An out-of-bounds read in the tmfile model loader of OAID Tengine (all releases up to and including 1.12.0) allows a malformed .tmfile model to drive reads beyond the end of an allocated buffer through the offset_root argument in source/serializer/tmfile/tm2_serializer.c. Exploitation is unauthenticated but requires user interaction - the victim must load the attacker-supplied model file - so only environments that ingest models from untrusted or third-party sources are realistically exposed, and the independent assessment rates this a low-priority issue notwithstanding its public disclosure. Publicly available exploit code exists (a public GitHub issue, OAID/Tengine#1453), but there is no evidence of active exploitation and no vendor patch has been released at time of analysis; impact is bounded to low-severity information disclosure and availability effects.
Cross-project Agent ownership transfer in n8n allows an authenticated user who holds only read-only Agent access to a victim project to seize and rewrite that project's Agents by supplying a foreign Agent ID to the Agents create endpoint. Affected are n8n versions before 2.41.4 and 2.42.x releases before 2.42.1; this is an IDOR-class authorization bypass (CWE-639) carrying a CVSS 4.0 base score of 6.1 and an assessed CVSS 3.1 vector of AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L, i.e. a medium-severity integrity-focused flaw rather than a pre-auth remote code execution issue. Exploitation requires a valid authenticated account, pre-existing read-only Agent visibility into the target project, and knowledge or possession of a valid Agent ID belonging to that project, so it cannot be mounted by an unauthenticated external attacker against a default install; no public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV.
Heap out-of-bounds write in the GStreamer ASF muxer plugin (asfmux) occurs when string metadata tags containing Unicode characters outside the Basic Multilingual Plane - such as emoji or supplementary-plane CJK characters - are written into an ASF/WMV container, because the buffer size calculation assumes 2 bytes per code point while UTF-16LE surrogate pairs actually require 4. Exploitation requires a local pipeline that muxes, remuxes, or transcodes attacker-supplied media into ASF while preserving metadata (AV:L, UI:R), enabling a user-assisted heap corruption that can cause a denial of service or limited memory corruption. Rated CVSS 6.1 with C:N/I:L/A:H, this is a medium-severity issue with a narrow attack path; no public exploit code and no confirmed active exploitation were identified at time of analysis, and affected packages are tracked for Red Hat Enterprise Linux 7, 8, 9, and 10.
Authenticated denial of service in RabbitMQ 4.0.x, 4.1.x, 4.2.x and 4.3.x allows a low-privilege AMQP 1.0 client to inflate broker memory with tiny frames. Because the pre-authentication max_heap_size guard is removed after SASL login, a client can send ordinary frames containing many AMQP 1.0 arrays whose shared constructor is zero-width, each expanding into a large list of terms in the reader process heap before frame validation or authorization occurs; repeated or concurrent frames can trip the node-wide memory alarm and block publishers. No public exploit identified at time of analysis, and the issue is fixed in 4.0.24, 4.1.15, 4.2.10 and 4.3.4.
Amazon SageMaker Python SDK versions V3 before 3.10.0 and V2 before 2.257.3 can write unredacted repository credentials into CloudWatch Logs when a git clone invoked through runclone_command() fails. An authenticated remote user with permission to read the relevant CloudWatch Logs can obtain plaintext repository credentials, but the clone operation must fail for the disclosure to occur. No public exploit identified at time of analysis, and vendor-released patches are available in V3 3.10.0 and V2 2.257.3.
Authenticated attackers with read and metadata-write access to encrypted objects in Amazon S3 can force a padding downgrade in the Amazon.Extensions.S3.Encryption .NET client, then use a Bleichenbacher padding oracle to recover the RSA-wrapped envelope key and decrypt the object. Affected versions are before 3.2.2 and 4.0.x before 4.0.3; the 1.x and 2.x lines are unpatched and must be migrated. Exploitation requires valid credentials, metadata modification permissions, and many decryption queries, so no public exploit identified at time of analysis, consistent with SSVC Exploitation: none.
SQL injection in Dell PowerScale InsightIQ versions 5.2.0 through 6.3.0 allows an authenticated local attacker with low privileges to cause a denial of service. The vulnerability (CWE-89) requires the attacker to have a valid account on the appliance and cannot be exploited remotely. No public exploit code or active exploitation has been identified at time of analysis.
