Stored cross-site scripting in the Cloudron Branding Footer setting (versions 9.1.7 and 9.2) allows an authenticated administrator to persist crafted HTML containing JavaScript event handlers, which is then rendered without adequate sanitization on the public login / OpenID interaction page and in the System Event Log. Because the affected pages are viewed by other users - including unauthenticated visitors reaching the login page - attacker-controlled JavaScript executes in the Cloudron web origin, enabling limited data theft or manipulation of the affected page; the CVSS vector scores this 5.9 (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L). Exploitation requires a high-privileged admin account plus a victim loading an affected page, and no public exploit code was identified at time of analysis.
pacioli-guard 0.9.6 fails to check that a consent marker actually authorizes a cancellation, so a nested Document.cancel() call can ride a valid human-minted submit marker belonging to an enclosing governed act and reverse the ledger effect of a different, caller-named pre-existing submitted document such as a Sales Invoice. The flaw is an incorrect-authorization defect (CWE-863) that bypasses the marker's document binding, act binding, single-use spend accounting, and denial audit, and it is reachable by an authenticated API-key credential holding Scope.require_consent (PR:L) only after a legitimate human has minted the enclosing submit marker (UI:R), which is why it rates a medium CVSS 5.7. Principals without a consent-gated grant are explicitly unaffected, and no public exploit has been identified at time of analysis - there is no CISA KEV listing for this CVE.
Missing authorization in the ThemeGrill User Registration WordPress plugin, affecting all releases through 5.2.7, lets remote attackers (no authentication or user interaction required per the reported CVSS vector) invoke functionality that should be gated behind capability or role checks, with limited confidentiality, integrity, and availability impact. The reported CVSS 5.6 with AC:H reflects that successful exploitation likely depends on a specific plugin feature, role/permission configuration, or application state rather than working against every default install. No public exploit code and no confirmed active exploitation have been identified at time of analysis, and the available data does not name the precise vulnerable endpoint, so the modified/affected action must be confirmed from the Patchstack advisory.
Privilege escalation in the Ultimate Member WordPress plugin (all versions through 2.13.1) arises from an incorrect privilege assignment that lets a user reach permissions beyond those they should legitimately hold. The assessed vector - CVSS 5.6 (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L) - combines high attack complexity with low-privileged access, meaning exploitation depends on specific conditions rather than a single trivial request, and the resulting confidentiality, integrity, and availability impact is limited rather than site-takeover grade. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (not in CISA KEV), so this should be treated as a moderate-priority patch item for any WordPress site running the plugin at or below 2.13.1.
Stored cross-site scripting in the login theme rendering component of Keycloak (and its downstream Red Hat Build of Keycloak and Red Hat Single Sign-On 7 products) lets a realm administrator inject malicious JavaScript into display fields that is later executed in the browsers of users loading the affected realm's login page. Exploitation requires an authenticated realm administrator (CVSS PR:H) who can both reach the theme display fields and bypass the input-sanitizing security filter, so this is a privilege-abuse or post-compromise vector rather than an anonymous remote attack; impact is limited to the confidentiality and integrity of affected users' sessions (C:L/I:L) with no availability impact. There is no public exploit identified at time of analysis and no CISA KEV listing; overall this is a genuine but modest-priority issue rather than a high-urgency crisis.
Opening a specially crafted XCF file in GIMP can crash the application through a NULL pointer dereference in the XCF loader's handling of image-simulation-intent and image-simulation-bpc parasites that carry zero-size data. The issue is confined to a denial of service of the GIMP process - there is no code execution, privilege escalation, or data exposure - and exploitation requires local access plus the victim manually opening an attacker-supplied file (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, 5.5). No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (not in CISA KEV), though Red Hat tracks the affected GIMP packages shipped in RHEL 6 through RHEL 10; this is a genuine but low-priority issue.
Denial of service in OpenPrinting CUPS before 2.4.20 lets a crafted Print-Job IPP request terminate the cupsd scheduler, taking every queue it serves offline with it. Repeated IPP group tags cause the parser to create unnamed separator attributes (IPP_TAG_ZERO) that add_job() re-tags as IPP_TAG_JOB; when the job starts, get_options()/ipp_length() calls strlen() on the NULL attribute name and crashes the daemon (CWE-476). The vendor scores this 3.3 on a local vector, while our assessment rates it CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, since an attacker who can reach the scheduler and submit to an enabled, accepting queue supporting the submitted document format can cause it; PR:L in the assessed vector indicates authenticated access is normally required, with anonymous submission possible only where listener and access-control configuration explicitly allow it. No public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); this is a low-severity availability issue rather than an urgent priority for most environments.
