Authenticated local access to the IBM Power Systems service processor enables writing crafted host firmware configuration data that crashes the boot stack during system initialization, potentially corrupting memory in firmware versions FW1060.00 through FW1060.81. This stack-based buffer overflow (CWE-121) has a CVSS 3.1 score of 7.3, with limited integrity impact and high availability impact. Exploitation requires service-level credentials (PR:L) and local access to the management plane (AV:L); no public exploit code or active exploitation is identified at time of analysis.
Adjacent attackers can manipulate the mobile device connected to a Windows host running Samsung Continuity Service versions before 4.6.1217.0, with no authentication or user interaction needed once a paired session is active. Exploitation requires wireless proximity or local L2 adjacency and high attack complexity, and it can affect confidentiality, integrity, and availability across both the PC and the linked phone. No public exploit was identified at time of analysis, and the assessed risk is moderate rather than top-tier because the attacker must be near the target and the phone must be actively connected.
Remote code execution in Thelia v2.6.0 is achievable by an authenticated administrator who abuses the document update endpoint to upload a server-executable file such as a PHP script. The document upload endpoint correctly blocks executable file types, but the update path omits the same validation (CWE-434), so the flaw is a validation gap between two sibling features rather than a broken upload filter overall. Exploitation is access-gated: the CVSS vector (AV:N/AC:L/PR:H/UI:N) confirms network reachability but requires high-privilege Thelia admin credentials, and the server must actually execute PHP from the writable document location; impact is rated high for confidentiality, integrity, and availability, but no public exploit code or confirmed active exploitation was identified at time of analysis.
Authenticated attackers holding a Thelia administrator account can achieve remote code execution on the underlying server by uploading a PHP file through the store banner upload feature, which validates file type solely on the client-supplied MIME type rather than inspecting file content or extension. The flaw affects Thelia v2.6.0 and carries a CVSS 3.1 score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), reflecting complete loss of confidentiality, integrity, and availability on a successful upload-to-execution chain, though the PR:H vector means the attacker must already hold high privileges and no pre-authentication path is involved. No public exploit code has been identified at time of analysis, and exploitation additionally assumes the web server executes PHP from the directory where uploaded banners are stored.
Authenticated low-privilege users of Open WebUI versions 0.8.6 up to but not including 0.11.4 can escalate privileges through the terminal proxy endpoint /api/v1/terminals/{server_id}/{path}, which forwards requests to the backend Terminals administrator API with the shared key attached; by targeting admin paths directly, an attacker can enumerate and stop other users' terminals, modify terminal policies, and inject environment variables into other users' sessions. The flaw is a missing-authorization (CWE-862) path-confusion issue reachable by any account with PR:L and no user interaction, and it only matters where the terminals feature is enabled against configured terminal servers in a multi-user deployment. No public exploit code has been identified at time of analysis and the issue is not tied to any confirmed active exploitation, but the vendor has shipped a fix and the independent assessment rates this as a genuine, moderate-priority risk rather than an emergency.
Improper access control in the Location Service for Esri component of IBM Maximo Application Suite 9.0, 9.1, and 9.2 allows an attacker who already holds high privileges on the underlying Kubernetes/OpenShift platform to abuse a schema-less Custom Resource Definition (CRD) and escalate to full read and write control over affected resources, since the CRD enforces no input validation and the component applies insufficient authorization checks. Exploitation requires authenticated high-privilege access (CVSS vector PR:H), no user interaction, and the optional Esri Location Service add-on to be deployed, so the barrier to entry is significant; the assessed vector is AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H for a base score of 7.2. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), making this a moderate-priority, high-barrier issue rather than an urgent widespread threat - though successful abuse yields high confidentiality and integrity impact on the Maximo environment.
Stored cross-site scripting in Open WebUI versions before 0.11.4 allows an authenticated user to plant a markdown link using a javascript: scheme inside a shared chat; when a second user opens that chat and clicks the link, the script executes in the victim's browser session and can exfiltrate the JWT held in local storage - including an administrator's token. Exploitation requires a valid low-privilege account plus the chat-sharing feature and, critically, a click by the targeted victim, so this is best characterized as a targeted social-engineering risk rather than an unauthenticated mass-exploitation issue. No public exploit code or confirmed active exploitation was identified at time of analysis, and the independent assessment rates this a credible, moderately serious risk rather than a top-tier emergency.
