Authenticated users on WisdomGarden Tronclass deployments can read the peer-review scores of any student by tampering with a client-controlled object identifier in the peer-review scoring feature. The flaw is a classic insecure direct object reference (CWE-639) in which the requested student or submission parameter is not checked against the requester's identity, so any account with access to that function can substitute another student's record and view scores they should not see. Per the authoritative assessment this is a genuine but low-to-moderate priority issue: exploitation requires a valid authenticated session (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), impact is confined to disclosure of peer-review score data with no write, deletion, or broader data exposure, and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Authenticated users with read-only or no share permission in Sure 0.7.0 through 0.7.6-alpha.6 can silently alter other family members' transactions - dates, names, notes, categories, merchants and tags - by submitting arbitrary entry_ids to the Transactions::BulkUpdatesController#create action, which performs no ownership or authorization check on the supplied records. It is a medium-severity missing authorization flaw (CWE-862, assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) that corrupts budgets and reports for the victim accounts but causes no data disclosure or service disruption, and it only applies where account sharing among multiple family members is in use. Exploitation requires valid low-privileged credentials in the same instance; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
Improper access control in the Ubiquiti UniFi Protect AI Key allows network-adjacent unauthenticated attackers to read limited internal resources, though exploitation hinges on high attack complexity and an unspecified conditional requirement that limits real-world reliability. This medium-severity (CVSS 5.3) flaw is not known to be actively exploited and no public exploit code exists as of analysis. The vendor has published Security Advisory Bulletin 070 with remediation guidance.
Authenticated low-privilege users of WisdomGarden Tronclass can alter the peer review scores of any student by manipulating a client-supplied object reference parameter, due to an insecure direct object reference (IDOR) flaw in the peer-review scoring function. Exploitation requires a valid session (PR:L) but no victim interaction, and the impact is limited to integrity of review scores with no data disclosure or service disruption. No public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated remote code execution is possible in the WordPress plugin MDTF (wp-meta-data-filter-and-taxonomy-filter) through version 1.3.9, which carries a CWE-94 code injection flaw in PluginUs.Net's metadata/taxonomy filtering component. Per the CVSS vector (PR:N/UI:N) no credentials or user interaction are required, so any site running the vulnerable release with the plugin active is exposed; the NVD score of 5.3 (C:L/I:N/A:N) is materially lower than the assessed C:H/I:H/A:H, and no public exploit code and no CISA KEV listing were identified at time of analysis. Confidence is capped because the signals are thin and internally inconsistent - the unresolved CVSS disagreement and the absence of any named injectable parameter, function, or endpoint mean the minimal precondition confirmed so far is simply the presence of the vulnerable plugin version.
Improper access control in Ubiquiti UniFi Protect AI Key allows remote unauthenticated attackers with network reachability to access internal resources through the device. The CPE wildcard indicates all versions may be affected, and the vendor-assigned CVSS 3.1 score is 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), with low confidentiality impact only. No public exploit code has been identified at time of analysis, and exploitation is constrained by the need for network access to a reachable device.
Missing authorization checks in the 10up WordPress plugin Restricted Site Access (versions through 7.6.2) allow unauthenticated remote visitors to reach content that the plugin's restriction settings are meant to hide, resulting in limited confidentiality disclosure (CVSS 5.3, C:L, no integrity or availability impact). The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication, user interaction, or special network position is required, but the flaw only has effect on sites where the plugin is active and actually configured to restrict visibility - on sites without an active restriction there is nothing to bypass. No public exploit identified at time of analysis and the issue is not listed in CISA KEV; this is a genuine but moderate-severity exposure rather than a high-priority emergency.
Heap memory disclosure and multicast join-state injection in Juniper Junos OS running on EX Series and MX Series platforms, and in Junos OS Evolved on ACX Series, arise from an integer underflow in the rpd routing daemon that can be triggered by an unauthenticated attacker on an adjacent network segment sending a malformed draft-Rosen MVPN message. Only devices that actually support and have draft-Rosen MVPN configured and active are exposed, which bounds the affected population; impact is limited to low-level confidentiality and integrity loss (assessed CVSS 3.1 base 5.3, AV:A/AC:L/PR:N/UI:N/C:L/I:L/A:N) rather than device takeover or denial of service. No public exploit code has been identified at time of analysis and there is no indication of confirmed active exploitation (CISA KEV), so this is a moderate, patch-in-normal-cycle priority rather than an emergency, especially since vendor fixes are already published.
