Authenticated cross-site scripting (XSS) in the local management interface of IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 allows a low-privileged authenticated user to embed arbitrary JavaScript into the Web UI when the deployment is in certain non-default configurations, potentially altering the interface's intended behaviour and disclosing credentials within a trusted session. Exploitation requires an existing account on the management interface (CVSS PR:L) and, in practice, a second trusted user such as an administrator who renders the injected content in their own session; no public exploit code and no confirmed active exploitation were identified at time of analysis. The issue is rated low-to-moderate priority - network-reachable but gated by high attack complexity (AC:H) attributable to the configuration prerequisite and by user interaction in the assessed vector.
SumatraPDF 3.6.1 and earlier can silently apply no policy restrictions when administrators deploy the file-based sumatrapdfrestrict.ini, because InitializePolicies() initializes gPolicyRestrictions to Perm::All and only ORs permission bits, so the INI can never revoke a permission. A malformed INI or zero-valued permission entries therefore leave intended disk, network, printing, registry, clipboard, preference and fullscreen restrictions open to a local, low-privileged user of that machine, while the alternative -restrict command-line path enforces correctly. No public exploit code identified at time of analysis; exploitation requires local access plus an intentionally configured INI-based lockdown, so default installations that deploy no restriction policy have nothing to bypass.
Tapo S505 v1.6 firmware stores device-specific cryptographic material in plaintext within nonvolatile storage, allowing an attacker with physical access to recover those secrets, for example by dumping the flash memory. The issue is classified as CWE-312 and has a CVSS 4.0 base score of 5.4; the independent assessment rates it as a medium-to-low real-world priority because exploitation is bounded by the physical-access requirement (AV:P) and downstream unauthorized access is only a conditional risk. The vendor has a patch available, and no public exploit code was identified at time of analysis.
Incorrect authorization in CISA Malcolm allows an authenticated low-privilege user to reach admin-only paths by percent-encoding them, bypassing the nginx Lua role-based access control gate that inspects the raw, undecoded request URI. The flaw affects Malcolm installations using its default nginx plus Lua RBAC reverse-proxy front end (CWE-863; CVSS 5.4, AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N), where a request such as /%68tadmin.php is routed by nginx's decoded-URI location matching into the restricted location while the Lua check sees no matching restriction and grants access. Exploitation requires a working authenticated account - there is no pre-auth path - and no public exploit code was identified at time of analysis; the issue was reported through CISA's ICS-CERT process (ICSA-26-280-01).
Low-privilege authenticated users can bypass authorization on Event Tickets (a WordPress plugin by Liquid Web / StellarWP) versions up to and including 5.30.0.1, reaching functionality that lacks a proper capability check and thereby reading or modifying event and ticket data they should not control. The flaw is rated CVSS 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, CWE-862) - exploitation requires only any valid logged-in account, such as a self-registered subscriber or ticket purchaser, so sites that permit open registration carry the most exposure. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, though the Patchstack advisory makes the weakness straightforward to probe for on unpatched installations.
Stack exhaustion in msgpack5, the MessagePack v5 implementation for Node.js and the browser, allows remote attackers to crash a process, worker, or request handler by feeding deeply nested arrays or maps to the decoder; versions prior to 6.1.0 impose no nesting-depth limit, so unbounded recursion in the decode path overflows the JavaScript call stack. No authentication, user interaction, or non-default configuration is required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L), but the impact is limited to availability - no confidentiality or integrity loss. There is no public exploit identified at time of analysis and no evidence of active exploitation, and the vendor has released a fix in 6.1.0 that caps decode depth at 100 by default.
Information disclosure in FFmpeg before 8.1.3 occurs when the HLS demuxer fails to enforce protocol and allowed_extensions restrictions while opening child playlists, allowing an attacker-supplied master playlist to make FFmpeg access disallowed protocols or non-multimedia local files. The issue requires a victim application or service to ingest the crafted playlist (unauthenticated attack with user interaction or an automated pipeline) and is limited to confidentiality impact; no public exploit identified at time of analysis. Vendor-released patch: FFmpeg 8.1.3.