Resource exhaustion in OpenPrinting CUPS (all versions through 2.4.20) lets an authorized print submitter stall the scheduler's job-timeout handling, so incomplete jobs accumulate until MaxJobs is exhausted and further legitimate print submissions are rejected. The defect in cupsdCheckJobs() suppresses submission-timeout processing for every pending job whenever any client connection holds an in-flight Send-Document operation, without matching that connection to the job being examined (CWE-770); per the independent assessment the attack surface is AV:N/AC:L with PR:L, meaning the attacker must already be a principal permitted to reach the IPP/HTTP service and allowed to submit Create-Job requests, not an anonymous outsider. Impact is transient and self-correcting once the held connection closes, with no persistence, data exposure, or effect beyond blocking new jobs; no public exploit code and no CISA KEV activity were identified at time of analysis, and the independent assessment rates this as a genuinely low-priority issue.
Denial of service in OpenPrinting CUPS before 2.4.20 lets a local, low-privileged user crash the cupsd scheduler by submitting a print job with the job-held-on-create attribute that references a temporary printer, which can then be auto-deleted while the held job still references it, triggering a NULL pointer dereference in cupsdCheckJobs(). The crash occurs when cupsdFindDest() returns NULL during the holding_new_jobs check, terminating cupsd and interrupting every queue it manages. Exploitation requires the temporary-printer feature (auto-created for shared or network-discovered destinations) to be in use and depends on timing between held-job submission and automatic printer cleanup, giving high attack complexity (AC:H) and availability-only impact (CVSS 5.1, C:N/I:N/A:H); no public exploit code has been identified at time of analysis.
Denial of service in libhangul can be triggered by a specially crafted Hanja dictionary file that contains an entry with a key but no valid value; parsing the file dereferences a NULL pointer and crashes the consuming application. Affected deployments include Red Hat Enterprise Linux 6 through 10 where the library is packaged, as well as any application that loads and queries such dictionaries. The CVSS vector (AV:L/PR:N/UI:R) means local delivery and user interaction are required, no privileges are needed, and impact is availability-only; no public exploit has been identified at time of analysis.
An authorization bypass (IDOR) in Jexactyl 4.0.0 through 4.0.5 allows any authenticated user to renew or unsuspend another tenant's billable game server by submitting an arbitrary server_id to the POST /api/client/billing/free/process endpoint, which loads the server without scoping the lookup to the caller's own account. Exploitation requires billing to be enabled, the target server to be billable with a non-null renewal_date more than seven days in the future, and a valid account on the instance - no ownership or subuser relationship to the victim's server is needed, only knowledge of its server_id. The impact is bounded to unauthorized renewal/unsuspension actions (no data disclosure or code execution) with CVSS 5.4; no public exploit code identified at time of analysis, and the vendor fix is available in version 4.0.5.
Missing authorization in the Cool Plugins 'AI Translation for Polylang' WordPress plugin (through version 1.6.2) allows an authenticated, low-privilege user to reach plugin functionality that is gated only by an absent or incorrectly configured access-control check (CWE-862). Exploitation requires a valid account on the target site - consistent with the CVSS PR:L metric - so sites that allow open registration or that grant contributor/subscriber roles broadly are the most exposed; impact is bounded to partial integrity and availability (C:N/I:L/A:L), with no confidentiality loss and no server-side code execution implied by the assessed vector. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS score was supplied in the intelligence feed, so this is best treated as a moderate-severity hardening issue rather than an emergency.
Authenticated low-privilege users on WordPress sites running the bPlugins 'Before After Image Comparison - Image comparison for WP' plugin (all versions through 1.1.21) can reach plugin functionality that lacks proper authorization checks, allowing them to read and alter data the plugin is intended to restrict (CWE-862, CVSS 5.4). The defect is remotely reachable over the network with no user interaction (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N), so any site that allows self-registration or hosts multiple untrusted accounts provides the necessary foothold, while single-administrator sites with no untrusted users face minimal realistic exposure. No public exploit code was identified at time of analysis and there is no confirmed active exploitation, but the low privilege prerequisite and network reachability make the prerequisite account easy to obtain on open-registration deployments.
