Uncontrolled resource consumption in the Strawberry GraphQL library's legacy graphql-ws subscription handler (versions 0.312.3 up to but not including 0.327.2) allows an unauthenticated remote client on a persistent WebSocket connection to fill that connection's configured subscription slots with one-shot subscriptions that have already completed, so later legitimate operations on the same connection are rejected with 'Subscription limit reached'. The impact is limited to the attacker's own connection and to availability (CVSS 3.1 base 3.7, AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L), requiring the non-default max_subscriptions_per_connection cap to be explicitly configured and the legacy graphql-ws protocol to be in use; the modern graphql-transport-ws protocol and deployments without the cap are unaffected. No public exploit code has been identified at time of analysis and the issue is not known to be actively exploited, but a vendor fix is available in 0.327.2.
Server-side request forgery in LinuxServer Heimdall through 2.8.3 lets an unauthenticated attacker coerce the server into issuing HTTP requests to arbitrary internal hosts and ports, including the cloud metadata address 169.254.169.254, by inducing a victim with network reachability to the instance to load attacker-controlled content that triggers the CSRF-reachable POST /test_config or GET /get_stats endpoints (CVSS 3.1 base score 3.4, vector AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N). Publicly available exploit code exists, but there is no indication of confirmed active exploitation, and the author scopes the CSRF exposure to only 'some realistic installations' where those endpoints are reachable. The realistic impact is a status/port oracle plus partial response data - not full response exfiltration - and the cloud-metadata path additionally requires Heimdall to run on an instance exposing an unauthenticated metadata service.
Out-of-bounds memory access in the phalFelica module of NXP NXPNfcRdLib on RC663-based NFC reader deployments (versions through 07.14.00_Pub) can corrupt or expose memory when an API caller supplies values that the library fails to bounds-check, resulting in limited loss of confidentiality, integrity, and availability. Exploitation requires local access with high privileges and high attack complexity per the assessed CVSS vector (AV:L/AC:H/PR:H), so there is no remote or unauthenticated path, and no public exploit has been identified at time of analysis. The issue is rated low severity (CVSS 3.9) and is remediated in NXPNfcRdLib 07.18.00 and later, making patching straightforward for teams able to update the library.
A domain-denylist bypass in Pydantic AI's local web-fetch tooling (web_fetch_tool and the WebFetch local fallback) lets an attacker-influenced model reach a host the operator explicitly placed in blocked_domains by supplying a DNS-equivalent spelling - an IDNA/fullwidth form, a non-ASCII label separator, a case variation, or a trailing root label - that does not string-match the configured entry but resolves to the same host. Affected are pydantic-ai and pydantic-ai-slim versions 1.77.0 through 1.107.5 and 2.0.0b1 through 2.44.0; the flaw is a denylist bypass only, so configurations that use allowed_domains fail closed and are unaffected, and the private-IP and cloud-metadata SSRF protections remain effective, meaning internal or metadata endpoints are not reachable through this bug. Rated CVSS 3.1 3.7 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) as a low-severity, high-complexity information-fetch issue, with no public exploit identified at time of analysis and vendor patches available in 1.107.6 and 2.44.0.
Silent in-place corruption of caller-supplied buffers occurs in the npm package msgpack5 before version 6.1.0 whenever the decoder parses a negative signed 64-bit integer (MessagePack int64, 0xd3): the two's-complement negation is written back into the very bytes of the caller's input buffer. The bug is network-reachable but high-complexity to exploit and low-impact - CVSS 3.1 base score 3.7 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N, unauthenticated per the PR:N vector) - because it yields no code execution, no memory disclosure and no denial of service; the only consequence is that an application which retains or reuses the same buffer after decoding (for integrity/hash checks, logging, or later re-processing) may see silently altered values. Only negative int64 values are affected; positive integers and all other MessagePack types are untouched, applications that discard or copy the input before decoding are unaffected, and there is no public exploit or CISA KEV record - confirmed active exploitation has not been reported and no POC was identified at time of analysis. Version 6.1.0 contains the vendor fix.
GnuTLS 3.8.13 incompletely enforces X.509 name constraints during certificate-chain validation, allowing an attacker who already controls a constrained subordinate Certificate Authority to issue certificates for domains outside its permitted namespace and thereby bypass cross-domain PKI restrictions. The victim must be a relying party using the affected version to validate such a chain; the forged certificate is then accepted without user interaction, yielding limited confidentiality and integrity impact. No public exploit code or confirmed active exploitation was identified at time of analysis, and EPSS is very low (0.12%, 2nd percentile), while our independent assessment rates the issue more severely than the vendor-published CVSS 3.7 because successful abuse of a trusted-CA position fully defeats the name-constraint control.
