Missing authorization in the WordPress plugin Paid Videochat Turnkey Site (ppv-live-webcams, versions through 7.5.13) lets an attacker who already holds a low-privilege account on the site bypass the plugin's access-control checks and read information that should be restricted to higher-privileged users. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N, score 5.0) confirms it is remotely reachable, requires no user interaction, and is limited to a confidentiality disclosure of low severity, with no integrity or availability impact; the scope change (S:C) reflects that the weakness lets the attacker reach resources beyond the plugin component itself. Exploitation status is no public exploit identified at time of analysis - there is no KEV listing and no published proof-of-concept code - and the practical prerequisite is that the attacker must first register or otherwise obtain a low-privilege session on a site running the vulnerable version.
Arbitrary file write on the orchestrator host affects Vercel deepsec versions 0.1.0 through 1.1.16, where the extractTarballLocally routine in the sandbox download path follows symbolic and hard links planted inside result tarballs. An attacker who already controls code running inside the deepsec sandbox - the canonical case being a prompt-injected coding agent - can plant links in the host data directory so that extraction of the returned tarball writes files outside the sandbox and onto the orchestrator host. The issue is rated medium severity (CVSS 4.0 base 4.9; independent assessment CVSS 3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:N), exploitation is highly conditional (attacker must already hold sandbox code execution, and the extraction must succeed on an attacker-influenced tarball), and no public exploit identified at time of analysis; there is no CISA KEV listing.
Stored cross-site scripting in Thelia (all versions from 0 through 2.6.0) lets an authenticated back-office user - specifically one with permission to create categories or products - persist malicious JavaScript that is later executed when an administrator in the admin interface or a shopper on the storefront product pages views the poisoned content. Because the script fires in the victim's browser session, the attacker can read or manipulate whatever that session can access, but there is no direct server-side compromise and a second user must load the affected page for the payload to run. No public exploit identified at time of analysis, and the EPSS score is low at 0.17% (5th percentile), making this a low-to-moderate priority issue rather than a critical one.
Availability loss in Zephyr RTOS Bluetooth Mesh affects nodes built with the default access-layer delayable message queue, where an unsynchronized race between the host RX thread and the system workqueue lets the handler touch a context slot that has already been purged. The attacker must be a provisioned mesh member - holding the NetKey and a bound AppKey - within Bluetooth radio range, who can control arrival rate, response size and destination address to exhaust the 4-entry context pool and 40-entry chunk pool and force the purge path; the trigger is a narrow, high-complexity race. Winning it produces a read-modify-write through a NULL-based pointer on the system workqueue thread, which on typical targets faults and aborts that thread (stopping all workqueue-driven functionality, including the mesh timing machinery) or resets the node, so impact is availability only - the write value and address are fixed, so there is no memory corruption or code execution path. Scoring is CVSS 3.1 4.8 (AV:A/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H); no public exploit identified at time of analysis, and there is no KEV listing.
Stored cross-site scripting (XSS) in the OTRS Custom Pages feature allows an authenticated administrator to inject arbitrary JavaScript that is stored and later executed in the browsers of users who access the affected page. Affecting OTRS 7.0.X, 8.0.X, 2023.X, 2024.X, and 2025.X, plus 2026.X before 2026.7.X, exploitation requires a high-privileged admin account and a victim to actively visit the page. No public exploit has been identified at time of analysis, and the issue is assessed as low-to-moderate priority.
Out-of-bounds read and write in the native AI sound-separation library (lib_sag_ai_sound_sep_v2.00.so) on Samsung mobile devices allows a local, low-privileged attacker to read and write memory outside the intended buffer, with impact bounded to low confidentiality, integrity, and availability within the affected component. The flaw is only reachable by an attacker who already holds local code execution on the device - typically a malicious or compromised app capable of supplying crafted input to the library - and affects firmware versions prior to SMR Oct-2026 Release 1. There is no public exploit identified at time of analysis and no indication of confirmed active exploitation; the moderate CVSS 4.8 score reflects the local attack vector and limited per-component impact rather than a remote or high-severity threat.
Local policy bypass in ImageMagick's -script operation (versions before 7.1.2-32) lets a low-privileged local user close file descriptors not opened by the current operation, undermining security restrictions configured in policy.xml. The flaw is a CWE-404 resource lifecycle issue (CVSS 4.0 base 4.8; assessed CVSS 3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) with availability-only impact and no scope change; it is most relevant where policy.xml is used as a containment boundary for untrusted ImageMagick operations. No public exploit code or active exploitation was identified at time of analysis, and vendor-released patch 7.1.2-32 is available.
