Stored cross-site scripting (XSS) in LibreNMS before 26.9.0 allows an attacker who controls the SNMP agent of a monitored device to inject JavaScript via wireless sensor description fields, which executes in the browser of an authenticated user viewing that device's Wireless tab and can lead to session hijacking. The CVSS 4.0 base score is 5.3, and exploitation requires user interaction (the victim must open the affected tab) plus the unusual precondition of controlling monitored-device SNMP data rather than LibreNMS credentials. No public exploit has been identified at time of analysis, and the independent assessment rates real-world urgency as materially lower than the raw score suggests because impact is confined to the victim's authenticated session.
Unauthenticated stored cross-site scripting in Admidio 5.0.0 through 5.0.14 allows attackers to inject JavaScript into the FIRST_NAME registration field, which is later rendered unencoded in a data-message attribute on the Manage registrations page. When an administrator hovers over the malicious entry, the script executes in their browser session, potentially leading to session hijacking or data theft. The vulnerability is fixed in version 5.0.15, has a moderate CVSS 4.0 score of 5.3, and no public exploit code is identified at time of analysis.
Stored cross-site scripting (CWE-79) in the Grav Guestbook plugin before 0.5.2 lets unauthenticated visitors persist markup in guestbook author and message fields that is later rendered as unescaped HTML through jQuery by the AJAX 'Load more' pagination handler and the admin 'Load all' moderation view. Because the CVSS vector carries PR:N, submission of the payload requires no authentication, but execution depends on victim interaction (UI:P/UI:R) - another visitor must trigger AJAX pagination, or, on versions 0.5.0 and 0.5.1 specifically, an administrator must open the moderation view, which elevates the impact to a moderation-session compromise. Rated CVSS 5.3 (vendor CVSS 4.0 AV:N/AC:L/AT:N/PR:N/UI:P/SC:L/SI:L) and independently assessed as CVSS 3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Improper authorization in the PswRecovery servlet of LogicalDOC Community Edition through 9.3 lets any user who can hold a valid low-privileged account hijack the password-recovery flow and reset credentials for arbitrary accounts, including administrators. Recovery tickets are issued but never bound to the requesting user, so an attacker can obtain a ticket for their own account and replay it with any arbitrary userId parameter, forcing the victim's password to a newly generated value, locking the victim out, and disclosing the victim's registered email address in the servlet response. The flaw is rated CVSS 5.3 (CVSS 4.0 base) with an assessed 3.1 vector of AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L; exploitation requires a valid LogicalDOC account, no public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.
SQL injection in the Database Migration functionality of ZKTeco BioTime 9.5.6 (Build 20260130.3206) allows an authenticated, low-privileged remote attacker to manipulate SQL statements through the /base/api/v1.0/systemSettings/db_migrate_setting/ API endpoint, potentially exposing or modifying limited data. This medium-severity flaw (CVSS 3.1 base 5.3) has no vendor-released patch at time of analysis, and no public exploit has been identified. The vendor was contacted about the disclosure but did not respond, leaving affected deployments reliant on compensating controls.
Missing authorization checks in Frappe ERPNext party-record endpoints let any authenticated user with a low-privileged role modify party records beyond what their role permits. Affected deployments are ERPNext versions before 15.110.0 and 16.x releases before 16.21.0; the assessed CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, 5.3) confirms the attack requires a valid low-privileged account and results in limited integrity impact only, with no confidentiality or availability effect. There is no indication of active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, so this is a medium/low-priority hardening issue rather than an urgent one, and instances already on 15.110.0 or 16.21.0+ are unaffected.
Authenticated users holding only low-privilege roles in Frappe ERPNext can call specific endpoints that fail to enforce role-based permission checks, allowing them to deactivate master records outside their assigned permissions. The flaw affects ERPNext releases before 15.108.0 and 16.x before 16.18.0 and carries a moderate 5.3 severity, with impact confined to the integrity of master data - the assessed vector shows no confidentiality loss, no availability impact, and no scope change. No public exploit code has been identified at time of analysis, and there is no indication of confirmed active exploitation (not listed in CISA KEV).
