A timing side-channel in QNAP QuRouter allows attackers on an adjacent network segment to extract limited sensitive data by measuring response-time discrepancies, without authentication and without user interaction. The issue is fixed in QuRouter 2.7.2.113 and later; the vendor advisory confirms a patched release is available. No public exploit code or active exploitation has been identified at time of analysis, and the scored risk is low (CVSS 4.0 base 1.3; independently assessed as CVSS 3.1 AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N), with the relevant confidentiality impact only and no integrity or availability effect.
Missing authorization in the WPExperts WP EasyPay plugin (versions through 4.5.4) leaves a plugin-provided endpoint or action reachable by unauthenticated remote requests, so an attacker with network access to a WordPress site running the vulnerable plugin can invoke restricted functionality and read data they should not be able to reach. The reported CVSS 3.1 base score is 5.3 (Medium) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, meaning no credentials, no user interaction, and no non-default configuration are required, but the impact is confined to limited confidentiality loss with no integrity or availability effect. No public exploit code has been identified at time of analysis, there is no CISA KEV entry, and no EPSS score was provided in the available intelligence, so exploitation risk currently rests on the ease of reaching the unauthenticated endpoint rather than on confirmed active abuse.
Denial of service in HPE NonStop TCP/IP Utilities (T8602L01^BAA and earlier) can be triggered when the traceroute utility is executed under specific, non-default conditions, allowing a remote attacker to render the affected utility unavailable. The assessed CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H, score 5.3) confirms the attacker needs no authentication and can act remotely, but exploitation depends on a narrow precondition (high attack complexity) and on a traceroute invocation or operator action occurring (required user interaction), so the attacker cannot trigger the condition unilaterally. Impact is restricted to availability - there is no confidentiality or integrity loss and no code execution - and no public exploit has been identified at time of analysis.
Improper authentication handling in ZoneMinder 1.34.0 through 1.36.38 lets remote unauthenticated attackers bypass the login redirect and read monitor and zone metadata through the zones view by submitting a malformed or invalidly signed token. The impact is limited to information disclosure-privileged and state-changing operations remain blocked because permission helpers reject the boolean false user value-and no public exploit code has been identified at time of analysis. Exploitation requires ZM_OPT_USE_AUTH to be enabled, token-based authentication in use, and the web interface to be network-reachable; vendor-released patch: 1.36.63.
Missing authorization in the WebberZone Knowledge Base plugin for WordPress (versions through 3.2.0) allows unauthenticated remote attackers to reach knowledge base content that the plugin's access-control settings were intended to restrict. Because the CVSS vector is PR:N/UI:N, no account or victim interaction is needed; the exposure is limited to confidentiality (C:L, CVSS 5.3), with no write or availability impact. No public exploit code has been identified at time of analysis, and there is no confirmed CISA KEV entry, so real-world exploitation is not established from the available data.
Unauthenticated remote attackers can exploit missing authorization in the WP Desk Flexible Quantity (Measurement Price Calculator for WooCommerce) plugin, versions up to and including 2.3.23, to modify a constrained set of data with low integrity impact. The flaw, tracked as CWE-862 and rated CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), requires no authentication or user interaction, but the exact affected feature is unspecified. No public exploit code or active exploitation has been identified at time of analysis.
Sunshine Photo Cart (WordPress plugin) versions up to 3.7.4 are affected by a missing authorization vulnerability (CWE-862) that allows unauthenticated remote attackers to bypass access controls and read limited sensitive data from the plugin, such as cart or customer information. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication or user interaction is required, but impact is confined to partial confidentiality loss (C:L) with no integrity or availability effect. No public exploit code has been identified at time of analysis.
Missing authorization controls in the WP E-Signature 'Ninja Forms Signature Contract Add-On' for WordPress (all versions from the initial release through 3.2.5) let remote, unauthenticated attackers reach a function that should be restricted and read data they are not entitled to see. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, score 5.3) confirms no credentials, no user interaction, and no special configuration are required against a default installation, but impact is limited to confidentiality - no data modification or denial of service is possible. No public exploit code was identified at time of analysis and no EPSS or CISA KEV data was provided, so there is no confirmed active exploitation; risk is driven by the plugin's narrow deployment footprint and the low-sensitivity, read-only nature of the exposure.
