World-readable CodeCatalyst token cache files in AWS Toolkit for VS Code versions before 4.10.0 let any other local user on the same host recover bearer tokens for a victim who has connected the CodeCatalyst integration. The flaw is a local information-disclosure and privilege-escalation concern (CWE-276, CVSS 6.8) rather than a remote attack: it requires a shared multi-user system, an ordinary local login, no user interaction, and no elevated privileges, and yields only read impact (confidentiality) with no integrity or availability loss. No public exploit code has been identified at time of analysis and the issue is not reported as actively exploited; the vendor has released a fix in version 4.10.0.
Stack exhaustion denial of service in OFFIS DCMTK 3.7.0 lets an attacker crash a JSON-parsing process by supplying a crafted DICOM JSON document whose sequence (SQ) values are nested deeply enough to exhaust the call stack through uncontrolled mutual recursion in DcmJSONReader (parseDataSet, parseElement and parseSequence in dcmdata/libsrc/dcjsonrd.cc). The affected components are the json2dcm conversion tool and any service that converts untrusted DICOM JSON, such as DICOMweb ingestion endpoints, with impact limited to availability (process crash) and no code execution, disclosure or integrity loss. No public exploit identified at time of analysis and CISA's SSVC records Exploitation: none, but the flaw is trivially automatable by anyone who can deliver a malicious JSON payload; it is fixed upstream in commit cf955e64c35a1e07ba10698f639d5dcdec53b9d7, which caps sequence nesting at 128 levels.
Deeply nested <sequence> and <item> elements in a crafted XML file drive unbounded mutual recursion between DcmXMLParseHelper::parseDataSet() and DcmXMLParseHelper::parseSequence() in OFFIS DCMTK 3.7.0's XML-to-DICOM converter, exhausting the call stack and crashing the process (CWE-674, denial of service only). The vulnerable code path is reached by the xml2dcm command-line tool and by any service or application that embeds DCMTK 3.7.0 to convert untrusted XML into DICOM; per the vendor vector the attack is unauthenticated (PR:N) but local (AV:L) and requires the victim to process the malicious file (UI:P), so risk is highest for automated, unattended conversion pipelines. Impact is limited to availability - no code execution, data disclosure, or integrity loss - and no public exploit identified at time of analysis, nor is the issue listed in CISA KEV; the upstream fix introduces a hard 128-level nesting cap.
Stack exhaustion in OFFIS DCMTK 3.7.0 allows an attacker who supplies a crafted DICOMDIR file to crash any application built on the library that opens it, including dcmgpdir and third-party DICOM media viewers. The root cause is uncontrolled recursion (CWE-674) in DcmDicomDir::moveRecordToTree() in dcmdata/libsrc/dcdicdir.cc, which follows a maliciously deep chain of directory records linked through the Offset of Referenced Lower-Level Directory Entity attribute until the process stack is exhausted. The affected vector is local with a user-interaction requirement (AV:L/PR:N/UI:P in the vendor CVSS 4.0 vector; AV:L/AC:L/PR:N/UI:R in the independently assessed CVSS 3.1 vector), impact is availability-only (no code execution, disclosure, or integrity loss), there is no confirmed active exploitation (no CISA KEV listing) and no public exploit identified at time of analysis, and a vendor fix is available as upstream commit ca761f7f3dcaaddaa95be87cf5d736138d7c3a9f.
Stack exhaustion and process crash in OFFIS DCMTK 3.7.0 can be triggered by feeding the bundled XML parser a crafted document with deeply nested elements, because XMLNode::ParseXMLElement() and XMLNode::emptyTheNode() recurse without a depth limit. An attacker who can make a DCMTK-based tool ingest untrusted XML - most directly by running dcmencap to encapsulate a malicious CDA document, or any application that calls OFXMLParser::parseFile() or OFXMLParser::parseString() on attacker input - can terminate the process at will. The impact is availability only: no code execution, data disclosure, or persistence, and exploitation is constrained by the vendor's assessment of a local vector (AV:L) with passive user interaction (UI:P), meaning some actor or workflow must hand the file to the parser. No public exploit identified at time of analysis; the vendor scores it 6.8 under CVSS 4.0, while our independent assessment scores it CVSS 3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H.