An out-of-bounds read in IBM DataPower Gateway (CWE-125) lets an attacker who already holds valid credentials on the gateway reach past intended buffer boundaries and have fragments of process memory returned to them, disclosing limited sensitive information. Affected release trains are 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2, as listed in ENISA EUVD-2026-94890 and IBM's advisory node/7289775. The base score is 5.3 with confidentiality-only, low-severity impact and no effect on integrity or availability; IBM's description requires a remote authenticated user, which the independent assessment reflects by treating the vector as PR:L instead of NVD's PR:N. No public exploit code has been identified at time of analysis and there is no CISA KEV entry, so realistic risk is confined to credentialed actors and compromised accounts rather than unauthenticated mass exploitation.
A remote, unauthenticated attacker can trigger a limited heap-based out-of-bounds read in IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3, including their container editions, by sending a specially crafted request to an exposed instance. Successful exploitation is confined to a partial memory read that can cause a denial-of-service condition; there is no confidentiality or integrity impact and no code execution path described. This is a low-severity issue (CVSS 3.1 base 3.7, AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) that should be treated as low priority despite its network-facing nature, and at time of analysis no public exploit code and no confirmed active exploitation were identified; a vendor patch is available via IBM support node 7291628.
Authenticated users can delete other users' subscriptions in Jivejdon through 5.0 by sending a delete action with a victim's subscriptionId to /account/protected/sub/subSaveAction, because SubscriptionServiceImp.deleteSubscription does not verify ownership of the supplied ID. This CWE-639 authorization bypass/IDOR requires a valid low-privileged account and knowledge or enumeration of numeric subscription IDs; it has integrity-only impact on subscription records, with no confidentiality disclosure or service outage, and no public exploit identified at time of analysis. The CVE record lists CVSS 5.3 (CVSS 4.0 vector with PR:L, UI:N, and I:L), and the independent assessment is consistent with a medium-severity, authenticated remote IDOR whose real-world risk is modest.
Server-side request forgery in FFmpeg's RTSP handling (ff_rtsp_connect() in libavformat/rtsp.c) lets a malicious RTSP server answer with an RTSP 3xx redirect whose Location header points to an internal host and port under a different scheme, which the library then follows without validating the target - defeating the -protocol_whitelist control. Affected builds are FFmpeg before 7.1.4 and the 8.0.x line before 8.0.2; exploitation is unauthenticated per the CVSS 4.0 vector (PR:N) but requires a victim application or user to process the attacker-controlled rtsp:// source, and impact is bounded to probing/reaching internal services rather than data exfiltration or code execution. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis; vendor patches are available in 7.1.4 and 8.0.2.
Reflected cross-site scripting in Jivejdon from commit 5489372d through ee67a65e allows unauthenticated remote attackers to execute JavaScript in a victim's browser by crafting a link to application/query/taggedThreadList.jsp with a script-closing payload in the tagID or count parameter when the start parameter is greater than zero. Exploitation requires the victim to open the crafted link (UI:P), and the impact is limited to the victim's browser context. No CISA KEV active exploitation is noted, no public exploit identified at time of analysis, and the CVSS 4.0 base score is 5.3.
Missing authorization in Jivejdon's UpdateThreadToForumAction (present from commit d58a36b0 through commit ee67a65e) lets any authenticated user relocate another user's forum thread into an arbitrary forum by submitting crafted threadId and forumId values to /message/threadToForum/save. The flaw stems from an absent ownership or role check in the action handler (CWE-862), and it is constrained in practice because only threads with no replies can be moved and the attacker must already hold a valid account, so impact is limited to integrity (thread relocation) with no confidentiality or availability loss and a CVSS 5.3 / CVSS:3.1 5.3 rating. There is no public exploit identified at time of analysis and no confirmed active exploitation, so this is a modest-severity issue rather than an urgent one.