Authenticated users can modify records in Frappe ERPNext before 16.22.0 by invoking endpoints that omit proper authorization checks, allowing operations beyond their permitted role and resulting in unauthorized data modification. This missing authorization flaw (CWE-862) requires a valid low-privilege account and network access to the ERPNext web application, but no victim interaction; the assessed CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) confirms integrity impact only. No public exploit code or confirmed active exploitation was identified at time of analysis.
VeraCrypt 1.26.29 (FUSE-T build) on macOS can leave a dismounted volume's decrypted contents readable, because VeraCrypt fails to terminate the FUSE-T auxiliary service (go-nfsv4) and its associated core-service helper processes, which keep serving the decrypted volume image (volume.dmg) over a loopback SMB session while retaining an open handle to the underlying raw device. An authenticated local user or process on the same host can then re-attach volume.dmg from the stale auxiliary mount, or simply reopen a previously accessed path (for example from the macOS Open Recent menu), and read the decrypted volume without supplying the passphrase again. The issue is specific to the FUSE-T build - the macFUSE build is explicitly unaffected - and requires that a volume was previously mounted and dismounted on that machine; no public exploit code and no confirmed active exploitation have been identified at time of analysis.
Time-of-check/time-of-use weakness in Privasys ra-tls-clients before 0.9.1 allows a local, low-privileged attacker on the attested TLS endpoint (the Attester) to modify workload code, data, or configuration after remote attestation has already succeeded, while the verifying peer continues to trust the original Evidence for the remainder of the connection. Exploitation requires prior local access to the Attester plus an attested connection (deterministic or challenge mode) that is still open - the window spans connection establishment to termination, and unattested ('none') connections are out of scope. The flaw is fixed in 0.9.1; no public exploit identified at time of analysis.
Heap corruption and process crash in vLLM audio transcription allow an authenticated remote attacker to repeatedly deny service to the inference API in versions before 0.29.0. Uploads to /v1/audio/transcriptions that fail primary decoding fall through to a PyAV/FFmpeg av.open() fallback guarded only by a file-size check, so a malformed IAMF container reaches FFmpeg's vulnerable IAMF parser and corrupts the heap, terminating the API process. The CVSS vector (PR:L) confirms authentication is required, impact is availability-only (no confidentiality or integrity effect), and no public exploit code or CISA KEV listing was identified at time of analysis; no EPSS score was supplied.
Authenticated users of Open WebUI 0.11.0 through 0.11.3 can crash or stall the backend by submitting short nested-repetition regex patterns to the built-in knowledge and chat file search tools (grep_knowledge_files, grep_chat_files), which compile the attacker-controlled pattern with a backtracking regex engine whose nested counted repetition expands without bound at compile time and is then cached. The result is a blocked event loop and exhausted worker memory - a pure availability impact (CVSS 4.0 7.1, AV:N/AC:L/AT:N/PR:L/UI:N/VA:H, CWE-400) with no confidentiality or integrity loss; the flaw sits in the default regex compilation path, so default installs of the affected versions are exposed rather than only a non-default feature. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor has shipped a fix in Open WebUI 0.11.4 that replaces the engine with RE2.
Denial of service in Open WebUI 0.9.0 through 0.11.3 lets an authenticated user who holds the operator-granted 'automations' permission stall the whole instance by submitting recurrence rules that are syntactically valid but unsatisfiable - the canonical example being a rule that resolves to a nonexistent date such as February 30th - to the automations create or update endpoints. Each submitted rule blocks the single shared async event loop for several seconds, so repeated requests degrade or halt service for all users; impact is availability-only, with no data exposure or code execution, and the instance recovers once the requests stop. The vulnerability is scored 7.1 (CVSS 4.0 AV:N/AC:L/PR:L, and 7.1 under CVSS 3.1 with A:H) and there is no public exploit identified at time of analysis, though a vendor-released fix (0.11.4) is available.
SQL injection in Frappe ERPNext (15.x before 15.113.0 and 16.x before 16.22.0) allows attackers with a valid ERPNext account to inject crafted parameters into database queries and read sensitive records from the underlying database. Exploitation requires an authenticated session over the network and no user interaction; the flaw yields high confidentiality impact with no integrity or availability impact. No public exploit code or confirmed in-the-wild activity has been identified at time of analysis, and the primary risk driver is the availability of low-privilege accounts - risk rises sharply where self-service or open registration is enabled or where the instance is internet-exposed.