Tokens issued through @fastify/jwt before 10.2.3 can be created without an exp claim - and therefore never expire - when expiresIn, notBefore, or maxAge is given a time-span string the plugin's parser cannot read, such as a compound span like '1h30m', a month unit, an ISO 8601 duration, a value using a decimal comma, or a string with surrounding whitespace. The identical flaw silently disables maxAge age-rejection on the verification path, so a token that should be rejected as too old is accepted. The issue is tracked as CVSS 3.1 6.8 (Medium; AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N), and the vector's PR:L reflects that an attacker generally needs to already hold a token - their own aged one or a stolen/leaked one - to benefit, with AC:H because the unparseable string must actually be in use as a non-default developer misconfiguration; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
Docker Sandboxes can expose host-managed OAuth access and refresh tokens to untrusted code inside a sandbox when the managed-credential injection feature is in use and a user actively completes the OAuth authorization flow. A case-sensitivity mismatch in token-endpoint hostname masking (CWE-178) lets malicious code request a case-variant hostname that reaches the genuine provider while bypassing response masking; exploitation requires local code execution inside the sandbox plus user interaction, not a remotely exploitable, no-interaction attack. No public exploit identified at time of analysis, and no KEV or EPSS data is provided; the independent assessment rates this as a moderate-priority confidentiality issue rather than a high-urgency emergency.
Local privilege escalation in Progressive Robot hMailServer 6.3.4 and 6.3.5 (fixed in 6.3.6) lets an attacker who already executes code as the low-privilege hMailServer service account ride a subsequent administrator- or root-run operation to full SYSTEM/root privileges. The flaw is improper link resolution (CWE-59): administrative command-line operations, the installer, DBSetup, the Control Panel, and store-maintenance/object-storage routines resolve file paths inside the log and data folders without guarding against junctions, mount points, or symbolic links that the service account can plant - and on Linux those maintenance routines run as root, so a planted symlink is followed with root authority. The attacker must already hold a foothold as NT SERVICE\hMailServer (Windows) or the packaged hmailserver user (Linux) and must wait for a privileged operation to be triggered, so exploitation is local-only, requires user interaction on the privileged side, and carries elevated complexity; no public exploit code or KEV-listed active exploitation was identified at time of analysis, and the CVE-org references point to the upstream work item and the v6.3.6 release.
Path traversal in the BackWPup WordPress plugin before 5.7.7 lets a high-privileged, authenticated user (PR:H, typically a WordPress administrator with backup/restore permissions) write files outside the intended restore directory by supplying a crafted backup archive during a restore that runs through the plugin's fallback archive library, which can escalate to remote code execution. The CVSS 3.1 base score is 6.6 (AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H), reflecting the high privileges and the non-default fallback-library code path required rather than a broad unauthenticated attack surface. A vendor patch is available in BackWPup 5.7.7, and no public exploit code was identified at time of analysis; exploitation is not confirmed as active (no CISA KEV listing).
Pydantic AI, a Python framework for building Generative AI agents, buffers complete HTTP response bodies before applying any size limit in its remote-content download paths, so an attacker-chosen URL can stream an arbitrarily large body that exhausts process memory and crashes the worker. Affected components are the local web_fetch_tool, the WebFetch capability's local fallback, and remote FileUrl media downloads (ImageUrl, DocumentUrl, VideoUrl, AudioUrl); the issue affects versions from 1.77.0 to before 1.107.2 on the v1 line and 2.0.0b1 through 2.23.0 on the v2 line. This is an availability-only flaw (CWE-400) - SSRF protections remain effective and there is no confidentiality or integrity impact - and no public exploit identified at time of analysis, though exploitation requires only that the application register the local web-fetch tool and expose the agent to untrusted prompts (or download untrusted-input-influenced FileUrls) while running an affected version.
Sanitizer bypass in enshrined/svg-sanitize 0.22.0 and earlier lets an attacker smuggle a fully live SVG <use> nesting bomb past the library's useNestingLimit defenses by writing the href attribute with mixed casing, for example xlink:HrEf or HrEf. The resolver builds its reference graph with the case-sensitive XPath predicate use[@href or @xlink:href], so the mixed-case nodes never enter the graph and are never nullified, while Sanitizer::cleanHrefAttributes() runs later in the same pass and re-canonicalizes the attribute to xlink:href - handing back output that would have been stripped entirely had the input used canonical casing. Impact is availability only (CVSS 6.5, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H): unauthenticated attackers able to upload or paste an SVG into an application that sanitizes and then serves it can cause a denial of service when the output is rendered (UI:R); publicly available exploit code exists (a reproducible proof of concept against tag 0.22.0 ships with the vendor advisory), but no CISA KEV entry indicates active exploitation.