Local denial of service in the illumos reparsed daemon (reparsed) lets a low-privileged authenticated local user crash the daemon and, through repeated requests, drive the svc:/system/filesystem/reparse service into maintenance. The bug is a stack buffer overflow (CWE-121) in the nfs-basic reparse plugin's get_fs_locations(), which copies attacker-supplied host and path components of a reparse string into a fixed 1024-byte stack buffer with no length validation, reachable because the door at /var/run/reparsed_door is world-readable and the door server does not verify caller credentials. Exploitation is availability-only on default builds (stack protection aborts the process rather than yielding code execution), no public exploit code has been identified at time of analysis, and the affected service is disabled by default, which substantially limits real-world exposure; this is a genuinely low-priority, availability-only issue despite the stack-based overflow classification.
NULL pointer dereference in the illumos Network Auto-Magic daemon (nwamd) allows any local user to crash the daemon - and, by repeating the call, to drive the svc:/network/physical:nwam service into maintenance so automatic network configuration stops - by issuing a door_call() with no argument data to the world-accessible nwam_door at /etc/svc/volatile/nwam/nwam_door. Every illumos distribution built before illumos-gate commit 0f1064d97f1a43778ddf87d4e438b99872aed1a0 is affected (the flaw dates to the 2010 commit 6ba597c5), and OmniOS is explicitly named in the affected-product CPE data, though exposure is materially limited because nwamd only runs when svc:/network/physical:nwam is enabled, which is not the illumos default. Impact is availability-only (CVSS 4.0 base 5.4; assessed CVSS 3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) with no confidentiality or integrity loss; the CVSS 4.0 vector rates exploit maturity as Proof-of-Concept (E:P), while the issue is not in CISA KEV and no active exploitation is confirmed.
Denial of service in the ipmgmtd IP management daemon on OmniOS r151020 and later and on SmartOS: an unprivileged local user can abort the daemon by sending a configuration-modifying door request, such as IPMGMT_CMD_RESETIF, even though the request is correctly rejected for lacking the solaris.network.interface.config authorization. The crash stems from a double free (CWE-415) in ipmgmt_handler()'s authorization-failure path, and repeated requests push the svc:/network/ip-interface-management service into maintenance, leaving the host unable to configure IP interfaces. Impact is availability-only (no confidentiality or integrity effect), exploitation requires a valid local account (CVSS 3.1 base 5.4; assessed A:H with PR:L), the defect is not present in upstream illumos-gate, and it is not confirmed as actively exploited (not in CISA KEV); the CVSS 4.0 vector records exploit maturity as proof-of-concept (E:P) rather than active exploitation, and vendor fixes exist as downstream commits.
Stored cross-site scripting in Talassoft Industrial Management Software (TMT Machinery Industry and Trade Co. Ltd.) before V16.0.1 allows an authenticated user with the ability to write into a persisted field to plant un-neutralized JavaScript that executes in the browser session of any other user who later loads the affected page. Exploitation is not self-triggering and is not remote-unauthenticated: the attacker must already hold valid credentials with sufficient write privilege (PR:L) and must wait for a separate victim to view the injected content (UI:R), which confines impact to limited confidentiality and integrity loss within the victim's browser context (C:L/I:L, no availability impact) and yields a moderate CVSS 3.1 base score of 5.4. There is no public exploit identified at time of analysis, and no KEV or EPSS signal was supplied with the source data; the issue is reported by TR-CERT and affects all releases prior to V16.0.1.
Authentication bypass in the Automattic Jetpack WordPress plugin, affecting all versions through 16.2, allows unauthenticated remote attackers to abuse the plugin's password-recovery flow and reach an authenticated state without valid credentials. No user interaction is required (PR:N/UI:N), but the assessed vector carries high attack complexity (AC:H), meaning the attacker must satisfy conditions outside their direct control - likely a timing/race window or a specific state in the recovery process - which limits reliable exploitation. Impact is partial (C:L/I:L, A:N) rather than full account or site takeover, and no public exploit code or confirmed active exploitation has been identified at time of analysis.
