Credential stuffing and unlimited password guessing against the Gophish phishing-simulation platform through version 0.12.1 are enabled by a login rate-limit bypass: the throttling middleware keys its counter on a client address that is rewritten from the attacker-supplied X-Forwarded-For or X-Real-IP header, so an unauthenticated remote attacker who sends a different forwarded address with every request never trips the limiter. Publicly available exploit code exists (documented in the Ostorlab review and VulnCheck advisory), and the flaw is rated CVSS 4.0 6.9 / assessed CVSS 3.1 6.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N); it is not confirmed actively exploited, so exploitation depends on whether the /login endpoint is network-reachable and whether targeted accounts use weak, default, or guessable credentials. The issue is genuine but moderate in severity rather than a top-tier emergency, and its real-world impact is sharply reduced for instances whose admin interface is not exposed to untrusted networks.
Authenticated stored cross-site scripting in the Envira Gallery WordPress plugin before 1.16.1 allows users with Author role or higher to inject arbitrary web scripts through unsanitized gallery display configuration values, which are stored and later rendered into an image tag attribute. The injected script executes when any visitor, including an administrator, views a page containing the affected gallery; exploitation requires an authenticated low-privilege account and a victim page view. Publicly available exploit code exists, but no CISA KEV active-exploitation flag is provided; the independent assessment rates it as requiring Author+ access with user interaction and limited confidentiality/integrity impact.
Stored cross-site scripting (XSS) in Envira Gallery WordPress plugin before 1.16.1 allows an authenticated user with Author role or higher to store a malicious gallery item identifier that is output unsanitized in an image tag attribute, causing script execution when any visitor, including an administrator, views a page embedding the gallery. Publicly available exploit code exists for this issue, but it is not listed in CISA KEV in the provided data; the vendor has released a patch in version 1.16.1. The input rates this CVSS 6.8 (Medium), while the independent assessment vector is AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N.
SQL injection in the MPG WordPress plugin before 4.2.3 allows authenticated users holding the Editor role or higher to inject crafted data through the plugin's project-import functionality, causing sensitive records such as WordPress password hashes to be read out of the database. The flaw is CWE-89: imported project data is not structurally validated before it is concatenated into a database query. Publicly available exploit code exists (per WPScan and the CVE.org reference), though the vulnerability is not confirmed actively exploited (CISA KEV), and its practical reach is bounded by the PR:H vector - anonymous visitors and low-privilege accounts (Subscriber, Contributor) cannot trigger it. Upgrading to version 4.2.3 removes the condition.
Second-order SQL injection in the Animated Number Counters WordPress plugin before version 3.1 allows an attacker with an Editor-level account to store a crafted counter value that is later concatenated into an SQL query and executed when any unauthenticated visitor loads a page containing the counter, enabling extraction of arbitrary database contents including password hashes. The flaw requires an existing Editor account (authenticated, high privileges) for the initial injection, but the malicious SQL runs without further authentication. A vendor patch (version 3.1) is available, and publicly available exploit code exists; the assessed CVSS vector (6.8, PR:H, scope changed) reflects the privileged prerequisite and high confidentiality impact.
Uploading a specially structured CSV file through GitLab CE/EE's import functionality lets an authenticated user with import rights overwhelm the instance's Sidekiq background workers, degrading or stalling asynchronous job processing across the deployment (CVSS 6.5, availability-only impact). The defect exists in every release from 11.7 up to the fixed versions 18.8.9, 18.9.5, and 18.10.3, and publicly available exploit code exists, documented in the linked HackerOne report; CISA's SSVC assessment records no observed exploitation and classifies the issue as not automatable, and our independent assessment rates it a genuine but moderate-priority issue rather than an emergency. Because the CVSS vector specifies PR:L with AV:N/AC:L/UI:N, only authenticated accounts that can reach a CSV import feature are affected - anonymous or pre-authentication attacks are not possible, and the risk is highest on multi-tenant or internet-facing instances that allow low-trust users to self-register or bring data in.