Reflected cross-site scripting in Jivejdon through 5.0 lets an attacker execute arbitrary JavaScript in an authenticated user's session by crafting a URL to application/message/postThread.jsp with malicious values in the 'to' or 'tag' parameters; the payload works by escaping an unencoded inline JavaScript string literal where those values are echoed back. The attacker does not need an account (PR:N per both the supplied CVSS 4.0 vector and the corroborating CVSS 3.1 assessment), but the attack requires the victim to be a logged-in Jivejdon user who clicks the crafted link (UI:P/UI:R), and because the flaw is reflected rather than persistent it cannot self-propagate and depends entirely on social engineering. Both vectors rate it 5.3 Medium with scope change in the 3.1 view, and there is no public exploit code or CISA KEV entry identified at time of analysis, so the immediate risk is targeted phishing-style session abuse rather than mass exploitation.
Missing authorization in the Creator LMS WordPress plugin (versions through 1.2.21) lets unauthenticated remote attackers invoke plugin functionality that should require elevated privileges, producing a limited integrity impact - the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N (base 5.3) confirms no authentication, no user interaction, and no confidentiality or availability loss. Any WordPress site running the affected plugin version that is reachable over the network is exposed, with default configurations affected. No public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV); no EPSS score was included in the supplied intelligence, so the practical risk is best characterized as moderate and dependent on whether the plugin is installed and exposed.
Path traversal in HashiCorp go-getter's S3 and GCS directory-download handling lets files be written outside the requested destination, affecting go-getter before 1.8.10 and go-getter/v2 before 2.2.5. Unauthenticated remote attackers (CVSS PR:N) can only succeed if a victim initiates a download against an attacker-influenced S3 or GCS bucket that contains crafted object keys with traversal sequences, which is why the vector requires user interaction (UI:R) and carries high attack complexity (AC:H); the resulting impact is integrity-only (CVSS 5.3, I:H with no confidentiality or availability effect). No public exploit code and no confirmed active exploitation were identified at time of analysis, and vendor patches are available.
Stored cross-site scripting in league/commonmark from 1.3.0 through 2.10.1 lets any user who can post Markdown bypass the DisallowedRawHtml extension and execute script in the browsers of everyone who views the rendered page. The bypass is triggered by ending a raw HTML block with a bare disallowed tag name (for example a line containing only `<script` or `<iframe`), after which a following block can supply attributes such as `src` or `onload` that the filter never saw; the CVSS 4.0 vector indicates network reachability with no privileges required (PR:N) and passive user interaction (UI:P), and the upstream GitHub advisory publishes full reproduction steps, though there is no CISA KEV listing or other indication of active exploitation at time of analysis. Affected deployments are those running the library with the default `html_input=allow` and the GFM/DisallowedRawHtml extension enabled, which is the default for `GithubFlavoredMarkdownConverter`.
Brocade Fabric OS switches running software versions before 10.0.1 can be induced to leak sensitive device metadata (model, serial number, hardware revision, firmware version) to an unauthenticated attacker positioned on an adjacent network segment. The web dispatcher in the management interface decides whether a request originates from a trusted internal management VLAN by reading the client-supplied HTTP Host header rather than the actual TCP socket source IP, so a crafted request can impersonate a trusted internal host and slip past IP-filtering ACLs. Exploitation requires adjacent-network reachability to the management interface (CVSS 4.0 AV:A, PR:N, impact limited to low confidentiality with no integrity or availability effect), and no public exploit code has been identified at time of analysis; the practical risk is concentrated on switches whose management ports are reachable from non-management segments rather than strictly out-of-band networks.
Cross-site request forgery in Jivejdon through 5.0 allows unauthenticated attackers to trick authenticated users into deleting private messages and subscriptions or renaming threads by luring them to crafted GET requests against /account/protected/delAll, /account/protected/sub/delSub, and /message/updateAction. These endpoints lack anti-CSRF tokens and accept GET requests, so a simple link, image, or iframe can trigger state changes on behalf of the victim; exploitation requires the victim to already hold a valid session and to load attacker-controlled content. The impact is limited to integrity (no data disclosure or denial of service), no public exploit code or active exploitation has been identified, and this is a genuine-but-low-priority issue per independent assessment.