Authenticated users with only low-level privileges on a WordPress site running the WP Event Manager plugin (all versions through 3.4.1) can reach plugin actions and data that should require higher capabilities, because the plugin fails to enforce authorization checks. The flaw is a Missing Authorization issue (CWE-862) rated CVSS 3.1 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N): it is not remotely unauthenticated, and impact is limited to partial confidentiality and integrity loss with no availability impact. No confirmed active exploitation (CISA KEV) and no public exploit code were identified from the available data; risk is materially higher on sites that allow open user registration or host multiple semi-trusted accounts, and lower where all registered users are fully trusted.
A remote denial-of-service condition in x64dbg-MCP Server before version 1.2 lets an unauthenticated network client crash the debugger and destroy any active debugging session by sending a crafted HTTP request with a near-maximum Content-Length value. The unbounded value is parsed and then used in an unchecked integer addition inside wsRecv() before the token check runs, so no credentials are required, and pre-1.2 builds bind the listener to 0.0.0.0 by default, making the endpoint broadly reachable. The resulting integer-overflow panic only terminates the process in Debug and ReleaseSafe builds (a ReleaseFast build would not panic), so the impact is limited to loss of availability rather than memory corruption or code execution; there is no confirmed active exploitation and no public exploit code identified at time of analysis.
Resource exhaustion in OWASP Coraza WAF 3.0.0 through 3.7.x lets an unauthenticated remote attacker (CVSS vector PR:N/UI:N) drain the host process's file-descriptor table by submitting a multipart/form-data body built from tens of thousands of minimal file parts, each of which holds an open temporary-file descriptor until the entire request returns. Because the default 128MB body limit caps bytes rather than part count, roughly 6.8MB of ~104-byte parts is enough to reach the Linux default 65536-descriptor ceiling, after which os.CreateTemp calls fail, the MULTIPART_STRICT_ERROR flag is set (causing CRS rule 200001 to return 400s, including for legitimate traffic), and the process can no longer open files or sockets - a process-wide availability impact that our assessment rates High, in contrast to the vendor-issued 5.3 score that rates availability only Low. The leak is transient (descriptors are released when the request ends), so sustained denial requires repeated or concurrent flooding, and it only affects deployments that actually inspect multipart bodies with filesystem-backed temp storage. No entry appears in CISA KEV and no confirmed active exploitation has been observed, but the vendor advisory ships a public proof-of-concept reproducer; the flaw is fixed in 3.8.0.
Stored mutation cross-site scripting in SmarterMail builds before 9777 allows an unauthenticated remote attacker to execute arbitrary script inside a victim's authenticated webmail session by delivering a crafted iCal calendar message whose body hides an <img src=x onerror=...> payload inside a <style> element nested in MathML foreign content (<math><mtext><mglyph>); the script fires as the recipient opens the message at /interface/message-iframe. The root cause is a sanitizer parsing differential - the custom HTML sanitizer treats the nested <style> as inert CDATA while browsers reparse it as live markup - and a permissive Content-Security-Policy does not block the resulting execution or data exfiltration. Vendor-scored CVSS 4.0 5.3 and the independently assessed CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N agree on a medium-severity, browser/session-confined impact; exploitation requires the victim to open the message, no public exploit code was identified at time of analysis, and there is no CISA KEV entry. Vendor-released patch: SmarterMail build 9777 (Oct 8, 2026).
Authenticated WordPress users holding only low-level permissions can create and publish Envira galleries they are not entitled to, and can bind image attachments they do not own into those galleries, when the site runs Envira Gallery Lite before 1.16.2. The root cause is a missing authorization check (CWE-862) in the plugin's gallery conversion REST endpoint, which validates edit rights on a source post instead of the capability required to create or publish galleries, and then writes a hard-coded publish status; caller-supplied image IDs are accepted without ownership verification. Impact is confined to integrity - unauthorized gallery creation and improper reuse of existing media - with no confidentiality or availability loss; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor has published a fixed release.
Missing authorization enforcement in the WordPress plugin "Restrict User Access - Membership Plugin with Force" (all releases through 2.8.1) allows unauthenticated remote attackers to bypass the plugin's content restrictions and read material that is meant to be limited to specific membership or security levels. Exploitation depends on the site having access-control "security levels" that are incorrectly configured, which is the primary limiting factor; where that condition holds, no authentication or user interaction is required and attack complexity is low per the CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector. Impact is bounded to unauthorized read access (C:L only, no integrity or availability effect), and no public exploit has been identified at time of analysis and the CVE is not in CISA KEV, so this is a moderate-severity issue rather than an emergency; EPSS data was not supplied with this report.
Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 can leak sensitive information through generated error messages when an unauthenticated remote attacker is able to provoke a specific application error condition. The assessed CVSS of 3.7 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) reflects that exploitation is high-complexity with confidentiality-only impact, and no public exploit code or confirmed active exploitation was identified at time of analysis. This is a genuinely low-priority issue whose signals are internally consistent rather than conflicting.
Information tampering in Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 arises because the product treats a less trusted source as authoritative (CWE-348), allowing data accepted from that source to be falsified. An unauthenticated, remote attacker (CVSS vector PR:N, AV:N) can trigger the condition without user interaction, but the high attack complexity (AC:H) means a specific precondition must be met first - for example a favorable network position to spoof or inject responses, or winning a timing/trust-state race - so it is not reliably reproducible. Impact is confined to low-level integrity tampering (I:L) with no confidentiality or availability effect, making this a genuinely low-priority issue despite being network-reachable and unauthenticated; no public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV).
Unauthenticated remote requests to pyLoad's /web/<path:filename> route render Jinja2 page templates that are otherwise gated behind @login_required on their direct routes (/logs, /settings, /queue, /dashboard), and a typo in the exception handler (exc.desc instead of exc.description) causes internal Jinja2 variable names such as "'conf' is undefined" to be echoed in HTTP 500 response bodies. The behavior affects pyLoad (pyload-ng) up to and including 0.5.0b3.dev100 on default installs with the WebUI reachable on port 8000 (CVSS 3.1 base 5.3, AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N); per the CVSS vector, no authentication is required. Impact is confined to template rendering, information disclosure and template-name enumeration (200 vs 500 differentiation) - no download/queue data exfiltration, write, or code execution - and the upstream GHSA ships step-by-step curl reproduction commands, though no public weaponized exploit is referenced in the supplied data. Note that info.html's sensitive values (Python version, OS platform, install/config folders, port) are populated client-side via JavaScript, so server-side leakage is largely limited to field labels and structure.
Nginx UI versions 2.2.0 up to but not including 2.6.0 mis-attribute client identity when the application is reached through its bundled reverse proxy without trusted-proxy configuration, so every request appears to originate from loopback. The practical unauthenticated impact (CVSS 5.3, PR:N) is a shared, temporary login ban: failed password or OTP attempts from different external clients are all counted against 127.0.0.1, letting an attacker lock out the login endpoint for legitimate users without invalidating existing sessions. A separate consequence is that management requests can satisfy the loopback exception in the IP allowlist, but this path is strongly limited because valid credentials are still required, so it does not amount to authentication bypass or account takeover. No public exploit code has been identified at time of analysis, and the issue is fixed in version 2.6.0.
An authenticated low-privilege user of openPDC can abuse the Modbus connection feature to make outbound connections to arbitrary internal destination addresses and ports, because the destination input is caller-controlled and not validated against any allow-list. The result is a server-side request forgery (CWE-918) condition that leaks reachability information - an attacker can distinguish which internal hosts and ports respond and, through repeated probes, gradually map the internal network - but no data theft, code execution, integrity, or availability impact is possible. The vulnerability is rated 5.3 under both the vendor's CVSS 4.0 vector and the independent CVSS 3.1 assessment (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), reflecting that valid credentials are mandatory and the only confirmed impact is limited confidentiality disclosure; there is no public exploit identified at time of analysis and no confirmed active exploitation.
Missing authorization checks in the WordPress plugin Scripts n Styles (unFocus Projects) through version 3.5.8 let unauthenticated, remote attackers reach functionality or data that should be restricted to privileged users. Because the CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N (base 5.3), no credentials, no user interaction and no non-default configuration are required - any site with the plugin installed and active at or below 3.5.8 is exposed, with impact bounded to low confidentiality loss and no integrity or availability effect. There is no evidence of active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, and no EPSS score was supplied; risk is therefore driven primarily by the plugin's presence and version rather than confirmed threat activity. The advisory, reported by Patchstack, does not disclose the specific vulnerable sub-functionality.
Reflected cross-site scripting in the BeeTienda e-commerce platform allows a remote attacker to execute arbitrary JavaScript in a victim's browser via the product list endpoint's 'search' parameter, which is reflected without proper sanitization. INCIBE-CERT reports the flaw in the latest demo version, and exploitation requires the victim to click an attacker-crafted link while the impact is confined to the victim's browser session rather than the server. No public exploit code was identified at time of analysis, and the issue is rated medium severity (CVSS 4.0 base 5.1).