Certificate validation bypass in GnuTLS 3.8.13 allows an attacker who can introduce a crafted end-entity X.509 certificate into the verification path to obtain sensitive information, because the library fails to reject certificates carrying a contradictory combination of Key Usage (KU) and Extended Key Usage (EKU) values. The flaw is remotely reachable without authentication or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N, C:H/I:N/A:N), and CISA's SSVC assessment rates it automatable with partial technical impact; no public exploit has been identified at time of analysis and the issue is not in CISA KEV. Exploitation is meaningful only where a consuming application actually relies on KU/EKU constraints for its trust decisions, and it requires a man-in-the-middle position on the TLS path or control of a server or endpoint the victim connects to.
Stored cross-site scripting in Eimzamip versions v1.6.4 up to but not including v1.6.7 allows an authenticated user to persist script-related HTML into a field that is later rendered to other users without neutralization. Exploitation requires a valid low-privileged account (PR:L per the assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N vector) plus a second user who views the poisoned page (UI:R), so unauthenticated or fully automated mass attacks are not possible. At CVSS 3.5 this is a low-severity issue; no public exploit has been identified at time of analysis, and CISA's SSVC decision data records Exploitation: none and Automatable: no.
The Magic: The Gathering Arena Windows/Steam client (builds 2026.59.30.12801.127931.6 and certain later 2026.60.x builds) hands a server-supplied home-screen carousel GoToExternalUrl value straight to the Windows shell via Application.OpenURL/ShellExecuteW without validating the URI scheme or domain, so any URI-scheme handler registered on the host - including ones a client would never expect, such as ms-calculator: - can be invoked with no user interaction. Exploitation requires the attacker to already control the carousel content delivered to clients, either by compromising the game's content backend or by intercepting the content channel on an adjacent network; that precondition is the primary limiter and is why this is assessed as a low-priority issue despite the unusual primitive (CVSS 3.1 base 3.4; NVD AV:A versus an assessed AV:N with AC:H, PR:N, UI:N, S:C, and only low integrity impact). There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, though a public technical writeup of the flaw exists; the practical impact is further bounded by which dangerous scheme handlers happen to be registered on a victim machine and whether one of them can be chained into a separately exploitable action.
Authenticated agents can bypass per-record authorization in the Appointment Booking Plugin (LatePoint) before 5.6.9, enabling them to read and modify other agents' profile data and read other agents' bookings and customer details when the optional AI Abilities API feature is enabled. The flaw is a CWE-639 authorization bypass via user-controlled keys. No public exploit code or active exploitation has been identified, and the assessed CVSS is low (3.3) due to the requirement for an authenticated agent account and the optional feature.
Booking Calendar, a WordPress plugin, fails to restrict which WordPress options a lower-privileged user can retrieve through one of its settings handlers, so an authenticated account holding the Editor role or higher can read the values of arbitrary entries in the site's options table - including core site configuration - in plugin versions from 10.15 up to but not including 11.8.3. The issue is rated CVSS 3.1 2.7 (AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N), reflecting a network-reachable but high-privilege-only path with limited confidentiality impact and no integrity or availability effect. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the practical risk is concentrated on sites that hand Editor-level access to untrusted or compromised accounts. A vendor-released patch exists: 11.8.3.
Authenticated WordPress users holding contributor-level access or higher can clone, modify, reorder, and write plugin metadata onto galleries and images owned by other users on any site running the Image Photo Gallery Final Tiles Grid plugin before 3.6.14. The root cause is incomplete object-ownership verification in the plugin's gallery and image management actions, where authorization is checked against a different object than the one being acted on or omitted entirely, producing a low-integrity authorization bypass with no confidentiality or availability impact. No public exploit code or active exploitation has been identified at time of analysis, and real-world risk is low because an attacker must already possess a contributor account on the target site; a vendor-released patch is available in version 3.6.14.
Cross-site user data disclosure in the SMS Alert WordPress plugin before 4.0.1 allows an administrator of one subsite on a WordPress multisite network to retrieve stored billing phone numbers belonging to users of other subsites on that network. The flaw only affects multisite installations, and exploitation further requires the SMS Alert SMS gateway credentials to be configured and stored on the acting administrator's own site; the attacker must already hold administrator privileges on at least one subsite (CVSS vector PR:H, authenticated), so this is realistically a cross-tenant disclosure by a trusted or compromised admin rather than unauthenticated remote exploitation. Scoring is low (vendor score 2.7; our assessment is CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N), no public exploit code has been identified at time of analysis, and there is no indication of active exploitation (not in CISA KEV); patched plugin version 4.0.1 is available from the vendor.
Irreversible deletion of orders, customers, and transactions stored by the Appointment Booking Plugin for WordPress is possible for authenticated backend staff users in all versions before 5.6.5, because the plugin's deletion routine never confirms that the acting staff account is authorized for the specific record it is asked to remove. An attacker holding a record-scoped staff role (for example, a staff member whose scope is limited to their own appointments) can supply an arbitrary record identifier and destroy data belonging to other staff or entirely outside their assigned scope, and the deletion cannot be undone. The vulnerability is network-reachable and requires no user interaction, but the principal barrier is the prerequisite of an existing backend staff login, which keeps the practical risk low and consistent with the vendor's 2.7 score; no public exploit code has been identified at time of analysis.