Hex, the package manager used by Elixir and Erlang projects, fails to properly scope its 'release-age cooldown' protection in versions 2.5.0 through 2.5.1, allowing an authenticated package owner to slip a freshly published, malicious release past the cooldown. The attacker must already hold package-owner permission on the target package, retire (or rely on a security advisory for) the release locked in the victim's mix.lock, and then wait for the victim to run mix deps.update - at which point Hex.RemoteConverger.build_cooldown_bypass/3 and unsafe_lock_bypass/1 lift the cooldown for every version of that package and its dependencies, so the new release is selected regardless of age. A secondary scoping defect causes the bypass to be keyed on package name alone, extending it to identically named packages in other repositories; cooldown configured through an organization dependency policy is not affected. This is a conditional supply-chain weakness rather than a broadly dangerous remote flaw, and no public exploit or in-the-wild activity has been identified at time of analysis. Patches are available from the vendor in Hex 2.5.2.
Denial of service in the Gitoxide gix-pack crate before 0.75.0 allows a remote attacker operating a malicious Git remote to crash a victim's clone or fetch operation by advertising an absurd pack-header object count, forcing the client to reserve hundreds of gigabytes of memory. Exploitation requires the victim to initiate the clone or fetch against the untrusted remote (user interaction), and no authentication is required of the attacker; the flaw sits in the default pack-header parsing path, so unmodified configurations are affected. The impact is limited to killing the client process with no code execution or data exposure, and no public exploit code was identified at time of analysis.
Memory exhaustion denial of service affects Grav CMS versions before 2.1.7, where an authenticated user with media-author upload privileges can submit a highly compressed oversized raster image that, when referenced through a Twig or Markdown image transform, is fully decoded by GD or Imagick without source-dimension validation. Once the transformed image is embedded in published content, unauthenticated page requests repeatedly trigger the decode-and-allocate behavior, causing sustained page unavailability; the assessed CVSS 4.0 base score is 7.1 (AV:N/AC:L/AT:N/PR:L/UI:N/VA:H), and no public exploit code was identified at time of analysis.
Denial of service in SiYuan versions 3.1.12 up to (but not including) 3.8.6 allows an attacker who can reach the /api/icon/getDynamicIcon endpoint to exhaust server memory and trigger an OOM kill of the SiYuan process with a single crafted request. The content parameter is rendered through an unrestricted Sprig template function map, so uncapped functions such as 'until' can be used to allocate unbounded resources (CWE-770, uncontrolled resource consumption). Per the CVSS 4.0 vector (PR:L) at least a publish-reader-level account is required in the default configuration, but if the administrator has disabled publish authentication the endpoint becomes reachable by any remote user with network access; the flaw is strictly a resource-exhaustion issue with no code execution or data exposure. No public exploit code was identified at time of analysis, and no confirmed active exploitation (CISA KEV) is associated with this CVE.
A divide-by-zero in FreeRDP's freerdp-shadow-cli shadow server (versions before 3.32.0) allows an authenticated client to crash the process by sending a Frame Acknowledge PDU with a frame id one greater than the last frame sent, disconnecting all viewers. Exploitation requires a valid authenticated session and only affects the non-default shadow server deployment; no user interaction is needed and complexity is low. No public exploit code has been identified at time of analysis, and the impact is availability-only (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
Denial of service in SurrealDB versions before 3.3.0 lets a query-capable authenticated user with embedded JavaScript scripting enabled abort the database server process by reading a non-ASCII header value through the JavaScript Headers get(), entries(), values(), or getSetCookie() APIs, or by returning such a value from a fetch() endpoint. The flaw is rated 7.1 (CVSS 4.0 AV:N/AC:L/AT:N/PR:L/UI:N, availability-only), reflecting that exploitation requires an authenticated query-capable principal plus the non-default scripting capability, and that the impact is limited to a server abort with no data exposure or modification; there is no public exploit identified at time of analysis and no CISA KEV listing. Vendor patch is 3.3.0.
Denial of service in Open WebUI 0.11.0 through 0.11.3 lets authenticated users who are permitted to create automations submit crafted recurrence rules that expand on a per-second basis, synchronously blocking the shared event loop for minutes per request and again on every scheduler poll. The root cause is a mismatch in strictness: the sub-daily frequency guard in the recurrence-rule validator parses rule text more strictly than the calendar library that actually executes it, so whitespace-folded rules (or, on 0.11.0 specifically, lowercase frequency keywords or omitted RRULE prefixes) slip past the guard yet still execute. The flaw is availability-only (CVE-2026-109297, CWE-400, CVSS 7.1) and authentication-gated; no public exploit code was identified at time of analysis and it is not confirmed actively exploited (not in CISA KEV), with patched builds available in 0.11.4.