Out-of-bounds read in the rpd routing process of Juniper Junos OS and Junos OS Evolved allows an adjacent attacker to disclose limited rpd process memory and disrupt a single LDP adjacency via a crafted IPv6 LDP message. The flaw affects numerous Junos OS and Evolved branches, with fixed versions available per Juniper advisory JSA112187. No public exploit code has been identified at time of analysis; exploitation requires the target to have LDP with IPv6 enabled and an attacker on the same network segment, making this a moderate-severity, limited-impact issue.
FreeRDP clients running versions 3.13.0 up to (but not including) 3.32.0 can leak local file handles when drive redirection (the rdpdr drive channel) is enabled and the client connects to a malicious or compromised RDP server. A server-sent IRP_MJ_CREATE with AllocationSize set to UINT64_MAX makes the allocation-size seek fail after the opened local file has already been registered in the drive dictionary, so the file object and its underlying OS handle are not released until the drive channel is torn down at disconnect. Exploitation requires the user to have opted into drive redirection and to establish a session with an attacker-controlled server (unauthenticated from the network perspective but requiring user interaction), giving it a medium/low rating consistent with the CVSS 4.0 base score of 5.3; no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Checkout-flow open redirection in the AmazonPay plugin for EC-CUBE 4 allows remote, unauthenticated attackers to send shoppers to an arbitrary external website during the ordering process, where the shopper's account information can be captured. Affected deployments are EC-CUBE 4-series stores running the AmazonPay v2 plugin (4.0/4.1 series, 4.2/4.3 series, and the 4.2/4.3 bundle edition) or the v1 plugin for the 4.0 series; stores without the plugin are unaffected. Rated CVSS 4.7 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N), there is no public exploit identified at time of analysis, and exploitation is not self-contained: it requires a victim shopper to be actively engaged in the order/checkout process and socially engineered into following the tampered flow, which limits both reach and reliability.
Authenticated customers of Shopizer through 3.2.5 can post product reviews and star ratings that are attributed to other customers by supplying a foreign customerId in the JSON body of POST /api/v1/auth/products/{id}/reviews, corrupting review authorship and aggregate product ratings. The flaw is rated CVSS 4.0 5.3 (independently assessed as CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) and requires a valid customer account - specifically a CVSS vector with PR:L, so exploitation is authenticated, not unauthenticated - with integrity-only impact confined to review and rating data. No CISA KEV entry is present, so the issue is not confirmed actively exploited, and no public exploit code was identified at time of analysis; a public technical writeup and a vendor-repository issue describing the IDOR are referenced instead.
Memory disclosure and denial of service in the l2ald daemon of Juniper Networks Junos OS and Junos OS Evolved can be triggered by malformed ICCP packets, allowing an attacker with adjacent access to an established Inter-Chassis Communication Protocol peer session to leak memory contents and disrupt the daemon. The vendor-rated CVSS 4.3 (Medium) reflects impact limited to confidentiality and availability, and our independent assessment scores it CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L, with the caveat that exploitation requires the device to be running a multichassis configuration that actively uses ICCP (for example MC-LAG) and that the attacker be logically adjacent on the inter-chassis control plane; standalone routers without ICCP are unaffected. There is no public exploit identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV), so this is a genuinely low-to-moderate priority issue consistent with its 4.3 score, though the memory disclosure component means it should not be dismissed purely on availability impact.
Improper handling of a length parameter in the L2ALM component of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, adjacent attacker to read stale packet memory from the Packet Forwarding Engine (PFE) by sending crafted VXLAN overlay-ping traffic to a local VXLAN tunnel endpoint (VTEP). Only devices configured as VTEPs with overlay-ping processing active are exposed, and the attacker must share Layer-2 adjacency with the target, so the flaw is not reachable across routed or Internet paths; impact is limited to low-severity confidentiality loss with no integrity or availability effect. No public exploit code has been identified at time of analysis and there is no indication of active exploitation. Per the vendor, patches are available; the assigned CVSS 4.0 base score is 5.3, and our independent assessment rates it as a medium-severity information-disclosure issue whose real-world priority is modest and bounded by its adjacency and configuration prerequisites.