Unauthenticated attackers can tamper with booking quantities in the Booking and Rental Manager WordPress plugin (versions through 2.8.0) due to improper validation of specified quantity input (CWE-1284), potentially removing important client functionality. The CVSS 5.3 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) confirms network-exploitable, low-complexity, unauthenticated access with integrity-only, partial impact and no confidentiality or availability effect. No public exploit or active exploitation has been identified at time of analysis.
Missing authorization (CWE-862) in the WPExperts APIExperts Square for WooCommerce (WooSquare) WordPress plugin allows unauthenticated remote attackers to invoke plugin functionality that lacks a capability/permission check, affecting all versions through 4.7.5. The assessed CVSS 5.3 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) confirms the attack needs no login, credentials, or user interaction, but the integrity-only, low-impact rating bounds the outcome to a limited set of unauthorized operations rather than full site compromise, and only stores running this Square-for-WooCommerce integration are exposed. No public exploit code and no confirmed in-the-wild exploitation were identified at time of analysis.
A low-severity denial-of-service condition affects the Go library kin-openapi in versions 0.145.0 through 0.146.0 (exclusive). When an application uses openapi3filter.ValidateRequest and its OpenAPI schema defines at least one query parameter with the deepObject serialization style, an unauthenticated remote client can send a request containing a large number of unrelated query keys, causing the urlValuesDecoder.DecodeObject routine to recompile the same parameter-name regular expression once per key and consume CPU and memory proportional to the attacker-controlled key count. The vulnerability scores CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L), and no public exploit code was identified at time of analysis; the issue is fixed in release 0.146.0.
Unsupported or non-canonical HTTP methods sent to Go services built on kin-openapi's openapi3filter.ValidationHandler with the legacy router reach a panic in PathItem.GetOperation before authentication runs, letting an unauthenticated remote client repeatedly abort connections and inflate stack-trace logs in all versions prior to 0.145.0. The access vector is network-only with no privileges or user interaction required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L), but the effect is bounded: Go recovers per-request panics by default, so the worst case is per-connection denial of service and log growth rather than a full process crash, and the panic requires an exactly-matched static path (a path served only by a templated route does not reach the same sink). No public exploit code was identified at time of analysis, and CISA KEV does not list this issue as confirmed actively exploited.
A nil pointer dereference in kin-openapi versions prior to 0.145.0 lets a crafted OpenAPI document panic the loader, denying service to any host application that parses untrusted specs. Trigerring it requires only a self-referential additionalProperties JSON Reference - a schema whose $ref targets its own additionalProperties member - which is dereferenced inside Loader.resolveComponent before document validation runs, so doc.Validate cannot block it (CVSS 3.1: 5.3, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, CWE-476). There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV); exposure is limited to services that accept attacker-supplied OpenAPI documents, and patched version 0.145.0 is available.
Stored cross-site scripting in OPNsense core prior to 26.1.11 lets a user who holds the page-system-certmanager privilege inject HTML metacharacters into a certificate description field, and that markup is later rendered unescaped in the SSL Certificate selector on System Settings > Administration, executing in the browser session of any other user who opens that page. Exploitation requires a multi-user deployment and deliberate victim interaction (CVSS 3.1 base 5.2, Medium; vendor vector AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:N, with the independent assessment treating the impact as scope-changing and limited to low confidentiality/integrity), and the attacker must already be authenticated with a high-privilege account. No confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; the flaw is resolved by upgrading to OPNsense 26.1.11.
Stored cross-site scripting in Sonatype Nexus Repository 3 allows an account holding 'edit' permission on a hosted R repository to embed script content in the metadata of an uploaded R package, which then executes in the browser of any user who opens that package's details in the Browse UI, running with the viewing user's own permissions. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:P, SC:H/SI:H) requires an authenticated attacker with repository edit rights and a victim who loads the affected package page, and Sonatype rates the issue Medium at 5.1. No public exploit identified at time of analysis; a vendor fix is available in Nexus Repository 3.97.0.
Stored cross-site scripting in LibreDesk versions before 2.9.0-rc.8 allows an authenticated agent to upload a crafted SVG whose Content-Type is supplied with a trailing parameter (for example 'image/svg+xml; x'), causing the application's exact-match check against 'image/svg+xml' to fail so the file is served inline without a sandboxing Content-Security-Policy instead of as an attachment. When a victim agent or administrator subsequently requests GET /uploads/{uuid}, the embedded script executes in their browser session, giving the attacker the ability to act with the victim's privileges in the helpdesk UI. Exploitation requires a valid agent session (CVSS vector PR:L) and victim interaction (UI:P), and only pre-2.9.0-rc.8 instances are affected; no public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV), so it ranks as a medium-priority, patched vulnerability.