Memory exhaustion in Open WebUI 0.6.42 through 0.11.3 allows an authenticated user to take the entire instance offline for all users by submitting a chat message whose image field points to an attacker-controlled host that returns a gzip-encoded HTTP response. Because get_image_base64_from_url decompresses remote image responses without any size limit, a small compressed payload expands into an arbitrary amount of heap memory and drives the server into an out-of-memory denial of service. Exploitation requires a valid account and the ability to post chat messages (PR:L per the CVSS vector), and the independent assessment rates the impact as availability-only (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), moderate severity rather than critical; no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV.
Authorization bypass in LavaLite CMS through 10.1.2 lets an authenticated low-privileged user modify other users' accounts - including administrator accounts - by sending a PATCH request to the user update route carrying a target user identifier, altering the victim's name, email, password, status, or mobile number. The CVSS:4.0 vector (AV:N/AC:L/PR:L/UI:N/VI:H) and the independent CVSS:3.1 assessment (PR:L, I:H, S:U) both confirm that a valid low-privilege login is required, that no victim interaction or non-default configuration is needed, and that the impact is high-integrity write access with no direct confidentiality or availability loss; the practical effect is a route to full administrative account takeover. No public exploit code was identified at time of analysis and there is no confirmed active exploitation (not in CISA KEV), so the principal exposure limiter remains the need for an existing low-trust account, which narrows realistic risk to deployments that allow self-registration or where an attacker already holds low-level credentials.
Authenticated SurrealDB record users can read field values that field-level SELECT permissions are meant to conceal on SurrealDB 3.0.0 through versions before 3.3.0, either by selecting records whose COMPUTED fields are derived from protected fields or by issuing write statements with RETURN clauses that reference $before/$after. It is a moderate, authentication-gated information disclosure (CVSS 4.0 7.1; independent CVSS 3.1 assessment AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) that only bites deployments whose schemas pair field-level SELECT permissions with COMPUTED fields or allow record users to use write RETURN clauses - no public exploit identified at time of analysis, and the vendor fix is SurrealDB 3.3.0.
Page editors on Grav CMS versions 2.0.22 through 2.1.6 can render the Clockwork debugger's system.debugger.token via editor-authored Twig and replay it as the X-Clockwork-Auth header, disclosing profiler records that contain configuration values, request metadata, and database queries. The flaw is an authenticated, page-editor-level information disclosure (CVSS 4.0 base 7.1; independent assessment CVSS 3.1 AV:N/AC:L/PR:L/UI:N/C:H/I:N/A:N) that requires the Clockwork debugger to be enabled so that a token and profiler records exist; it is not anonymously reachable. Exploitation status: no public exploit identified at time of analysis, and the issue is remediated by upgrading to 2.1.7, which adds system.debugger.token to the Twig sandbox redaction list. This is a moderate-priority information disclosure flaw, not a critical emergency, because it needs valid editor credentials and Twig authoring rights and yields read-only exposure.
Authorization bypass in SurrealDB 3.0.0 through 3.3.0 allows authenticated record users to read records from other namespaces or databases by resolving record IDs via FETCH queries. Attackers can switch to a foreign namespace/database and use a RETURN … FETCH query to read another tenant's data if table PERMISSIONS allow reads. No public exploit identified at time of analysis; exploitation requires a valid authenticated session, multi-tenant deployment, and knowledge of a specific record ID.
Information disclosure in Open WebUI 0.11.0 through 0.11.3 allows an authenticated non-admin user who holds the tool export permission to retrieve the complete Python source code of tools shared with them in read-only mode by calling GET /api/v1/tools/export, exposing any API keys or credentials embedded in that source. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the impact is bounded by three prerequisites: a valid account, the specific tool export permission, and the presence of read-only shared tools that actually contain secrets. The issue is rated CVSS 4.0 7.1 (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N) and is fixed in 0.11.4.
