Client-side heap buffer overflow in FreeRDP 3.10.0 through 3.32.2 allows a malicious RDP peer to crash the connecting client by sending an oversized CF_DIB clipboard image whose conversion to PNG triggers an out-of-bounds memcpy once an internal realloc() call fails. The impact is availability-only (no code execution or data disclosure), which is why the issue is rated MEDIUM (CVSS 6.0) despite the memory-corruption class; the client is reached unauthenticated over the network, but the victim must actually interact with the clipboard transfer and the overflow only fires when a memory-allocation failure occurs, so the bug is not deterministic. There is no public exploit identified at time of analysis and no CISA KEV listing, and the affected range is limited to FreeRDP 3.10.0-3.32.2 with the client clipboard path as the attack surface.
Cross-site scripting in idcCMS 1.70 is a low-priority vulnerability: publicly available exploit code exists, but it affects the admin/member_deal.php member management function and requires a low-privilege authenticated session plus victim interaction to execute injected script, so it is not remotely exploitable without credentials. No CISA KEV confirmation is present, and the provided data does not include EPSS. Affected deployments should restrict admin access and sanitize/encode member-related inputs until a vendor fix is available.
Out-of-bounds write in FreeRDP clients running versions before 3.32.0 allows a malicious or compromised RDP server to corrupt client memory when the victim explicitly connects using the non-default /video (MS-RDPEGT) option. The server supplies a signed geometry origin with a negative topLevelLeft value that is stored unchecked in an unsigned surface coordinate, causing the blit clamp in gdiVideoShowSurface() to wrap in 32-bit arithmetic and be skipped, which can result in an out-of-bounds write of decoded H.264 picture data or an abort of the client. No public exploit code or confirmed active exploitation has been identified at time of analysis, and although the CVSS 4.0 base score is 6.0, real-world risk is reduced because /video is off by default and the attack is a reverse server-to-client scenario requiring the user to initiate the connection to the attacker's server.
Craft CMS versions 5.0.0 through 5.10.13 contain a missing authorization flaw in AppController::actionSwitchToLicensedEdition() that allows an authenticated low-privileged user - such as a registered front-end account - to invoke the edition-switching action route and persistently downgrade the site's edition in project config, a change administrators cannot revert from the control panel. Exploitation requires a valid account (PR:L) plus the precondition that the installed edition does not match the licensed edition, and the outcome is limited to integrity and availability of the edition configuration rather than code execution or data disclosure. There is no confirmed active exploitation (CISA KEV) and no public exploit code identified at time of analysis, so this is assessed as a genuine but moderate-priority issue rather than an emergency; sites that do not provision low-privileged or self-registering user accounts are not practically exposed.
Malicious or compromised RDP servers can crash FreeRDP-based clients (versions 3.9.0 through 3.31.x) that use Remote Credential Guard by sending crafted, unaligned RDPEAR payloads, such as CreateApReqAuthenticatorReq messages, that trigger an out-of-bounds read in the NDR scalar readers. The flaw is remotely reachable without authentication (PR:N in the assessed vector) but requires the victim to initiate the RDP session and have Remote Credential Guard enabled, in addition to high attack complexity and a specific unaligned-payload precondition. No public exploit code has been identified at time of analysis, and the primary impact is denial of service through client process crashes rather than code execution or data disclosure. This is assessed as a moderate-risk, low-urgency issue; however, a user-interaction requirement is present because the client must actively connect to the attacker's server.
Denial of service in FreeRDP client versions 3.9.0 through 3.31.x (all releases before 3.32.0) lets a malicious or compromised RDP server crash the connecting client by sending a CreateApReqAuthenticatorReq containing a truncated KERB_RPC_INTERNAL_NAME structure, which drives the RDPEAR NDR reader's cleanup path into a NULL pointer dereference (CWE-476). Exploitation is client-side and inverted: an unauthenticated remote attacker must lure a victim into initiating an RDP session against a server they control and that session must reach the RDPEAR Kerberos remote-credential exchange, so user interaction is required and the outcome is limited to a client crash with no confidentiality or integrity loss (CVSS 4.0 base 6.0). No public exploit code and no confirmed active exploitation were identified at time of analysis, and clients that only connect to trusted internal RDP servers are at substantially lower risk.