High-privileged, already-authenticated administrators on the management interface of IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 can forge or tamper with audit log records by injecting argument delimiters into the logging functionality (CWE-88). Because the CVSS vector is PR:H, only an account that already holds elevated privileges on the management console can reach the affected feature, so realistic exposure is confined to insider misuse or an attacker who has already stolen a privileged credential; no user interaction is required and the interface is network-reachable, but impact is limited to audit log integrity with no confidentiality or availability effect. There is no vendor indication of exploitation, and no public exploit identified at time of analysis; severity is low (CVSS 2.7), and a patch is available per the vendor advisory.
Unauthenticated querying of internal management endpoints in Brocade ASCG releases before 3.5.0 discloses the configuration and operating state of the Brocade Fabric OS (FOS) switches that the appliance manages, exposing a customer's SAN fabric topology and switch connectivity attributes. An attacker only needs to be positioned on the same or adjacent management/storage network segment (CVSS AV:A, PR:N, UI:N) to reach those endpoints; no credentials or user interaction are required. Impact is read-only information disclosure with no integrity or availability effect, and no public exploit code or confirmed active exploitation was identified at time of analysis, keeping real-world priority low-to-moderate rather than urgent.
Unauthenticated attackers can force any pre-existing backup job in the BackWPup WordPress plugin (versions 3.3 through 5.7.6) to execute immediately by sending a request straight to its cron-triggered backup execution handler, which does not confirm the request originated from WordPress's internal scheduled-event dispatch. The attacker cannot create, edit, or delete jobs and gains no access to backup contents, so the practical impact is confined to unscheduled job execution and the resulting resource consumption rather than data exposure. No public exploit code or confirmed active exploitation was identified at the time of analysis, and EPSS data was not supplied; the vendor fixed the issue in BackWPup 5.7.7.
Unauthenticated information disclosure in the Track Orders for WooCommerce WordPress plugin before 1.2.7 lets anyone who already knows a customer's email address retrieve that customer's name, email, phone number, postal address and order history from the plugin's order-tracking lookup. The lookup returns billing details without ever verifying that the requester owns the referenced order, and because the CVSS vector confirms PR:N and UI:N, no account or interaction is needed - the only gating factor is prior possession of a valid customer email. No public exploit identified at time of analysis and no confirmed active exploitation (the flaw is not listed in CISA KEV), but CISA's SSVC assessment marks it automatable, and the vendor has released a fix in version 1.2.7.
Unauthenticated visitors can retrieve any customer's name, contact details, and order confirmation code from WordPress sites running the Appointment Booking Plugin before version 5.7.3 due to an insecure direct object reference (IDOR, CWE-639) in the order confirmation summary flow. The plugin fails to verify that the caller owns the order referenced by a sequential order-item identifier, allowing enumeration of all booking confirmations. No public exploit has been identified at time of analysis, but the predictable identifiers make the flaw trivially exploitable whenever booking orders exist, and the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms it is network-reachable without authentication or user interaction.
Authenticated Dolibarr ERP CRM users who hold only read permission on a record can persistently modify that record's extrafield values in all versions before 24.0.2, because the AJAX endpoint htdocs/core/ajax/updateextrafield.php calls restrictedArea() without the 'write' mode flag and therefore enforces only read access. Exploitation requires a valid authenticated session plus read visibility of the target object (third party, product, member, project or contact) and a crafted POST supplying objectType, objectId, field and value; no victim interaction is needed, but the flaw is confined to integrity of extrafield data (CVSS 4.0 5.3, PR:L, I:L) with no confidentiality or availability impact. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, so this is a moderate-risk authorization weakness rather than an emergency; vendor patch data confirms a fix is available in 24.0.2.