Denial of service in Pydantic AI (pydantic-ai and pydantic-ai-slim) versions 1.77.0 through 1.107.5 and 2.0.0b1 through 2.43.x lets a server-controlled web page stall an entire agent process: the local web_fetch_tool and the WebFetch capability's local fallback perform quadratic-time title extraction, whitespace normalization, preformatted-block stripping, and ordered-list numbering directly on the asyncio event loop, so a modest ~1-2 MB page of repeated unterminated <title> tags, long whitespace runs, or large ordered lists blocks every other coroutine in the process for minutes. A response carrying a Content-Type charset of punycode achieves the same block with no HTML at all (roughly half a minute per megabyte of body), while unsupported codecs such as rot_13 or base64_codec, or HTML/JSON nested a few hundred elements deep, raise an unexpected exception that aborts the individual agent run. Exploitation requires an application that enables the vulnerable tool and a low-privileged actor able to steer the agent into fetching an attacker-controlled URL (typically via untrusted or injected prompts); the pre-existing SSRF protections and download-size cap from GHSA-v2xh-2vp8-57h8 remain effective but only bound bytes downloaded, not processing time. There is no public exploit code identified at time of analysis, and the impact is availability only - no confidentiality or integrity loss.
Denial of service in IBM Guardium Data Protection 12.2 is achievable by an authenticated remote attacker using path traversal sequences against a network-reachable component, with high integrity and availability impact (CVSS 3.1 base 8.1). The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H confirms the attacker needs only low-privilege credentials, no user interaction, and low attack complexity, so the main barrier is obtaining a valid Guardium account. No public exploit identified at time of analysis, and the supplied data does not confirm active exploitation or CISA KEV listing.
Malcolm's upload-processing pipeline allows an authenticated user with PCAP/log upload rights to exhaust the shared Docker volume by submitting a small single-stream compressed file (e.g., .gz, .bz2, .xz, .lzma, .lz) that decompresses to an effectively unbounded size. The flaw, CWE-409 decompression bomb, bypasses the entry-count, nesting-depth, and uncompressed-byte limits that scripts/safe-extract.py applies only to container archives (zip/tar/rar/7z via libarchive), causing disk exhaustion that disrupts OpenSearch, Logstash, Arkime, and Zeek for all users. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis; exploitation requires valid credentials with upload permissions and results in availability impact only (CVSS 6.5).
Prototype pollution in the msgpack5 npm package (all versions prior to 6.1.0) allows attacker-controlled MessagePack input to replace the prototype of a decoded object when the application constructs its msgpack5 instance with an empty or partial options object - a usage pattern that silently drops the default protoAction:'error' guard. A decoded map containing a __proto__ key can then alter inherited properties on that decoded object and influence downstream behavior, although Object.prototype is never modified globally. This is an unauthenticated, network-reachable issue (CVSS:3.1/AV:N/AC:H/PR:N/UI:N) with moderate severity; the independent assessment rates impact as Integrity Low / Availability Low, and no public exploit code has been identified at time of analysis.
Security restriction bypass in IBM Security Verify Access (10.0 through 10.0.9.2) and IBM Verify Identity Access (11.0 through 11.0.3), including their container images, lets a remote attacker who already holds a valid low-privilege session circumvent authentication controls and gain high confidentiality and integrity impact (CVSS 3.1 base 8.1, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). Because the vector is PR:L, anonymous or unauthenticated attackers cannot trigger this on their own; the attacker must first possess valid credentials or a session, after which the bypass is low-complexity, requires no user interaction, and is reliably reproducible. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (no CISA KEV listing), but a vendor patch is available, so the issue should be treated as a credible, above-average-priority fix rather than an emergency.