REBUILD through 4.5.0 provides an authorization bypass (IDOR, CWE-639) in its AiBot2 AI-assistant endpoints, letting an authenticated low-privilege user act on another user's chat by supplying that user's chatid to chat-init, chat-delete, chat-feedback, or chat-stream-stop. Successful exploitation allows reading and exfiltrating conversation content (high confidentiality impact), deleting chats, and interrupting active streams, with limited integrity impact and no direct availability loss to the application as a whole. The attack is network-reachable but rated AC:H because the attacker must first obtain or guess a valid victim chatid, and it only matters on multi-user deployments where the AiBot2 assistant feature is in use; no KEV entry or public exploit code was identified at time of analysis, and EPSS data was not provided.
Prototype pollution in the n8n AI workflow builder allows an authenticated user to degrade an instance until it is restarted by creating a workflow node whose name is a reserved key such as '__proto__' and then invoking the connect-nodes operation, which merges node connections using node names as object members without filtering reserved keys. Affected releases are all versions before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1; the impact is availability-only (CVSS 6.0, C:N/I:N/A:H in the vendor's CVSS 4.0 vector; assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), with no confidentiality or integrity loss and no public exploit identified at time of analysis. Exploitation requires a valid account with the ability to create workflow nodes through the API and access to the AI workflow builder's connect-nodes operation, and it further depends on the attacker supplying the specific crafted node name, which is why the vendor's vector carries an AT:P attack-requirements value.
Private attachment disclosure in Blinko through 1.8.8 allows a low-privileged authenticated user to read other users' non-shared attachments through the /api/file route because the route's owner check is flawed. Exploitation requires a valid account and knowledge or reconstruction of the victim's stored filename, which follows a basename-plus-millisecond-timestamp pattern, and the independent assessment rates it moderate severity (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N). No public exploit code or confirmed active exploitation was identified at time of analysis; impact is confidentiality only, with multi-user or multi-tenant deployments representing the realistic risk surface.
Authenticated cross-tenant file disclosure affects the iFlytek AstronRPA platform through version 1.1.6 via an insecure direct object reference in the resource-service /file/download endpoint. Any user who holds a valid tenant login can supply a fileId belonging to a different tenant and receive that tenant's S3-stored file, because the DAO method FileMapper.getFile returns the object without any owner or tenant ownership predicate; the time-ordered Snowflake file identifiers make reliable enumeration practical (reflected as AT:P in the CVSS 4.0 vector). Impact is confidentiality-only (no write or availability effect) and the assessment is CVSS:3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, with no public exploit code identified at time of analysis, though a public technical writeup documents the flaw and no CISA KEV entry exists.
Malformed clock-synchronization messages delivered over SyncE or PTP can crash the clksyncd daemon and trigger persistent Routing Engine switchovers on Juniper MX Series devices running vulnerable Junos OS releases that are equipped with an SCBE3 Switch Control Board and configured for external clock synchronization. The attacker must be logically adjacent (CVSS AV:A) - sitting as, or controlling, the upstream timing node that feeds the victim's clock path - and no authentication is required (PR:N), but the trigger is a race condition that Juniper itself describes as outside the attacker's direct control (AC:H), so the resulting denial of service is non-deterministic rather than reliably forcible. Impact is purely availability (C:N/I:N/A:H); devices without SCBE3, or not running SyncE/PTP, are unaffected, and no public exploit code or active exploitation has been identified at time of analysis. This is a genuine but modest-priority issue, not a top-tier emergency.
Denial of service in PgBouncer 1.21.0 through 1.26.0: a remote attacker who sends a packet header declaring a length above 2^31 triggers an integer overflow in the message buffer growth routine (mbuf_make_room), saturating a CPU core and stalling every pooled connection until the process is restarted. The attack is gated by a non-default configuration - max_packet_size must be set above 2147483648, whereas the shipped default of 2147483647 is not exploitable - but when that setting is in place, versions 1.23.0 through 1.26.0 are reachable before authentication with only a five-byte packet header (PR:N in the assessed vector), while 1.21.0-1.22.x require reaching the vulnerable code path. No public exploit identified at time of analysis, and a vendor patch is available (fixed in 1.26.1 per the EUVD affected-version range).