A crafted Excel (.xlsx) file can crash any Go application that parses it with Excelize 2.0.0 through 2.11.0 using a non-streaming worksheet API, resulting in an unrecovered panic that terminates the process. The bug occurs when a row lists a higher-column cell (e.g. D1) before a lower-column final cell (e.g. B1): checkRow sizes its backing cell slice from the last cell in document order, so the earlier cell's column index falls outside the slice and triggers an out-of-bounds access. Exploitation requires the victim or application to load the malicious workbook (UI:R), impact is limited to availability with no data disclosure or code execution, and no public exploit was identified at time of analysis; an upstream fix is available as a PR/commit but a released patched version is not independently confirmed.
Optimole WordPress plugin versions 4.0.0 through 4.2.15 expose the site's stored third-party image-optimization service credentials to any authenticated user, including the lowest-privilege Subscriber role, because the account dashboard widget renders that data without a capability check. Exploitation requires only a valid account on the affected site and no user interaction, giving a complete confidentiality loss (CVSS 6.5, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), with the practical risk driven mostly by whether open self-registration lets an outsider obtain the required Subscriber session. Publicly available exploit code exists and the vendor shipped a patch in 4.2.15; this issue is not confirmed actively exploited (CISA KEV) and should be treated as a legitimate medium-severity flaw rather than a high-urgency threat.
Unauthenticated information disclosure in the Geliver Akıllı Kargo Pazaryeri WordPress plugin (versions 3.0.0 through 3.1.0, fixed in 3.1.1) allows any remote attacker to fetch a plugin-generated log file left inside a web-accessible directory, exposing the site's carrier integration key and customer order data. Recovering the integration key lets an attacker tamper with WooCommerce order statuses, so the issue carries both confidentiality and limited integrity impact (CVSS 6.5, PR:N/UI:N per the assessed vector). Publicly available exploit code exists and the flaw is trivially automatable, though no confirmed active exploitation has been observed, and the affected plugin has a narrow deployment base.
Username enumeration in Gophish through 0.12.1 allows unauthenticated remote attackers to distinguish valid administrator accounts from invalid ones by measuring response-time differences in the login handler, which performs a bcrypt comparison for existing users but short-circuits for unknown ones. Rated low-to-moderate priority (CVSS 4.0 6.3; assessed CVSS 3.1 AV:N/AC:H/PR:N/UI:N with low confidentiality impact), the flaw yields only a list of valid usernames and does not authenticate an attacker, disclose passwords, or modify data. Publicly available exploit code exists, but there is no evidence of active exploitation and no CISA KEV listing; real-world exposure is sharply limited to deployments where the Gophish admin interface (POST /login) is reachable from an untrusted network, since the recommended deployment keeps it on an internal or VPN-only segment.
Unauthenticated information disclosure in the WordPress plugin Integration for Epos Now and WooCommerce (versions 4.6.0 through 4.11.1) lets any remote visitor who can reach an unprotected REST endpoint read the site's scheduled background tasks together with their stored arguments, exposing WooCommerce order identifiers and, under narrower conditions, the plaintext passwords of newly registered customers queued for WooCommerce's deferred-emails feature. No credentials or user interaction are required (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N), but the high attack complexity reflects two dependencies: WooCommerce's deferred-emails option must be enabled, and a freshly registered customer's email task must still be present in the scheduled-task queue when the request is made. Publicly available exploit code exists and vendor patch 4.11.2 is available; exploitation has not been confirmed in the wild, and the practical blast radius is limited by the conditional nature of the password exposure.
Denial of service in Open5GS up to and including 2.7.7: an unanswerable or failing PFCP Session Report path triggered from the GTP-U receive code causes the UPF (and the parallel SGW-U path) to abort or to leak PFCP transaction objects, degrading or halting user-plane service. The flaw is CWE-770 uncontrolled resource allocation in the GTP-U receive path (src/upf/gtp-path.c, ogs_pfcp_xact_local_create) and is remotely reachable without authentication or user interaction (CVSS:3.1 AV:N/AC:L/PR:N/UI:N), though in a correctly segmented 5G core the N3/GTP-U socket is exposed only to the access network (gNB) rather than the public internet. Impact is availability-only (CVSS 5.5, A:L, no confidentiality or integrity effect); publicly available exploit code exists, and no confirmed actively exploited (CISA KEV) status has been reported.