Open redirect in the Creema handmade marketplace mobile apps for Android and iOS lets a crafted URL cause the app to render an attacker-controlled web page inside its own in-app screen, enabling convincing phishing pages that appear to originate from a trusted app. The flaw requires the victim to actively open a malicious link (UI:A/UI:R) and no authentication is needed (PR:N), but impact is limited to integrity of displayed content (C:N/I:L/A:N), with no code execution or direct data compromise; CVSS base score is 5.1 (medium). There is no public exploit identified at time of analysis and no confirmed active exploitation (not in CISA KEV), though JPCERT/CC has published the issue as JVN48627289 and users of both platform apps are exposed regardless of app version because the vendor CPE entries are version-agnostic.
The ゲオアプリ (GEO app) from GEO CORPORATION fails to properly authorize requests handled through its registered custom URL scheme, so an attacker who can get a victim to open a crafted link can redirect the app's in-app browser (WebView) to an arbitrary website, exposing the user to phishing content or leaking a service session ID. The flaw affects both the Android and iOS builds (CWE-939; CVSS 5.4, AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N), meaning the attack is remote and unauthenticated but depends on victim interaction, with impact limited to low confidentiality and integrity loss and no availability effect. This is a medium-severity issue, not a top-tier priority, and no public exploit was identified at time of analysis.
Incomplete cleanup in ABB My Control System 26.4 and 26.5 allows an attacker who already has adjacent-network access and a valid low-privileged account to degrade or exhaust system resources on the affected host, resulting in a high availability impact while confidentiality and integrity remain unaffected. Exploitation is not trivial: it requires proximity to the system on the same network segment, authenticated access, and interaction from a legitimate operator to reach the vulnerable code path, which is why our independent assessment rates this as a genuine but modest-priority issue rather than an emergency. No confirmed active exploitation (no CISA KEV listing) and no public exploit code have been identified at time of analysis, and no EPSS score was supplied; the vendor's own advisory, ABB document 7PAA025438, is the authoritative source for the affected versions and fix guidance.
The GEO app (ゲオアプリ) for Android and iOS stores user passwords in cleartext within its local storage, allowing an attacker with physical access to a device to read the credentials. This vulnerability (CWE-312) has a CVSS score of 4.3 (Medium) and requires physical possession of an unlocked device with the app installed and a saved password. No public exploit code is known at time of analysis, and no vendor patch has been identified.
Server-side request forgery in Matomo 5.11.2 allows an attacker holding a low-privilege authenticated account to make the application issue HTTP requests to arbitrary destinations through the SiteContentDetector/SitesManager functionality, disclosing limited sensitive information from internal or otherwise unreachable services. The vulnerability is rated CVSS 5.0 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) as a CWE-918 SSRF, so exploitation requires credentials but no user interaction, and impact is confined to confidentiality with no integrity or availability effect. Publicly available proof-of-concept code exists (SSVC exploitation status: poc; a dedicated CVE-2026-78850 demonstration repository is referenced), but there is no confirmed active exploitation (CISA KEV).
Reload-password and code disclosure, plus unintended state-changing operations against a foreign local server, affect developers using the Wheels CLI through 4.1.0. Because the CLI never verifies that the local development server it contacts on a targeted port actually belongs to the current project, any process listening on that port - or, for `wheels console`, on one of the common ports it probes when the project's own server is down - can capture the reload password and code sent via `wheels reload` or `wheels console`, while other commands can be induced to perform state-changing operations against another local application's server and database. Exploitation is local only (CVSS AV:L, PR:L, UI:R) and requires the developer to actively run an affected command, making this a genuine but bounded developer-workstation risk rather than a mass-exploitation priority; no public exploit was identified at time of analysis, and the vendor addresses the flaw in 4.1.1.
Cross-site scripting in QNAP Notes Station 3 before 3.9.12 allows an attacker who already holds a valid Notes Station user account to inject malicious code that executes in a second user's browser session when that user views or interacts with the crafted content. Exploitation is not possible remotely without credentials (the assessed vector is PR:L), and it depends on a victim actively triggering the injected payload, so the resulting impact is confined to that victim's browser session - the QNAP NAS host and the Notes Station application itself suffer no direct confidentiality, integrity, or availability loss. No public exploit identified at time of analysis, and QNAP has shipped a fix in version 3.9.12.