Use-after-free in FreeRDP's rdpsnd audio channel can crash the client: a malicious or compromised RDP server disconnects the session while asynchronous Wave2 audio playback is still draining queued PDUs, and the disconnect path frees the audio formats and device structures without joining play_thread, leaving the playback path dereferencing freed heap memory. Affected are FreeRDP client builds from 2.1.0 up to but not including 3.32.0 that negotiate the static rdpsnd channel; exploitation is non-deterministic and requires the victim to initiate the connection to an attacker-controlled server (UI:P) with the race window landing on the disconnect, so the outcome is a client-side denial of service rather than code execution. No public exploit identified at time of analysis (no CISA KEV listing).
Stored cross-site scripting in y_project RuoYi up to and including 4.8.3 lets an authenticated low-privilege admin user inject arbitrary script through the cssClass argument handled by renderDrawer in the Dictionary Data Drawer Preview at /system/dict/data/add; the payload is persisted and executes in the browser of any second user who opens the preview. Publicly available exploit code exists (a proof-of-concept is published on GitHub by Bob-wentao), but there is no indication of confirmed active exploitation (no CISA KEV entry). Successful abuse requires a valid backend account plus a victim passively viewing the affected preview, so impact is limited to client-side actions in that victim's session rather than server compromise, consistent with the medium severity (CVSS 5.1) rating.
DeepSeek Harness versions up to and including 0.1.1-rc.2 do not properly enforce the intended behavioral workflow within the dsh-workflow-worker-thread component's agent function (CWE-841), allowing an authenticated remote attacker who can also induce passive user interaction to partially bypass intended workflow sequencing, with limited confidentiality, integrity, and availability impact confined to the harness itself. Publicly available exploit code exists, but the requirement for low-privileged authentication (CVSS 4.0 PR:L) and user interaction (UI:P) keeps the issue medium severity (CVSS 4.0 base 5.1), and there is no confirmed CISA KEV listing for this CVE.
The Gleam build tool (versions 0.32.4 up to but not including 1.19.2) derives the on-disk build directory for each dependency from the Hex release metadata 'app' (OTP application name) field without validating it, so a malicious package publisher could set that field to a traversal or absolute path such as ../../../../target and cause Gleam to delete an arbitrary directory outside the project build tree. The deletion happens only in the dependency-failure cleanup path: when a dependency fails to compile, Gleam calls remove_dir_all on the resolved build directory, meaning the attacker-controlled package must fail to build and the developer must actively run gleam build, check, run, test, or export (CVSS 4.0 5.9; assessed CVSS 3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H). Impact is limited to availability (data/directory loss) - no attacker code runs, even for what appears to be a pure Gleam package - and there is no public exploit identified at time of analysis; the vendor has released fixes.
Stored cross-site scripting (CWE-79) in the Netcore NR268 router Web UI (firmware 1.7.121109) lets an attacker who already holds a privileged, authenticated session write malicious markup through the title, note, URL, or content arguments processed by /router/l7_call_board_user_set.cgi, which is later rendered in another Web UI user's browser. Publicly available exploit code exists (documented in a GitHub report linked from the VulDB entry), but the practical blast radius is small: the payload only executes when a victim subsequently loads the affected call-board page, and the assessed impact is limited to low integrity with no confidentiality or availability effect (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N; CVSS 4.0 base 1.9). The vendor was contacted about the disclosure and did not respond, so no vendor-released patch has been identified at time of analysis.
Cross-site scripting in Edimax BR-6208AC firmware 1.32 lets an authenticated administrator inject script through the /goform/formPortFw Port Forwarding handler; publicly available exploit code exists. Exploitation requires high privileges (PR:H) and user interaction (UI:P) when an administrator later views the affected Port Forwarding page, and the assessed impact is limited to low integrity with no direct confidentiality or availability effect. The vendor was contacted but did not respond, so no vendor-released patch is identified in the available data.