ImageMagick before 7.1.2-32 leaks heap memory when its command-line -process option is invoked with certain crafted arguments, allowing an attacker who can run the magick/convert tooling and influence those arguments to gradually exhaust memory and degrade service availability. The flaw is classified as CWE-401 (missing release of memory) and is strictly local, requiring at least low-level privileges to execute the CLI (AV:L/PR:L per the assessed vector), with impact limited to low availability loss and no confidentiality or integrity effect. No public exploit code and no confirmed active exploitation have been identified at time of analysis; the vendor has published a fix commit and an advisory, and the issue rates as medium severity (CVSS 4.0 base 4.8) with low real-world urgency.
Heap buffer over-read in ImageMagick's -fx expression processor affects versions 7.1.0-21 through 7.1.2-31, allowing a local, low-privileged attacker who can get a crafted -fx expression evaluated to read past the end of an allocated heap buffer and disclose limited memory contents or trigger a crash. The issue is rated CVSS 4.0 4.8 (AV:L/AC:L/PR:L/UI:N, confined to low confidentiality and availability impact), and there is no public exploit identified at time of analysis. Practical risk is highest where a service passes untrusted input into ImageMagick -fx expressions and is comparatively small for typical operator-driven command-line use, matching the independent assessment that this is a low-to-moderate priority issue rather than a high-severity emergency.
Local privilege escalation in Yun Jia Security Guard up to 2.7.1.9 allows an authenticated local attacker to manipulate the Pid argument to function sub_14000885C in the kgameprotect.sys kernel driver, resulting in improper privilege management. The vulnerability requires the product to be installed with the driver loaded and a low-privileged local account; it cannot be exploited remotely. No public exploit code has been identified, and the vendor has not responded to disclosure attempts.
Server-side request forgery and local file inclusion in Frappe Framework 15.x before 15.107.3 and 16.x before 16.17.0 allow an authenticated user who can render user-controllable content to PDF to make the server fetch internal resources or embed local server files into the resulting PDF. The root cause is Frappe's dependency on a vulnerable version of the pdfkit library (CVE-2025-26240), which resolves external URLs and file references during server-side PDF rendering. The assessed vector is network-accessible but requires a valid Frappe account with access to a PDF-generating feature (print formats, templates, or report-to-PDF flows), and impact is limited to confidentiality; it is a medium-severity, low-priority issue for most deployments, and no public exploit was identified at time of analysis.
Repeated directory traversal during image-layer unpacking in containerd allows a malicious container image to consume excessive CPU by interleaving ordinary files with opaque whiteout markers, delaying container startup and reducing image-pull concurrency for unrelated deployments. Affected versions are containerd prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5; exploitation requires an operator, orchestrator, or CI/CD pipeline to pull or import the attacker-controlled image (CVSS 4.0 base 4.6, Medium; independent assessment CVSS 3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L), so environments restricted to trusted, signed images from controlled registries are effectively not exposed. Only availability is affected - there is no code execution or data exposure - and no public exploit code had been identified at the time of analysis; this is a genuine but low-priority denial-of-service issue rather than a high-severity emergency.
Connection-resource exhaustion in IBM Power Systems firmware levels FW1110.00 through FW1110.31, FW1120.00 through FW1120.01, and FW1060.00 through FW1060.81 lets a highly privileged attacker on an adjacent network segment drive a denial of service by consuming connections the service processor never releases, until legitimate management traffic can no longer be serviced. The assessed vector (CVSS 4.5, AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) means exploitation requires pre-existing administrative access to the affected interface plus network adjacency to the management segment, which confines realistic risk to insiders or attackers who have already established a foothold on the management network; confidentiality and integrity are unaffected. No public exploit has been identified at time of analysis and there is no indication of active exploitation, making this a low-to-moderate priority availability issue rather than an urgent one.
Local users on IBM i 7.3, 7.4, 7.5, and 7.6 can modify the system BOOTP table because the operating system fails to enforce a proper authority check on that configuration function, a case of improper privilege management (CWE-269). Exploitation requires an interactive or authenticated local presence on the host with at least low-level privileges (CVSS vector AV:L/PR:L), so neither a remote nor a fully unauthenticated attacker can trigger it, and the resulting impact is capped at low confidentiality and low integrity with no availability effect (CVSS 4.4). No public exploit code has been identified at time of analysis and there is no evidence of active exploitation, though IBM has published a vendor fix; this is a low-to-moderate priority issue rather than a top-tier emergency, with exposure scaling with the number of local accounts permitted on the partition.