Missing authorization in Frappe ERPNext versions before 15.105.0 and 16.x before 16.15.0 allows an authenticated low-privilege portal user to create documents on behalf of other parties, compromising data integrity. The flaw affects document-creation endpoints that fail to verify the requesting portal user belongs to the target party. No public exploit code has been identified at time of analysis, and the independent assessment rates this as a moderate access-control issue requiring a valid portal account.
Missing authorization checks in Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 allow authenticated users to modify data beyond their permitted role, compromising data integrity with no confidentiality or availability impact. Exploitation requires a valid low-privilege ERPNext account (PR:L) and reachable endpoints that fail to enforce role-based authorization; anonymous access is not possible, and no public exploit identified at time of analysis. This is a moderate-severity broken access control issue, not a critical flaw.
Missing authorization checks in Frappe versions before 15.113.3 and 16.x before 16.25.0 allow authenticated users with low-privilege roles to modify records beyond their assigned permissions via crafted API requests to certain endpoints. Exploitation requires a valid authenticated session (PR:L) and impacts only integrity, with no confidentiality or availability impact. No public exploit has been identified at time of analysis, and the flaw is fixed in versions 15.113.3 and 16.25.0.
Missing authorization in LibreNMS before 26.9.0 allows any authenticated account holding the global-read (read-only) role to permanently purge port records it has no delete rights over. By issuing a DELETE request to /ports/purge - optionally with purge=all - a low-privilege user can irreversibly erase every soft-deleted port across all devices visible to that account. The flaw is an authenticated privilege-escalation-style access-control gap (CVSS 3.1 5.3, PR:L) with integrity-only impact confined to already soft-deleted port entries; no public exploit code has been identified at time of analysis, and there is no confirmed active exploitation (CISA KEV). The vendor-released patch is LibreNMS 26.9.0.
Stored cross-site scripting in LibreNMS before 26.9.0 allows unauthenticated remote attackers who control the Oxidized API response or a monitored device's SNMP sysName to inject script that executes in the browsers of authenticated users viewing the Tools > Oxidized page. The flaw is rated medium severity (CVSS 5.3) and only affects the victim's browser session, not the LibreNMS host; exploitation requires the Oxidized integration to be enabled and limits exposure to deployments that actually use it. No public exploit code has been identified at time of analysis.
Input data manipulation in WP Desk Flexible Quantity - Measurement Price Calculator for WooCommerce through 2.3.22 lets unauthenticated remote attackers alter submitted quantity or measurement values because the plugin does not properly validate those inputs (CWE-1284). The issue is rated CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), so impact is limited to integrity of pricing/quantity calculations, with no read, denial-of-service, or code-execution impact. No public exploit identified at time of analysis, and no CISA KEV active-exploitation entry is present in the provided data.
Authenticated users on LogicalDOC Community Edition through 9.3 can abuse the default-enabled XMLConverter to make the server fetch attacker-chosen URLs and apply attacker-controlled XSLT during document conversion, because xml-stylesheet href values are resolved without scheme or host allowlisting. The vulnerable converter accepts http, ftp, file, and jar URLs, so a low-privileged user who can upload an XML document can reach internal services, read local files, or influence the resulting converted output. The issue is rated medium severity (CVSS 4.0 base 5.3; independently assessed CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), authentication is mandatory and no unauthenticated path exists, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Missing authorization enforcement in certain Frappe ERPNext endpoints allows an authenticated user holding only low-privilege role access to modify documents and records beyond the permissions assigned to their role, affecting all releases before 15.121.1 and 16.x before 16.34.2. Exploitation requires valid ERPNext credentials and the ability to reach the affected endpoints, but no user interaction and no non-default configuration - the flaw lies in the endpoints' own failure to check roles (CWE-862). Impact is bounded to low confidentiality and low integrity effects with no availability impact, no public exploit code has been identified at time of analysis, and the vendor has released patched versions (see advisory GHSA-49wp-r82c-j825).