LDAP filter injection in Zimbra Collaboration Suite 10.1.0 through 10.1.21 lets unauthenticated remote attackers reshape the external LDAP search filters Zimbra constructs during authentication, turning the login path into a password oracle for external directory users on domains configured for search-filter authentication combined with lazy provisioning. A secondary, authenticated path through S/MIME lookups can return certificates and identity data belonging to unintended directory entries. The flaw carries a moderate CVSS 5.3 (confidentiality-only, no code execution or write access) and no public exploit identified at time of analysis; it is not confirmed actively exploited (CISA KEV), no EPSS score was supplied, and real-world exposure is gated by the non-default external-directory auth and provisioning configuration.
Renovate before 44.61.3 does not correctly enforce its minimumReleaseAge quarantine when a maintainer clicks the rebase/retry checkbox on a dependency-update pull request, allowing a freshly published malicious dependency version to be pulled into that PR and executed in CI before the configured release-age window elapses. The flaw is rated 5.3 (CVSS 4.0, AV:N/AC:L/AT:N/PR:N/UI:P) and independently assessed as CVSS 3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N, reflecting a scoped integrity impact rather than host compromise. There is no public exploit identified at time of analysis and no evidence of confirmed active exploitation (CISA KEV), though exploitation still requires a human to trigger the rebase action and is therefore not fully automatic. The primary fix is upgrading to Renovate 44.61.3 or later.
GrowChief 0.3.0 and earlier exposes a cross-tenant user enumeration flaw in the getAllUsers handler of its backend, allowing any authenticated low-privilege user to list user IDs, emails, names, and organization IDs from every tenant. The missing IsSuperAdmin guard means a self-registered account can retrieve the full user directory by sending an empty or short search value to GET /users/all-users. This is a moderate-severity information disclosure (CVSS 4.0 score 5.3; independent assessment CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) with no public exploit identified at time of analysis and no confirmed active exploitation.
An insecure direct object reference in the oauth module of lamp-boot (versions 4.16.0-java17 through 4.21.2-java17) allows any authenticated low-privilege user to read the department membership of every employee in their tenant by iterating sequential employeeId values against the /anyone/findDeptByCompany endpoint. The endpoint is placed under an /anyone/ path prefix that bypasses the application's URI permission check, so the request never triggers the authorization logic that would otherwise scope results to the caller. Impact is limited to confidentiality (read-only exposure of department-membership data within a single tenant), authentication with a low-privilege account is a hard prerequisite, and no public exploit code was identified at time of analysis.
A malformed BGP-LS UPDATE message can cause the Juniper Junos OS and Junos OS Evolved routing protocol daemon (rpd) to leak small amounts of heap memory to an adjacent, already-peered BGP-LS speaker. Only devices that have an established BGP-LS session with the traffic-engineering address family explicitly enabled are exposed, and the attacker must itself be a configured BGP-LS peer, so this is not reachable by arbitrary remote hosts and is not a default configuration. Impact is limited to low-severity confidentiality loss (CVSS 3.1, AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) with no integrity or availability effect, no public exploit identified at time of analysis, and no confirmed actively exploited (CISA KEV) status.
Gitea instances that have OpenID sign-in enabled can be coerced into sending an outbound HTTP POST to an attacker-chosen OpenID provider endpoint, letting the attacker use the server as a blind SSRF proxy into internal networks. The vulnerability affects Gitea 0 through 1.26.4 and requires no authentication or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, 5.3), but exploitation is gated on the non-default OpenID feature being explicitly turned on, and because the response is never returned to the attacker the impact is limited to the reachability and side effects of internal HTTP services. Multiple signals converge on this being a genuine but moderate-priority issue rather than an emergency: EPSS is only 0.17% (6th percentile), there is no CISA KEV designation, and no public exploit code was identified at time of analysis.