Email HTML injection in the MetForm WordPress plugin before 4.3.1 lets unauthenticated attackers submit crafted form-field values that are inserted into the HTML body of administrator and submitter notification emails without sanitization or escaping, allowing arbitrary markup to be rendered in the recipient's mail client. Successful exploitation yields limited confidentiality and integrity impact (CVSS 3.1 base 5.4, AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) and is confined to email-rendered content - spoofing or phishing-style content rather than server-side execution - because the injected markup takes effect only when a recipient opens the notification. Publicly available exploit code exists (WPScan published the finding and a proof-of-concept reference), and no public exploit identified at time of analysis would be misleading here; there is no CISA KEV listing, so this is treated as a moderate-priority, non-actively-exploited issue.
Unauthenticated attackers can read WooCommerce product sales counts, exact stock levels, and private product meta from WordPress sites running the WPCafe plugin before version 3.0.21, because several of the plugin's REST API endpoints fail to enforce the access restrictions WooCommerce applies to that same data. CVSS 3.1 scores the flaw 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), reflecting a network-reachable, credential-free, read-only disclosure with limited confidentiality impact, and publicly available exploit code exists. The real-world blast radius depends on the target also running a populated WooCommerce store, since without WooCommerce product data there is nothing meaningful to leak.
Unauthenticated email relay in the Magee Shortcodes WordPress plugin (versions through 2.1.1) allows remote attackers to send arbitrary emails to any address through an affected site, because the plugin does not restrict the recipient of some of its unauthenticated contact-form actions. Any WordPress site running the plugin with a page that renders one of its contact-form shortcodes is exposed; sites with the plugin installed but no such page are substantially less exposed, since the vulnerable action endpoint is not reachable. No authentication (PR:N) and no user interaction (UI:N) are required, publicly available exploit code exists, and there is no CISA KEV confirmation of active exploitation. The impact is limited to mail abuse - the assessed vector (C:N/I:L/A:N) reflects no data disclosure, no code execution and no denial of service, making this a moderate abuse-of-functionality issue rather than a system compromise.
Server-side request forgery in Gophish 0.11.0 through 0.12.1 allows authenticated, low-privileged users to force the server to fetch arbitrary internal URLs through the POST /api/import/site endpoint, because the default dialer deny list does not block loopback or RFC1918 private destinations. Attackers can read the responses of reachable internal services and enumerate internal hosts and ports from differential error messages, but the impact is confined to information disclosure with no write, code-execution, or availability effect, and authentication is mandatory (CVSS:4.0 PR:L / assessed CVSS:3.1 PR:L). Publicly available exploit code exists - documented in an Ostorlab review of Gophish 0.12.1 and tracked by VulnCheck - while the reported CVSS 4.0 score is a moderate 5.3 and no CISA KEV entry is present in the supplied intelligence, so this is confirmed as a moderate-severity issue rather than an emergency.
Email address disclosure in the User Private Files WordPress plugin before version 2.1.9 allows any authenticated user - including a low-privileged Subscriber - to retrieve the email address of any registered account on the site, including administrators. The plugin fails to verify that a supplied user actually belongs to the document being operated on, so an attacker with a valid account can simply supply arbitrary user identifiers and read back the associated email addresses. Publicly available exploit code exists (documented by WPScan), no CISA KEV entry confirms active exploitation, and the impact is limited to confidentiality (CVSS 4.3, C:L) with no data modification or service disruption - making this a genuine but low-to-moderate priority issue rather than a critical one.
Broken access control in the Yaad Sarig Payment Gateway For WC WordPress plugin before 2.2.13 lets any authenticated user - including the lowest-privilege Subscriber role - act on and alter WooCommerce orders that belong to other customers. The flaw sits in several of the plugin's order payment-processing actions, which perform neither an authorization check nor an ownership check against the supplied order identifier (CWE-639, CVSS 4.3). Exploitation requires only a valid account and no user interaction, and publicly available exploit code exists; however, per CISA's SSVC assessment, exploitation has not been observed (no KEV listing) and the impact is bounded to order integrity with no confidentiality, availability, or privilege-escalation effect.
An authorization flaw in the Academy LMS WordPress plugin before 4.0.0 allows any authenticated user who is enrolled in at least one course - such as an ordinary student - to read the quiz answer options for questions that belong to other courses they are not enrolled in. Because the plugin fails to verify that a referenced quiz question actually belongs to a course the requester can access, a valid session plus minimal enrollment is enough to pull answer data across course boundaries; publicly available exploit code exists, though there is no evidence of confirmed active exploitation. Independent assessment rates this as a genuine but low-priority issue - authentication is mandatory (PR:L), no anonymous exploitation is possible, impact is limited to confidentiality of quiz answers (no write, no takeover), and the attack is not automatable at scale per SSVC (Automatable: no).