SQL injection in the wp-post-author WordPress plugin before version 4.1.0 lets an authenticated attacker with high privileges inject arbitrary SQL through a plugin endpoint, allowing disclosure of data stored in the underlying WordPress database. The flaw is rated CVSS 3.1 4.9 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N), so exploitation requires an existing high-privilege account on the target site, no user interaction, and the impact is limited to confidentiality - integrity and availability are unaffected. There is no confirmed active exploitation (not listed in CISA KEV) and no public exploit code identified at time of analysis, though the low complexity of the attack path means this should be treated as a realistic post-compromise or insider data-exfiltration vector on multi-author WordPress installations.
Heap-based buffer overflow in Affinity by Canva for macOS before 3.3.1 allows a crafted Affinity document to corrupt memory in the QuickLook thumbnail/preview extension the moment the file is displayed or its containing folder is browsed in Finder, causing the preview process to crash. The bug stems from an integer overflow in image-buffer size calculation when generating QuickLook thumbnails and previews (CWE-122), rated CVSS 4.9 (AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L); exploitation requires the malicious file to already be on local storage and demands precise crafting of size metadata plus heap grooming, so overall risk is low-to-moderate. No public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor fix is available in version 3.3.1.
Jetpack WordPress plugin versions through 16.2 contain an authentication bypass in the password-recovery workflow, allowing remote unauthenticated attackers to achieve limited account compromise. The vulnerability requires specific conditions to be met (high attack complexity per CVSS), and no public exploit identified at time of analysis; with a CVSS score of 4.8, it represents a moderate-severity issue that should be addressed but is not a top-priority emergency.
An authenticated insecure direct object reference in CiviForm before 3.33.0 lets a Trusted Intermediary read the display name and email address of applicants belonging to other trusted intermediary groups by enumerating account IDs through GET /admin/tiDash/editClientForm/:accountId. The route enforces the Trusted Intermediary role but the downstream showEditClientForm handler performs a raw lookupAccount(accountId) without verifying that the citizen account falls inside the caller's trustedIntermediaryGroup, so varying the accountId path parameter returns a different applicant's personal identifiers. Exploitation requires a legitimate, admin-provisioned Trusted Intermediary account, the disclosed data is limited to name and email (not full application contents), and the fix ships in version 3.33.0; no public exploit code or confirmed active exploitation was identified at time of analysis, and the risk is a moderate-severity authorization flaw rather than a broad data breach.
Opening a maliciously crafted Affinity document in Affinity by Canva builds prior to 3.3.1 can trigger an out-of-bounds read and dereference of an untrusted pointer, resulting in memory corruption or an application crash. Exploitation is file-based and local rather than remote: a victim must open the attacker-supplied document (UI:R) and the malformed raster data must reliably drive the fault across variable memory conditions, making attack complexity high and yielding only a CVSS 3.1 base score of 4.5 (AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L). No public exploit code exists and the issue is not confirmed actively exploited (it does not appear on CISA KEV); our assessment rates this a genuinely low-to-moderate priority memory-safety defect.
Out-of-bounds reads in MariaDB Server's legacy mysql_json plugin can expose memory contents or crash the server when the plugin parses a specially crafted MySQL-origin table containing invalid MySQL binary JSON. The flaw affects MariaDB 10.6.1 and later branches up to (but excluding) 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, and is only reachable when tables imported from MySQL must be read through the mysql_json compatibility path - for example during ALTER TABLE ... FORCE. The CVSS vector (AV:L, PR:N, UI:R, S:U, C:L, I:N, A:L, score 4.4) confirms this is a local, interaction-driven issue rather than a remotely exploitable one; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and vendor patches are available.
Mindwtr mobile versions prior to 1.1.5 persist the Cloud sync bearer token and WebDAV password as plaintext in React Native AsyncStorage (@mindwtr_cloud_token and @mindwtr_webdav_password), allowing anyone who can read the app's private storage - via a rooted/jailbroken or physically possessed device, or an unencrypted device backup that captures AsyncStorage - to recover those credentials and reach the user's synchronized tasks and attachments. Per the CVSS vector (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, base 4.4), this is a locally-scoped, high-privilege information disclosure with no remote or network vector and no user interaction; only users who actually enabled self-hosted Cloud sync or WebDAV sync in an affected build are exposed. There is no public exploit code identified and no CISA KEV listing - this is a low-to-moderate local credential-at-rest weakness rather than an urgent remote threat, and it is fixed in version 1.1.5.