Arbitrary file read in Frappe Framework versions before 15.117.0 and 16.x before 16.30.0 allows a user who can supply outgoing email HTML content to set an HTML attribute value pointing at a local server file path, which the framework then dereferences and exposes, disclosing server files readable by the Frappe service account. The flaw is remote and low-complexity but requires an authenticated account with enough privilege to author or configure outgoing email/notification content (CVSS vector PR:L, no victim user interaction), so its impact is confined to information disclosure of the service account's readable files rather than code execution or data modification; the vendor advisory GHSA-8v98-cfpm-9p67 and VulnCheck advisory describe the fix, and no public exploit code has been identified at time of analysis.
SQL injection in Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 allows an authenticated attacker holding at least low-level application credentials to inject SQL into database queries through specific endpoints that fail to validate input, resulting in extraction of sensitive data from the underlying database. The vulnerability is confidentiality-only (CVSS:4.0 7.1 / assessed CVSS:3.1 7.1, C:H with I:N and A:N) - there is no integrity or availability impact, and exploitation is not possible anonymously, so broad internet scanning is ruled out. No public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); risk is highest for internet-exposed instances that provision self-service or broadly distributed low-privilege accounts.
Authenticated SQL injection in Frappe ERPNext (before 15.106.0 and 16.x before 16.16.0) allows a low-privilege logged-in user to inject crafted input into several endpoints that build database queries without adequate validation, exposing sensitive data stored in the ERPNext database. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, vendor score 7.1) confirms high confidentiality impact with no inherent integrity or availability effect, and authentication is mandatory, so risk is concentrated where low-privilege accounts are widely issued, self-registration is enabled, or instances are internet-facing. No public exploit code and no confirmed active exploitation were identified at time of analysis, though the breadth of affected endpoints and the presence of a public GitHub security advisory make the issue operationally relevant for exposed, multi-tenant deployments.
SQL injection in Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 lets an authenticated low-privileged attacker read sensitive database information through specific endpoints that fail to validate input. Exploitation requires a valid low-privileged ERPNext session and network reachability to the affected instance; no user interaction or elevated privileges are needed, and patched 15.106.0/16.16.0 versions are not affected. There is no public exploit identified at time of analysis, and no CISA KEV entry is present in the provided data.
SQL injection in Frappe ERPNext allows authenticated attackers to read sensitive data from the underlying database by sending specially crafted requests to endpoints that fail to validate user-supplied input. The flaw affects ERPNext releases before 15.110.0 and 16.x versions before 16.21.0, and exploitation requires a valid low-privilege session (CVSS PR:L), so it cannot be triggered by an unauthenticated remote attacker. No public exploit code has been identified at time of analysis and no CISA KEV entry confirms active exploitation; the assessed risk is moderate-priority given the authentication barrier and the read-only confidentiality impact (C:H/I:N/A:N).
SQL injection in Frappe ERPNext (before 15.119.1, and 16.x before 16.32.0) allows an authenticated user with only low privileges to read sensitive data out of the underlying database by sending crafted input to endpoints that do not validate parameters before building SQL queries. Unauthenticated and anonymous users cannot trigger the flaw - a valid ERPNext session is required (PR:L), and the impact is limited to confidentiality (high data disclosure, no integrity or availability loss), which caps the practical severity despite the 7.1 CVSS v4.0 base score. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS score was supplied with the available intelligence; the principal exposure is any production instance running an affected version with normal user accounts.
Authenticated SQL injection in Frappe ERPNext before 16.34.2 allows users holding only low-privilege accounts to send crafted requests to multiple application endpoints and read sensitive data out of the underlying database. The flaw is a missing input validation issue (CWE-89) that is remotely reachable without user interaction, but it is gated behind the need for valid low-privilege credentials, which limits it to a moderate, authentication-dependent risk rather than an anonymous internet-wide exposure; no public exploit code and no confirmed active exploitation were identified at time of analysis.
SQL injection in Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 allows authenticated attackers with low privileges to extract sensitive information from the database via crafted requests to endpoints lacking input validation. The vulnerability is not known to be actively exploited, and no public exploit code has been identified at time of analysis. With a CVSS 4.0 score of 7.1, exploitation requires network access and valid low-privilege credentials, making it a significant risk for insiders or compromised accounts in multi-tenant deployments.