Prompt-structure injection in the Banks LLM prompt-templating library (masci/banks) before 2.5.0 allows attacker-controlled template data to cross the prompt boundary and be reinterpreted as system, assistant, or tool chat messages. Because Prompt.chat_messages() parses every rendered line of template output as ChatMessage JSON and ChatMessage.role accepts arbitrary strings, an unauthenticated remote attacker who can induce a consuming application to render untrusted data through a Banks template and forward the resulting messages to an LLM provider can override system instructions, alter the intended prompt structure, or confuse downstream tool and message handling. This is a genuine but conditional, medium-severity input-validation flaw (CVSS 6.5, CWE-20): it does not affect a default Banks install in isolation, and no public exploit code was identified at time of analysis. Vendor-released patch: 2.5.0.
Denial of service in Pydantic AI's local web_fetch_tool and WebFetch local fallback allows an attacker-controlled HTML page, fetched on the model's behalf, to burn excessive CPU and memory during HTML-to-Markdown conversion (CVSS 3.1 6.5, AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H; CWE-400). Affected are pydantic-ai and pydantic-ai-slim from 1.77.0 through 1.107.6, and from 2.0.0b1 through 2.51.x (fixed in 1.107.7 and 2.52.0); provider-native web fetching is not affected, and no public exploit code has been identified at time of analysis, with no KEV listing. Because the fetch must be induced through the agent (UI:R), the realistic exposure is a stalled or resource-starved agent process rather than a remotely triggerable crash, and EPSS-style urgency is correspondingly moderate.
An authenticated user can exhaust server resources in IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3, including the containerized editions, by submitting a specially crafted HTTP query that triggers uncontrolled resource allocation, resulting in a denial of service (CVSS 3.1 base 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Exploitation requires a valid authenticated session on the affected HTTP interface (PR:L); there is no confidentiality or integrity impact, only availability. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV, so this is a moderate-priority availability defect rather than a top-tier emergency; vendor patching is available per IBM's advisory.
Authentication workflow bypass in IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 allows a remote authenticated attacker who already holds valid first-factor credentials or an active session to skip the configured additional authentication workflow steps - such as step-up authentication, multi-factor prompts, or multi-step policy flows. Rated CVSS 6.5 (moderate), the flaw only affects deployments that actually enforce an additional authentication workflow; environments without one have nothing for the bypass to defeat. Exploitation requires the extra-workflow feature to be configured and the attacker to be a remote authenticated actor, and no public exploit code or confirmed in-the-wild exploitation has been identified at time of analysis; note that IBM's supplied CVSS vector (PR:N) contradicts its own 'remote authenticated attacker' description and our independent assessment, which uses PR:L and should be reconciled with the vendor.
Cross-project authorization bypass in Apache DolphinScheduler before 3.4.3 lets an authenticated user who holds legitimate schedule or workflow permissions in one project reach into a different project and manipulate its resources, because the affected API endpoints validate the caller's rights against the projectCode in the URL but never confirm that the schedule id, workflow definition code, or task instance actually belongs to that project. In practice an attacker can take workflow schedules online or offline and flip workflow definitions between ONLINE and OFFLINE, disrupting scheduled execution and task processing in tenants they were never granted access to. Impact is bounded to integrity and availability of workflow state (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L), authentication is required, exploitation is only meaningful where multi-project isolation is treated as a security boundary, and no public exploit identified at time of analysis; vendor-released patch 3.4.3 resolves the flaw.
Heap buffer overflow in libming through 0.4.8 allows an attacker who supplies a crafted SWF file to crash the parsing process by driving the bit-reader past a fixed-size buffer while decoding the file header. The flaw lives in r_readc()/freadc() in src/blocks/fromswf.c, where the 9-byte rect[] array is overrun when the RECT header declares a large nbits value or the stream is truncated. Exploitation requires the victim to open or convert the malicious SWF (user interaction, no authentication), and impact is limited to denial of service with no confidentiality or integrity effect; EPSS is low (0.17%, 6th percentile), there is no CISA KEV listing, and no public exploit code was identified at time of analysis, although an upstream fix is available.
Missing authorization checks in Apache DolphinScheduler before 3.4.3 let any authenticated user pull other accounts' details from the /dolphinscheduler/users/list-all REST endpoint, enabling account enumeration and unauthorized disclosure of user information. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) reflects that exploitation requires a valid DolphinScheduler session and results in low confidentiality impact, even though the vendor labels the issue critical; risk rises sharply in deployments permitting self-registration, shared low-privilege accounts, or broad internal network access. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was present in the supplied data, so prioritization currently rests on the vendor severity label and internal exposure rather than observed exploitation.