MongoDB libmongocrypt's explicit decryption component can return unrecognized encrypted payloads unchanged instead of raising a decryption error, causing affected applications to process attacker-supplied bytes as plaintext. This is a moderate integrity flaw (CVSS 4.0 score 5.3) that requires the application to use explicit client-side field level encryption and the attacker to already hold write access to stored encrypted fields or an in-path position to tamper with ciphertext, such as a database writer, a malicious or compromised MongoDB server, or a network intermediary. No public exploit code or CISA KEV listing was identified at time of analysis, and applications that do not use explicit decryption are unaffected.
An authorization bypass in QloApps through 1.7.0 allows an authenticated back-office employee with a restricted (non-super-admin) profile to read room availability and booking status for hotels outside their assigned access by simply changing the id_hotel parameter on the Book Now page. Only multi-hotel deployments that use restricted staff profiles are meaningfully affected, since the flaw discloses booking information rather than allowing modification of records, and single-hotel installs expose nothing the employee could not already see. No public exploit code or in-the-wild exploitation has been identified (no public exploit identified at time of analysis), and the issue is a medium-severity tenant-isolation defect rather than a high-urgency remote compromise; the upstream project has published a fix as pull request 1916 and the vulnerability is documented in a public technical write-up.
Unauthenticated remote attackers can deny OpenID Connect, SAML and passkey sign-in for all users of hMailServer 6.3.4 and 6.3.5 by flooding the REST API's sign-in initiation routes, which store pending state in bounded tables that evict the oldest entry when full. Because those routes are reachable without authentication (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, score 5.3), an attacker sending requests a few times per second - roughly one hundred per second in the passkey case - can push every other user's pending sign-in out of the table before that user's browser returns, breaking single sign-on and passwordless login for as long as the flood continues. Impact is limited to login availability: confidentiality, integrity and mail delivery are unaffected, no public exploit code was identified at time of analysis, and exploitation requires that the deployment actually has OIDC, SAML or passkey authentication enabled.
pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains an improper authorization (IDOR) flaw in the note module's delete() action that lets any authenticated member delete note comments and category associations belonging to other members by submitting the victim's note ID in the POST 'id' parameter. The impact is integrity-only and scoped to note-module comment/category data (CVSS 3.1 base 5.3, PR:L), not full account or site compromise. No public exploit has been identified at time of analysis, CISA SSVC rates exploitation as 'none', and the vendor patched the issue in 18.5.0.
Authenticated MCP clients connected to a beam_mcp server in the 0.1.0 through 0.10.0 range can call tools (and prompts) with arguments that violate the JSON Schema the server itself advertised, because BeamMCP.Schema.validate/2 only enforced constraints on the top-level arguments object. The practical impact is limited to integrity (CVSS 3.1 base vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, 5.3): a host whose dispatch code trusts the declared schema may act on out-of-range numbers, undeclared nested keys, or other forbidden values, and whatever that host does with the value determines the real blast radius. Exploitation requires an authorized MCP client connection (PR:L) plus a host that does not independently re-validate - no public exploit identified at time of analysis, CISA SSVC records Exploitation: none and Automatable: no, and no KEV listing exists. The issue is rated medium severity and low priority despite being network-reachable.
Unauthenticated attackers can exploit a missing authorization flaw (CWE-862) in the Visual Composer Website Builder WordPress plugin (versions through 45.16.3) to access information they should not be able to reach. The vulnerability is rated CVSS 5.3 with network attack vector, no privileges required, and no user interaction, but only low confidentiality impact. No public exploit code or active exploitation has been identified at time of analysis.
Authorization bypass in the StellarWP Event Tickets WordPress plugin (versions through 5.30.0.1) allows attackers to manipulate a user-controlled object key - such as a ticket, order, or attendee identifier - so that records they do not own can be located and altered, because the affected endpoint performs no server-side ownership check. The flaw is rated CVSS 5.3 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, confining impact to the integrity of specific records with no confidentiality or availability effect. No public exploit code or confirmed active exploitation has been identified at time of analysis, though the effective privilege requirement should be validated because comparable WordPress-plugin IDORs frequently require at least a low-privileged authenticated session despite a PR:N vector.