Improper TLS server-certificate validation in hex_core (0.1.0 through versions before 0.20.0) lets an attacker who already holds an on-path/Man-in-the-Middle position impersonate hex.pm, repo.hex.pm, or any other repository or API endpoint to any Erlang/Elixir program using the library's built-in hex_http_httpc adapter selected by hex_core:default_config/0. The adapter is affected when it cannot obtain a CA trust store: all HTTPS requests fall back to insecure ssl defaults on Erlang/OTP 24 (public_key:cacerts_get/0 does not exist), hex_core before 0.11.0 never set ssl options at all, and on OTP 25 the fallback triggers whenever the OS certificate store cannot be loaded - although the CVSS 4.0 vector still requires user interaction because a Hex fetch must actually be triggered, and OTP 26+ verifies certificates by default even without the fix. No confirmed in-the-wild exploitation and no public exploit code were identified at time of analysis, and the primary risk is data/registry-response disclosure and package-fetch integrity (CWE-295, tagged Information Disclosure) rather than remote code execution.
Heap memory corruption in psqlODBC versions before 18.00.0005 can be triggered when an application binds 32,769 or more parameters on a single SQL statement via SQLBindParameter. An attacker who controls the parameter count-for example through an untrusted 'IN (?, ?, ...)' list-can wrap the driver's signed 16-bit binding counter, causing a massive out-of-bounds write of zeros that crashes the application or leaves it running with a corrupted heap. No public exploit code has been identified at time of analysis, and exploitation requires a vulnerable application pattern where parameter counts are derived from untrusted input; the flaw is availability-only (CVSS 5.9).
Edimax BR-6208AC firmware 1.32 contains a cross-site scripting vulnerability in the QoS configuration page (/goform/formQoS). An authenticated administrator must be tricked into interacting with a crafted request, after which malicious script can alter page content, but impact is limited to low integrity with no confidentiality or availability loss. Publicly available exploit code exists, though active exploitation has not been confirmed (not in CISA KEV); this is a low-priority, high-noise finding rather than an urgent threat.
Cross-site scripting in the web management interface of Edimax BR-6208AC firmware 1.32 allows an authenticated administrator to inject script into the /goform/formFilter packet-filter configuration handler; a victim with administrative access must then interact with the affected page for the payload to execute in their browser. Publicly available exploit code exists, but no CISA KEV active-exploitation confirmation is available, and the risk is low-to-moderate because exploitation requires high administrative privileges and user interaction while targeting a LAN-facing management endpoint rather than an unauthenticated internet service. The vendor was contacted but did not respond, and no vendor-released patch has been identified.
Improper certificate validation in Hex (the Elixir/Erlang package manager client, versions 0.20.2 through 2.5.1) allows a man-in-the-middle attacker to impersonate a Hex host under a narrow set of conditions: the attacker must intercept the victim's HTTPS traffic, must hold a certificate for the target host issued by a CA present in Hex's bundled CA store, and the victim must have pointed cacerts_path (HEX_CACERTS_PATH) at a custom store that deliberately excludes that CA. Under those preconditions the attacker can present a chain that reaches a bundled CA and have it accepted, defeating the operator's explicit trust configuration and potentially exposing package metadata, tarballs, and credentials transmitted to the impersonated host, although hostname verification still applies and reduces the attack surface. Assessed risk is medium (CVSS 4.0 base 5.9; CVSS 3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N) and is constrained by the non-default configuration requirement and the privileged network position needed; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV. A vendor patch is available in Hex 2.5.2.
Memory corruption in the Zephyr RTOS Bluetooth host ATT transmit path can be triggered by a peer in Bluetooth radio range whenever an application issues an ATT Signed Write Command over an unencrypted link. In chan_send(), the BT_ATT_OP_SIGNED_WRITE_CMD branch unrefers a net_buf it does not own after bt_smp_sign() fails (no local CSRK exists for the peer - a state the remote peer controls by pairing without requesting the signing key, pairing with No Bonding, staying unpaired, or keeping the link unencrypted); the callers honor the opposite ownership contract, so the already-freed buffer is re-queued, dereferenced and freed a second time, corrupting the ATT TX FIFO, deferred-destroy and pool free lists, while a related retry path can append a second 12-octet signature into a pooled buffer sized for one. Exploitation requires the deprecated, non-default CONFIG_BT_SIGNING build option plus a victim application that actually performs signed writes, giving CVSS 5.9 (AV:A/AC:H/PR:N, no confidentiality impact, high availability impact, low integrity impact); a vendor fix commit and GHSA-p3r4-qw98-j59m are available, and no public exploit was identified at time of analysis.