Stored cross-site scripting in the MasterStudy LMS WordPress plugin (versions through 3.7.52) allows an authenticated attacker with a low-privilege role, such as a student or instructor, to inject persistent JavaScript that executes when a privileged user views the affected page or dashboard view. The CVSS 3.1 base score is 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L); exploitation requires victim interaction, and no public exploit code or active exploitation has been identified at time of analysis.
Signature forgery in IBM DataPower Gateway lets an authenticated user with valid low-privilege credentials submit signature requests that the appliance processes without properly verifying data authenticity, producing forged signatures that relying parties may accept as genuine. Affected firmware spans 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2; the impact is integrity-only (CVSS 3.1 base 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) with no confidentiality or availability loss. There is no public exploit identified at time of analysis, and IBM has published a vendor fix via its support portal, so this is a moderate-risk authenticated integrity issue rather than a remotely exploitable, unauthenticated critical defect.
Authenticated wallet-balance theft affects WooCommerce stores running the Wallet System for WooCommerce plugin in versions 2.0.0 through 2.7.x, where the wallet-transfer routine fails to confirm that the submitting user owns the wallet being debited. Because only a valid login is required (CVSS PR:L), any self-registered Subscriber can nominate an arbitrary user's wallet as the transfer source - including an administrator's - and drain its balance into an account they control, producing a high integrity impact with no confidentiality or availability loss (CVSS 6.5). Stores with open customer registration and the wallet-transfer feature enabled are directly exposed; no public exploit code has been identified at time of analysis and the flaw is not listed as confirmed actively exploited (CISA KEV).
Man-in-the-middle attackers can bypass certificate hostname verification in GnuTLS 3.8.13, letting them impersonate the intended TLS server and eavesdrop on client communications that should have been protected by certificate validation. Exploitation requires the attacker to already occupy a MITM position between a GnuTLS 3.8.13 client and its intended server and to supply a crafted certificate that is mishandled on the Common Name fallback path; no victim action beyond completing a normal TLS handshake is required, but the flaw does not permit compromise of an arbitrary host without traffic interception. Published severity is 9.1, while our independent assessment is more conservative (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N, roughly 8.1) because of that MITM prerequisite; EPSS is 0.11% (1st percentile), there is no CISA KEV listing, and no public exploit code was identified at time of analysis, though a GitHub Gist is cited among the references with unconfirmed content.
Improper authorization in IBM DataPower Gateway lets a local attacker who already holds a valid low-privileged account read sensitive information that should be restricted from that privilege level. Exposure is limited to specific builds: 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6 (10.6CD), and 11.0.0.0 through 11.0.0.2. Exploitation requires local access to the appliance plus authenticated credentials (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N), so realistic risk is confined to insiders or post-compromise scenarios; CISA SSVC records no known exploitation, no public exploit code is identified at time of analysis, and IBM has published a vendor patch (support node 7289775).
IBM Guardium Data Protection 12.2.2 writes SECRET and API_KEY credential material into INFO-level logs produced by the edge-controller and edge-manager components during credential rotation, so an authenticated attacker who can read those application or container logs can harvest live service credentials and later use them to impersonate services or reach the Guardium control plane. Exploitation requires prior Guardium authentication (the vector carries PR:L), read access to the affected logs, and that a rotation event occur or be induced so the secret is actually written; no user interaction is involved. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor advisory (IBM support node 7288627) is the primary reference. Because the prerequisite is log readability on the host or container rather than open network reachability, our assessment treats the vector as local (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) even though the vendor scores it AV:N.
A crafted SVG carrying an internal DTD subset with a #FIXED attribute default can drive svg-sanitizer (prior to 1.0.0) into calling DOMElement::removeAttribute() twice on the same attribute name inside cleanAttributesOnWhitelist(), corrupting libxml state and terminating the PHP worker. Affected deployments are those that pass untrusted SVG through sanitize() - the vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) indicates remote, low-privileged access with no user interaction, and impact limited strictly to availability. Repeated submissions can interrupt workers continuously and degrade or exhaust application capacity; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Authentication bypass in CISA Malcolm's shipped front nginx reverse proxy lets unauthenticated remote attackers reach the Arkime backend and assume arbitrary identities by requesting the 'Dashboards -> Arkime shortcut' path with any path segment that is not exact-lowercase (for example /IDDASH2ARK/...). The location's case-insensitive regex matcher fires, but the case-sensitive rewrite does not issue the intended redirect, so nginx falls through to the one proxied location in the shipped configuration that omits the per-location authentication file; that same location also forwards a client-supplied X-Forwarded-User header un-overwritten, and Arkime is configured as shipped to trust that header as the authenticated username, enabling forged, auto-provisioned identities. CVSS 3.1 base score is 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, CWE-290) with no credentials or user interaction required; no public exploit code identified at time of analysis and no confirmed active exploitation (not in CISA KEV), and practical risk is moderate because it is bounded mainly by network reachability of the front proxy - instances not exposed beyond trusted segments have reduced exposure.