Frappe ERPNext instances running releases before 15.120.0, or 16.x releases before 16.23.0, contain an authorization bypass that allows any authenticated user - including a low-privilege account - to read party records outside the scope of their assigned role. The affected endpoint honours a caller-supplied flag that is meant to disable its own permission enforcement, so simply setting that flag in the request causes the server to skip the role check entirely; the result is a read-only confidentiality exposure with no write, modification, or availability impact. No public exploit code has been identified at time of analysis, but exploitation requires only a valid session and is most consequential on multi-user or multi-tenant deployments where party data is meant to be segregated by role, making this a legitimate but moderate-priority issue rather than a top-tier emergency.
An HQL injection in LogicalDOC Community Edition through 9.3 lets any authenticated user who holds read permission on a single folder escape that folder's scope and read document metadata and database contents they are not entitled to see. The flaw is reachable through the documents.xml data endpoint (DocumentsDataServlet), where the 'indexed' request parameter is concatenated unvalidated into a Hibernate query, so the primary barrier is only the requirement for a low-privileged, read-only account; impact is limited to confidentiality with no modification or denial of service. There is no vendor patch version confirmed in the available data beyond the upstream fix commit, and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, though an advisory and public discussion exist.
Missing authorization checks in Frappe ERPNext document-status modification endpoints allow authenticated low-privileged users to alter records beyond their assigned roles, with the primary impact being high integrity loss and limited availability impact (CVSS 4.0 7.1; assessed CVSS 3.1 AV:N/AC:L/PR:L/UI:N/C:N/I:H/A:L). Only instances running the 15.x branch below 15.121.0 or the 16.x branch below 16.34.0 are affected, and exploitation requires a valid low-privilege account plus reachability and knowledge of the relevant status endpoints - no administrative access or anonymous path exists, and confidentiality is unaffected. This is a genuine but moderate-priority issue rather than a critical emergency; no public exploit code has been identified at time of analysis and there is no confirmed active exploitation.
An out-of-bounds read in Progress MarkLogic Server 12.x query-processing functionality allows an authenticated remote attacker to crash or destabilize the server and to read a limited amount of data from process memory by submitting specially crafted input to the affected query routines. The flaw affects MarkLogic Server 12.x releases before 12.1.0; environments on 12.1.0 or later, or on other major branches, are out of scope. Exploitation requires valid low-privilege credentials (CVSS PR:L) plus network reachability to the query interface - this is not an unauthenticated flaw - and no user interaction is needed. Vendor-released patch: 12.1.0. No confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis; CVSS 3.1 base score is 7.1 (High) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H, driven primarily by the high availability impact of induced server instability.
XML external entity (XXE) processing is enabled by default across multiple request paths in Progress MarkLogic Server 11.x before 11.3.7 and 12.x before 12.1.0, allowing an attacker who submits crafted XML to trigger server-side requests or read local files. The vulnerability is rated CVSS 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L), meaning exploitation requires at least low-privileged credentials or an existing authenticated session - it is not an unauthenticated flaw - and the impact is limited to confidentiality loss and minor availability effects, with no integrity impact. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so exposure is currently a matter of unpatched, authenticated attack surface rather than active exploitation. Progress has published a security advisory and fixed releases that disable default external entity processing.
A denial-of-service condition in the Rust gitoxide `gix-pack` crate (all versions before 0.75.0) lets a malicious or compromised remote abort a client's fetch or clone by serving a malformed thin pack. The crafted pack combines a REF_DELTA that points at an already-known object with a following OFS_DELTA whose base_distance exceeds the current pack_offset, which drives the LookupRefDeltaObjectsIter into an arithmetic boundary it cannot satisfy and causes a panic that terminates the fetch process. The attack is unauthenticated from the attacker's side (PR:N) but requires user interaction (UI:P/UI:R): the victim must voluntarily fetch from or clone the attacker's repository, so it cannot be triggered against a passive listener. Impact is limited to availability of the fetch operation - no code execution, data disclosure, or integrity impact - and no public exploit code has been identified at time of analysis.
Denial of service in gitoxide gix-pack before 0.75.0 allows a malicious remote to panic and abort a client's git clone or fetch by responding with a crafted 12-byte pack header declaring version 3, which trips a release-enabled assert_eq! in BytesToEntriesIter::new_from_header that expects version 2. The attack requires the victim to initiate the fetch from an attacker-controlled or compromised remote (UI:R), but no authentication is needed (PR:N); automated CI, dependency resolution, or mirror synchronization that pulls from untrusted sources is the primary exposure. No public exploit code or CISA KEV entry was identified at time of analysis, and the CVSS 4.0 score is 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H per independent assessment).