Improper access control in the @backstage/backend-defaults package of the Backstage developer portal framework (versions prior to 0.17.8, shipped in Backstage releases before v1.54.6) allows an authenticated user to invoke backend actions that an operator had explicitly excluded through backend.actions configuration. The excluded actions are filtered out when actions are listed, but the invocation path never re-applied those filters, so a caller who knows or guesses an action ID can still trigger it; per-action permissions and downstream authorization remain enforced, which caps the impact at a low-integrity exposure (CVSS 4.3, C:N/I:L/A:N). There is no public exploit identified at time of analysis and no confirmed active exploitation (not in CISA KEV), and the issue only matters in deployments that actually configured action exclusions. Fixed in @backstage/backend-defaults 0.17.8.
An authorization bypass in Nango versions prior to 0.70.9 allows a same-team user with the development_full_access role to read production integration flow metadata and named flow configuration when RBAC is enabled (has_rbac=true). This occurs because two private flow-read routes-GET /api/v1/integrations/:providerConfigKey/flows and GET /api/v1/flow/:flowName-omit the can({ action: 'read', resource: 'flow', scopedBy: envScope }) guard, enabling access to env=prod despite production role boundaries. The flaw is fixed in version 0.70.9; no public exploit code or active exploitation is currently identified, and the CVSS score is 4.3 (low severity).
Metadata and file-existence disclosure in OpenList versions through 4.2.3 allows an authenticated low-privileged user with a restricted BasePath to bypass authorization and view search results for sibling directories when Bleve search indexing is enabled. The flaw stems from a non-separator-aware strings.HasPrefix check that mis-authorizes paths like /base2 as contained within /base, and the Bleve backend’s unfiltered Total count leaks match existence even when individual results are filtered. A public proof-of-concept exists, though exploitation requires the Bleve engine to be configured, a specific sibling-directory naming collision, and authentication; the CVSS score is 4.3 (low-to-medium severity).
Missing authorization checks in the WP User Manager plugin for WordPress (versions through 2.9.22) let an authenticated low-privileged user invoke plugin functionality that should be restricted to higher-privileged roles, resulting in unauthorized integrity changes rather than data disclosure or disruption. The flaw is rated CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), meaning remote exploitation is possible but requires a valid low-privileged account (PR:L) and only affects integrity (C:N/A:N); because the plugin provides front-end registration and profile management, such accounts are frequently self-obtainable on sites with open registration enabled, which materially raises practical reach even though fully anonymous attackers cannot exploit it. There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, so this is best treated as a modest-priority, high-volume WordPress plugin hardening issue rather than an urgent emergency.
Missing authorization in the WP Desk Flexible Subscriptions WordPress plugin, affecting all versions through 1.8.4, lets an authenticated low-privilege user (for example a registered customer or subscriber, PR:L) invoke plugin functionality that lacks a proper capability check, altering data the account should not be able to change. Impact is limited to partial integrity loss - no confidentiality or availability effect and no scope change - giving it a moderate CVSS 3.1 base score of 4.3, and exploitation requires a valid session on the target WordPress/WooCommerce site. There is no evidence of active exploitation (not listed in CISA KEV) and no public exploit code identified at time of analysis, so this is a moderate-risk, not a priority, issue.
Exposure of JavaScript source map files in IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 lets remote attackers retrieve the original, unminified client-side source of the web application, exposing internal identifiers, endpoint references, comments and other development-time detail. Per the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) no authentication or user interaction is required, and the impact is confined to a low-severity confidentiality loss - reconnaissance material rather than direct access, since integrity and availability are unaffected. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and EPSS data was not provided; the vendor itself scored the attack vector as adjacent (AV:A), which would further limit exposure to attackers on the same local or logical network segment. This is a low-priority finding that is nonetheless a confirmed, genuinely disclosed product weakness.
Convex Backend self-hosted deployments running images or local binaries older than the August 10, 2026 release can, in rare cases, allow a remote unauthenticated attacker to read deployment information if user interaction is achieved; Convex cloud deployments were patched automatically and are not affected. The maintainer intentionally withheld the affected component and trigger mechanism, no public exploit identified at time of analysis, and the independent assessment rates this as a genuinely low-priority issue despite the network attack vector because exploitation requires interaction and high attack complexity. The vendor CVSS is 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N), while the independent assessment uses AC:H; only confidentiality is affected, not integrity or availability.
Authenticated users of a WordPress site running the Paid Videochat Turnkey Site plugin (ppv-live-webcams) through version 7.5.12 can manipulate quantity/specified-value input parameters because the plugin fails to properly validate them (CWE-1284). Rated CVSS 3.1 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), the flaw is network-reachable but demands a logged-in account and yields only limited integrity impact, with no confidentiality or availability effect. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, so this is a moderate-severity, low-priority hardening item rather than an urgent threat.