Improper access control in Contao CMS 5.7.0 through 5.7.11 lets an authenticated, low-privileged backend user read, create, update, or delete records in Data Container tables that fall outside their assigned module permissions - including tables holding member records and newsletter-subscriber e-mail addresses. The root cause is a caching defect in TableAccessVoter, which stores authorization decisions under a key built only from the user's security token and omits the table name returned by getDataSource(), so a decision made for a permitted table can be silently reused for a different, forbidden table within the same request, with DefaultDataContainerVoter able to turn the resulting abstention into a grant. Exploitation requires valid backend credentials and the specific request ordering of an allowed-table check preceding a denied-table check, and no public exploit code has been identified at time of analysis; the issue is rated moderate severity (vendor CVSS 4.3, assessed CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N).
Improper access control in Contao CMS 5.7.1 through 5.7.11 lets an authenticated non-administrator backend user whose group holds the preview_link module list every tl_preview_link record and lift other users' already-signed share URLs, then follow them to view unpublished or embargoed pages without holding page permission. The failure is deterministic in default configurations because a service-registration typo silently drops the ownership voter at container compile time and no createdBy SQL filter compensates, so no special setting has to be toggled on; exposure depends on having a non-admin backend account with the preview_link module granted. No public exploit code has been identified at time of analysis, the CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, 4.3) rates it low-to-medium, and the issue is fixed in 5.7.12.
All Bootstrap Blocks WordPress plugin through version 1.3.31 exposes embedded sensitive data to authenticated attackers with low-level WordPress privileges, allowing retrieval of limited confidential information from affected sites. The CVSS 3.1 score is 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), so exploitation requires an authenticated PR:L account and causes only confidentiality impact; no user interaction is needed and unauthenticated visitors cannot exploit it. No public exploit identified at time of analysis, and no CISA KEV listing is present in the provided data.
Authenticated low-privileged users with network reach to Dell Secure Connect Gateway (SCG) Policy Manager instances running versions earlier than 5.34.00.16 can supply input of an unexpected type that the application accepts without validating it, resulting in limited information exposure and limited information tampering (assessed CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N). Realistic exploitation is constrained by high attack complexity, meaning the attacker must first satisfy conditions outside their control such as a specific application state or timing, and by the prerequisite of an existing low-privilege foothold, so this is not a remote unauthenticated flaw against default configurations. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the overall risk is genuinely low rather than merely rated low.
Missing authorization in the Asgaros Forum WordPress plugin (versions through 3.4.0) lets a logged-in low-privilege account reach a forum function that should be gated by a capability check, resulting in limited information disclosure. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, score 4.3) confirms that an attacker must already hold an account on the target site - typically any registered forum member - because the flaw is a missing authorization check rather than an unauthenticated entry point, and the impact is confined to confidentiality with no integrity or availability effect. There is no CISA KEV listing and no public exploit code identified at time of analysis, so this is a moderate, low-priority issue; sites that do not allow untrusted user registration sharply reduce their exposure.
Cookie-parser confusion in OWASP Coraza WAF prior to 3.8.1 allows unauthenticated remote attackers to hide cookie-carried attack payloads from SecRules that inspect REQUEST_COOKIES or REQUEST_COOKIES_NAMES, because Coraza splits a Cookie header into name/value pairs differently than the protected backend application does. The bypass applies only when a Web Application Firewall ruleset is scoped to specific cookie names or values and the backend is a parser confirmed to trim boundary control characters - PHP's $_COOKIE and Python's http.cookies - while Node's cookie package and current Werkzeug 3.1.9 split the header the same way Coraza does, so exploitation does not apply there; the CVSS vector (AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N, score 4.0) reflects that attacker-supplied data repositions the name/value boundary across a security-authority change, producing limited integrity impact with high attack complexity and no availability or confidentiality effect. There is no public exploit identified at time of analysis, and the issue is fixed in version 3.8.1; this is a modest-severity WAF-bypass condition rather than an emergency, but operators running cookie-scoped rules against PHP or Python backends should treat it as a real detection gap.