Authentication bypass in TP-Link Wi-Fi range extenders lets an unauthenticated attacker on the same local network obtain administrator access to the device's web-management interface by capturing a legitimate administrator's HTTP login exchange and deriving an alternative credential value that the device still accepts. The attack depends on the login being served over plain HTTP and on the attacker passively observing a real administrator's session key, dictionary, and login value, which makes it high-complexity and timing-dependent rather than on-demand (CVSS 4.0 5.9, CWE-287); the independent assessment rates confidentiality and integrity impact as High with no availability impact. No public exploit code was identified at time of analysis, and successful abuse would let the attacker view credentials/config and modify exposed configuration settings.
Decryption of stored TOTP secrets and credentials in FileRise manual (non-Docker) installations from 3.9.0 before 3.22.0 is possible when the instance runs on a published legacy compatibility key because neither PERSISTENT_TOKENS_KEY nor metadata/persistent_tokens.key is present. An attacker must separately obtain the ciphertext-bearing account or configuration files (such as persistent_tokens.json, adminConfig.json, or the users file) before the known key can be used, so the medium CVSS 5.9 rating reflects high attack complexity and a narrow set of prerequisites. No public exploit code or confirmed active exploitation was identified at time of analysis. The issue is fixed in 3.22.0.
Integer underflow in the NXP KW41Z IEEE 802.15.4 receive path of Zephyr RTOS lets an attacker within radio range corrupt memory in the shared network-buffer pool from interrupt context. The driver samples the over-the-air PHY-header length byte from the ZLL IRQSTS register and subtracts the FCS length in a uint8_t, so a crafted frame advertising a length of one wraps to 255 bytes, which is copied into a single 128-byte net_buf fragment and overruns it by up to 127 bytes while also reading past the end of the radio's RX register array. No public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited; exploiting it requires RF proximity plus a timing race that the attacker must win by flooding length-one frames.
Denial of service in Erlang OTP's stdlib erl_tar module (OTP 29.0 before 29.1.2, stdlib 8.0 before 8.1.1) allows an attacker who supplies a tar archive to be extracted to disk to hang the extracting process and consume a scheduler indefinitely, using a crafted GNU sparse member with a sparse map that ends before its declared real size. The same vulnerable code is vendored as hex_erl_tar in hex_core 0.14.0 and later, as mix_hex_erl_tar in Hex 2.4.2 and later, and as r3_hex_erl_tar in rebar3 3.27.1 and later, so those components remain exploitable on any OTP release including OTP 28. The assessed vector is local and unauthenticated (AV:L/AC:L/PR:N/UI:N) with availability-only impact on a single process/scheduler; no public exploit identified at time of analysis, and extraction using the memory output option is not affected.
Local users with low privileges can bypass the ClawScan Static scanner (clawscan-static) in OpenClaw ClawScan up to and including version 0.1.6 by supplying scan targets whose paths the tool wrongly treats as skippable, allowing content such as packaged Python bytecode to go uninspected while still being processed. The flaw is a path-classification error in shouldSkipTargetPath (internal/runner/runner.go), so the protection mechanism fails rather than being memory-corrupted, and impact is limited to low confidentiality, integrity, and availability effects (CVSS 4.0 base score 1.9; independently assessed as CVSS 3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N). Publicly available exploit code exists (a proof-of-concept scanner-bypass project) and exploitation requires the victim to actually run ClawScan against attacker-supplied content; there is no indication of confirmed active exploitation (CISA KEV), and the vendor has released a fix in version 0.1.7.
Local privilege escalation in Palo Alto Networks GlobalProtect App versions 6.3.0 before 6.3.3-h16 and 6.2.0 before 6.2.8-h15 on macOS allows an authenticated local non-administrative user to obtain root privileges and execute arbitrary commands. The vulnerability is due to an untrusted search path (CWE-426) and requires a local foothold; no public exploit has been identified at time of analysis. Other platforms (Linux, Windows, iOS, Android, Chrome OS) are not affected.
Processing a malformed KWAJ archive with libmspack through 0.11alpha can free uninitialized heap pointers, crashing the host application and potentially providing an arbitrary-free memory corruption primitive. The flaw is unauthenticated but local/file-delivery in nature: an application linked against libmspack must invoke the KWAJ decompressor (kwajd_open) on attacker-supplied input, and the attacker must present a truncated, zero-length, or wrong-signature file that forces an early error return before the filename and extra pointers are initialized. No public exploit code or CISA KEV entry was identified at time of analysis, and the independent assessment rates this as a moderate, not top-priority, issue whose reliable outcome is a crash, with arbitrary-free escalation conditional on platform- and compiler-specific uninitialized stack values.