Race condition in the WordPress plugin Tutor LMS (Themeum) affecting versions through 4.1.1 lets an authenticated attacker with low privileges exploit improper synchronization of a shared resource by firing overlapping concurrent requests in order to win a timing window, with the assessed impact limited to integrity (CVSS 5.3, CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N). Because exploitation requires a valid low-privileged account and depends on a non-deterministic concurrency race (AC:H, SSVC Exploitation: none, Automatable: no), successful abuse is probabilistic rather than reliable. There is no public exploit identified at time of analysis and no CISA KEV listing, so this is a genuine but moderate-priority issue for sites exposing Tutor LMS to registered users rather than an emergency.
Missing authorization controls in the YITH WooCommerce Product Bundles plugin for WordPress (versions through 2.29.0) allow unauthenticated remote attackers to perform bundle-related actions they should not be permitted to perform on sites where the plugin is installed and active. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, base 5.3) confirms that no credentials or user interaction are required, but the impact is bounded to a low-integrity effect - there is no confidentiality or availability impact - and the store must actually run the affected plugin for exposure. At the time of analysis there is no vendor-released patch identified and no public exploit code identified; exploitation is limited to network reachability of the vulnerable endpoint on a WooCommerce store with the bundle feature enabled.
GiveWP, a WordPress donation and fundraising plugin, ships with a missing-authorization flaw (CWE-862) in versions through 4.18.0 that allows remote attackers to perform unauthorized actions against plugin-scoped data without authenticating or interacting with a victim. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, score 5.3) confines impact to a limited integrity loss with no confidentiality or availability effect, so the realistic outcome is unauthorized modification of donation-related or plugin configuration data rather than full site compromise. Any internet-reachable WordPress installation running the affected range is exposed by default; no public exploit code or confirmed active exploitation was identified at time of analysis, and the issue is tracked by Patchstack and as EUVD-2026-94928.
Quadratic algorithmic complexity in the SPF macro-expansion path of hMailServer 6.3.4 and 6.3.5 allows a remote, unauthenticated attacker to consume worker-thread time by sending mail from a domain whose SPF record they control and which expands through macros to a domain name far longer than 253 characters, making each SPF check take several seconds. The attack requires SPF validation to be enabled on an inbound path and is bounded by SPF's own per-term and per-macro limits, so the resulting availability loss is partial rather than a complete outage. No public exploit code has been identified at time of analysis, and a vendor patch (6.3.6) is available; the 5.3 MEDIUM CVSS score reflects a low-to-moderate priority issue in which impact is confined to availability (C:N/I:N/A:L).
Local privilege escalation in Checkmk 2.5.0 (before 2.5.0p10) requires the non-default 'mk-oracle' agent plugin and local write access to the Oracle Instant Client path, enabling an authenticated local attacker to escalate privileges (CWE-426). The vendor has released a patch in 2.5.0p10, and no public exploit identified at time of analysis; the CVSS 4.0 score is 5.2, but exploitation is constrained by multiple preconditions that substantially limit real-world risk, making this a low-to-moderate priority issue.
Stored cross-site scripting in Jivejdon through 5.0 allows an authenticated user to embed script inside a private short message that then executes in the recipient's browser when the message is opened. The flaw is reachable over the network but gated by two prerequisites: the attacker must hold a valid account able to send private messages, and the victim must actively open the malicious message, so real-world abuse is limited to targeted attacks against a chosen user rather than unattended, broad compromise. It carries a vendor CVSS 4.0 score of 5.1 (our independent 3.1 assessment aligns at AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Stored cross-site scripting in Jivejdon through 5.0 lets an authenticated, upload-capable user store an attachment whose client-supplied Content-Type is text/html; because UploadShowAction serves that attachment inline on the application's own origin, any logged-in user who opens the shared link executes the attacker's JavaScript in the Jivejdon origin (CVSS 4.0 base 5.1, CWE-79). Exploitation requires a low-privileged account permitted to upload attachments (CVSS PR:L) plus victim interaction with the crafted link (UI:P), matching the assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, so this is a real but bounded medium-severity issue rather than an urgent one. It is not in CISA KEV and no public exploit code was identified at time of analysis; an upstream GitHub issue tracks the report.