Loading an attacker-supplied read-only dictionary (.rws) file in GNU Aspell through 0.60.8.2 can corrupt heap memory, yielding reliable denial of service and potentially code execution. The root cause is a heap-based buffer overflow write (CWE-122) triggered by a signed-integer overflow in String::reserve(), which lets a crafted 32-bit length field in the .rws header (for example lang_name_size = 0x7FFFFFFF, paired with the valid endian marker 12345678) bypass the capacity check so attacker-controlled data is written past an undersized allocation. Exploitation is local in nature - there is no network-service trigger - and requires the victim to actively load the malicious dictionary, such as by running 'aspell dump master <file>'; no public exploit code was identified and there is no confirmed active exploitation at time of analysis, so this is assessed as a moderate-priority issue despite the RCE tag.
Local information disclosure in Samsung Internet lets an attacker who already has access to the device read sensitive data through an improper access control weakness in all versions prior to 30.0.5.6. Samsung rates it CVSS 4.0 5.9 (AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N), and our independent assessment agrees: medium severity, local-only reach, confidentiality impact only, with no integrity or availability effect. No public exploit identified at time of analysis, so this is a moderate-priority patching item rather than an urgent one; the attack requires local access plus a specific precondition (AT:P) rather than working against every default invocation, but once met it needs no authentication or privileges (PR:N) and no user interaction (UI:N). Updating to 30.0.5.6 or later removes the flaw.
Cross-site scripting in Edimax BR-6208AC 1.32 firmware allows an authenticated administrator to inject script into the HTTP Blocking Page via /goform/formUrlb, with execution occurring when a victim views the affected page. Public exploit code exists, but there is no CISA KEV confirmation of active exploitation, and the independent assessment rates this as a low-priority issue because it requires high administrative privileges and victim interaction. The vendor did not respond to disclosure, and no fixed firmware version is identified.
Zephyr RTOS Bluetooth Mesh nodes built with the default Access-layer delayed-message feature can be persistently muted by a mesh peer that is already provisioned into the same network and within Bluetooth radio range. By flooding the victim with requests that elicit segmented responses while withholding Segment Acknowledgments, the attacker forces bt_mesh_delayable_msg_manage() down an error path that returns a message context to neither the free nor the busy list, permanently shrinking the default four-entry context pool until every reply from Configuration Server, Health Server and application server models fails with -ENOMEM and is silently dropped. The impact is availability-only (CVSS 5.7, CWE-772, authenticated/PR:L and adjacent/AV:A per the assessed vector); the defect is cleared only by a reboot, the upstream fix is a committed source change, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Cleartext transmission and storage of private task content and connected issue-provider credentials in Super Productivity 17.3.0 through 18.13.0 occurs because the SuperSync end-to-end-encryption setup invokes sync(true) before the user has set an encryption password, so the operation-upload path pushes and persists all operations in plaintext. Affected data can include reusable issue-provider passwords, API tokens, and app passwords in addition to task text; users who finish E2EE setup have the plaintext operations deleted, but users who abandon the password-setting step can leave that data stored on the sync backend indefinitely, and the Disable SuperSync action does not remove plaintext already uploaded. Exploitation is not confirmed as actively exploited and no public exploit code has been identified at time of analysis; realizing the exposure requires the incomplete-setup condition plus read access to the server-side sync storage or the user's sync account, consistent with an authenticated (PR:H) attacker and attack-requirements-present (AT:P) profile. This is a genuine but moderate-priority confidentiality flaw, and the available signals are internally consistent rather than conflicting.