Arbitrary file write in the Markdown Preview Enhanced extension for Visual Studio Code (all versions before 0.8.30) lets JavaScript already running inside a preview webview invoke the _crossnote.updateMarkdown command with an arbitrary target URI and attacker-supplied content; the extension then hands both straight to vscode.workspace.fs.writeFile, so configuration, startup, source, and build files can be overwritten within the limits of the VS Code user's operating-system privileges. Exploitation is conditional rather than standalone: remote attackers need no credentials per the CVSS PR:N vector, but the victim must open attacker-controlled Markdown or repository content with the extension active, and the attacker must first obtain a separate webview JavaScript execution path such as the .crossnote/head.html script injection or the blind command-dispatch weakness fixed in the same release. No public exploit code and no confirmed active exploitation were identified at time of analysis, and a vendor patch exists in 0.8.30, making this a moderate, conditional risk rather than a drop-everything priority.
Crafted LAS/LAZ point-cloud files parsed by LASzip through 3.5.0 can trigger an invalid free inside laszip_read_header(), crashing the host application and corrupting its heap. A file whose header declares an inflated variable-length-record (VLR) count while supplying truncated VLR data leaves internal attribute pointers uninitialized, so they are freed when the reader is destroyed through the C API (CWE-824, access of uninitialized pointer). The issue is Medium severity (source-provided CVSS 4.0 base 5.8; independently assessed as CVSS 3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H), meaning a victim or automated pipeline must open an attacker-supplied file - there is no network-reachable or auto-triggered path - and impact observed is crash plus heap corruption rather than confirmed code execution; no public exploit identified at time of analysis, although a public technical writeup of the bug exists.
A heap out-of-bounds write in libsixel's GIF decoder (gif_init_frame() in src/fromgif.c) allows a crafted GIF file to corrupt heap memory in any application that links the library and decodes untrusted images. Affected releases are libsixel before 1.8.7-r1 and versions 1.9.0 through 1.10.5. Successful exploitation is gated by several conditions - the decoder must be invoked with a non-NULL background color (the CVSS 4.0 AT:P attack requirement), the GIF must declare a transparent color via its graphic control extension, the active global or local color table must be small, and the transparent index must exceed that palette size - so the practical risk is medium (CVSS 4.0 base 5.8; assessed CVSS 3.1 AV:L/AC:H/PR:N/UI:R with integrity and availability impact only). The vector is local with required user interaction, no public exploit identified at time of analysis, and a vendor fix is available.
Arbitrary local file exfiltration is possible in evolution-data-server (EDS) when a calendar event's ATTACH property contains a file:// URI: on saving the event, EDS reads the referenced local file, base64-encodes it, and uploads it back to the calendar server. Exploitation requires an authenticated attacker with write access to a shared or subscribed CalDAV calendar (CVSS PR:L) plus the victim interacting with the malicious event (UI:R), and is limited to files readable by the victim's own account - confidentiality is the only impacted property (CVSS 5.7, CWE-200). No public exploit code has been identified at time of analysis, and the flaw is rated a moderate-priority information-disclosure issue rather than an urgent one.
Unauthenticated HTTP endpoints in the Pipecat development runner (/start, /daily, and /daily-dialin-webhook) allow an unauthenticated network caller to spin up bot sessions and Daily rooms when the runner has been deliberately exposed beyond its default localhost binding. Only deployments of the pipecat-ai Python package between versions 0.0.98 and 1.6.0 that have been misconfigured with --host 0.0.0.0, a published container port, or a public tunnel lacking access controls are reachable; the default localhost-only install is not remotely attackable. Per the CVSS vector (PR:N), no attacker authentication is required once the port is exposed, and the impact is limited to low confidentiality, integrity, and availability effects such as consumption of local resources and third-party Daily quotas and, depending on configuration, disclosure of a room URL and join token. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; vendor-released patch: 1.6.0.
Unauthenticated remote attackers can delete monitoring data and reports from cemtan sar2html 4.0.0 because the deleteHost, deleteRange and deleteAll routines in sar2html.py carry out their destructive operations without performing any authentication or authorization check. Exploitation requires only that the sar2html web interface (sar2html.py) be reachable over the network - the CVSS 4.0 vector is AV:N/AC:L/AT:N/PR:N/UI:N with VI:L and VA:L, meaning no credentials or user interaction are needed and the result is partial loss of integrity and availability of stored sar/sysstat data, with no confidentiality impact. Publicly available exploit code exists (the CVSS 4.0 vector carries E:P and the finder disclosed the issue publicly), but there is no indication that this is confirmed actively exploited (CISA KEV) - it is a medium-severity, low-priority issue whose practical risk is bounded by exposure, since sar2html is usually an internal reporting tool.