Cross-site scripting in Progress Kendo UI for jQuery (versions 2022.3.1109 up to but not including 2026.3.1015) allows an attacker who can influence the URL of a ToolBar ButtonGroup button to inject extra HTML attributes - including an event handler - and execute JavaScript in a victim's browser when that button is interacted with. The flaw is unauthenticated from the network perspective (CVSS:3.1/AV:N/PR:N) but requires user interaction (UI:R) and is rated high complexity (AC:H) because the payload must break out of an unquoted attribute; impact is scoped to the application's browser context with low confidentiality and integrity effects (C:L/I:L/A:N, base score 4.7). This is a genuine but comparatively low-urgency issue: no public exploit code exists and there is no confirmation of active exploitation (not listed in CISA KEV), and the vendor has released a fix in version 2026.3.1015.
Stored/DOM cross-site scripting in Progress Kendo UI for jQuery (Scheduler widget, versions 2026.3.811 and earlier) allows an attacker who can control a scheduler resource's color value to inject extra HTML attributes - including event handlers - into the quoted event wrapper attributes rendered by the Day, Timeline, Month, and Agenda views, so JavaScript executes in a victim's browser when the affected event is interacted with. Successful exploitation compromises the confidentiality and integrity of data accessible to the host application, though severity is limited by high attack complexity (AC:H), mandatory victim interaction (UI:R), and the practical need for write access to resource data (assessed PR:L; the vendor published PR:N). No public exploit code has been identified at time of analysis and the issue is not known to be actively exploited; the vendor-released fix is version 2026.3.1015.
Cross-site scripting (XSS) in the PanelBar component of Progress Kendo UI for jQuery (versions 2019.2.514 through before 2026.3.1015) allows unauthenticated remote attackers who can influence PanelBar item URL values to inject additional HTML attributes, including event handlers, into a single-quoted href attribute, resulting in JavaScript execution in a victim's browser upon interaction with the crafted item. Exploitation requires that the target application binds the PanelBar to a data source with attacker-controllable URLs and that a victim interacts with the item, making it a moderate-severity issue (CVSS 4.7) with high attack complexity. No public exploit code has been identified at time of analysis, and the vulnerability is fully remediated by upgrading to version 2026.3.1015.
Cross-site scripting in the FileManager component of Progress Kendo UI for jQuery (versions 2023.3.1010 through 2026.3.1015) allows an attacker who can control or influence a file or folder name to inject HTML with event handlers that execute JavaScript in a victim's browser when the user drags that item, because the default drag hint renders the remote item name as raw HTML while the corresponding list items are correctly encoded. The vector is unauthenticated over the network (PR:N) but requires a user to actively drag the poisoned item and demands the attacker first seed a crafted name, so the CVSS 4.7 (Medium) score reflects a genuinely moderate priority - no public exploit code exists and there is no evidence of active exploitation. The issue is a client-side DOM XSS with scoped confidentiality and integrity impact (S:C/C:L/I:L/A:N) and is fixed in version 2026.3.1015.
Out-of-bounds memory read in HPE NonStop EXPAND can disclose sensitive information to a local attacker who already holds high privileges on the NonStop system. The flaw requires local access and high privilege with high attack complexity, so realistic exploitation is limited to malicious or compromised privileged operators rather than external or unauthenticated attackers. No public exploit identified at time of analysis, and the CVSS 3.1 score is 4.7 (AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:L), consistent with a low-priority information-disclosure issue.
PeaZip 10.5.0 through 11.2.0 on Windows fails to show its 'Do you want to run this file?' confirmation before launching shell-executable archive entries - specifically .url Internet Shortcuts and .lnk shortcuts - so a victim who opens an attacker-crafted archive and then opens that entry through the archive object viewer can have a program, or an attacker-supplied command line, run silently in their own user context. The flaw is unauthenticated but requires two deliberate user actions (open the archive, then open the entry), is Windows-only and depends on ShellExecuteW, and provides no privilege escalation because the payload runs with the rights of the user who opened the archive. A proof-of-concept .lnk that launched cmd.exe with an attacker-chosen command line was demonstrated by the reporter, but the CVE is not listed in CISA KEV and there is no confirmation of active exploitation in the wild; the reporter's CVSS 4.0 score is 4.6, while the assessed CVSS 3.1 vector is AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
Modification of protected system or configuration data in QNAP QuRouter is possible when a local attacker who already holds a QuRouter administrator account abuses an external-control-of-configuration flaw (CWE-15). This is an authenticated, local-only issue with low integrity impact and no confidentiality or availability impact; there is no remote or unauthenticated path. QNAP fixed it in QuRouter 2.7.2.113 and later, and no public exploit code has been identified at time of analysis.