Path traversal in the mistral.rs inference server (mistralrs-server-core) through version 0.9.3 lets a remote, unauthenticated attacker direct where the server writes its calibration importance matrix by supplying a non-bare save_cimatrix value to the POST /calibration/apply endpoint. The pre-patch code passed the client-supplied string straight into PathBuf::from with no validation, so values containing '/', '\\', or '../' escape the server's working directory; impact is limited to placing/overwriting the server-generated .cimatrix file at an attacker-chosen path (no attacker-controlled file contents, no direct code execution), assessed as CVSS:3.1 6.9-level moderate risk. Publicly available exploit code exists, the vendor has released a patch in version 0.9.4 (commit 8c81056712709b4845ec6d9531e4d35bab4a367c, PR #2445), and there is no indication of confirmed active exploitation (not in CISA KEV).
Server-side request forgery in EricLBuehler mistral.rs 0.9.3 and earlier allows remote unauthenticated attackers to bypass the private-IP guard used by the server's media-source fetcher, causing the server to request internal addresses such as loopback, link-local, or cloud metadata endpoints. The flaw lives in the is_global_ip/reject_private_ip logic in mistralrs-server-core/src/media_source.rs, which failed to decode IPv6 transition-address forms (IPv4-mapped, IPv4-compatible, 6to4, and NAT64) that embed an internal IPv4 address, so those addresses were judged global and fetched. Publicly available exploit code exists, and the issue is rated CVSS 4.0 6.9 (our independent assessment is a lower-severity SSRF with low confidentiality impact and no integrity or availability impact); no confirmed active exploitation (CISA KEV) was identified at time of analysis. Exploitation is only meaningful where remote media-URL fetching is enabled and reachable internal services exist.
Server-side request forgery (SSRF) in Ollama versions up to 0.34.1 allows unauthenticated remote attackers to make the server issue HTTP requests to arbitrary internal hosts via cross-host redirects during model pulls. A malicious or compromised registry can redirect manifest or blob requests to internal addresses, potentially exposing limited sensitive information. Publicly available exploit code exists, and the issue is fixed in version 0.34.2 by enforcing a same-host-only redirect policy by default.
SQL injection in the Forgot Password handler (source/authprocessing.php) of krupalshah EmployeeRecruitmentSystem lets remote, unauthenticated attackers inject SQL through the 'fpemail' parameter submitted to the forgot-password request. The application is an obscure, unversioned project tracked only by commit hash (up to 922ff6d208278282e7c8e36d70d9ae356adec9fe), it is no longer maintained, and the vendor was contacted early but never responded, so no fixed release exists or is expected. Exploit details have been disclosed publicly and exploit code is publicly available (CVSS 4.0 vector carries E:P), which raises the likelihood of opportunistic scanning against any internet-exposed instance; the independent assessment rates real-world impact as low-priority overall because deployment of this unmaintained application is minimal.
Improper access control in IBM i 7.3, 7.4, 7.5, and 7.6 allows a local attacker who already holds a valid account on the system to trigger a denial-of-service condition, while the supplied impact metrics also point to a low-severity information exposure. The issue carries a moderate CVSS score of 5.3, and there is no CISA KEV listing, no EPSS score provided, and no public exploit code identified at time of analysis, so this should be treated as a low-urgency, locally-privileged defect rather than an active threat. Defenders should note that the published vector (AV:N/PR:N, C:L, A:N) contradicts both IBM's own 'local attacker' description and our assessed vector (AV:L/PR:L), and also fails to express an availability impact despite the denial-of-service wording - this is a data-quality conflict that should be resolved with IBM before assuming network-facing exposure.
Information disclosure in UNISOC modem (baseband) firmware allows a local, low-privileged attacker to read sensitive data that is captured in modem crash dumps without filtering of sensitive fields. Exploitation requires the attacker to already have local code execution on an affected device - for example an installed malicious app or a local process with access to the dump - with no remote vector (AV:L, PR:L) and no user interaction (UI:N). Rated CVSS 5.5 with confidentiality-only impact, this is a moderate-severity local exposure rather than an urgent remote-exploitation priority; no public exploit code has been identified at time of analysis, and the specific affected firmware/chipset versions are not specified in the available data.