Information disclosure in itsmeravitejak's Online-Examination-System allows a remote, unauthenticated attacker to read data exposed through the project's dbtables.sql file, with the assessed impact limited to low-confidentiality leakage (no integrity or availability effect). The project follows a rolling-release model, so no discrete affected or fixed version exists; EUVD records commit e6208e630b14657999bbfe4c9912302d2a1e2449 as the affected snapshot. Publicly available exploit code exists and the upstream maintainer has not responded to the issue report, but there is no confirmed actively exploited (CISA KEV) status, and real-world exposure is constrained by the product's near-zero deployment base rather than by any technical barrier. This is a low-priority, low-real-risk issue despite its network attack vector.
SQL injection in cemtan sar2html 4.0.0 allows remote unauthenticated attackers to inject arbitrary SQL through the 'sort' argument handled by the index function in sar2html.py, enabling partial read and modification of the application's database contents. Per the assessed vector (AV:N/AC:L/PR:N/UI:N) no credentials, user interaction, or special configuration are required, so any standard sar2html 4.0.0 instance exposed to a network is reachable. Publicly available exploit code exists and the maintainer has not responded to the upstream issue report; there is no CISA KEV listing, so active exploitation has not been confirmed, and the overall risk is judged low-to-moderate because of the product's narrow deployment base and the limited (partial) confidentiality and integrity impact.
Local authenticated attackers can retrieve LUKS disk-encryption passphrases from hosts using the Clevis PKCS#11 pin because the clevis-pkcs11-afunix-socket-unlock daemon writes passphrases in plaintext to a world-readable log file. This affects Red Hat Enterprise Linux 7 through 10 and Red Hat OpenShift Container Platform 4 deployments where this non-default disk-unlock configuration is in use. No public exploit code has been identified at time of analysis; exploitation requires an existing low-privileged local account and prior logging of a LUKS unlock passphrase.
Cross-site scripting in the Progress MOVEit Transfer Ad Hoc module allows an authenticated user to plant script that executes in the browser of anyone who later views the crafted content, including high-privilege administrators. Only MOVEit Transfer before 2025.1.6 and 2026.0.0 through 2026.0.3 are affected; per the CVSS vector the attacker must already hold a valid account (PR:L, authenticated) and a victim must render the malicious page (UI:R), so this is not exploitable pre-authentication. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Authenticated path traversal in FileRise versions prior to 3.19.0 lets a low-privileged user who already holds create or owner permission on a parent folder create directories outside the configured upload root by submitting dot-dot segments to the folder-creation API. The impact is limited to arbitrary directory creation (integrity and availability impact rated low, CVSS 3.1 base score 5.4, vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) - there is no file read, overwrite, or code execution primitive, and the traversal only succeeds where the web-server operating-system account can already write. The issue requires a valid account, the appropriate parent-folder permission, and a valid CSRF token, so it cannot be triggered anonymously, and no public exploit identified at time of analysis; the vendor released a fix in 3.19.0 that rejects dot and dot-dot segments and validates that the parent path resolves inside the upload root.
Stored cross-site scripting in Lichess study analysis lets an authenticated user who can add a chapter to a shared study embed attacker-controlled HTML and CSS in the PGN 'Annotator' tag, which is then rendered unescaped for other viewers who open that study, producing content spoofing, navigation to attacker-controlled sites, and CSS-based data exposure. Because the site's Content Security Policy blocks injected JavaScript, the impact is bounded to markup and style injection rather than script execution, cookie theft, or session takeover, and the vulnerable rendering branch only triggers when a study node carries at least two comments. Publicly available exploit code exists, but the flaw is not confirmed as actively exploited; the CVSS 3.1 vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N gives a base score of 5.4 that reflects the authenticated write prerequisite and the required victim interaction.
Improper authorization in the FileRise folder-rename API (all versions prior to 3.23.0) lets an authenticated, non-administrator user who owns a source folder move that entire folder tree beneath another user's existing folder or into the admin-controlled root namespace, with the relocated tree's ownership and ACL records rekeyed to the new path. Exploitation requires valid authentication plus a CSRF token scoped to the source folder, and the chosen destination must be unused, so existing victim files cannot be overwritten and their contents are never exposed; the only disclosure is a path-existence oracle from distinct pre-fix error messages. It is rated CVSS 5.4 (medium) and is meaningful only in multi-tenant installations with more than one distinct folder owner; no public exploit identified at time of analysis.