Information disclosure in the Academy LMS WordPress plugin before 4.0.0 allows an authenticated student - including one who simply self-registers when open registration is enabled - to read the full content of arbitrary lessons through an under-protected REST API route, including lessons belonging to paid or private courses they are not enrolled in. The issue is an authorization/ownership-check failure (CWE-639) rated CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), and publicly available exploit code exists, although CISA's SSVC assessment records no observed exploitation and classifies the issue as not automatable. Impact is bounded to confidentiality of lesson content - no data modification, no site disruption - and installations that disable open student self-registration materially raise the barrier to entry.
Authenticated users with subscriber-level privileges can delete the Frontend Dashboard WordPress plugin's configured profile and post form fields in versions before 3.0.0 due to a missing capability check in an AJAX action. This broken access control flaw (CWE-284) has a CVSS score of 4.3 and publicly available exploit code, but no confirmed active exploitation. The risk is moderate because exploitation requires a low-privilege account and only affects data integrity, not confidentiality or availability.
Server-side request forgery in the PowerPress Podcasting plugin by Blubrry (versions 11.13.12 through before 11.17.11) lets authenticated WordPress users with contributor-level access or higher supply a media URL that the plugin fetches server-side, following HTTP redirects to attacker-chosen destinations, and thereby probe or reach internal services. The flaw is a redirect-destination validation failure classified as CWE-918 with CVSS 4.1 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N per the assessed vector), so impact is limited to confidentiality-oriented access to internal endpoints with no direct write or code-execution path indicated. Publicly available exploit code exists for this issue, but there is no confirmed active exploitation (CISA KEV) and no evidence of a zero-day; the vendor has released a patch, and this is a moderate, not urgent, priority.
Arbitrary file creation or truncation in Apache Jackrabbit's WebDAV/DavEx client (jackrabbit-spi2dav) occurs when a malicious or intercepted remote server supplies externally controlled input that causes the client to instantiate classes from its classpath. Affected versions are 2.23.0 through 2.23.5, 2.22.0 through 2.22.4, and 2.20.0 through 2.20.17, but only applications using jackrabbit-spi2dav directly or through jackrabbit-jcr2dav to connect to a remote repository are impacted; Jackrabbit servers are not vulnerable. The vendor CVSS 4.0 base score is 6.9 (medium) with an unauthenticated network vector, and the independent assessment rates CVSS 3.1 as AC:H with integrity-low impact only (C:N/I:L/A:N) because the attacker must control the remote server or intercept the connection; no public exploit code has been identified at time of analysis.
Pre-authentication CPU exhaustion affects wolfSSH servers through 1.5.0 that are built with Diffie-Hellman group-exchange SHA256 support, letting a remote unauthenticated client force the server to execute client-role key-exchange logic. After negotiating diffie-hellman-group-exchange-sha256, the attacker sends SSH_MSG_KEX_DH_GEX_GROUP (31) - a message only a client should send - and the server runs the client-side handler DoKexDhGexGroup(), performing two 8-round Miller-Rabin primality tests on an attacker-supplied prime of up to 8192 bits and then generating a Diffie-Hellman key pair in the attacker's group. The flaw yields only availability impact (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) with no memory corruption or data exposure; no public exploit code has been identified at time of analysis and it is not confirmed as actively exploited.
Server-side request forgery in LMCache through 0.5.5 allows unauthenticated remote attackers to bypass the frontend monitoring service's proxy allowlist by registering arbitrary host entries through POST /api/proxies, then relaying requests to internal systems via /proxy or /proxy2 and reading the responses back. Successful abuse also permits tampering with catalogued nodes and stopping the heartbeat mechanism, but the impact is bounded to limited information disclosure, limited integrity impact, and availability disruption rather than full host takeover. Exploitation is unauthenticated (PR:N, CWE-306) and requires only network reachability to the frontend monitoring service, so real-world risk depends heavily on whether that service is exposed beyond trusted internal ML-serving infrastructure; no public exploit code or confirmed active exploitation was identified at time of analysis.