Server-side request forgery in Gitea lets an unauthenticated remote attacker cause the server to contact loopback or private-network HTTP services by supplying a crafted OpenID URL when OpenID sign-in is enabled. Affected deployments are vulnerable Gitea releases such as 1.25.4 (CPE wildcard all versions) that have deliberately enabled ENABLE_OPENID_SIGNIN and lack destination restrictions; the vendor patch changes that setting to default false and adds a built-in blocklist for localhost, loopback, private ranges, and IPv6 link-local addresses. Publicly available exploit code exists and the issue is automatable, but no CISA KEV active-exploitation confirmation is present, and the assessed CVSS is 5.3 with only low confidentiality impact.
Dell PowerScale InsightIQ versions 5.2.0 through 6.3.0 ship with an overly restrictive account lockout mechanism that an unauthenticated remote attacker can abuse to lock out accounts and degrade availability of the monitoring/management platform. The flaw is network-reachable and requires no credentials or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, base 5.3), but its impact is confined to availability - lockouts are typically temporary and recoverable, with no code execution, privilege escalation, or data exposure. No public exploit code or confirmed active exploitation was identified at time of analysis; the primary exposure driver is whether the InsightIQ authentication interface is reachable from untrusted networks rather than restricted to a management segment.
Address space corruption in HPE NonStop TSQLFIL is reachable by a low-privileged local user on the NonStop host who invokes a specific affected API, which mishandles input and drives undefined behavior in the process memory space. The assessed vector (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H, score 5.3) shows no confidentiality loss but high availability impact, so the realistic outcome is integrity damage and/or abnormal termination of the affected TSQLFIL process rather than data theft. Exploitation is constrained by local authenticated access and by high attack complexity requiring preconditions outside the attacker's control, and no public exploit has been identified at time of analysis; there is no confirmed active exploitation (CISA KEV).
Angular DevTools versions 1.20.0 through 1.21.0 accept chrome.runtime.sendMessage traffic in their background service worker without adequately validating the message sender, so an untrusted web page or third-party content script that has learned a victim tab's randomized tabId can instruct the extension to attach chrome.debugger to that tab and trigger Chrome DevTools Protocol breakpoints, pausing JavaScript execution and blocking interaction with the page. The achievable impact is confined to a tab-level denial of service: displaying the debugging banner and freezing a single tab, with no remote code execution, privilege escalation, or cross-origin access to memory or credentials, and no public exploit has been identified at time of analysis. Per the assessed CVSS vector the issue is unauthenticated (PR:N), but exploitation is gated by the high-complexity randomized-tabId precondition and victim interaction; version 1.21.1 resolves it.
Reflected cross-site scripting in ClipBucket v5 (builds through 5.5.3-#206) lets an attacker reflect a script payload into the ClipBucket admin panel origin by luring a logged-in administrator who holds the basic_settings permission to a crafted link targeting admin_area/language_settings.php with a malicious edit_language GET parameter. The unencoded value is echoed into a hidden input on the language edit form, so the injected script runs in the administrator's session and origin, allowing admin-context actions, session abuse and UI redressing; because the value is only reflected into a hidden field and the victim must be a privileged, already-authenticated admin who actively opens the link, exploitation is interaction-dependent rather than drive-by. Fix code is present upstream in commit 0c1b5878a6135950d8a516975c4585e3b7c8790d, which casts the parameter to int, and no KEV listing or confirmed public exploit code was observed at time of analysis - making this a moderate-severity issue with low real-world urgency.
HTML injection in BottleCRM 0.30 through 1.14.5 lets an authenticated organization member embed arbitrary markup and CSS into customized invoice PDFs by writing HTML into the notes, terms, client name, or client address fields that render_invoice_template() processes. The injected content can visually overlay totals, payee details, and payment instructions in the resulting PDF, which is then viewed by a victim through a direct download, a public link, or an email attachment (CVSS 4.0 base 5.1; assessed 3.1 vector AV:N/AC:L/PR:L/UI:R, integrity-only with low impact). Exploitation requires the deployment to actually use a custom invoice template and requires a victim to open the rendered document, making this a fraud-oriented, low-to-medium priority issue rather than automatic server-side compromise, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Stored cross-site scripting in DataEase versions prior to 2.10.26 lets an authenticated user with permission to edit dataset fields and chart configuration inject HTML into a bar-horizontal chart's dimension value, which is then rendered as raw markup in a tooltip when the category-axis label is truncated. When a victim opens the affected dashboard and hovers the truncated axis label, attacker-controlled JavaScript executes in that victim's DataEase session, permitting limited confidentiality and integrity impact within the application origin. Exploitation is constrained: the attacker must already hold editor-level privileges, the chart must be bar-horizontal with axis-label length limiting active and an actually-truncated label, and a victim must manually hover the tooltip, making realistic exposure mostly insider or compromised-account scenarios; no public exploit code was identified at time of analysis and the issue is not in CISA KEV.
