Missing capability checks in the CP Media Player WordPress plugin before 1.3.4 let any authenticated user holding Contributor-level access create, modify, duplicate, and delete the site-wide media player configurations, and change at least one plugin setting that should be administrator-only. Exploitation requires a logged-in WordPress account with Contributor privileges on a site running the vulnerable plugin, with no user interaction required; publicly available exploit code exists, and there is no indication of active exploitation. This is an integrity-only, low-severity broken access control issue - our independent assessment scores it CVSS 3.1 2.7 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) - and every signal points to low real-world priority rather than an urgent threat.
Stored and reflected cross-site scripting in Gophish through 0.12.1 allows an attacker who controls or intercepts the SMTP server configured in a sending profile to inject JavaScript that runs in an administrator's browser when campaign results are viewed or a test email is sent, enabling theft of the administrator's API key. Exploitation is unauthenticated from the attacker's perspective (PR:N) but requires a significant precondition: control over, or man-in-the-middle interception of, the sending profile's SMTP endpoint, plus passive interaction by a privileged administrator; the independent assessment rates this as a low-priority issue with a CVSS:3.1 score reflecting high attack complexity (AC:H), required user interaction (UI:R), and scope change (S:C) with only low confidentiality and integrity impact. Publicly available exploit code exists, but there is no indication of confirmed active exploitation (no CISA KEV listing).
HTTP Digest authentication in AsyncHttpClient (Java) prior to 3.0.12 and 2.16.1 derives the client nonce (cnonce) from ThreadLocalRandom rather than a cryptographically secure source, weakening the Digest exchange against chosen-plaintext and credential-precomputation attacks for an observer who can infer generator state. The issue is rated CVSS 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N), so per the assessed vector no authentication is required from a remote attacker, but exploitation is statistical and high-complexity rather than a direct exploit. Only applications that use AsyncHttpClient's Digest auth via Realm.Builder are affected; no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV is not indicated).
Improper verification of the WebSocket opening handshake in AsyncHttpClient (AHC) versions prior to 3.0.12 and 2.16.1 lets a malicious or man-in-the-middle WebSocket endpoint have frames decoded and delivered to the application's WebSocketListener even though the server's Sec-WebSocket-Accept value was missing or invalid and the 101 upgrade was never authenticated. Only Java applications that use the WebSocketUpgradeHandler on an affected AHC release and connect to an attacker-controlled or intercepted endpoint are exposed, and because the request future still fails and the channel is closed the window for delivering coalesced frames is narrow and the impact is limited to integrity of listener-delivered data. No public exploit code has been identified at time of analysis and the issue is not known to be actively exploited, consistent with its low CVSS 3.1 score of 3.7 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).
Local denial of service in m17n-lib, the multilingual input-method library shipped in Red Hat Enterprise Linux 6 through 10, can crash an application that opens an input method: a partial failure during library initialization leaves an internal driver pointer uninitialized, and the subsequent dereference is performed without validation. The assessed risk is genuinely low (CVSS 3.1 base 2.9; AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L), because the trigger - system resource exhaustion or corruption of the input-method database - is rare and cannot be reliably forced, the vector is local rather than remote, and the impact is confined to an application crash with no confidentiality or integrity effect. No public exploit identified at time of analysis, and there is no indication of active exploitation (not in CISA KEV).
Obot versions 0.25.0 through 0.25.5 and 0.26.0 can persist stale group memberships after an administrator revokes a user's group in the upstream identity provider, leaving the user with revoked group-based access for roughly ten minutes. The flaw is a race condition (CWE-362) in the auth provider group-refresh path: when two refreshes for the same identity overlap and commit out of order, an older refresh overwrites the newer one and restores memberships that were just removed. It is a genuinely low-priority issue - the CVSS 4.0 score is 2.3 (assessed independently as CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N), exploitation requires an already-authenticated user (PR:L), the timing is not attacker-controllable (AC:H), impact is limited to retaining previously held access rather than gaining new privileges, and the condition self-heals within the group check period; no public exploit code has been identified at time of analysis and there is no CISA KEV entry.
An out-of-bounds read in Apache YuniKorn's non-default LDAP group resolver allows a malformed LDAP group-membership entry to panic the scheduler process in versions 1.8.0 through 1.9.x, making the scheduler unavailable until it is restarted. The crash occurs only when an installation has explicitly configured the LDAP group provider and the LDAP server returns a memberOf entry for a user referenced in a submitted pod that does not begin with the 'CN=' prefix; default installations that use the built-in group resolution are not affected, and successful triggering generally requires an authenticated, low-privileged user able to have a pod processed. This is a low-severity, availability-only defect - CVSS 4.0 base score 2.1 (low) and an independently assessed CVSS 3.1 vector of AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L - with no public exploit identified at time of analysis and no confirmed active exploitation; a vendor fix is available in 1.10.0.
Heap-based buffer overflow in XnView Classic 2.52.5 allows a crafted FLI file to corrupt heap memory when a victim opens it, requiring user interaction and no authentication; publicly available exploit code exists per the CVSS v4.0 E:P metric. This client-side parsing flaw has low confidentiality, integrity, and availability impact, making it a moderate-severity, low-priority issue, and upgrading to version 2.52.6 is recommended.
Admission-control bypass in Apache YuniKorn 1.9.0 and earlier allows an authenticated Kubernetes user who holds UPDATE/patch permission on workload objects (deployments, replicasets, statefulsets, daemonsets, jobs, cronjobs) to set an arbitrary user-info annotation and rewrite the workload's application ID, potentially gaining placement into a queue the user would not normally be entitled to and sidestepping user-based quota accounting. The CREATE path correctly enforces the label and user-annotation checks, so the flaw exists only on the UPDATE action, meaning an attacker must first create a workload and then modify it - reflected in the vendor CVSS 4.0 base of 2.0 (AV:N/AC:L/AT:P/PR:H/UI:P, integrity-only) and in the independent assessment (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N). Impact is confined to multi-tenant queue isolation and quota governance with no host, data, or code-execution exposure; no public exploit identified at time of analysis. The issue is tracked as YUNIKORN-3473 and fixed in YuniKorn 1.10.0 (also landed in the 1.11.0 fix version) via GitHub PR #1106.