Prototype pollution in the npm package traverse (versions 0.3.6-0.3.9, 0.4.0-0.4.6, 0.5.0-0.5.2, and 0.6.0-0.6.11) lets unauthenticated remote attackers add or overwrite properties on String.prototype, Number.prototype, or Boolean.prototype when an application passes an attacker-controlled path array to set(), as when a path is built directly from an untrusted JSON body. Exploitation is gated entirely on that anti-pattern: the path must cross or end on a primitive value, and plain JSON data is not sufficient to reach the far higher-impact Object.prototype, which requires a non-data path segment such as an object whose toString returns a different value on each call or a Proxy that accepts an assignment without storing it. Impact is limited to low integrity and low availability with no confidentiality effect (vendor CVSS 4.0 score 6.9 Medium; independently assessed CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L), with no public exploit identified at time of analysis and confirmed fixes available from the vendor in 0.3.10, 0.4.7, 0.5.3, and 0.6.12.
Cross-origin cookie injection in AsyncHttpClient (AHC) Java library before 3.0.13 and 2.16.1 allows an attacker-controlled host beneath a registry-level public suffix such as co.uk to set a cookie for that suffix itself, which the shared ThreadSafeCookieStore then replays to unrelated hosts under the same suffix. The failure lies in ThreadSafeCookieStore, which performs domain matching but never applies the RFC 6265 Section 5.3 step 5 rule that rejects a Domain attribute naming a public suffix; the practical result is that session-relevant cookie values can be injected or overwritten across origins sharing that registry. Impact is integrity-only (I:H, no confidentiality or availability loss) and exploitation is scenario-dependent, requiring one cookie store shared across requests to both an attacker host and a victim host under the same suffix, which is why the assessed vector carries High attack complexity and a present Attack Requirement. No public exploit code or active exploitation was identified at time of analysis; fixes are released as version 3.0.13 and 2.16.1.
Unauthenticated attackers can delete arbitrary slider images and replace the entire OrdaSoft Touch Slider database tables site-wide via the module's AJAX handler in versions below 5.4.6. The handler modOsTouchSliderHelper::getAjax() lacks any JFactory::getUser(), authorise(), or CSRF-token check, so exploitation requires no session or task parameter and works against default configurations where the module is installed and enabled. No public exploit identified at time of analysis.
Unauthenticated remote attackers can leak residual stack memory from Coturn 4.10.0 by sending a TURN Allocate request with no credentials, which causes the server to copy uninitialized stack bytes into the ERROR-CODE reason phrase of its response. The disclosed fragments can include pointer values that weaken ASLR and assist precise version fingerprinting, but the leak is bounded to whatever fits in the reason phrase, is probabilistic depending on residual stack contents, and provides no write or code-execution capability on its own. The issue is rated moderate severity (vendor/third-party CVSS 6.9; independent assessment CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), there is no confirmed active exploitation (CISA KEV) and no public exploit code identified at time of analysis, and a vendor patch is available in Coturn 4.11.0.
Heap memory corruption in the X.Org X server (prior to 21.1.25) and Xwayland (prior to 24.1.14) arises from a cluster of flaws disclosed in the October 2026 X.Org security advisory, for which CVE-2026-93524 serves as the coordinating identifier. An authenticated local X client that can already open and authenticate to the display socket can trigger double-free, use-after-free, numeric-truncation and heap buffer overflow conditions across the XKB, Present, XInput, GLX and XFixes extensions, causing server crashes and - where heap layout protections are defeated - potentially arbitrary code execution. The assessed vector is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H; no public exploit code, EPSS score or CISA KEV listing was present in the source data, so no public exploit is identified at time of analysis, and the advisory text does not state the specific trigger conditions for CVE-2026-93524 itself.
Cookie-store handling in AsyncHttpClient (AHC) versions 2.1.0 through 2.16.1 and 3.0.0 through 3.0.13 lets a shared client instance attach one user's stored cookies to another user's request, causing the outbound request to execute under the wrong session. The enabled-by-default cookie store replaces a Cookie header set explicitly via setHeader or addHeader whenever the store holds any cookie for the origin, a gap that survives the earlier CVE-2024-53990 fix (which only covered cookies supplied through addCookie). Exploitation is conditional rather than broadly weaponizable: it requires a multi-tenant shared client, an authenticated participant (CVSS PR:L), at least one caller supplying the Cookie header directly, and a stored cookie for the same origin, with timing/ordering dependence reflected in the high attack complexity (AC:H) of the assessed CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N vector; no public exploit identified at time of analysis and no CISA KEV listing. A vendor-released patch, version 3.0.14, is available.