An out-of-bounds write in the Hitachi Disk Array Driver for IBM AIX (versions 01-00 through 01-22, fixed in 01-23-/A) and for Virtual I/O Server (versions 01-04 through 01-22, fixed in 01-23-/A) allows a local user who already holds high privileges to corrupt driver memory, which the assessed vector scores as high availability impact with limited integrity impact. Because exploitation requires the CVSS vector combination AV:L and PR:H with no user interaction, only already-privileged local accounts - or an attacker who has first compromised such an account - can reach the vulnerable code path; there is no network-facing or unauthenticated path. There is no public exploit identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV entry); a vendor patch is available, which makes this a low-to-moderate prioritization item rather than an emergency.
Stored cross-site scripting in DataEase allows an authenticated user who holds folder-creation permission to inject HTML into folder or dataset names via the datasource/createFolder and datasetTree/save endpoints; the payload is later rendered as live markup when another user opens a datasource or dataset "Move to" dialog and types into its search box, executing JavaScript in that victim's session. The flaw affects DataEase versions prior to 2.10.26 and is rated CVSS 5.1 (medium) with the vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N, reflecting required authentication, folder-creation privilege, and victim search interaction. No public exploit code or confirmed active exploitation was identified at time of analysis; the vendor fixed the issue in version 2.10.26 by replacing the unsafe innerHTML highlight sink with structured segment rendering.
Reflected cross-site scripting in ClipBucket v5 (affected through 5.5.3-#206) lets an unauthenticated attacker execute arbitrary JavaScript in the administrative origin by luring a currently logged-in administrator or moderator into opening a crafted /admin_area/flagged_item.php?type= URL; the type GET parameter is echoed into the admin page without encoding. Exploitation is not server-side or anonymous - it requires the victim's interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, 5.1, and the vendor vector's UI:A), and because the vector is reflected rather than stored each target must individually open the attacker-supplied link, which limits breadth but not the severity of a successful admin-context script execution. A vendor fix commit that restricts type to Flag::getFlagElementTypes() is referenced in public advisories, and no public exploit code or confirmed active exploitation was identified at time of analysis, so the practical risk is concentrated in deployments that have not yet applied the upstream fix.
Server-side request forgery in Redash 10.0.0 through 26.9.0 allows an authenticated user holding execute_query permission on a JSON data source to redirect the query runner's HTTP request to an arbitrary external origin. The flaw stems from the use of urljoin in redash/query_runner/json_ds.py, which lets an absolute query URL replace the configured base_url instead of remaining bound to it; when the data source is configured with HTTP Basic Auth, those stored credentials are also forwarded to the attacker-selected origin, creating a credential-exfiltration path. Private and internal address access remains constrained while REDASH_ENFORCE_PRIVATE_IP_BLOCK is enabled, which limits but does not eliminate the impact; there is no confirmation of active exploitation (CISA KEV) and no public exploit code identified at time of analysis, and the assessed risk is a genuine but moderate-severity SSRF rather than an emergency.
Identity spoofing in the PAN-OS GlobalProtect gateway (CVE-2026-0319) lets an already-authenticated GlobalProtect user establish a session under another user's identity, inheriting that account's confidentiality and integrity context - for example, the resources and security policy applied to the impersonated user. Per the assessed vector (CVSS 3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N) and the vendor's CVSS 4.0 base score of 4.9, exploitation requires valid GlobalProtect credentials (PR:L), a PAN-OS device with the GlobalProtect gateway feature configured and enabled, and additional attack requirements (AT:P) in the gateway's session/identity-handling flow, making this a moderate rather than top-tier priority with no availability impact and no scope change. Cloud NGFW and Panorama are explicitly not affected, and no public exploit code and no confirmed active exploitation were identified at time of analysis; no EPSS data was supplied.