An authenticated mailbox user on Zimbra Collaboration Suite can defeat an administrator's policy that disables mail forwarding by creating a Sieve filter that uses the 'notify' action to copy message bodies and headers to an arbitrary external address. The flaw is an incorrect-authorization issue (CWE-863) scored CVSS 6.5 with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, meaning exploitation requires a valid account (PR:L), is network-reachable, needs no user interaction, and yields confidentiality impact only - no integrity or availability effect. No public exploit code was identified at time of analysis and the CVE is not listed in CISA KEV; the risk is concentrated in deployments that rely on disabling forwarding as a data-loss-prevention or exfiltration control, rather than in default installs where forwarding is already permitted.
Authorization bypass in Zimbra Collaboration Suite 10.1.0 through 10.1.19 allows an authenticated user on an EWS-enabled server to read complete mailbox items - including raw MIME bodies and attachments - from arbitrary local accounts without any share or delegation grant. The flaw is reachable remotely over the network by an authenticated account of any privilege level (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, 6.5), but it is gated on the Exchange Web Services interface being turned on for that mailbox, so deployments that disable the EWS connector are not exposed. Impact is confined to confidentiality: there is no integrity or availability effect, and no public exploit identified at time of analysis, though the read-only-but-total nature of the disclosure makes multi-tenant and large-org servers the highest-risk configurations.
Advancity ALMS Cloud (Caz Informatics Services Trade Inc.) fails to enforce proper access-control lists, letting an authenticated low-privilege user reach functionality and data that should be restricted to higher-privileged roles. Exploitation requires a valid session on a tenant (CVSS PR:L) but no user interaction, and all deployments up to and including the 2026-10-08 build are affected; the resulting impact is confidentiality-only (C:H/I:N/A:N), enabling unauthorized data disclosure rather than modification or disruption. No public exploit code was identified at time of analysis, and because the vendor did not respond to the coordinated disclosure, no fixed version has been published.
Stored cross-site scripting in the Zotpress WordPress plugin through 7.4.4 allows an authenticated low-privilege user to inject persistent JavaScript that executes when another user views the affected page. The assessed CVSS v3.1 score is 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L), and no public exploit code or confirmed active exploitation was identified in the provided intelligence. Because exploitation requires a low-privilege account plus victim interaction, risk is highest on multi-author WordPress sites, while single-admin or closed-registration blogs have a reduced attack surface.
Stored cross-site scripting in the WordPress plugin WP Plugin Info Card (all versions through 6.3.5) lets an authenticated user with low-level posting privileges place a malicious script into content that the plugin later renders as an info card, so the payload executes in the browser of any user who views the affected page. Successful exploitation requires two separate conditions: the attacker must already hold a WordPress account able to create or edit the relevant content (PR:L), and a victim - typically an administrator or another site user - must subsequently view the rendered card (UI:R); the flaw is not reachable by fully unauthenticated attackers and does not fire automatically. Patchstack rates it CVSS 6.5, and there is no public exploit identified at time of analysis and no vendor-released patch identified at time of analysis, so the practical exposure is limited to sites running the plugin with multiple content-authoring accounts.
Stored cross-site scripting in Gutenberg Blocks by Kadence Blocks (also distributed as Kadence Blocks) affects WordPress installations running version 3.7.12 or earlier, allowing an authenticated user with contributor- or author-level posting rights to embed malicious script content inside Kadence blocks that executes when a higher-privileged user - typically an administrator or editor - later views or previews the affected post. Because the injected script runs in the privileged user's session, the attacker can hijack administrative actions, inject further content, or persist access, although exploitation depends on both obtaining a content-creation account and a privileged victim rendering the poisoned content. No public exploit code has been identified at time of analysis and there is no indication of active exploitation (CISA KEV); the issue is assessed as moderate priority rather than top-tier.