Local privilege escalation in TSplus Remote Access allows an authenticated low-privilege user to modify writable autostart1.tscr login scripts in the shared themes directory, then wait for another user-including a higher-privileged one-to log in with the same theme or operating mode, at which point the injected commands execute in that victim's security context. Exploitation requires three conditions: a valid interactive session on the terminal/remote desktop server, misconfigured permissions on the shared script files (CWE-276), and a subsequent victim login; no public exploit has been identified at time of analysis. The vendor rates this CVSS 4.0 5.4 (Medium) with high confidentiality, integrity, and availability impact on the vulnerable system.
Denial of service in RabbitMQ 4.x allows an authenticated AMQP 1.0 publisher holding write permission on a target queue to store a crafted message body that misclassifies under the broker's optimized server_mode AMQP 1.0 parser, causing downstream AMQP 1.0 consumers to terminate while decoding the entry; cross-protocol conversion paths (AMQP 0-9-1 and similar) that perform full body decoding can likewise terminate the consumer protocol process. The broker itself remains alive, routing and authorization are not bypassed, and the defect is confined to consumer-side protocol processes, but acknowledgement-required delivery can redeliver the poisoned message and produce repeated failures. Vendor-released patches ship in RabbitMQ 4.0.24, 4.1.15, 4.2.10, and 4.3.4; no public exploit code was identified at time of analysis and CISA KEV does not list this CVE.
FileRise releases prior to 3.21.0 enforce administrator-configured login-method restrictions only in the browser client, so an authenticated user holding valid credentials for a method the administrator has disabled (form login, Basic Auth, or OIDC) can still authenticate by calling that method's backend endpoint directly. Exploitation is not credential-free - valid credentials for the disabled method are mandatory (CVSS vector PR:L) and only deployments that have actually disabled a method are affected, since a default all-enabled install has no policy to bypass - but the flaw fully defeats the login-method policy admins rely on for attack-surface reduction. Impact is bounded to policy enforcement rather than privilege escalation (CVSS 5.4, C:L/I:L/A:N), and no public exploit code or confirmed active exploitation was identified at time of analysis; the vendor fixes the issue in version 3.21.0.
Path traversal in YOURLS before 1.10.5 lets an attacker escalate a pre-planted PHP file into code execution: the keyword returned by yourls_get_request() survives yourls_sanitize_url() and yourls_esc_url(), is passed to file_exists() and include() under YOURLS_PAGEDIR, and '../' or '..\' sequences let it resolve a script outside the pages directory, which then runs with the privileges of the YOURLS web process. Exploitation is conditional and chained rather than self-contained - the vulnerable code supplies only the include primitive, so an attacker must first get a PHP file onto the server through a separate upload or file-write vector, which the advisory acknowledges by describing an 'uploaded or injected file'. No public exploit code has been identified at time of analysis, and the supplied CVSS 5.3 (AV:L/AC:L/PR:L) conflicts with the independent assessment, which rates this inclusion primitive CVSS 8.1 (AV:N/AC:H/PR:N) while still classifying overall risk as medium severity given the hard file-precondition.
Uncontrolled memory allocation in BottleCRM 0.45 through 1.14.5 lets an authenticated user who also holds the application's 'mass-import' permission send oversized CSV files to the /api/contacts/import/ and /api/cases/import/ endpoints, causing worker processes to exhaust memory and terminate. The root cause is that the upload handler reads the entire file into memory before enforcing the intended 5 MB limit, so a single oversized file or, more effectively, several concurrent oversized files can outpace memory reclamation and trigger out-of-memory kills. Impact is availability-only (worker crashes, degraded or interrupted import and request handling) with no data exposure or modification; exploitation is gated by the privileged mass-import permission, no public exploit code has been identified, and no vendor-released patch was identified at time of analysis. This is a medium-severity denial-of-service issue rather than an urgent priority, and it is not confirmed actively exploited (no CISA KEV listing).
