Uninitialized memory disclosure in FFmpeg's HDR10+ dynamic metadata serializer (av_dynamic_hdr_plus_to_t35()) lets crafted Matroska T.35 BlockAdditional or HEVC/AV1 SEI metadata cause up to three bytes of stale process memory to be written into remuxed or transcoded output files. All FFmpeg versions through 9.0.2 are affected; CVSS 4.0 scores this 4.8 (AV:L/UI:P/C:L) and the independent assessment concurs at CVSS 3.1 4.8 with only confidentiality impact, because the leak is bounded to a few bytes, requires the victim to actively process the file, and gives the attacker no control over the leaked contents. There is no public exploit identified at time of analysis and no CISA KEV listing, but an upstream fix commit and pull request are already available, making this an internally consistent low-to-moderate priority remediation item rather than an urgent one.
Predictable per-booking access hashes in the Booking Calendar WordPress plugin before 11.8 let unauthenticated attackers read a booking's personal data or modify the booking in place, provided they can determine or closely estimate when that booking was created. The flaw is rated CVSS 4.8 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N), reflecting that no login or victim interaction is needed but that the attack is targeted and per-booking rather than mass-exploitable, since the low-entropy, time-seeded value behind each hash must be narrowed down first. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (no CISA KEV listing); vendor remediation is available in version 11.8.
An out-of-bounds read in the bundled IJG JPEG decoders of OFFIS DCMTK 3.7.0 (libijg8, libijg12 and libijg16) lets a crafted DICOM file whose JPEG stream carries a Huffman table with a difference category above 15 drive the decoder past the end of the small static extend_test[] and extend_offset[] lookup tables, producing incorrectly decoded pixel data or a crash and disclosing a bounded amount of adjacent process memory. Exploitation is unauthenticated (CVSS PR:N) but strictly local in vector: the attacker must deliver the file and the victim must decompress it (UI:P), and the same exposure applies to dcmdjpeg and any application that decompresses JPEG DICOM images with DCMTK. Default builds are affected because the DCMTK_ENABLE_STRICT_HUFFMAN_TABLE_CHECK guard is disabled by default; no public exploit identified at time of analysis, SSVC records Exploitation: none and Automatable: no, and the vendor fix is available as a source commit.
A heap-based out-of-bounds read in OFFIS DCMTK 3.7.0's DcmRLECodecDecoder::decodeFrame() allows unauthenticated local attackers to read up to 63 bytes of adjacent heap memory or cause a crash by tricking a victim application into decoding a crafted RLE Lossless DICOM file whose pixel data fragment is shorter than the 64-byte RLE header. Exploitation requires user interaction to open or process the malicious file and only affects applications using the frame-by-frame decoding path (e.g., via DcmPixelData::getUncompressedFrame()); the dcmdrle command-line tool is not affected. The issue is fixed in commit 45469f3c30037e9c7159290e4bb74cd7b3b9ef1d, and no public exploit code has been identified at time of analysis.
Improper handling of custom URL schemes in the Android application Ticket Ryutsu Center allows a malicious co-resident app on the same device to send a crafted Intent that causes the victim app to open an arbitrary website. Exploitation requires a separate attacker-controlled application to already be installed and depends on user interaction; impact is limited to low integrity violation with no code execution, data theft, or availability loss. No public exploit identified at time of analysis, and the issue is assessed as genuinely low priority.
Cross-organization repository metadata disclosure in the Katello (Red Hat Satellite 6) Docker Tags repositories API allows an authenticated user who holds product-view permissions in one organization to retrieve repository configuration data for Docker meta tags owned by a different organization by simply supplying that foreign tag identifier. The weakness is an authorization-scoping gap (CWE-639, IDOR-style) correctly rated CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), with impact limited to low-severity confidentiality loss - there is no write or denial-of-service effect. Exploitation requires valid credentials, multi-organization deployment, and knowledge or enumeration of valid foreign tag identifiers; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and EPSS data was not supplied.
Missing authorization in Event Tickets 5.30.0.1 and earlier allows an authenticated low-privileged WordPress user, such as a subscriber or customer, to perform a restricted event-ticket action they should not be authorized to perform. The affected product is the Liquid Web/StellarWP Event Tickets WordPress plugin, and the issue carries a moderate CVSS score of 4.3 with only low integrity impact and no confidentiality or availability impact. Exploitation requires a valid login but no victim interaction, and no public exploit identified at time of analysis.
Authenticated information disclosure in the Easy Digital Downloads WordPress plugin before 3.7.1 allows any subscriber-level account to read other customers' recent order contents and harvest signed download links that grant free access to paid digital files. The flaw rates CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, CWE-200) because exploitation requires a valid low-privilege login, making it most dangerous on sites that allow open or self-service registration. No public exploit identified at time of analysis; vendor-released patch: 3.7.1.
Information disclosure in the Wallet System for WooCommerce plugin before 2.8.0 allows any authenticated user on a WordPress site - the description states a subscriber-level account is sufficient - to generate and download a report containing every customer's wallet transaction history, including names, email addresses, user roles, transaction amounts, payment methods and dates. The report endpoint performs no capability check and instead trusts a token that the plugin renders on a front-end page, so any logged-in user can retrieve the token and then invoke the endpoint; no user interaction is required. The published base score is 4.3 (Medium) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, while our assessment rates the confidentiality impact as High (C:H) because the exposure covers complete customer PII and the store's full financial transaction ledger. No public exploit code identified at time of analysis; patch available in 2.8.0.