Denial of service in IBM Db2 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 can be triggered by an authenticated, low-privileged user (PR:L) submitting a specially crafted query that references a Materialized Query Table, causing a stack-based buffer overflow (CWE-121) that crashes the database engine. IBM has released a patch; no public exploit identified at time of analysis, and impact is limited to availability with no data disclosure or modification. Note that IBM's CVSS vector indicates local access (AV:L), while the query-execution nature suggests a remote authenticated client may be able to trigger the flaw, pending confirmation with the vendor.
Improper validation of the frequency index passed to the Unisoc kernel apsys DVFS driver (CVE-2026-87765, CVSS 3.1 5.5) lets local code that already holds low-level privileges on the device select an out-of-range operating point, resulting in an out-of-bounds read of the driver's frequency/voltage tables or corruption of the power-management hardware registers, which can destabilize or crash the system. Impact is limited to availability (C:N/I:N/A:H) - no confidentiality or integrity loss is described - and the assessed vector AV:L/AC:L/PR:L/UI:N means there is no remote or unauthenticated path; an attacker must already be able to invoke the DVFS driver interface locally. Exploitation signals are weak: no public exploit code exists and there is no confirmed active exploitation (not listed in CISA KEV), and no EPSS score was supplied, so this should be treated as a moderate-severity, low-priority issue remediated through vendor firmware/driver updates rather than emergency action.
Direct HTTP requests to the db/matrimony.sql database dump in code-projects Matrimonial System 1.0 expose the application's schema and stored records to unauthenticated remote attackers (CVSS 4.0 base 5.5; assessed CVSS 3.1 5.3, CWE-425). The weakness is forced browsing: the SQL dump ships inside the web-accessible document root, so a predictable GET to the file returns it as a static asset with no authentication required (CVSS vector PR:N). Publicly available exploit code exists - the reporter published a proof-of-concept walkthrough on GitHub - but there is no CISA KEV listing, and impact is limited to confidentiality (VC:L) with no integrity or availability effect; the product's very small deployment footprint is the main practical limiter.
Authenticated administrators of Thelia 2.6.0 and earlier can achieve remote code execution by injecting malicious Smarty expressions into email templates, which execute with web process privileges when previewed or rendered. The vulnerability requires high-privilege back-office access, but successful exploitation enables arbitrary OS command execution and file read/write. No active exploitation has been confirmed and no public exploit code is currently identified.
Authenticated template injection in Thelia versions up to and including 2.6.1 lets a logged-in user with access to Smarty template-name handling point the engine at an arbitrary absolute filesystem path, which can result in server-side template injection and, in some deployments, remote code execution. The flaw is post-authentication (CVSS vector PR:L) and the RCE outcome is conditional: it depends on Smarty loading/compiling the referenced file without an effective security policy and on a suitable file existing at the referenced path, so impact is not guaranteed on every installation. No public exploit code and no active exploitation were identified at time of analysis (EPSS 0.40%, ~32nd percentile), and no vendor-released fixed version was confirmed from the provided references (CERT/CC advisory VU#162329; CVE-2026-103537).
Cross-site scripting in IBM i 7.3, 7.4, 7.5, and 7.6 allows an authenticated remote user to inject arbitrary script into content that is later rendered by another user's browser, because user-supplied input is not properly validated before being included in a page. Exploitation is not automatic: an attacker must already hold an authenticated session on the system and a separate victim must view or interact with the injected output, so this is not a default-configuration, unauthenticated remote exploit. IBM has published a fix through its support portal, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Revoked short-tokens in Nginx UI prior to 2.4.1 can be replayed to regain authenticated access to HTTP and WebSocket routes that accept short-token authentication, because token deletion fails to invalidate the corresponding short_token cache entry. Exploitation is authenticated and tightly conditioned: the attacker must already hold a previously issued short token (CVSS PR:L), the account must be disabled and then re-enabled before the stale cache entry expires, and the surviving cache record is then resolved by GetTokenUserByShortToken - a timing-dependent, opportunistic flaw rather than a reliably reproducible one. There is no public exploit identified at time of analysis and no evidence of confirmed active exploitation (no CISA KEV listing); the vendor-released patch is Nginx UI 2.4.1.