The cluster-samples-operator in Red Hat OpenShift Container Platform 4 assigns an overly permissive RBAC Role (coreos-pull-secret-reader) that grants get/list/watch on all Secrets in the openshift-config namespace, exceeding the operator's requirement for only the pull-secret Secret. This excessive-privilege weakness (CWE-250) does not provide initial access; an attacker must first compromise the operator pod or its service-account token through a separate vulnerability, after which they can read sensitive cluster secrets such as OAuth identity provider credentials and cloud provider credentials. No public exploit code is identified, and the issue is a defense-in-depth concern rather than a directly exploitable flaw (assessed CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).
Local, low-privileged users on Windows hosts running Veeam Agent for Microsoft Windows can terminate arbitrary processes on the system - including security agents, endpoint protection services, and backup components - because the agent's process-control functionality performs no authorization check on the caller (CWE-862, Missing Authorization). Rated 6.8 by the vendor and assessed as medium severity (CVSS:3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), the flaw is strictly local, requires a pre-existing authenticated low-privileged account, needs no user interaction, and affects only availability - no confidentiality or integrity impact is possible through this path. There is no public exploit identified at time of analysis and the issue is not in CISA KEV; realistic risk climbs only on hosts where killing specific processes (for example EDR agents or the backup service itself) materially degrades protection or disrupts operations.
Use-after-free in the Present extension of X.Org X server before 21.1.25 and Xwayland before 24.1.14 lets an authenticated X client crash the display server and potentially expose limited process memory. An attacker with the ability to open an X display connection creates cross-window Present notify entries pointing at a separate target window and then destroys that window, so the freed per-window notify list is traversed after present_clear_window_notifies() releases the window's private data without unlinking the entries; both the Present and SYNC extensions must be enabled, which they are by default. The issue is a local, low-privilege, user-interaction-free memory-safety bug (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H), and no CISA KEV listing, EPSS score, or public exploit code was identified at time of analysis.
Path traversal in IBM Langflow OSS 1.0.0 through 1.12.2 lets a remote attacker who holds a valid Langflow account read files outside the intended restricted directory, exposing sensitive data at high confidentiality impact (CVSS 6.5, CWE-22). The flaw is network-reachable, low-complexity and requires no victim interaction, but it cannot be triggered anonymously: the CVSS vector (PR:L) means the attacker must already be able to authenticate to the instance, so risk concentrates on internet-exposed or multi-tenant deployments with loose account provisioning. IBM has published a vendor patch (referenced in its support advisory), and no public exploit code was identified at time of analysis; no KEV listing was provided in the intelligence for this CVE.
Information disclosure in IBM Langflow OSS 1.0.0 through 1.12.2 allows a remote, authenticated attacker holding only low-privilege credentials to obtain sensitive information that should not be reachable from their account, resulting in a high confidentiality impact with no effect on integrity or availability. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) confirms credentials are required and that no user interaction is needed, while the scope-change metric indicates the exposed data can affect resources beyond the vulnerable component itself. Patch available per vendor advisory; no public exploit identified at time of analysis, and no CISA KEV or EPSS signal was provided. This is a credible mid-tier priority rather than an emergency, and the practical risk hinges on how many low-privilege accounts exist and whether the instance is reachable from untrusted networks.
Path traversal in IBM Langflow OSS 1.0.0 through 1.12.2 allows an authenticated remote attacker to read files outside the intended directory, causing high-impact confidentiality loss (CVSS 6.5, C:H/I:N/A:N) without modifying data or disrupting service. Exploitation requires low-privileged credentials (PR:L) but is network-reachable, low-complexity, and needs no user interaction, so multi-tenant or self-registration deployments face elevated risk because obtaining an account is trivial; the flaw is a moderate-severity information-disclosure issue with middle-tier real-world priority. No public exploit code or confirmed active exploitation is identified at time of analysis, and IBM has published a vendor patch advisory.