Local, high-privileged attackers can crash the Samsung Vyond TEE monitor by passing an out-of-bounds enclave ID to the Keystone SBI create_enclave path in tee/monitor/src/enclave.rs. The flaw affects all versions before commit be6e297b0c4836e20d73b2f8a40a561ea496ebaa and requires supervisor-mode access (PR:H) with no user interaction; impact is limited to availability (monitor crash/instability) with no confidentiality or integrity effect. No public exploit has been identified, and despite the CVE assignment, this is a genuinely low-priority issue.
Samsung Vyond's RISC-V security monitor aborts with an uncaught Rust panic when its SBI error paths are reached, because pre-fix builds call panic!() instead of returning a structured error code. Exploitation requires an attacker who already executes at RISC-V supervisor (S-mode) privilege and can invoke the monitor's SBI calls (enclave lifecycle or shared-memory region operations) with parameters that drive those functions into an error branch, making this a local, high-privilege, availability-only crash of a TEE security monitor. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV); CVSS 3.1 scores it 4.4 (AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H), with no confidentiality or integrity impact.
Sensitive information exposure in the Elementor Website Builder plugin for WordPress through version 4.2.3 lets any authenticated user with contributor-level access or higher read the full post_content and the plaintext post_password of private, draft, pending, and future posts belonging to any author, including Administrators and Editors. Successful exploitation only requires a low-privileged account on the affected site and no victim interaction (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, 4.3), making open-registration, membership, and multi-author sites that hand out contributor roles the most exposed. This is a moderate, authorization-gap issue (CWE-862, Missing Authorization) rather than a high-urgency flaw; no public exploit was identified at the time of analysis.
Authenticated Contributor-level users on WordPress sites running Blog2Social up to 9.1.4 can read arbitrary post titles and content, including private and pending posts owned by other users, through an insecure direct object reference in the b2s_ship_item and b2s_ship_item_reload_url AJAX handlers. The flaw is a low-severity information disclosure (CVSS 4.3, CWE-639) that requires a valid Contributor account; no public exploit identified at time of analysis and no confirmed active exploitation. It matters most on multi-author, membership, or guest-contributor sites where Contributor accounts are broadly assigned, because single-author installs expose little or no data beyond what the attacker can already see.
Server-side request forgery in Helium Platform before 2.2.60 lets any authenticated user force the server to issue outbound HTTP requests to arbitrary internal or external hosts by storing a crafted URL as an external calendar feed, enabling host and port reconnaissance through response differences and unhandled RemoteDisconnected errors. The vulnerable path is the default external-calendar feature, and the periodic refetch in fetch_ical_conditional makes the requests repeatable, though the advisory confirms only forced outbound requests and internal reachability-not secret exfiltration. Authentication is required (CVSS PR:L) and no public exploit has been identified at time of analysis; the vendor-aligned CVSS is 4.3.
Missing authorization controls in the Meow Apps AI Engine WordPress plugin (all versions through 3.8.3) let an authenticated low-privileged user reach a plugin feature or endpoint whose access-control level is incorrectly configured, granting limited unauthorized modification (C:N/I:L/A:N) rather than data disclosure or service disruption. Exploitation requires a valid WordPress account with at least low privileges (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, base score 4.3), so unauthenticated visitors cannot trigger it, and only sites running the plugin at or below 3.8.3 are exposed. No public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV); this is a genuine but modest-priority broken-access-control issue reported through Patchstack.
Memory corruption in Google Chrome's SVG rendering path affects builds prior to 155.0.8059.84 and allows a remote, unauthenticated attacker to read memory from the browser process when a victim opens a crafted HTML page that embeds a malicious SVG image. The flaw is confined to an information disclosure (CVSS 4.3, C:L/I:N/A:N) - no code execution or data modification - and, per the assessed vector (AV:N/AC:L/PR:N/UI:R), requires no privileges but does depend on user interaction. CISA's SSVC assessment records exploitation as 'none' and no public exploit code has been identified at time of analysis, so the practical risk is concentrated on users running unpatched Chrome builds; Google has released a fixed version (155.0.8059.84), which is the primary mitigation.