Former collaborators of a Heym workspace can keep running JWT-authenticated workflows after their share is removed, because scoped 'workflow:execute' tokens minted while they still had access remain valid and cannot be listed or revoked by the workspace owner. Heym versions from v0.0.5 up to (but not including) v0.0.113 are affected, matching CPE cpe:2.3:a:heymrun:heym; the issue is an insufficient session expiration flaw (CWE-613) rated CVSS 5.3 with an authenticated-remote vector (CVSS:4.0 PR:L, corroborated by the assessed CVSS:3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N), so only someone who legitimately held collaborator privileges can abuse it. The token's configurable TTL can extend to roughly ten years, letting the removed collaborator repeatedly trigger the workflow and consume the shared credentials it uses; there is no public exploit identified at time of analysis and no evidence of active exploitation, and no EPSS score was supplied.
Notification injection in Fire-Boltt BSW013 smartwatches (firmware through V0.0.8) allows unpaired attackers within Bluetooth Low Energy range to send spoofed alerts and vibrate the device, enabling phishing via fake notifications. The vulnerability stems from missing authentication on a proprietary BLE command characteristic, with only a non-cryptographic CRC-16 checksum protecting commands. No public exploit code has been identified at the time of analysis, and the impact is limited to integrity (spoofed notifications) without confidentiality or availability loss.
Broken access control in Frappe Suite's JMAP mail APIs allows authenticated mail users to read other accounts' mailbox metadata by supplying a victim's JMAP account ID. Affected deployments are any Frappe Suite build prior to commit 2697564a9c46da6acc614743eaf9915fe5238f4f that runs the Mail service with more than one account; a valid low-privileged mail login (PR:L) is required, and the impact is read-only disclosure of mailbox names, message counts, automation rules containing sender addresses, and storage quota usage rather than message contents. No public exploit identified at time of analysis and no confirmed active exploitation (not in CISA KEV), keeping this a moderate-severity (CVSS 5.3) information-disclosure issue.
Cross-site WebSocket hijacking in Network-AI (vendor: jovancoding) versions 5.0.0 up to but not including 5.15.2 lets an attacker-controlled web page open a WebSocket to the victim's loopback DashboardServer and read live agent topology - agent IDs, roles, task descriptions and token budgets. The upgrade handler performs no Origin or token check, so the connection is unauthenticated (CVSS PR:N), but exploitation still requires the victim to be actively running the dashboard and to be lured into loading a malicious page in a browser on the same host (UI:P), which keeps the CVSS 4.0 base score at 5.3 and our re-scored CVSS 3.1 at AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N. Impact is confined to read-only reconnaissance - no write, disruption or code-execution component - and no public exploit code was identified at time of analysis.
Missing authorization checks in Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 let an authenticated low-privileged user change the status of records they should not be able to touch, bypassing role-based access restrictions. The flaw carries a vendor/VulnCheck CVSS 4.0 base score of 5.3 (moderate) and requires a valid low-privileged session, so exploitation is limited to insiders or holders of legitimately provisioned low-tier accounts; impact is integrity-only, with no confidentiality or availability effect. No public exploit code has been identified at time of analysis and the issue is not known to be actively exploited (no CISA KEV listing); vendor patches are available in 15.110.0 and 16.21.0, so the practical priority is moderate - patch on a normal maintenance cadence.
Authenticated users in Frappe ERPNext deployments before 15.112.0 can bypass role-based record permissions by calling specific endpoints that lack proper authorization validation, allowing them to modify individual fields on record types they are not permitted to edit. This is a medium-severity (CVSS 5.3) broken-access-control flaw (CWE-862) with integrity-only impact and no confidentiality or availability loss; no public exploit identified at time of analysis. A vendor security advisory (GHSA-f7x9-qfrf-92m8) and VulnCheck advisory provide further details.
Authenticated low-privileged users can cause ERPNext to send transactional emails for documents they are not permitted to read, due to missing authorization checks in certain endpoints. This affects ERPNext before 15.119.0 and 16.x before 16.31.0. The vulnerability is not known to be actively exploited, no public exploit code has been identified, and the CVSS 3.1 base score is 5.3 (moderate), with limited confidentiality and integrity impact.