SQL injection in LogicalDOC Community Edition through 9.3 allows authenticated low-privileged users to execute crafted SQL via the firstLetter parameter of TagsDataServlet, enabling UNION SELECT statements to be returned in the XML tag list and disclosing usernames, email addresses, and password hashes from the ld_user table. This is a credible but bounded risk: the CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N) and independent assessment (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) confirm that an authenticated session is required, with no integrity or availability impact; no public exploit identified at time of analysis. The upstream fix commit (8428bfb) parameterizes the vulnerable LIKE clause, but a tagged patched release is not independently confirmed.
Frappe ERPNext before 15.118.0 and 16.x before 16.27.0 allows authenticated low-privilege users to read financial data beyond their assigned role because certain endpoints do not enforce proper authorization checks (CWE-862). The vulnerability is remote and requires valid ERPNext credentials (PR:L) with no user interaction, but impact is limited to high confidentiality read exposure with no write or availability effect; no public exploit identified at time of analysis. This is a genuine but moderate-priority issue rather than a top-tier emergency, with practical risk highest in broad-user-base or multi-tenant deployments where many low-privilege or portal accounts can reach the affected endpoints.
Frappe ERPNext instances running versions before 15.116.0, or 16.x before 16.27.0, expose financial data to any user who can authenticate, because specific endpoints omit the role-based authorization checks that should gate them. An attacker holding a valid but low-privileged account can query those endpoints directly and read financial records that their role does not permit, resulting in high confidentiality impact with no integrity or availability effect. Exploitation requires authentication (CVSS PR:L) and no user interaction, so the realistic threat is a malicious or compromised insider, portal user, or leaked low-privilege credential rather than an anonymous internet drive-by; no public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited.
Authenticated users of Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 can read data, including personal information, beyond their assigned role permissions due to missing authorization checks on certain endpoints. The flaw requires a valid low-privilege account (PR:L) and network access but no user interaction or elevated privileges. No public exploit code has been identified at time of analysis, and this is best treated as a moderate-priority authenticated data-confidentiality exposure.
Missing authorization checks in Frappe ERPNext let authenticated users with low-privilege accounts read item master data outside their permitted role. The flaw affects all releases before 15.118.2 on the 15.x line and 16.x versions before 16.30.0, and is rooted in endpoints that skip server-side role enforcement (CWE-862). Exploitation requires valid credentials (PR:L per the assessed CVSS:3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), so it is not reachable by fully unauthenticated attackers, and impact is confined to information disclosure with no write or availability effect; no public exploit identified at time of analysis, and vendor patches are available.
Missing authorization checks in certain Frappe ERPNext endpoints let authenticated low-privileged users read personal data beyond what their assigned role permits, affecting releases before 15.112.0 and the 16.x branch before 16.23.0. Because exploitation requires a valid low-privileged account (CVSS PR:L) rather than unauthenticated access, the practical risk is highest in deployments that expose portals or large numbers of low-trust accounts, such as customer/vendor portals, sizable employee bases, or multi-tenant hosting. The flaw is a confidentiality-only issue (CWE-862) with no integrity or availability impact, no public exploit code identified at time of analysis, and no confirmed active exploitation (CISA KEV); the CVSS 4.0 base score is 7.1 while our independent assessment rates it 7.5 under CVSS 3.1, reflecting its genuine but moderate-priority access-control nature.
Missing authorization checks in project-related endpoints of Frappe ERPNext allow any authenticated low-privilege user (CVSS v3.1 PR:L, remote, no user interaction) to read project data that their assigned role should not permit, resulting in a high-confidentiality, read-only disclosure with no integrity or availability impact. Affected deployments are ERPNext versions before 15.111.0 and 16.x before 16.22.0, with vendor patches available at 15.111.0 and 16.22.0; there is no public exploit identified at time of analysis, and the flaw is not confirmed actively exploited (CISA KEV). The practical risk is highest in multi-user or multi-tenant installations where semi-trusted or low-privileged accounts exist, since exploitation only requires a valid account and direct knowledge of the affected endpoint calls.
Missing authorization in Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 allows authenticated low-privileged attackers to read financial data beyond their permitted role. The vulnerability is network-reachable with low attack complexity and requires only a valid low-privileged account, resulting in high confidentiality impact but no integrity or availability impact. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS 4.0 score is 7.1 (High).