Remote code execution in Thelia 2.6.0 and earlier is achievable by an authenticated back-office administrator who uses the module ZIP upload-and-install feature to deliver a crafted module whose install() method contains embedded PHP; that code is executed on installation with the privileges of the web server. The affected scope is Thelia up to and including 2.6.0, and exploitation requires the highest application privilege level (an administrator account), which is why the independent assessment rates real-world priority as LOW despite high confidentiality, integrity, and availability impact on the host. There is no public exploit identified at time of analysis, no CISA KEV listing, and EPSS is only 0.19% (8th percentile), so this is best treated as an insider/misconfiguration-adjacent hardening issue rather than an urgent internet-facing threat.
Cross-site scripting in IBM Planning Analytics 2.0 and 2.1 allows remote attackers to execute arbitrary JavaScript in a victim's browser session by supplying content that is rendered without proper output encoding. Per the supplied CVSS vector (AV:N/AC:L/UI:R/S:U/C:L/I:L/A:N, base 5.4), exploitation requires the victim to interact with or load the attacker-influenced page, and impact is confined to that user's browser context rather than the underlying host or other accounts. No public exploit identified at time of analysis, and no exploitation activity is recorded in CISA KEV; patch available per vendor advisory. Note that the vector's PR:N conflicts with IBM's description of a 'remote authenticated attacker', so authentication requirements are not confirmed from available data and should be verified against IBM support node 7291604.
Authenticated users with only low privileges (for example a WordPress subscriber or registered WooCommerce customer) can reach at least one TMDS dropshipping plugin action that performs no authorization check, allowing them to make unauthorized state changes against a WordPress site running TMDS 1.0.15 or earlier. The vendor-assigned CVSS of 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) reflects limited integrity and availability impact with no confidentiality loss, and exploitation requires a valid low-privilege account, so the practical risk is moderate rather than critical. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and no EPSS or CISA KEV data was supplied; only a Patchstack advisory (credited as the reporting source) documents the issue.
Duplicate customer-identity records can be created in OTRS whenever more than one CustomerUser backend is configured (for example a database backend alongside LDAP), because the email-address uniqueness check is applied only within the backend selected at the time of creation rather than across all backends. An authenticated operator holding the permission to create or modify customer users (PR:L per CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, base score 5.4) can therefore register an address already assigned to a customer in another backend, after which ticket records or outgoing email may be associated with, or exposed to, the wrong customer identity. Exploitability is narrowed by two prerequisites - a non-default multi-backend CustomerUser configuration and a privileged customer-user management role - so this is a genuine but moderate-priority integrity and information-exposure issue rather than an urgent emergency; no public exploit identified at time of analysis and no CISA KEV listing.
Broken access control (CWE-863) in Foreman's domain and subnet interface API lets an authenticated user who already holds a host-view permission and can see a shared domain or subnet read interface records for hosts outside their authorized scope; the API checks the host permission but omits its search-limit filter, returning every interface on the domain or subnet. A user who also holds host-edit permission can persist a change to one of those out-of-scope interfaces, giving limited confidentiality and integrity impact (CVSS 5.4, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N). Red Hat Satellite 6, which ships Foreman, is the affected product per CPE; no public exploit identified at time of analysis.
Stored cross-site scripting in IBM Planning Analytics 2.0 and 2.1 allows an authenticated user holding a valid account on the Web UI to persist arbitrary JavaScript into a stored field, which then executes in the browser of any other user who views that content - potentially disclosing credentials or session data within a trusted session. Per the assessed vector (CVSS 6.4, AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), exploitation requires both the attacker's existing authenticated access and a second victim user viewing the affected page, and impact is bounded to low confidentiality and integrity within the browser session rather than server-side code execution or availability loss. There is no public exploit code, no CISA KEV listing, and no EPSS score in the available intelligence, so the flaw rates as 'no public exploit identified at time of analysis'.
HTTP response splitting in Progress MarkLogic Server affects the Query Console file-exploration endpoint in 12.x releases before 12.1.0 and 11.x releases before 11.3.7, where insufficient input sanitization permits CR/LF injection into generated HTTP responses. Exploitation requires an authenticated Query Console session (CVSS PR:L) and a victim to trigger the attacker-influenced request (UI:R), so it is not a fully automated remote attack; the impact is a scope-changed, low-severity client-side response manipulation with limited confidentiality and integrity effects and no availability impact, consistent with a CVSS 3.1 base score of 5.4. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS score was supplied with the source data.