Authenticated users of Frappe ERPNext (before 15.121.3 and 16.x before 16.35.0) can abuse a transactional-email endpoint to send arbitrary messages through the site's own configured outgoing mail account, because the endpoint does not verify the caller's authorization before dispatching mail. Any low-privilege account is sufficient - no admin role or special permission is required - and the site must simply have an outgoing email account configured, which is the default for a functioning ERPNext deployment. The result is email relay abuse under the organisation's trusted sending identity, useful for phishing, spam, or reputational damage rather than data theft or service disruption; the assessed impact is limited to low integrity (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Missing authorization checks in Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 let authenticated users with low-privilege roles modify data beyond their assigned permissions through certain network-reachable endpoints. According to the assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), exploitation requires a valid authenticated session and results only in limited integrity impact, with no confidentiality or availability loss. No public exploit code has been identified at time of analysis, and the vendor has released fixed versions 15.121.0 and 16.34.0.
Missing authorization in Frappe Framework's whitelisted send_sms API endpoint allows any authenticated low-privilege user who lacks SMS-sending permissions to send arbitrary SMS messages that impersonate the Company, affecting releases before 15.120.0 and 16.x before 16.33.0. Exploitation requires a valid Frappe session (PR:L per the assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) and no user interaction, but impact is confined to integrity/impersonation of outbound messaging with no data disclosure or service disruption, and is further gated by whether the instance has a functioning SMS gateway configured. No public exploit code was identified at time of analysis, and this is assessed as a medium/low-priority issue rather than a high-severity emergency.
Unauthenticated remote attackers can supply their own values for web parameters that the VillaTheme Salevo (woo-boost-sales) WordPress plugin treats as immutable, letting them tamper with the data the plugin accepts and acts on in versions up through 1.3.0. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, base score 5.3) confirms the request path needs no authentication, no user interaction, and no non-default configuration, but the impact is capped at a partial integrity loss with no confidentiality or availability effect. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was supplied, so this is a moderate-priority hardening item rather than an emergency patch, with real exposure confined to sites that actually run this specific plugin.
Missing authorization in the WPMU DEV Forminator WordPress plugin (versions up to and including 1.58.0) allows unauthenticated remote attackers to reach functionality that should be gated by an access-control check, resulting in low-impact but unauthenticated disclosure of site data. The assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N indicates no credentials, no user interaction and no special complexity are needed against an affected installation, though the impact is confined to confidentiality (no integrity or availability loss). No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS score was supplied with the source data, so the practical risk is medium and primarily affects sites still running 1.58.0 or earlier.
Missing authorization checks in the Arraytics Booktics WordPress plugin through version 1.0.28 let unauthenticated remote attackers invoke functionality that should require elevated privileges, resulting in a limited integrity-only impact (CVSS 5.3, CWE-862). Because the CVSS vector is PR:N/UI:N, exploitation needs only network reachability of the vulnerable endpoint on a site running the plugin - no account, no victim interaction, and no non-default configuration. There is no CISA KEV listing and no public exploit code identified at time of analysis, though the low attack complexity makes the flaw attractive to automated WordPress scanning and mass-exploitation tooling; risk is tempered by the plugin's small deployment footprint and the fact that confidentiality and availability are unaffected.
An out-of-bounds write in the SPI host command interface of Semtech's LR11xx transceiver firmware lets an attacker who already has hands-on hardware access and logical control of the SPI bus send a crafted host command with an oversized length field, causing the firmware to write up to 254 arbitrary bytes beyond an internal non-persistent memory buffer. The affected product lines are the LR1110 transceiver and modem-E, the LR1120 transceiver, and the LR1121 transceiver and modem-E; the vulnerability is rated 5.2 (CVSS 4.0) and assessed at CVSS 3.1 AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H, meaning integrity and availability of the transceiver can be corrupted but no confidentiality loss occurs. There is no network or remote attack vector - exploitation requires physical access to the device plus SPI bus access - and no public exploit identified at time of analysis, with no confirmed active exploitation (CISA KEV) reported. Because the corrupted buffer is non-persistent, effects may be cleared by a device reset, keeping real-world risk low to moderate.
Local information disclosure in Code for IBM i (the codefori/vscode-ibmi Visual Studio Code extension) before 3.0.1 lets other local accounts on the same host read sensitive content written to the shared /tmp directory during Object Browser downloads and the edit-save workflow, because those files are not reliably cleaned up after use. Although the vendor scored it 5.1 on a CVSS:4.0 vector carrying AV:N, exploitation in practice requires an attacker who already holds a separate local account on a shared multi-user machine with a readable /tmp (a common default on many Unix/Linux systems) plus a legitimate developer having performed a download or edit-save in a vulnerable version; single-user workstations and hosts with per-user private temp directories are not affected. Our independent assessment rates it CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N - a low-to-medium risk, confidentiality-only issue - and there is no public exploit identified at time of analysis.