GET-side WAF rule bypass in OWASP Coraza WAF 3.0.0 through 3.7.x lets unauthenticated attackers evade signature matching when the library is deployed through non-net/http integrations such as coraza-spoa, coraza-proxy-wasm, or custom FFI/WASM hosts. When a URI containing a raw control byte (0x00-0x1F or 0x7F) makes Go's url.ParseRequestURI fail, Coraza's error branch leaves QUERY_STRING, ARGS_GET, ARGS_GET_NAMES, and the GET-derived portion of ARGS empty, so rules targeting those variables - the default target set for most OWASP CRS GET-side rules - never fire on the attacker-controlled query content, even though a downstream component may still parse and act on it. The bundled coraza/v3/http integration is unaffected because Go net/http rejects such malformed request targets with a 400 before Coraza is invoked, and exploitation additionally requires a backend that still consumes the dropped parameters, so this is a genuine but defense-in-depth-only bypass; no public exploit code was identified at time of analysis and CVSS is 4.0 (AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N). Fixed in 3.8.0.
Null pointer dereference in OpenPrinting CUPS allows unauthenticated remote attackers who can submit jobs to a shared printer queue to crash the cupsd print daemon, causing a temporary denial of service for all printing services. Exploitation requires a vulnerable version that still ships the deprecated embedded job-ticket comment feature and a single crafted PostScript or PDF file submitted via the Print-Job operation whose first lines contain a malformed %cupsJobTicket: entry. Impact is bounded to a brief daemon crash with automatic restart-there is no code execution or data exposure-and no public exploit code has been identified at time of analysis.
Unbounded memory allocation in Apache CXF's multipart/MTOM attachment part-header parser lets a remote, unauthenticated attacker exhaust server memory and cause a denial of service by sending a single crafted multipart request. The parser applies attachment-max-header-size (default 300 characters) only per physical line and enforces attachment-headers-max-count (default 500) against distinct header names rather than total header lines, so folded continuation lines or a repeated header name slip past both limits and inflate the parsed value without bound. Affected are CXF 4.2.0 through 4.2.3, 4.0.0 through 4.1.8, and all releases before 3.6.13 that expose a multipart/MTOM-accepting endpoint; fixed releases are 4.2.4, 4.1.9 and 3.6.13. Exploitation requires no authentication (CVSS PR:N/UI:N) and no non-default configuration, but it is limited to availability impact only; EPSS is low at 0.24% (14th percentile) and no public exploit code or confirmed active exploitation was identified at time of analysis.
Authentication bypass in Apache CXF's OidcClientCodeRequestFilter renders the max_age authentication-freshness check inoperative, allowing stale OIDC sessions to be accepted regardless of age when a relying party has configured setMaxAgeOffset to enforce step-up re-authentication. The defect stems from a milliseconds/seconds unit mismatch and inverted comparison polarity, silently defeating session-age validation; affected releases are Apache CXF 4.2.0 before 4.2.4, 4.0.0 before 4.1.9, and 3.6.x before 3.6.13. Vendor patches are available, no public exploit identified at time of analysis, and EPSS is low (0.23%), though exploitation requires the non-default setMaxAgeOffset setting, limiting real-world impact to deployments that opt into max_age policies.
Concurrent token-exchange requests against Apache CXF's JPA-backed OAuth2 authorization code grant provider can redeem a single authorization code more than once, yielding multiple valid access tokens from one code. Only deployments running the JPA authorization code provider that persists codes to a shared relational database under READ_COMMITTED isolation and that expose the token endpoint to remote callers are affected; versions below 3.6.13, 4.0.0 through 4.1.8, and 4.2.0 through 4.2.3 are in scope. Exploitation is unauthenticated per the CVSS vector (PR:N) but carries a high attack-complexity rating because the attacker must already hold one unredeemed code and win a timing race, so success is probabilistic; EPSS is low at 0.22% (11th percentile) and no public exploit identified at time of analysis, making this a real-but-conditional risk rather than a mass-exploitation emergency.
Apache CXF versions prior to 4.2.4, 4.1.9, and 3.6.13 allow remote, unauthenticated attackers to cause a denial of service by submitting a very large XML document that exhausts memory and CPU during parsing. The flaw lies in StaxUtils, which by default imposes no limit on the total number of elements or characters, and is most impactful when CXF builds a DOM from the input, such as in SAAJ or WS-Security processing. No public exploit code has been identified, and deployments that enforce a request size limit are largely protected.