OS command injection in the web-based management API of Cisco Application Policy Infrastructure Controller (APIC) allows an attacker who already holds valid administrative credentials to run arbitrary commands as root on the underlying controller operating system. Exploitation is remote and requires no user interaction, but the PR:H rating in the CVSS vector confirms the high privilege bar: only authenticated admins can reach the vulnerable code path, so realistic exposure is limited to insider abuse, stolen or shared admin accounts, or APIC management interfaces reachable from untrusted networks. No public exploit code has been identified at time of analysis and there is no CISA KEV entry; Cisco's base score of 6.5 understates the assessed impact, since the independent re-scoring (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) also credits full loss of availability on the controller.
Opening a crafted workbook with the Excelize Go library (versions 2.1.0 through 2.11.0) triggers an integer-overflow panic that crashes the process, producing a denial of service. A Zip64 entry whose declared uncompressed size falls between 2^63 and 2^64-1 wraps to a negative int64, slips past the library's size-limit checks, and is passed to an allocation as a negative capacity; the crash occurs on the standard open/read path with default options and no credentials. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, 6.5) reflects that remote attackers can deliver the file but the victim application must be induced to parse it, and that only availability is affected - there is no data exposure or modification, and no public exploit has been identified at time of analysis.
Code injection in ImageMagick's PostScript and PDF output coders allows attacker-controlled text such as an image label to be written into generated PostScript/PDF output without escaping, so an injected PostScript operator can execute when that output is later rendered by an interpreter such as Ghostscript. Affected are ImageMagick 7.x before 7.1.2-31 and 6.x before 6.9.13-56; exploitation is not confirmed actively exploited (CISA KEV) and no public exploit code is identified at time of analysis. The assessed severity is medium (independent CVSS 5.3 / evaluated vector CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H): the attack is remote and requires no authentication, but exploitation demands a high-complexity chain in which a conversion writes a label out through the ps, ps2, ps3, or pdf coder and the resulting file is subsequently rendered.
Path traversal in Backstage's optional @backstage/plugin-scaffolder-backend-module-confluence-to-markdown package (versions before 0.3.25) allows an authenticated user who can execute a template using the confluence:transform:markdown action and control the repository file location to write generated content outside the task workspace, potentially overwriting files writable by the Backstage backend process. The vulnerability is rated CVSS 7.1 with high integrity and low availability impact but no confidentiality impact; exploitation requires the module to be installed and enabled, and the attacker must supply directory-traversal sequences in the repoUrl input. The issue is fixed in version 0.3.25 (Backstage release v1.54.6), and no public exploit has been identified at time of analysis.
Path traversal in the Backstage Confluence-to-Markdown scaffolder module can let an authenticated Backstage user who runs a template with attacker-influenced Confluence content cause file writes outside the intended image directory, affecting integrity and potentially availability of the scaffolder workspace. The vulnerable package is @backstage/plugin-scaffolder-backend-module-confluence-to-markdown before 0.3.25; exploitation requires the optional module to be deployed and wired into a template, plus an attacker able to create or modify Confluence attachment metadata. There is no public exploit identified at time of analysis, and the issue is fixed in version 0.3.25 and Backstage release v1.54.6.
Sensitive-file disclosure in the export policies feature of Cisco Application Policy Infrastructure Controller (APIC) allows an authenticated remote administrator to submit crafted values in specific UI fields and read files from the device's underlying filesystem, including cryptographic key material. The flaw carries a moderate CVSS score of 6.5 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N) and is not remotely exploitable without credentials: valid administrative access is mandatory, and the CVSS vector confirms the high privilege requirement (PR:H) with no user interaction. Because the exposed key material may be usable to escalate to root on the affected APIC and on managed switches in the ACI fabric, the fallout of a successful attack can extend well beyond a single controller; no public exploit code or confirmed active exploitation was identified at time of analysis, and there is no CISA KEV listing.
Server-side request forgery in Splunk Enterprise (below 10.4.3, 10.2.7, and 10.0.10) lets an authenticated user who holds a role with the read_o11y_content capability redirect an outbound request made by the Splunk App for Splunk Observability Cloud to an attacker-controlled host, thereby disclosing the configured Observability Cloud API token. The flaw exists because the app does not fully validate the destination of outbound requests; the request is triggered through the REST API, requires no user interaction, and is rated CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), indicating a high-confidentiality but no integrity or availability impact. Exploitation is gated by a non-default capability, by the presence of the Observability Cloud app, and by an environment where an API token is configured; Splunk Enterprise 9.4.x is explicitly unaffected. No public exploit code and no confirmed active exploitation were identified at time of analysis, and a vendor patch is available.