Stored cross-site scripting in Jivejdon through 5.0 allows any authenticated forum user to inject JavaScript into a thread by posting an unsanitized message body, which then executes in the browser of every other user who opens that thread. The flaw arises because messageListBody.jsp renders stored message bodies with filter="false" and RenderingFilterManagerImp.java applies non-escaping default filters, so attacker-supplied HTML/script is emitted verbatim; exploitation requires a valid posting account (PR:L) plus a victim passively viewing the thread (UI:R), and impact stays within the browser/session context of forum users rather than the server. The provided CVSS 4.0 score is 5.1 (medium) and the independent assessment (CVSS 3.1: AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) is consistent with that rating; no public exploit code was identified at time of analysis and there is no CISA KEV entry.
Stored cross-site scripting in the JiveJdon forum platform (banq/jivejdon) from commit 595d8d22 through commit ee67a65e lets an authenticated user who can post messages inject javascript: URLs or quote-breaking link markup that the default-enabled TextStyle filter writes unvalidated into anchor href attributes, so JavaScript executes when another user clicks or hovers a rendered link. Exploitation requires a valid posting account (PR:L) and victim interaction (UI:P), and the default TextStyle filter must be active on a vulnerable commit; this is a moderate, not a top-priority, issue. No public exploit code has been identified and there is no confirmed active exploitation (not in CISA KEV), and no vendor-released patch version is identified in the available data.
Brocade Fabric OS releases before 10.0.1 expose an authorization logic flaw in the REST API gateway, where the gate protecting restricted internal management endpoints trusts client-controlled HTTP headers, so any holder of a valid REST session-regardless of privilege level-can spoof those headers and read sensitive chassis metadata, hardware memory patrolling state, and firmware integrity audit logs. Exploitation requires an already-authenticated low-privilege REST session (PR:L) and adjacent-network reachability to the gateway (AV:A), and the impact is limited to read-only information disclosure with no integrity or availability effect, consistent with the assessed CVSS 5.1. No public exploit code and no confirmed active exploitation were identified at time of analysis, making this a modest-severity issue that is largely contained unless the REST interface is reachable from routed or untrusted networks.
Missing authorization controls in the Brocade Fabric OS REST API on releases before 10.0.1 allow any authenticated API user - regardless of assigned role or administrative scope - to retrieve complete Monitoring and Alerting Policy Suite (MAPS) violation data across all logical switches. The exposure is limited to information disclosure of chassis-wide health metrics, port performance violations, and configuration data; there is no write, code-execution, or availability impact, and the attacker must already hold valid Fabric OS credentials and have adjacent/management-network reachability to the API. There is no public exploit identified at time of analysis, and the issue is best characterized as a modest-priority information disclosure flaw rather than a system-compromise vector.
IBM Guardium Data Protection 12.0, 12.1 and 12.2 ship the WfpMonitor kernel driver, whose METHOD_NEITHER IOCTL handlers dereference caller-supplied pointers without consistent probing or exception handling, so a local attacker who already holds high privileges on the host can trigger a system crash or obtain limited reads of kernel memory. The CVSS 3.1 vector (AV:L/PR:H/UI:N, C:L/I:N/A:H, score 5.1) confirms the flaw is local-only and requires pre-existing elevated privileges, meaning it grants no privilege escalation and has no integrity or code-execution impact. There is no CISA KEV entry and no public exploit code identified at time of analysis, and a vendor patch is available, making this a moderate-to-low real-world priority that is best handled through routine driver patching.