Stored cross-site scripting in the Robo Gallery WordPress plugin (versions through 5.1.6) lets an authenticated low-privilege user - such as a contributor or author with posting rights - persist malicious JavaScript into gallery content, which then executes in the browser of any user who later views the affected page, typically an administrator. Rated CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) because the payload can alter the rendering scope and requires victim interaction to fire, the practical exposure is limited to sites that grant untrusted accounts the ability to create or edit Robo Gallery content. No public exploit code was identified at time of analysis and there is no confirmed active exploitation (CISA KEV); the issue was reported via Patchstack.
Medium-severity (CVSS 6.5) missing authorization flaw (CWE-862) in BdThemes Ultimate Post Kit WordPress plugin versions up to and including 4.5.5 allows an authenticated low-privilege user (such as a subscriber or contributor) to access a plugin function or endpoint that lacks proper authorization checks, resulting in high confidentiality impact (information disclosure) with no integrity or availability impact. Exploitation requires the target site to allow low-privileged accounts; sites that disable open registration or restrict such roles are not affected. No public exploit identified at time of analysis.
Stored cross-site scripting (CWE-79) in the WP Store Locator WordPress plugin through version 3.0.3 allows an authenticated low-privilege user to inject script that is persisted and later rendered without neutralization, executing in the browser of a privileged victim who views the affected page. The assessed CVSS 3.1 base score is 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L), reflecting a network-reachable flaw that requires a valid low-privilege account (PR:L) and victim interaction (UI:R) rather than unauthenticated access. No public exploit code was identified at time of analysis, and no CISA KEV entry is associated with this CVE, so real-world exploitation is constrained by the need for an authenticated foothold and for an administrator or editor to actually view the attacker-controlled content.
Stored cross-site scripting in ShortPixel Image Optimizer versions through 6.5.6 allows an authenticated low-privileged WordPress user to inject JavaScript that executes when a higher-privileged victim views the affected plugin-generated page. The vulnerability is a CWE-79 improper-neutralization issue in a WordPress plugin, requires the plugin to be installed and active, and is not remotely exploitable by an unauthenticated attacker against a default install. No public exploit identified at time of analysis, and no EPSS score was supplied; the assessed severity is moderate with scope change and limited confidentiality and integrity impact.
Authorization bypass in the WordPress plugin HollerBox (Groundhogg) through version 2.3.14 allows unauthenticated remote attackers to manipulate plugin-managed objects by supplying a user-controlled key that the plugin fails to validate against ownership or access level. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L, score 6.5) confirms no authentication or user interaction is required and impact is limited to integrity and availability, with no data disclosure. No public exploit code has been identified at time of analysis and there is no indication of confirmed active exploitation (CISA KEV).
Denial of service in hMailServer 6.3.2 through 6.3.5 lets an unauthenticated remote attacker exhaust the webmail/REST HTTP listener by sending a message that references one small embedded image an extreme number of times, if the recipient opens it in webmail. The rendering path has quadratic work and can occupy one of four worker threads for minutes while building a multi-gigabyte document, so a few messages can make webmail, the administration console, and the REST API unavailable. No public exploit identified at time of analysis; the vendor has released 6.3.6, and this is a moderate-priority availability issue rather than a critical one.
A remote, unauthenticated attacker can degrade or fully stall Progressive Robot hMailServer (6.2.22-pre1 through 6.3.5) by sending a single HTML-only email whose body contains a very large number of character entity references, because the server's shared string class performs entity decoding with a replace/remove implementation whose cost grows with the square of the number of entities (CWE-407). The expensive decode runs only when the server builds a folder snippet - when the recipient lists the folder in webmail via the REST API (6.3.3-6.3.5) or when an IMAP client issues a PREVIEW request (6.2.22-6.3.5) - and the message never has to be opened; each such listing can pin one of the listener's four worker threads for minutes, so a handful of crafted messages leaves webmail, the administration console and the REST API unable to answer anyone. Impact is availability-only (CVSS 6.5, AV:N/AC:L/PR:N/UI:R, C:N/I:N/A:H) and depends on victim-side interaction (folder listing or PREVIEW); no public exploit code was identified at time of analysis. The vendor has released 6.3.6, which resolves the quadratic behaviour.