Denial of service in Splunk Enterprise 10.x allows an authenticated user with only low-privileged roles to degrade or take down a REST API endpoint exposed by the Discover Splunk Observability Cloud app, because the app validates input with an inefficient regular expression that can be driven into excessive CPU consumption. Affected branches are 10.4.x below 10.4.3, 10.2.x below 10.2.7, and 10.0.x below 10.0.10; Splunk Enterprise 9.4.x is explicitly not affected, and the exposure only exists where the Observability Cloud preview app and its endpoint are present and reachable. Impact is confined to availability (no data disclosure or modification), no public exploit code has been identified at time of analysis, and the vendor has released fixes in 10.4.3, 10.2.7, and 10.0.10.
A negative index panic in the Go Excelize library (versions 2.8.0 through 2.11.0) allows unauthenticated remote attackers to cause a denial of service when an application reads cell styling from a crafted .xlsx file. The flaw arises because GetStyle's extraction predicates for fill, border, and font IDs only validate upper bounds, permitting negative fillId, borderId, or fontId values from attacker-controlled styles.xml to reach slice indexing and trigger a panic. No fixed version is available, though an upstream patch (PR #2367) exists; no public exploit has been identified, and exploitation requires the application to parse an untrusted file and call File.GetStyle (UI:R).
Malformed Excel workbooks can terminate Go processes that use Excelize's conditional-format extractor, because versions 2.7.0 through 2.11.0 index required child slices and dereference an optional colorScale element without validating rule structure. An unauthenticated remote attacker who can get a crafted spreadsheet ingested by a host application that subsequently calls GetConditionalFormats can trigger an out-of-range index or nil-pointer dereference that panics and terminates an unprotected process; user interaction is required to deliver the file and the impact is availability only. No public exploit code has been identified at time of analysis, and no released fixed version exists, although the upstream fix is visible in PR #2375 and commit be7a16390fa69c71d3ca618c741d1a2b5ed362cd.
SQL injection in the SPL2 module filtering feature of Splunk Enterprise (10.4.x below 10.4.3) lets an authenticated user who holds a role with the list_spl2_modules capability read data exposed by the affected REST API, including private SPL2 module definitions owned by other users. The flaw is rooted in unparameterized user input being passed into database queries that back SPL2 module filtering, so a crafted filter value escapes the caller's intended module visibility scope; the impact is confidentiality-only with no write or availability effect, and the CVSS 3.1 vector (6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) confirms the network-reachable but authenticated and low-privilege nature of the attack. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, but a vendor patch is available in Splunk Enterprise 10.4.3, and Splunk Enterprise 10.2.x, 10.0.x, and 9.4.x are explicitly not affected.
An out-of-bounds slice access in the Excelize Go library (versions 2.7.1 through 2.11.0) lets a crafted .xlsx workbook crash the host application, causing denial of service. When mergeCellsParser encounters a mergeCell element with an empty 'ref' attribute it returns an empty rectangle and passes it to cellInRange, which indexes four positions without a length check; any non-streaming cell API such as GetCellValue then panics on the first affected cell operation. The bug is remotely triggerable but requires the victim application to process an attacker-supplied spreadsheet and invoke an affected cell-reading API (CVSS 3.1: AV:N/AC:L/PR:N/UI:R, A:H only), and no public exploit or confirmed active exploitation is known at time of analysis.
Missing authorization checks on multiple Splunk Secure Gateway REST API endpoints allow any authenticated Splunk user who does not hold the 'admin' or 'power' roles to reach privileged Secure Gateway functionality and make the gateway sign attacker-controlled payloads. The issue affects Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10 and 9.4.15, as well as standalone Splunk Secure Gateway versions below 3.10.11, 3.9.25 and 3.8.72, and it requires a valid low-privilege Splunk account plus network reachability to the Secure Gateway REST API (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N per independent assessment; NVD publishes 6.5 with C:H/I:N). There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV), but a vendor patch is available and the integrity impact of forged signatures makes timely upgrade worthwhile.