Hard-coded credentials embedded in the Ticket Ryutsu Center Android application (wavedash_co.,_ltd.) let anyone who downloads the publicly available Google Play package recover an API key used by the app through static analysis or decompilation. The vector (AV:L/PR:N/UI:N) shows the only prerequisite is local access to the distributed binary, meaning the extraction requires neither authentication nor user interaction, though the real-world blast radius depends entirely on the backend scope and permissions conferred by that key, which the JVN advisory does not document. Impact is therefore scored as limited confidentiality disclosure (CVSS 4.0, C:L/I:N/A:N per the independent assessment, which matches the NVD vector for this unauthenticated local-access flaw); no public exploit code and no confirmed active exploitation were identified at time of analysis.
MongoDB C Driver can store or use incorrect numeric values when parsing over-precision Decimal128 strings that contain leading zeros and should have been rejected. The issue affects applications built on the driver that parse attacker-controlled decimal strings, including via Extended JSON, and is limited to data integrity (C:N/I:L/A:N) with no public exploit identified at time of analysis; exploitation requires the embedding application to accept external decimal input. This is a low-to-moderate priority issue rather than a high-urgency flaw.
Data corruption in luksmeta allows a local attacker who already holds administrative privileges to damage or destroy metadata and encrypted payload data stored on a Linux Unified Key Setup (LUKS) device when a new metadata entry is saved. Because faulty free-space boundary calculations and flawed overlap detection can let new records be written past the available area or on top of existing ones, integrity is fully compromised though confidentiality is not (CVSS 5.1, AV:L/AC:L/PR:H/UI:N/C:N/I:H/A:L), and affected volumes may become inaccessible. Exploitation requires local host access with privileges sufficient to run luksmeta and write to the device; there is no remote or unauthenticated vector, no public exploit identified at time of analysis, and no confirmed active exploitation (not in CISA KEV), so impact is realistically limited to accidental or deliberate corruption by a privileged operator. The issue affects luksmeta as shipped with Red Hat Enterprise Linux 7, 8, 9 and 10, plus Red Hat OpenShift Container Platform 4 through the underlying RHCOS userland.
Server-side request forgery in IBM DataPower Gateway (10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2) lets an authenticated user who satisfies high-complexity preconditions make the appliance send requests to destinations of the attacker's choosing, enabling internal network enumeration and reconnaissance that can support follow-on attacks. Rated CVSS 4.9 (AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N), this is a moderate-severity, low-priority issue rather than an emergency: exploitation requires a valid authenticated session plus the ability to reach a request-handling function that accepts an attacker-influenced destination, and there is no public exploit identified at time of analysis, with real-world impact bounded by whatever sensitive internal hosts the gateway itself can reach. IBM has published an advisory covering these builds, and other versions are not in scope.
Keycloak, including the Red Hat Build of Keycloak and Red Hat Single Sign-On 7, exposes the active primary secret of confidential clients to any authenticated realm administrator who holds only the read-only view-clients role. The flaw sits in the installation provider and client registration endpoints, which return client credentials that a read-only administrator should never be able to read; with the leaked secret an attacker can authenticate as the confidential client and inherit its service account permissions across integrated services. Exploitation requires an existing realm administrator account with the view-clients role, so risk scales with how broadly that low-trust role is delegated, and no public exploit has been identified at time of analysis.
Improper certificate validation in GnuTLS 3.8.13 causes applications that rely on it for TLS trust decisions to accept certificates carrying invalid extensions, letting an attacker who can intercept a connection impersonate a trusted server and read or modify the protected traffic. The assessed vector requires a man-in-the-middle position rather than remote-at-will access, but once that position exists no credentials or user interaction are needed, and the NVD score of 9.1 reflects high confidentiality and integrity impact. Publicly available exploit code exists (a GitHub PoC repository and an associated gist), CISA's SSVC evaluation marks the issue as PoC-exploited, automatable, with total technical impact, and no CISA KEV entry has been recorded at time of analysis.