Cross-site request forgery in Contao CMS's backend action dispatch allows an attacker to make an authenticated backend user silently execute destructive or state-changing backend operations by simply loading an attacker-controlled URL. The flaw exists because RequestTokenListener - the only generic REQUEST_TOKEN validator in Contao - runs on POST requests only, while the GET-side guard is local and declarative and fires solely when an 'act' parameter is present, leaving every backend action dispatched through a different parameter (notably 'key=') with no CSRF protection at all; the CSRF validation added in the fix reads the token from the 'rt' query parameter. The assessed CVSS v3.1 score is only 3.5 (AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) because exploitation requires a valid backend session AND user interaction (the victim must be socially engineered into loading the crafted link), and the reachable actions are limited to modules that victim user can already access - the advisory verified only destructive/state-changing actions, not privilege escalation. Vendor-released patch: 5.3.50 and 5.7.12; no public exploit identified at time of analysis.
Subsite administrators on WordPress multisite networks running the Code Snippets plugin before 3.10.0 can activate, deactivate, and reprioritise network-scoped snippets that execute across every site in the network, because one of the plugin's snippet-management actions omits a capability check and derives the snippet's network scope from the request instead of the stored record. The issue is an authenticated authorization flaw (CWE-862, CVSS 3.1 base 3.3, vector AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:L) that only affects multisite deployments with at least one network-scoped snippet already present and an attacker who already holds administrator rights on a subsite. Publicly available exploit code exists for this issue, but EPSS is only 0.13% (2nd percentile) and there is no confirmed actively exploited (CISA KEV) status; practical impact is limited to toggling or reordering existing snippets rather than injecting arbitrary new code.
Dell Secure Connect Gateway (SCG) Policy Manager before 5.34.00.16 contains an improper check for unusual or exceptional conditions, allowing an authenticated, high-privileged remote attacker to tamper with information and bypass protection mechanisms. The flaw requires administrative-level access (PR:H), confining exploitation to malicious or compromised privileged operators; no public exploit code or active exploitation has been identified at time of analysis. Impact is limited to partial integrity and availability losses, with no confidentiality exposure, making this a low-priority issue despite the network attack vector.
Heap memory disclosure and application crashes affect Affinity by Canva before version 3.3.1 (October 2026 release), where insufficient bounds checking on arrays of strings inside Affinity document files triggers a heap buffer over-read (CWE-126). Exploitation requires unauthenticated but local delivery: a victim must be socially engineered into opening a crafted Affinity document with the vulnerable application, which is consistent with the assessed vector CVSS:3.1/AV:L/AC:H/PR:N/UI:R/C:L/I:N/A:L and a low base score of 3.6. Impact is limited - any leaked heap contents are non-deterministic and bounded by heap layout (AC:H), and the most likely practical outcome is a client-side crash rather than reliable data theft; no public exploit identified at time of analysis.
Heap buffer over-read in Affinity by Canva versions before 3.3.1 (October 2026 release) allows an attacker to disclose small amounts of adjacent heap memory or crash the application when a user opens a specially crafted Affinity document containing a malformed, incomplete UTF-8 character sequence in its text. The flaw sits in the local document text parser and is rated low severity (CVSS 3.6, AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L): exploitation is local, requires the victim to open the malicious file, and is high-complexity because meaningful disclosure depends on heap layout, with integrity impact absent and only limited confidentiality/availability effects. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has released a fixed version (3.3.1) via its trust center advisory.
Out-of-bounds heap read in Affinity by Canva for macOS before 3.3.1 (the October 2026 release) allows a crafted Affinity document to leak adjacent heap memory - including memory addresses - into the thumbnail or preview image that macOS QuickLook renders in Finder. Affected are users of the pre-3.3.1 macOS app whose QuickLook preview generator is registered with the OS; the victim only needs to select or browse to the malicious file in Finder, as automatic preview rendering triggers the bug without opening the document in the app. The issue is local-only with a high attack complexity (favorable heap layout required) and no authentication requirement (PR:N); it is not confirmed as actively exploited (no CISA KEV listing), no public exploit code was identified at time of analysis, and no EPSS score was supplied - consistent with its low assessed severity (CVSS 3.6) and its practical value as an information-leak primitive to chain with a separate vulnerability rather than a standalone compromise.
Opening a malformed Affinity document in Affinity by Canva versions before 3.3.1 (the October 2026 release) causes an out-of-bounds pointer dereference during file parsing, which crashes the desktop application. The attack requires user interaction (UI:R) to open the crafted file and a local vector (AV:L), so an attacker must rely on social engineering or a trusted-looking shared asset rather than any remote or automatic trigger. Impact is limited to availability (A:L) with no code execution, data disclosure, or integrity loss described, and no public exploit has been identified at time of analysis.
An out-of-bounds heap read in Affinity by Canva for macOS (before 3.3.1) lets a crafted Affinity document leak adjacent heap memory into the QuickLook thumbnail and preview images rendered by Finder, or crash the thumbnail/preview extension. The attack is local - the malicious file must already reside on the target Mac - and requires the victim to browse to or preview the file in Finder, which triggers the vulnerable code path; the disclosed bytes are non-deterministic, so an attacker cannot select what is exposed. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the assessed severity is low (CVSS 3.1 base 2.9).
Read-only authenticated users of MongoDB Ops Manager can retrieve daily host monitoring records belonging to projects they do not have access to, exposing deployment metadata such as host and configuration details, when they already know the exact identifier of the target record. Exploitation requires a valid Ops Manager account with at least a read-only role on some project plus knowledge of a record identifier from a different project, which sharply limits practical exposure; impact is confined to low-severity information disclosure with no write or availability effect. There is no public exploit identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), consistent with the vendor-assigned CVSS 4.0 score of 2.3 and our independent CVSS 3.1 assessment of AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N.
Local users holding an unprivileged account in any zone on an illumos-based host can send an unauthorized ZSD_CMD_NEW_ZONE request to the zonestatd door, forcing the daemon to re-create its door file in an arbitrary zone so that new zonestat requests in that zone can fail while the file is replaced, and using the command's response timing as an oracle for whether a given zone ID is currently running. The root cause is a missing authorization check (CWE-862) in zsd_server() in usr/src/cmd/zonestat/zonestatd/zonestatd.c, a gap that has existed since illumos-gate commit efd4c9b6 in 2010 and affects illumos-gate and OmniOS builds prior to illumos-gate commit 865b58d2; a vendor fix is available, and no public exploit code was identified at time of analysis. Impact is confined to transient disruption of zone statistics collection plus a zone-existence oracle - no privilege gain, persistence, or data theft - so this is a low-priority issue for single-tenant or single-admin hosts and only a modest concern in multi-tenant deployments where untrusted users hold zone-local accounts.
Local unprivileged users on illumos distributions can silently alter the persistent IP multipathing (IPMP) configuration because the ipmgmtd door service fails to require the solaris.network.interface.config authorization for the IPMGMT_CMD_IPMP_UPDATE command. Rated only CVSS 4.0 1.9 (independent assessment CVSS 3.1 7.3-adjacent vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L), the issue requires an existing local account on an illumos-gate derivative such as OmniOS built before commit e8d3efa1, and the modified state only takes effect when the stored ipadm configuration is next applied (typically at reboot), so impact is delayed and limited to integrity and availability of network configuration rather than immediate disruption. No CISA KEV listing is present; the CVSS 4.0 vector's E:P metric indicates proof-of-concept-level exploit maturity, meaning publicly available exploit code exists, and the flaw has been present since illumos-gate commit a73be61a in 2021.