Deletion of stored form entries in the WordPress plugin Database Addon for WPForms (also distributed as 'wpforms entries') is possible against any site running a version before 1.1.1, because the entry-removal handler fails to validate a CSRF nonce when that field is omitted and performs no capability check of its own. An attacker can host a crafted page that, when loaded by a logged-in WordPress administrator, silently submits the deletion request on the victim's behalf; the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N confirms network reachability and low complexity but gates success on administrator interaction. Impact is integrity-only (C:N/I:L/A:N, CVSS 4.3 Medium) and limited to removal of stored form submissions, with no code execution, data disclosure, or site availability loss; there is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV).
Missing per-session authorization in Indico's legacy session export API (all versions prior to 3.3.13) allows any authenticated user who can access a parent event to pull metadata - session title, description, and conveners - for restricted sessions they are not permitted to view. Exploitation requires a valid Indico account plus legitimate access to the containing event, and the leaked data is read-only, so impact is limited to low-severity information disclosure (CVSS 4.3, PR:L, C:L only). There is no public exploit identified at time of analysis, and the flaw is corrected in 3.3.13 via a vendor-released patch.
Session exhaustion in Progressive Robot hMailServer 6.2.28 through 6.3.5 lets any user who holds valid credentials for a single mailbox repeatedly log in and keep the server's shared browser-session table full, causing the least-recently-used eviction logic to terminate other users' webmail and administration sessions, including those of the server administrator and support staff. Because the table is global rather than per-account and imposes no cap on how many concurrent sessions one account may hold, the attacker does not need elevated privileges or special access - only network reachability to the REST API endpoint (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L, assessed as an authenticated-remote availability issue). Impact is limited to denial of service against idle sessions, with no code execution, data disclosure, or integrity impact, and no public exploit identified at time of analysis; upgrading to hMailServer 6.3.6 clears the condition.
Offline tokens issued by Keycloak, Red Hat Build of Keycloak, and Red Hat Single Sign-On 7 can stay valid after a backchannel logout because a serialization bug in the OIDC Dynamic Client Registration (DCR) response omits the backchannel-logout offline-token-revocation setting, silently disabling it whenever a client is updated through the standard update flow (CVE-2026-107623, CVSS 3.1 4.3, CWE-862). The actor must hold client-management/registration privileges (AV:N/PR:L), and the deployment must use DCR and rely on backchannel logout to revoke offline tokens, so this is a loss of a revocation guarantee rather than an account takeover. No public exploit code was identified at time of analysis and the issue is not in CISA KEV; EPSS signal is not available in the supplied data, and the assessed real-world risk remains low.
Missing authorization checks in the VillaTheme Core WordPress plugin, affecting versions up to and including 1.0.5, allow an authenticated low-privilege user to reach plugin functionality that should require higher capabilities, resulting in limited information disclosure. The flaw carries a CVSS 3.1 score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) and per the assessed vector is not exploitable by unauthenticated users - an account on the WordPress site is a prerequisite (PR:L). No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis; impact is limited to low confidentiality exposure with no integrity or availability effect, making this a moderate, low-priority issue.
Expired JSON Web Tokens can keep being accepted by fast-jwt through version 6.3.3 when the verifier is created with caching enabled (cache: true) and a token carries an exp claim but no iat claim. In src/verifier.js, cacheSet only derives an exp-based cache deadline when iat is present, so the entry falls back to the generic cacheTTL (600000 ms / 10 minutes by default), and a later cache hit returns the stored payload before expiration is revalidated - allowing an attacker who already holds such a token to replay it past its expiry for up to the cache TTL. The attacker cannot forge or alter a token, and the CVSS vector indicates a low-privilege authenticated context (PR:L); no public exploit code and no confirmed active exploitation were identified at time of analysis. The issue is fixed in 6.3.4.
Authentication bypass in CISA's Malcolm network traffic analysis platform lets any host with network adjacency to the Malcolm deployment reach the bundled Arkime live-capture service directly on TCP port 8005 and impersonate arbitrary users, gaining full administrative access to the Arkime viewer. The issue stems from documented default configuration: the arkime-live container runs with network_mode: host and binds the viewer to 0.0.0.0 (viewHost), Arkime trusts the X-Forwarded-User header from any source IP (userAuthIps=::,0.0.0.0/0) with automatic user creation, and the passwordSecret is the hardcoded public value 'Malcolm'. Exploitation is unauthenticated and requires no user interaction, but it does require adjacency to a network segment the Malcolm host is attached to, because the attacker must connect to port 8005 directly and bypass the nginx front end; deployments that block 8005, restrict userAuthIps, or change the passwordSecret are not exploitable by this path. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); CISA's ICS assessment publishes a base score of 4.2, while our independent assessment rates confidentiality impact as High (unauthenticated reads of captured traffic and viewer data) for a materially higher score.