary to RFC 4254 section 7.2, and a server should never receive a forwarded-tcpip open at all. Impact is limited to availability (memory exhaustion, assessed CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L; vendor CVSS 4.0 base 6.3), the forwarding feature must be explicitly enabled at build time, and no public exploit code was identified at time of analysis. No vendor-released tagged fix version is confirmed from the provided data; upstream patch commits exist.
A missing authorization check in Amazon Athena engine version 3 request handling allowed an authenticated AWS principal to retrieve limited query metadata - specifically AWS account identifiers and SQL statement text - belonging to other AWS accounts. The exposure was confined to that narrow metadata set: query results, credentials, and Amazon S3 data were not reachable, and AWS states no customer metadata was accessed. Exploitation required a valid authenticated AWS identity with Athena access (CVSS vector PR:L), no public exploit code has been identified, and AWS has already remediated the condition server-side on September 1, 2026, so the service is no longer exploitable and no customer action is required.