Heap out-of-bounds write in Mutt's convert_file_from_to() charset conversion routine can be triggered when a user adopts an attacker-supplied email message as a composition template, letting a crafted Content-Type header drive the conversion past the end of an allocated buffer. Exploitation is local and user-driven: the victim must deliberately invoke the template workflow on the malicious message (CVSS 3.1 AV:L/AC:H/PR:N/UI:R, base score 2.5; the internal assessment results in the same base metric group with a Low rather than None availability impact), and favorable memory conditions are needed for the out-of-bounds write to occur reliably. Mutt versions up to and including 2.4.2 are affected per EUVD, no public exploit has been identified at time of analysis, and no vendor-released patch version is confirmed in the available data.
Information disclosure in Pydantic AI's OpenTelemetry instrumentation (vulnerable ranges >= 0.3.4, < 1.107.6 and >= 2.0.0b1, < 2.44.0) lets sensitive agent content reach telemetry backends even when the content-redaction setting InstrumentationSettings(include_content=False) is enabled, because exception events, exception stack traces, error status descriptions, and the serialized model_request_parameters attribute were never covered by that setting. Affected deployments must have OpenTelemetry instrumentation active, must have configured include_content=False, and must actually hit an error path - a tool ModelRetry/ToolFailed, a tool-code exception, a validation error, or a failed model request, embedding, or image-generation call - for the leak to occur; data reaches only parties who already have read access to the configured telemetry backend, so no new access to agent data is granted. There is no public exploit identified at time of analysis, no CISA KEV listing, and the assessed severity is low (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N), with vendor-released patches available in 1.107.6 and 2.44.0.
Pydantic AI's OpenTelemetry instrumentation fails to redact validation-retry prompt content from exported telemetry, so agents configured with InstrumentationSettings(include_content=False) can still leak model-generated invalid values into span attributes such as gen_ai.input.messages and pydantic_ai.all_messages. Only deployments using structured output modes that skip tool calls (NativeOutput or PromptedOutput) or output validators on text output are exposed on this specific code path; tool-call retries and installations that never set include_content=False are unaffected. Disclosure is limited to parties able to read the telemetry backend, and no public exploit code or confirmed active exploitation has been reported; assessed CVSS is low (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N, CVSS 4.0 base 2.3).
Incorrect type conversion in the BeamMCP (beam_mcp) Elixir library from 0.1.0 before 0.10.1 causes an authenticated MCP client's JSON boolean and null tool arguments to arrive at the host's dispatch function as the Elixir strings "true", "false" and "nil"; because a string is truthy in Elixir, a host that branches on truthiness - for example `if args.dry_run` or a `confirm: false` guard - evaluates a client-supplied false as though it were set. The same normalization applies to prompts/get arguments on versions 0.5.0 and later, while the practical impact is bounded: the client could have sent true directly, so only hosts or policy layers whose false branch diverges from their true branch are meaningfully affected, and an attacker must already be an authorized MCP client (CVSS 4.0 base 2.3; assessed CVSS 3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N). No public exploit has been identified at time of analysis and CISA SSVC records no exploitation; a vendor-released patch (0.10.1) is available.
Incorrect client-IP attribution inside the Brocade Fabric OS web management daemon lets an authenticated, adjacent-network attacker win a timing race and potentially slip past AAA evaluation or Calling-Station-ID ACL policies on switches running Fabric OS before 10.0.1. Because the PAM modules in the multi-threaded execution pool can pick up stale or mismatched client IP addresses and switch context numbers, audit records can be misattributed and IP-keyed policy decisions can be made against the wrong session. Impact is limited to integrity of low severity (CVSS 4.0 2.1 / assessed CVSS 3.1 5.0-style low), exploitation is probabilistic rather than reliable, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Race-condition information disclosure in Brocade Fabric OS before 10.0.1 allows a low-privilege authenticated attacker on an adjacent/management network to obtain limited management or configuration data belonging to another concurrent FCIP request. The issue requires precise timing to win the narrow window between address-variable population and response construction, making exploitation non-deterministic and limited to partial data exposure; no public exploit identified at time of analysis. With CVSS 2.1 and no integrity or availability impact, this is a low-priority information disclosure issue.
Heap buffer overflow in the MongoDB PHP Driver's BSON encoder can corrupt process memory or crash the PHP process when an application encodes a string near 4 GiB under a non-default runtime configuration that permits multi-gigabyte values. The vulnerability requires local access (AV:L) and low privileges (PR:L), and per the independent assessment, exploitation hinges on a specific attack requirement (AT:P) - the enabling configuration - making real-world risk low. No public exploit code or active exploitation (KEV) has been identified at time of analysis. The CVSS 4.0 base score is 2.0, and the independent CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L) confirms limited impact (low integrity and availability) with no confidentiality loss.