Authenticated IMAP users can make hMailServer 6.0.0 through 6.3.5 stop responding and consume excessive memory, because several IMAP command parsers do work that grows quadratically with the length of a command or the number of elements it names. The issue requires a valid signed-in mailbox account (CVSS PR:L, AV:N, AC:L) and causes availability impact only (A:H, no confidentiality or integrity impact, CVSS 6.5). No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); a vendor fix is available in release 6.3.6.
Denial of service in Progressive Robot hMailServer 6.0.0 through 6.3.5 lets a remote unauthenticated sender stall the IMAP, SMTP, POP3 and webmail services by delivering a single message whose header field carries an RFC 2047 encoded word that decodes to a very large number of line breaks. The decoder unfolds such a value quadratically, so each read of the poisoned header can occupy a shared worker thread for minutes or longer; because IMAP worker threads are shared with SMTP and POP3, a handful of messages can render the mail services unresponsive. Exploitation is gated by user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, base 6.5 MEDIUM): the cost is incurred when a victim's IMAP client searches, sorts or threads by a header, when webmail lists the folder, or where header-testing delivery rules, Subject spam tagging or abuse-report reading are configured. No public exploit code and no CISA KEV entry were identified at time of analysis, and the vendor has released a fixed version.
Authenticated denial of service in Progressive Robot hMailServer 6.2.24 through 6.3.5 lets any account holder who can publish an active Sieve script exhaust the server's shared delivery thread pool using their own filters. A ':matches' pattern with several wildcards evaluated against a long string, or a 'deleteheader' rule that strips many same-named fields, consumes seconds of CPU per message (44 seconds for an '*a*a*a*b' pattern over 800 characters; 18.8 seconds to remove 80,000 header fields), and a handful of self-delivered messages is enough to stall mail delivery for every user on the instance. The vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (6.5) and the impact is availability only; the vendor has released 6.3.6 with fixes, and no public exploit identified at time of analysis.
Heap-based buffer overflow in hMailServer's legacy Blowfish encryption routine can crash the service, affecting Progressive Robot hMailServer versions 6.0.0 through 6.3.5. Remote exploitation requires hMailServer 6.3.4 or 6.3.5 with the non-default self-service REST API enabled and an authenticated mailbox user who creates a fetch account with a password 129-247 characters long that is not a multiple of 8 and then requests a personal data export; locally on Windows, any interactive user can reach the same routine through the COM method Utilities.BlowfishEncrypt without hMailServer authentication, and stored-secret writes are affected when ProtectStoredSecretsWithDPAPI is set to 0. No public exploit was identified at time of analysis. The CVSS 3.1 score is 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), an availability-only impact; real-world priority is lower than the base score suggests because the remote path depends on a non-default feature and the unauthenticated path requires local interactive access to the Windows host.
DNS rebinding against the Pydantic AI development web chat server (Agent.to_web() and `clai web`) lets a hostile website visited by a developer reach the loopback-hosted agent as a same-origin service, read the served UI, and submit chat requests that execute the agent's tools with the local process's privileges and credentials - resulting in data disclosure or unwanted side effects. The flaw affects pydantic-ai and pydantic-ai-slim versions 1.34.0 through 1.107.4 on the v1 line and 2.0.0b1 through 2.29.x on the v2 line, and is fixed in 1.107.5 and 2.30.0. Scoring is CVSS 3.1 6.4 (AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:L), reflecting an unauthenticated remote attack path that nevertheless requires the attacker to control a DNS name and persuade a developer to visit the attacker's page in the same browser; no public exploit code or CISA KEV listing was identified at time of analysis, and no EPSS score was supplied.
A kernel-mode heap buffer overflow (CWE-122) in HP Sure Click and the related HP Wolf Security product family at versions below 4.4.33 allows a local attacker who already holds elevated privileges to corrupt kernel memory and potentially escalate to full system-level code execution. The flaw is reachable only from a local context on a Windows host running the affected endpoint security agent, requires a non-trivial triggering condition such as precise heap state or a memory-corruption race, and exposes no network or remote attack path. HP has released version 4.4.33 as the vendor-released fix, and no public exploit code has been identified at time of analysis.