Insecure direct object reference in the Hotel Booking WordPress plugin (versions through 3.8) lets any authenticated user - a Subscriber-level account is sufficient - retrieve booking records that belong to other customers by supplying a booking identifier they do not own. Because the plugin performs no ownership check on the requested record, an attacker can harvest customer PII including names, email addresses, phone numbers, and postal addresses; the CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, score 4.3) confirms a network-reachable, low-privilege, read-only confidentiality impact with no integrity or availability effect. The issue is significantly easier to reach on sites that allow public user self-registration, which is common for hospitality bookings; no public exploit code was identified at time of analysis and there is no CISA KEV listing, so this is a genuine but moderate-priority authorization defect rather than an emergency.
Cross-site request forgery in OTRS 7.0.X, 8.0.X, 2023.X, 2024.X, 2025.X and 2026.X before 2026.7.X lets an unauthenticated remote attacker cause an authenticated administrator's browser to fire the DBUpdateLogCleanUp administrative action through a forged GET request, deleting the DBUpdate log entries present at the time the request is processed and degrading diagnostic and audit history. Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N, 4.3) exploitation requires an administrator with an active session to be lured into loading an attacker-controlled page, so the attacker cannot choose targets or confirm success, and no public exploit code was identified at time of analysis. Additional administrative, deployment/synchronization, and export or read-only endpoints were also found to lack ChallengeToken validation, but those paths cannot introduce arbitrary new configuration and export responses remain protected by the browser's same-origin policy, so no confidentiality impact has been demonstrated.
Cross-site request forgery in the Hotel Booking WordPress plugin (versions through 3.8) lets an attacker forge administrative requests that create, delete, or modify booking order records inside an administrator's authenticated browser session, yielding a limited integrity-only impact (CVSS 4.3, C:N/I:L/A:N). The attacker needs no account of their own (PR:N), but the attack only succeeds if a logged-in administrator is tricked into loading an attacker-controlled page or hidden auto-submitting form (UI:R), which is the primary limiting factor. No public exploit code has been identified at time of analysis, and confidentiality and availability are not affected - only the accuracy of booking order data is at risk.
Cross-site request forgery in FileRise versions prior to 3.14.0 lets an attacker who lures an already-authenticated user into issuing a forged POST create an empty file or a share link under that user's identity, because the /api/file/createFile.php and /api/file/createShareLink.php handlers omit the server-side X-CSRF-Token check that adjacent state-changing endpoints enforce. The attacker does not need credentials of their own (PR:N), but the victim must hold an active session and be induced to make the request (UI:R); assessed severity is low (CVSS 4.3, AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N), and impact is bounded to file creation and share-link creation with the victim's permissions, not arbitrary content upload or account takeover. There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis; the default SameSite=Lax session cookie is the decisive practical limiter, since a standard scripted cross-site POST will not carry the session cookie.
Missing authorization in the VideoWhisper Broadcast Live Video WordPress plugin (all versions through 7.3.6) allows an authenticated low-privilege user to invoke plugin functionality they are not entitled to and alter site content or plugin settings without holding the required capability. The impact is integrity-only (CVSS 4.3, C:N/I:L/A:N), scope is unchanged, and no confidentiality loss or denial of service results. There is no public exploit identified at time of analysis, CISA KEV does not list this CVE, and the assessed exploitation conditions (a valid low-privileged account on a site with the plugin enabled) place real-world risk at low priority rather than urgent.
Local information disclosure in FreeRDP 3.0.0 through 3.31.x allows an unprivileged local attacker on a multi-user Unix host to read PKINIT private-key material that the client writes to a shared temporary directory with world-readable permissions during soft-smartcard logon. Exploitation requires the attacker to already hold a local account, the victim to perform a soft-smartcard PKINIT logon during the attacker's monitoring window, and the deployment to actually use soft-smartcard authentication; single-user hosts and installations not using this flow are unaffected. No public exploit identified at time of analysis, and the flaw is not known to be actively exploited; it yields only confidentiality impact, with no integrity or availability effects.
Locally positioned attackers who can control copy queue work in Progress ShareFile Storage Zones Controller 5.12.6 and earlier can exploit an unvalidated callback URL acknowledgement path combined with a race condition to make FileCopyService consume attacker-controlled metadata and content. The issue is assessed as low-to-moderate priority with limited integrity and availability impact (C:N/I:L/A:L), no confidentiality exposure, and high attack complexity; no public exploit code or CISA KEV active exploitation is identified in the provided data. Remediation should occur in normal maintenance cycles rather than emergency patching.