Server-side template injection in BottleCRM (Django-CRM) through 1.14.5 allows an authenticated member of an organization to have attacker-controlled text compiled as a Django template by the send_email Celery task, exposing the template rendering context and the Python modules loaded in the worker, or tying up the shared worker with nested loops. The flaw is reachable remotely without any victim interaction through POST /api/accounts/<id>/create_mail/ by supplying a crafted AccountEmail message_body, and it requires a valid account that belongs to the target organization (the CVSS vector specifies PR:L). Because the sink is django.template.Template() rather than Jinja2, the assessed impact is confined to tenant-scoped information disclosure and denial of service against the shared Celery worker, with no public exploit identified at time of analysis and no confirmed path to arbitrary code execution.
Unauthenticated information disclosure in the FileRise Pro portal-detail endpoint (/api/pro/portals/get.php) lets any remote caller who knows or guesses a client portal's slug retrieve that portal's full internal record, including internal storage folder paths, client contact email addresses, form settings, and upload-policy details, instead of the curated branding fields that the public publicMeta.php endpoint intentionally exposes. The flaw affects only installations running the FileRise Pro add-on with at least one configured client portal; base-edition FileRise deployments are unaffected, and file contents or credentials are not exposed. The issue carries a self-consistent CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N (5.3, CWE-200), and no public exploit code or active exploitation has been identified at time of analysis; it is resolved in FileRise 3.24.0.
Denial of service in RabbitMQ's MQTT plugin lets an authenticated publisher using MQTT 5 force a single victim subscriber's connection to be dropped. Because the parser accepts the CONNECT-only Request-Problem-Information property on PUBLISH packets and the broker then routes it to matching subscribers, the outbound serialization path hits a missing clause in serialise_prop/2 and raises an uncontained function_clause that closes the victim's MQTT or Web MQTT connection. Exploitation requires valid broker credentials with topic-write permission on a topic that at least one other client subscribes to, and the broker, the publisher connection, and all other clients remain available; no public exploit code was identified at time of analysis, and no confirmed active exploitation (CISA KEV) has been reported.
Authenticated members of BizSpring Shop can act on other members' orders through an insecure direct object reference in the OrderController cancel and receive handlers, which accept a user-supplied orderId without verifying ownership. By supplying a victim's orderId, an attacker can cancel a pending order (releasing allocated stock) or confirm receipt of a shipped order (advancing fulfilment and settlement) without the victim's consent. The issue also affects the related BizSpring Java Mall codebase; no public exploit identified at time of analysis and it is not in CISA KEV, with a CVSS 4.0 base score of 5.3 (assessed CVSS 3.1 5.3) reflecting limited integrity and availability impact confined to order state.
Gogs (self-hosted Git service) prior to 0.15.0+dev contains an open redirect in the /redirect endpoint and other post-action redirect flows that allows unauthenticated attackers to send victims to arbitrary external sites from a trusted Gogs domain. The flaw arises because internal/urlx/urlx.go IsSameSite evaluates a normalized copy of the redirect target while cmd/gogs/internal/web/web.go getRedirect and similar callers emit the original, unnormalized value in the Location header; a literal backslash ('\'), a percent-encoded backslash (%5C/%5c), or embedded tab/CR/LF causes browsers to resolve the emitted value as a scheme-relative external URL. Per the independent assessment the issue is medium severity (CVSS 4.0 base 5.3; CVSS 3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), requires victim interaction (a click on a crafted link), and grants no access to the Gogs server itself; no public exploit code has been identified at time of analysis and the CVE is not in CISA KEV.
A malformed UDP packet can abort the DNS proxy running inside the Akamai Guardicore Platform Agent's macOS NetworkExtension system extension, which executes as a root-level system extension, producing an availability loss on the host. Specifically, a single UDP datagram shorter than 96 bytes that begins with a particular trigger value drives an integer underflow (CWE-191) in a length/size calculation, causing a near-SIZE_MAX allocation request that fails and raises an uncaught Objective-C exception, terminating the extension. The CVSS 3.1 vector (5.3, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) rates this as a low-impact, unauthenticated network availability issue with no confidentiality or integrity effect, and the independent assessment characterises it as a genuine but bounded problem whose real-world reachability depends on whether the DNS proxy listener actually consumes arbitrarily sourced packets or only on-device queries and upstream responses; no public exploit code and no CISA KEV entry were identified at the time of analysis, and no EPSS score was supplied in the source data.