Privilege escalation in ZITADEL 3.0.0 through 4.19.1 lets accounts that already hold the IAM_END_USER_IMPERSONATOR or ORG_END_USER_IMPERSONATOR role obtain tokens for administrators, including IAM_OWNER, and sign in to relying applications carrying those administrators' roles and claims, because the OIDC token-exchange flow fails to enforce the admin.impersonation check (CWE-863). Exploitation requires the high-privilege prerequisite that an end-user impersonator role has been deliberately granted (CVSS PR:H), so arbitrary authenticated users and unauthenticated attackers cannot trigger it, and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis. The vendor fixed the bypass in ZITADEL 4.19.2.
Reflected cross-site scripting in Admidio 4.0.12 through 4.3.17 and 5.0.0 through 5.0.14 allows unauthenticated attackers to execute arbitrary JavaScript in the context of the Admidio origin by tricking a victim into clicking a crafted link to system/redirect.php with a malicious url parameter. The flaw stems from an incomplete fix for CVE-2021-43810 and can be exploited via a javascript: URL containing a decoy http:// segment that defeats validation. Exploitation requires user interaction (UI:A), and no public exploit code has been identified at time of analysis.
Cross-site scripting in DOMPurify 3.4.15 and earlier lets an attacker smuggle live markup through the library's IN_PLACE sanitization path when a rawtext element such as <style> is passed as a DOM Node: the killed node is returned detached but its text content still contains the closing </style> tag plus an img onerror payload, which materializes as script if the application serializes that node and re-parses the resulting HTML in a plain HTML context. Only applications that call DOMPurify.sanitize(node, { IN_PLACE: true }) with a Node (not a string) and then perform a serialize-then-reparse round-trip on the returned value are affected; the CVSS 4.0 base score is 5.1 (medium, AV:N/AC:L/PR:N/UI:A, no impact to the vulnerable system, low confidentiality and integrity impact on a subsequent system), and a working proof-of-concept is published in the upstream advisory, though there is no indication of confirmed active exploitation. Vendor-released patch: 3.4.16.
Memory corruption in the legacy USB CDC virtual COM (vcom) driver shipped in RT-Thread through 5.3.0 lets a physically connected USB host trigger writes past the serial ring buffer and, on port close, an invalid rt_free(), causing denial of service on the affected device. Only builds that include components/legacy/usb/usbdevice/class/cdc_vcom.c and enable RT_USING_SERIAL_V2 are exposed; exploitation requires physical USB access (CVSS 3.1 AV:P, PR:N), and impact is limited to availability with no code execution, data disclosure, or integrity loss. No public exploit code has been identified at time of analysis and the issue is not listed as actively exploited, so this is a medium-severity, low-operational-priority item for most environments; an upstream fix exists (PR #11770 / commit ceef6e0c).
DOM-based cross-site scripting in DOMPurify 3.4.13 through 3.4.15 lets unauthenticated attackers who supply markup retain armed on* event handlers on a subtree that a sanitization hook removes, so a queued handler such as an img onerror fires in the victim origin after sanitize() returns. The flaw is conditional rather than universal: it only triggers when the host application calls DOMPurify.sanitize(node, { IN_PLACE: true }) and registers an afterSanitizeElements or afterSanitizeAttributes hook that removes a non-root element, a supported but non-default configuration, which sharply narrows the affected population despite DOMPurify's very broad deployment. Independent assessment rates it CVSS 3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N (attacker markup, victim interaction required, script execution confined to the victim origin rather than host compromise); no public exploit code identified at time of analysis.
Stored cross-site scripting (XSS) in Open WebUI versions 0.6.31 up to but not including 0.11.4 allows authenticated users to inject malicious JavaScript via crafted Markdown tool-call details blocks whose embeds attribute is mounted in script-enabled iframes. A victim passively viewing the crafted channel message, chat message, or citation content can be subjected to in-app phishing or, if the non-default iframeSandboxAllowSameOrigin option is enabled, session hijacking. This moderate-severity vulnerability (CVSS 4.0 base 5.1) has no public exploit identified at time of analysis and requires a valid account plus victim interaction.