Stored cross-site scripting in the Gallery Custom Links WordPress plugin (all versions up to and including 2.3.3) lets an authenticated attacker with subscriber-level access or higher inject arbitrary script that executes in the browser of anyone viewing the affected page. Exploitation is not opportunistic: it requires two coordinated attacker-supplied inputs - an HTML-comment payload stored in a comment body (preserved by WordPress comment kses) plus a matching simple_html_dom 'noise key' in the attacker's profile display_name that survives esc_attr() - both of which must be present before the plugin's default-on output-buffering pass rewrites the rendered page (AC:H, PR:L, UI:N, scope-changed per CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N). There is no evidence of active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, and the low CVSS base score of 4.9 reflects genuine low priority despite the CWE-79 class.
Symbolic-link following in FileRise public shared-folder links (all versions prior to 3.15.0) allows an unauthenticated holder of a valid share token to read files outside the folder that was actually shared, confined to sibling directories under the upload root. Exploitation requires a pre-existing symlink inside the shared folder, subfolder browsing enabled on the share, and the local storage adapter, making the practical risk lower than the raw network vector suggests; no public exploit code was identified at time of analysis and the issue is not in CISA KEV. The vendor addressed it in version 3.15.0.
FileRise versions prior to 3.21.0 return the administrator-configured branding.footerHtml value verbatim through the unauthenticated public site-configuration API, so raw admin-supplied HTML reaches any client that consumes that endpoint. Because the official FileRise frontend already sanitizes the footer with a tag allowlist (a, b, strong, em, i, span, small, br) and safe-link handling before rendering, the bundled web client is not exploitable; realistic impact is confined to alternate or third-party clients, or future render paths, that display footerHtml without their own sanitization. Exploitation requires an authenticated administrator (PR:H) to first store a crafted value and a victim to load an affected client (UI:R), which is why this is rated defense-in-depth / low priority rather than an urgent threat, and no public exploit code has been identified at time of analysis.
Opening a specially crafted DWG file (versions AC1018, AC1024, or AC1027) in LibreCAD or any application linking libdxfrw can trigger a stack-based out-of-bounds read in dwgReader18::readFileHeader(), which calls strlen() on a decrypted header buffer that is not guaranteed to be NUL-terminated; the read walks past the end of the stack buffer and typically crashes the process. The issue affects libdxfrw through LC2.2.0 and LibreCAD through 2.2.1.5, and exploitation is local, requiring the victim to manually open the malicious drawing (CVSS 4.0 base 4.8; assessed CVSS 3.1 AV:L/AC:L/PR:N/UI:R with availability-only impact). There is no confirmed active exploitation (CISA KEV) and no public exploit identified at time of analysis, and the observed outcome is a denial of service rather than code execution or confirmed information disclosure. Upstream fixes have been committed to both the libdxfrw and LibreCAD repositories, though a tagged patched release has not been independently confirmed.
Excessive memory allocation in the asm-commons AdviceAdapter of OW2 ASM (versions 3.1 through 9.10.x, fixed in 9.11) lets an attacker who can get crafted bytecode processed by a tool that uses AdviceAdapter drive the JVM into hundreds of megabytes of allocation and ultimately a denial of service. The flaw is triggered by class files whose constructors contain many forward jump targets, causing unbounded stack-frame copying in the forwardJumpStackFrames handling; exploitation is local (AV:L) and requires the victim process to be induced to ingest the malicious class file (UI:P/UI:R), with impact limited to availability (VA:L) and no confidentiality or integrity effect. No confirmed active exploitation (not in CISA KEV) and no public exploit code was identified at time of analysis, and the vendor has released a fix, so this is a genuine-but-modest-priority issue rather than a high-severity emergency.