WisdomGarden Tronclass, a learning management system, exposes anonymous student information to authenticated remote users who bypass the platform's anonymous grading restriction, as tracked under CVE-2026-110466. Exploitation requires valid credentials on the target instance (CVSS 3.1 vector PR:L, AV:N, no user interaction) and is only meaningful where the anonymous grading feature is actually in use for the targeted course or assignment; the resulting impact is limited to low confidentiality loss (privacy/disclosure of student identities behind anonymized submissions) with no integrity or availability effect. There is no public exploit identified at time of analysis and no KEV or EPSS signal amplifying real-world risk, so this rates as a medium-severity information-disclosure issue driven primarily by privacy exposure.
Arbitrary file deletion in the Database Addon for Contact Form 7 - CFDB7 WordPress plugin through version 1.4.1 allows unauthenticated attackers to inject a crafted multipart submission field whose name contains the substring 'cfdb7_file' and whose value is an arbitrary filesystem path; the plugin stores that non-form-tag field and later passes it to unlink() without basename()/realpath() normalisation or any check that the file belongs to that submission. Because deletion does not occur at submission time but only when an administrator bulk-deletes the poisoned entry from wp-admin, successful exploitation depends on privileged operator interaction, which is why the independent assessment rates it CVSS 5.3 (MEDIUM) with UI:R while retaining PR:N and network reachability. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV).
Server-side request forgery in the yudao-module-ai image service of ruoyi-vue-pro (through 2026.09) lets an authenticated user make the application server issue HTTP requests to arbitrary destinations by supplying the referImageUrl parameter to the Midjourney 'imagine' endpoint, which is handed to Hutool's HttpUtil.downloadBytes() without SSRF filtering. Exploitation requires a valid low-privileged application account with access to that AI image feature (CVSS 4.0 base 5.3, PR:L), so there is no unauthenticated attack path; the practical payoff is internal reconnaissance and information disclosure - probing loopback, RFC1918, and cloud metadata endpoints such as 169.254.169.254 - rather than code execution. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, making this a moderate-priority finding whose real-world severity rises sharply on cloud-hosted deployments that expose IMDSv1 or internal-only administrative services.
Authenticated path traversal in the Colanode server (versions through 0.4.7) allows any user holding a valid account to read .jpeg image files outside their own workspace by injecting a percent-encoded ../ sequence into the avatarId parameter of GET /client/v1/avatars/:avatarId. The impact is deliberately narrow: only files with a .jpeg extension can be retrieved, so configuration files, keys, or credentials are not exposed, and meaningful cross-tenant exposure requires a multi-workspace deployment plus knowledge or guessing of the target's relative path. There is no CISA KEV listing and no confirmed public exploit code, although the disclosure is accompanied by a public technical writeup (hackmd.io/@hieuPenguinnn/colanode-avatar-download-path-traversal) describing the traversal; CVSS 4.0 scores it 5.3 with VC:L, and the independent assessment scores it CVSS:3.1 5.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), framing it as a moderate, constrained information-disclosure issue rather than a top-tier priority.
Unauthenticated information disclosure in the Avada (Fusion) Builder WordPress plugin (all versions up to and including 3.16.1) lets remote attackers read arbitrary WordPress user meta - including administrator email addresses and login names, the wp_user_level field, and WooCommerce customer PII such as billing_email, billing_phone and billing_address_1 - for any user ID by supplying a crafted args[link_target] value. The one prerequisite is that the target site must render the [fusion_instagram] shortcode on some page, because the required awb-instagram-nonce is printed in plaintext inside fusionInstagramVars there and can be harvested by any anonymous visitor before the exploit request is sent; no authentication or user interaction is otherwise required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, base 5.3). Impact is greatest on WooCommerce-enabled sites where billing data lives in user meta, and no public exploit code was identified at time of analysis (not listed in CISA KEV); the flaw is a CWE-200 exposure whose practical priority is moderate given the low confidentiality-only impact and the shortcode precondition.
Authenticated users of InvoiceShelf can persist falsified financial figures on invoices, estimates, and recurring-invoice templates because versions prior to 2.4.0 trust client-supplied total, sub_total, tax, discount_val, and due_amount values instead of recomputing them from the line items. The result is stored documents whose totals disagree with their own item prices and quantities, an integrity-only business-logic flaw (CVSS 4.0 5.3, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) that requires a valid account with permission to create documents, so the blast radius is bounded by what that user is already authorised to create. The recurring-invoice path is the most consequential because a tampered template total propagates into every invoice generated from it. Exploitation is trivial but low-impact, no public exploit code has been identified at time of analysis, it is not listed in CISA KEV, and a vendor fix is available in version 2.4.0.