Path traversal in Samsung Smart Switch prior to version 3.7.73 allows someone with physical access to the machine running the utility to reach files outside the intended working directory and read them with the privileges of the Smart Switch process. The vendor rates it CVSS 4.0 base 5.1 (medium), and our independent assessment scores it CVSS 3.1 5.1 with a physical attack vector (AV:P), no authentication and no user interaction required, which rules out remote or mass exploitation and confines realistic risk to lost, stolen, or otherwise physically controlled devices; devices updated to 3.7.73 or later are not affected. No public exploit code has been identified and the issue is not listed in CISA KEV, so it is not confirmed as actively exploited; a vendor patch exists (3.7.73).
Stored cross-site scripting in Frappe ERPNext (15.x before 15.110.0 and 16.x before 16.21.0) lets an authenticated user who holds write access to item master data persist JavaScript inside a record name, which is then rendered without escaping and executes in the browser of any operator who opens the affected item page. Exploitation requires an existing account with item-write privileges plus a second user later viewing the poisoned record, so it is an insider- or compromised-account scenario rather than a remote unauthenticated attack, and the impact is confined to the viewing operator's browser session rather than the ERPNext server. Severity is moderate (CVSS 4.0 base 5.1; independent assessment 3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), no public exploit code and no confirmed active exploitation were identified at time of analysis, and upgrading to 15.110.0 or 16.21.0 removes the condition.
Stored cross-site scripting in Frappe ERPNext 16.x before 16.27.0 allows an authenticated user who holds edit (write) rights on a document type to set a record's name field to a script payload that the application later renders without HTML escaping. The script executes in the browser of any colleague who subsequently opens the affected record page, enabling session-context actions such as data theft or UI manipulation within that victim's ERPNext session. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has released a fix in version 16.27.0, so this is a genuine but limited medium-severity issue rather than an urgent emergency.
Stored cross-site scripting (XSS) in Frappe versions prior to 15.118.0 and 16.x before 16.31.0 allows authenticated attackers with dashboard chart editing privileges to inject malicious filter values that execute in the browsers of users who view the affected chart. The vulnerability arises because jQuery renders filter values as rich text instead of escaping them. Exploitation requires the victim to open the dashboard chart, and no public exploit code has been identified at time of analysis. This medium-severity issue (CVSS 5.1) can lead to session hijacking or other client-side attacks for the viewing user.
Stored cross-site scripting in the Hugo static site generator (versions v0.60.0 up to but not including v0.167.0) lets anyone holding Markdown content-authoring privileges break out of the href attribute generated for heading anchors by .TableOfContents or .Fragments.ToHTML and inject arbitrary HTML elements carrying event handlers into the rendered page. The issue is scored CVSS 4.0 base 5.1 (CWE-79) and requires low-privileged content access (PR:L) plus a victim viewing the poisoned page (UI:P); because the injected content is only dangerous when Hugo processes Markdown from multiple or untrusted authors, single-author sites built from a fully trusted repository are effectively not exposed. No public exploit code was identified at the time of analysis and the flaw has not been confirmed actively exploited (no CISA KEV listing), making this a moderate-priority hardening item rather than an urgent remote-code-execution-class emergency.
Stored cross-site scripting (CWE-79) in the Frappe framework's leaderboard page allows an authenticated user to persist a crafted display name whose payload executes in the browsers of other users who open the leaderboard, in all versions before 14.99.10 and 15.x before 15.91.1. Because the name is stored server-side and rendered on a shared page, the payload fires for every visitor without further attacker interaction, giving cross-site scripting in the context of the Frappe application's origin. Exploitation requires a valid account capable of setting its own user name (PR:L) plus a victim navigating to the leaderboard (UI:P); no public exploit code or confirmed active exploitation was identified at time of analysis, and the CVSS 4.0 base score of 5.1 (MEDIUM) reflects the limited direct confidentiality/integrity impact on the vulnerable system offset by scope change to the victim's browser session.