Low-privilege authenticated users can bypass access-control checks in the WordPress 'Event post' plugin (versions from initial release through 6.1.1), allowing them to perform event-management actions and read or modify event data they are not authorized to touch. The flaw is a CWE-862 missing authorization issue scored CVSS 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N), so exploitation requires an existing account on the target site at subscriber/contributor-level privilege or higher - unauthenticated visitors cannot trigger it directly, though self-registration or any low-privilege account lowers the bar. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; impact is limited to partial confidentiality and integrity of event data with no availability effect.
Missing authorization in the WordPress plugin VideoWhisper Site Manager for ChatGPT, Claude, Codex (all versions through 1.2.10) lets an authenticated low-privilege site user reach plugin functionality that should require higher capabilities, resulting in limited confidentiality and integrity impact at CVSS 5.4. The flaw is a broken access control condition (CWE-862) requiring only a valid WordPress account on a site with the plugin active (PR:L), remote reachability and low attack complexity with no user interaction; availability is unaffected. No public exploit code was identified at time of analysis, and this does not by itself permit full site takeover or denial of service.
Cross-site request forgery in OTRS 7.0.X, 8.0.X, 2023.X through 2026.X before 2026.7.X lets an unauthenticated remote attacker induce a logged-in administrator to delete Import/Export templates through the AdminImportExport::TemplateDelete action, which fails to validate the ChallengeToken. The issue is moderate severity (CVSS 5.4, CWE-352) because exploitation requires an active administrator session and user interaction, yields no code execution or data disclosure, and matters only where the Import/Export template feature is in use; no public exploit has been identified at time of analysis.
Missing authorization in the RocketGeek WP-Members WordPress plugin through version 3.5.7 permits authenticated low-privilege users-such as self-registered members-to bypass incorrectly configured access-control security levels, resulting in limited confidentiality and integrity impact. Rated CVSS 5.4 (CWE-862), the flaw requires a valid low-privilege account that is readily obtainable on sites with open registration, and its effect is amplified when membership security levels are misconfigured. No public exploit or active exploitation is identified in the provided intelligence.
Missing authorization in the Arraytics Booktics WordPress plugin (versions through 1.0.28) lets an authenticated low-privilege user - such as a subscriber or customer - invoke plugin functionality that should be reserved for higher-privileged roles, resulting in limited unauthorized data disclosure and modification. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, score 5.4) confirms the attack is network-reachable and requires no user interaction, but an account on the target site is a hard prerequisite, and there is no availability impact. No public exploit code has been identified at time of analysis, and this is assessed as a moderate, not high-priority, issue.
Authorization bypass in Kirby CMS affects versions up to 4.9.5 and up to 5.5.3, allowing an authenticated user with only low-level privileges to retrieve data through the Dynamic Option Generation feature that they should not be permitted to see. The flaw sits in OptionsQuery::resolve (src/Option/OptionsQuery.php) and is classified as an authorization bypass through a user-controlled key (CWE-639); per the independent assessment the impact is confidentiality-only, with no integrity or availability effect, and exploitation requires a valid authenticated session (CVSS PR:L) rather than an anonymous visitor. The EPSS signal and CISA KEV status are not provided, and no public exploit code was identified at time of analysis; vendor fixes are available in 4.9.6 and 5.6.0.
Denial of service in the openstack-network-exporter HTTP metrics server, as shipped in Red Hat OpenStack Platform 18.0, allows an unauthenticated remote attacker to open many slow HTTP header connections and exhaust server file descriptors, preventing legitimate Prometheus metric scraping and alerting. The component is deployed without a ReadHeaderTimeout or comparable connection timeouts, so any network-reachable instance is affected with no credentials or user interaction required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, 5.3). There is no public exploit identified at time of analysis and no evidence of active exploitation; impact is limited to monitoring availability and does not touch the OpenStack data plane, making this a modest availability issue best handled through routine hardening and network segmentation.