Reflected cross-site scripting in the Tutor LMS - eLearning and online course solution WordPress plugin affects all versions up to and including 4.1.0, allowing unauthenticated attackers to inject arbitrary web scripts through the 'tab' parameter. Exploitation requires user interaction (a victim clicking an attacker-supplied link), and the CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N, base 4.7 Medium) reflects real but constrained risk: the payload only reaches the output sink on lesson pages where the nav-items array is empty, which occurs when a lesson has no post content, no attachments, and comments are disabled or the viewer is not logged in. No confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis.
The clevis-luks-pkcs11-askpin helper shipped with Red Hat Enterprise Linux (7, 8, 9 and 10) and Red Hat OpenShift Container Platform 4 writes the PKCS#11 token PIN in cleartext to a file that is not given restrictive permissions, so under the default process umask the file is world-readable, and the file is also not reliably removed when the decryption script exits early, leaving the PIN readable indefinitely. The issue is assessed as CVSS 3.1 4.7 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N), meaning an authenticated local user with low privileges can obtain high-confidentiality secret material, but only on systems that actually use the non-default clevis PKCS#11 pin for LUKS unlocking. No public exploit code was identified at time of analysis and there is no CISA KEV listing; exploitation is local-only and the practical risk is confidentiality loss of the token PIN rather than a remote or code-execution threat.
Local information disclosure in Red Hat Clevis's PKCS#11 pin lets an already-logged-in, low-privileged local user capture the PKCS#11 token PIN that clevis-decrypt-pkcs11 passes as a command-line argument to pkcs11-tool, from where it is readable through process listing or /proc/<pid>/cmdline. The issue affects Clevis as shipped with Red Hat Enterprise Linux 7, 8, 9 and 10 as well as Red Hat OpenShift Container Platform 4, and carries a CVSS 3.1 base score of 4.7 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N), reflecting high confidentiality impact but a local-only, high-complexity attack requiring a non-default configuration. Exploitation requires the PKCS#11 pin to be configured, a decryption operation to be in flight at the same moment, and the attacker to win a timing race against the short-lived pkcs11-tool process; no public exploit code and no confirmed active exploitation (not in CISA KEV) have been identified at time of analysis.
Local attackers can exploit improperly secured AF_UNIX sockets in the clevis PKCS#11 pin to inject arbitrary device/key pairs or intercept LUKS passphrases, potentially gaining unauthorized access to encrypted disks. Affected products include Red Hat Enterprise Linux 7, 8, 9, and 10, as well as Red Hat OpenShift Container Platform 4. Exploitation requires an authenticated local user and a permissive process umask; no public exploit code or active exploitation has been identified, and the issue is rated modest priority due to the local-only attack vector and dependency on non-default umask settings.
Local, low-privileged users can cause a denial-of-service (BSOD) on Windows endpoints running Akamai Guardicore Platform Agent by sending a crafted outbound ICMPv6 packet with an IPv6 Hop-by-Hop extension header when the non-default IPv6 ICMP redirect policy is enabled. This use-after-free (CWE-416) in the WFP callout driver allows kernel pool grooming, leading to a system crash. The vulnerability requires local access (AV:L) and high attack complexity (AC:H); no public exploit code or active exploitation has been identified at time of analysis.
Repeatedly delivered crafted log data can push the Palo Alto Networks Panorama management appliance into maintenance mode by triggering a stack-based buffer overflow in its log-processing functionality, producing an availability-only denial of service. The issue is confined to Panorama's management plane: Palo Alto states explicitly that Cloud NGFW, Prisma Access, and standalone PAN-OS firewalls are not affected, so data-plane inspection is out of scope. Per the CVSS 4.0 vector the attack is network-reachable and unauthenticated (PR:N), but carries the AT:P flag, meaning success is condition-dependent and typically requires multiple attempts rather than a single reliable request; no public exploit code has been identified and there is no CISA KEV entry indicating active exploitation at time of analysis, and no EPSS score was supplied.
Predictable pseudo-random number generation in HPE NonStop MODULAR NSJ weakens any security function that depends on unpredictable output, allowing an authenticated low-privileged attacker who can also induce victim interaction to recover the PRNG seed or internal state and forecast subsequent values. The assessed vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L, 4.6) shows exploitation requires a valid low-privilege account plus user interaction, and the high attack complexity reflects the analysis needed to reconstruct the generator state; confidentiality, integrity and availability impacts are all bounded to Low. This is a moderate-severity, low-priority issue in practice, and no public exploit was identified at time of analysis - it has not been confirmed actively exploited (no CISA KEV listing) and no proof-of-concept code is referenced in the available intelligence.