Out-of-bounds write in Samsung Android's libsmkvextractor.so media parsing library allows a local attacker to corrupt memory by supplying a crafted Matroska (MKV) file, resulting in low integrity and availability impact. Affected are Samsung devices running firmware prior to SMR Oct-2026 Release 1; no public exploit code or active exploitation has been identified at time of analysis, and the CVSS 4.0 base score is 5.1 (medium). The attacker requires local access but no special privileges, and the flaw does not compromise confidentiality or change scope.
Out-of-bounds write in Samsung Android's libcodec2-sec-flacdec.so FLAC decoder allows a local attacker to write memory beyond the intended buffer, degrading integrity and availability of the affected device process. The issue affects devices running firmware prior to SMR Oct-2026 Release 1, and exploitation requires local access plus the ability to push attacker-controlled FLAC data into the codec path, typically through a malicious or compromised app. There is no public exploit identified at time of analysis, and the vendor-assigned CVSS 4.0 base score of 5.1 (bounded to low integrity and low availability impact with no confidentiality loss) places this in routine monthly-patch priority rather than emergency response.
Local information disclosure in Samsung's CocktailBarService allows a malicious or compromised app already running on a Galaxy device to access sensitive data without additional user interaction or authentication. The flaw requires local code execution (AV:L) and affects Samsung builds prior to SMR Oct-2026 Release 1; no public exploit code has been identified at the time of analysis, and the confidentiality impact is limited (C:L). This is a moderate, locally-exploitable issue rather than a remote or high-severity threat.
Local path traversal in Samsung Flow before version 4.9.22.1 allows an attacker who already has a foothold on the host device (Android or Windows) to escape the application's intended file boundaries and read clipboard contents. The attack requires local access - typically a malicious app installed on the same device or interactive access - with no authentication and no user interaction needed, but the impact is limited to disclosure of clipboard data with no effect on integrity or availability. There is no CISA KEV listing and no public exploit code identified at time of analysis, making this a genuinely moderate, low-urgency issue rather than a critical priority.
Local attackers who can run code on a Samsung device can exploit improper input validation in Samsung Checkout's CreditCardRegisterActivity to launch arbitrary activities using Samsung Checkout's own privileges, yielding low-level confidentiality and integrity exposure. The flaw affects Samsung Checkout versions prior to 5.1.03.1 and requires local code execution on the device, but no additional authentication or user interaction (CVSS:4.0 AV:L/AC:L/PR:N/UI:N, score 5.1; independently assessed as CVSS:3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N). No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; overall this is a medium-severity, locally-scoped issue with limited real-world urgency.
Improper input validation in the CreditCardRetrieveActivity component of Samsung Checkout prior to version 5.1.03.1 allows a locally installed malicious application to launch arbitrary activities with Samsung Checkout's own privileges, resulting in low-severity information disclosure and integrity impact. Exploitation is not remote: the attacker must already have code executing on the device, typically through a sideloaded or otherwise installed malicious app, and must be able to pass crafted input to the affected activity. There is no confirmed active exploitation and no public exploit code identified at time of analysis, and Samsung has shipped a fixed build (5.1.03.1) as documented in its mobile security bulletin.
Improper input validation in the GuestCreditCardRegisterActivity component of Samsung Checkout allows a malicious or malfunctioning app already installed on the same Samsung device to launch arbitrary activities with Samsung Checkout's privileges, giving limited unauthorized read and write impact (low confidentiality and integrity, no availability impact). Only Samsung Checkout builds prior to 5.1.03.1 are affected, and the flaw requires local on-device access from a separate app; it cannot be triggered remotely or over a network, and neither user interaction nor authentication is required once that local app is running. No public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV); the medium-severity rating (CVSS 4.0 base 5.1, assessed CVSS 3.1 5.1) reflects that the mandatory prerequisite of pre-existing local code execution substantially narrows realistic exposure.
Cleartext transmission of sensitive information in IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 can allow a local attacker who can observe the relevant channel to obtain limited sensitive information. The assessed vector is CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, meaning exploitation requires local access and no authentication or user interaction but only affects confidentiality; the CVE record lists a base score of 5.1. No public exploit identified at time of analysis, and a vendor patch is available per IBM's advisory.