A use-after-free in the Windows WFP packet-capture driver of Akamai Guardicore Platform Agent (GPA) before 7.4 lets a local Administrator crash the host by sending a single crafted outbound IPv6 packet through a raw IPV6_HDRINCL socket while an IPv6 proxy/redirect rule is active, causing a fault at DISPATCH_LEVEL and an immediate system crash. The flaw is a denial-of-service only (CVSS 4.4, AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H): it grants no privilege gain because exploitation already requires local Administrator rights, and it only affects hosts where the IPv6 redirect/proxy feature is enabled. No public exploit code and no confirmed active exploitation were identified at time of analysis, and all signals point to a LOW real-world priority given the strict non-default preconditions.
Application crashes in the HPE NonStop TSQLEXE SQL execution component can be triggered by a crafted SQL query submitted by an authenticated, low-privileged user who already has local access to the system, producing availability loss for that component. The assessed severity is deliberately low (CVSS 3.1 base 4.4; AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L): there is no confidentiality or integrity impact, no victim interaction, and no evidence of a remote, unauthenticated path or of code execution. No public exploit code and no confirmed active exploitation (no CISA KEV listing) were identified at time of analysis, and the EPSS signal is unavailable in the supplied intelligence.
Sensitive information exposure in the LatePoint appointment-booking plugin for WordPress (all versions up to and including 5.7.3) allows an authenticated subscriber-level user to leak privileged booking data - administrator-only admin_notes, assigned agent internal contact details, transaction tokens, and payment request URLs - by storing a template placeholder such as {{customer_admin_notes}} in their own first_name field via the customer_cabinet__update route and then triggering the LatePoint password-reset/notification email flow, which expands the placeholder server-side and mails the result to the attacker's address. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base 4.3) confirms network reachability with mandatory low-privilege authentication and only a limited confidentiality impact, with no effect on integrity or availability and no code execution or data modification; no public exploit identified at time of analysis, and exploitation depends on the site allowing self-registration or otherwise granting low-privilege accounts that can reach the customer cabinet update route.
Dell Terraform Provider for OME versions 1.0.0 through 1.2.3 inserts sensitive provider configuration data into log files, so an authenticated, low-privileged remote attacker who can read those logs may obtain limited confidential information about the managed environment. Scored 4.3 (Medium) as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, the issue requires prior low-level access plus reachability of the log destination, with no integrity or availability impact. No public exploit code has been identified at time of analysis, and no confirmed active exploitation is reported, so practical risk is governed by what the provider actually writes to logs and how tightly log retention and access are controlled.
Authenticated, low-privilege users of Hitachi Ops Center Administrator running versions before 11.0.9-01 can cause the management console to return error output that exposes internal application information, giving an attacker useful reconnaissance detail about the underlying service. The flaw maps to CWE-209 (improper error handling) and carries a CVSS v3.1 base score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), meaning it is remotely reachable only with a valid low-level account, needs no user interaction, and results in limited confidentiality impact with no integrity or availability loss. Vendor-released patch: 11.0.9-01; no public exploit identified at time of analysis, and the issue is not a confirmed actively exploited (CISA KEV) vulnerability, so it should be treated as a low-to-moderate priority hardening item rather than an emergency.
Sensitive information handled by the redfish_certificate resource in the Dell Terraform Provider for Redfish (versions 1.1.0 through 1.6.1) can be exposed to unauthorized parties through CWE-532 weakness, most plausibly via Terraform debug logs, state files, or CI/CD console output. Exploitation requires a high-privileged actor operating within the Terraform workflow (PR:H) who also has access to wherever the sensitive data is written, so realistic abuse is confined to users already close to the automation pipeline; the bounded version range and low confidentiality impact further constrain it. The vendor scores this CVSS 4.3, and our independent assessment concurs at 4.3 with confidentiality-only impact, making it a low-severity information-exposure issue rather than an urgent patching priority. No public exploit identified at time of analysis.