Memory corruption in Google Chrome before 155.0.8059.84 allows a remote, unauthenticated attacker to read memory from the browser process when a victim opens a crafted HTML page. Exploitation requires user interaction (UI:R) and results in only low confidentiality impact (C:L) with no integrity or availability loss; CISA SSVC rates exploitation as 'none' and the issue is not automatable. No public exploit code has been identified at time of analysis, and a vendor patch (155.0.8059.84) is available.
Apache Airflow's SFTP provider (apache-airflow-providers-sftp) omits SSH host-key verification in its deferrable code paths - SFTPTrigger, SFTPHookAsync and SFTPClientPool - because the no_host_key_check connection extra defaulted to permitting unknown hosts instead of requiring a known-hosts match. Any deployment that runs SFTP sensors or operators in deferrable mode while leaving that extra unset, supplying no host_key, and having no known_hosts entry is exposed: an unauthenticated attacker who holds a machine-in-the-middle position between the Airflow triggerer and the SFTP server can impersonate the server and capture the credentials and data exchanged (CWE-322; independent assessment scores it CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N). The vendor-released patch is apache-airflow-providers-sftp 7.0.0, which also fixes the sibling defect CVE-2026-94134 covering the synchronous SSH hook default; no public exploit code and no CISA KEV entry were identified at time of analysis, and the required MITM network position is the main factor limiting realistic risk.
Missing authorization in the WordPress plugin Login with Phone Number (all versions through 1.8.77) allows any authenticated user, including a low-privileged registered account, to perform a plugin action that should be reserved for a higher-privileged role. Per the assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N (score 4.3), the attacker must already hold an account on the target site, the attack is network-reachable with no user interaction, and the impact is limited to integrity with no confidentiality or availability loss. No public exploit code has been identified at time of analysis, and the flaw is not confirmed as actively exploited (no CISA KEV listing).
Missing authorization checks in the WP Chill Strong Testimonials WordPress plugin through version 3.3.12 allow an attacker who already holds a valid low-privilege account (CVSS PR:L, so network-reachable but authenticated) to invoke plugin functionality that lacks a proper capability check and read data they should not be able to access. Impact is confined to limited confidentiality loss - no integrity or availability effect, and no unauthenticated path - making this a low-to-moderate priority issue; the realistic prerequisite is open/self-service registration or an already-compromised subscriber-level credential. No public exploit code or confirmed active exploitation was identified at time of analysis.
Authenticated OPNsense users who hold at least one affected module privilege can supply a crafted safe-delete token that is interpolated into an XPath query over config.xml, letting them read configuration metadata from modules they are not authorized to access. The flaw, tracked as CVE-2026-58395, affects OPNsense releases prior to 26.1.11 and yields a substring-presence oracle that leaks configuration item names, descriptions, reference paths, and UUIDs, though it cannot modify configuration or delete data. It is a read-only information-disclosure issue rated 4.3 medium; no public exploit code identified at time of analysis, and CISA KEV does not list it.
Stack-based buffer overflow in HPE NonStop EMS Distributor (CWE-121) allows an attacker who already holds a local presence on the NonStop host to corrupt the memory of the Event Management Service Distributor process, producing low integrity and low availability impact with no confidentiality exposure. The assessed vector (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L, base 4.0) means the flaw cannot be reached remotely, requires conditions beyond the attacker's control to trigger reliably, needs no application-level authentication once local access exists, and involves no user interaction - making this a low-priority issue rather than a critical one. No public exploit code has been identified at time of analysis, there is no CISA KEV listing, and no EPSS score was supplied; the impact is bounded to the local host and to degradation of the EMS Distributor rather than a full system compromise.
Path traversal and symlink-following flaws in BorgBackup's `borg extract` let a specially crafted archive delete or overwrite files outside the chosen extraction directory - for example a symlink item "evil" -> "/etc" followed by an item path "evil/passwd", a path embedding "..", or a hardlink whose source points outside the tree. All releases before 1.4.5 and all 2.0.0 betas before b22 are affected, but exploitation is heavily gated: the attacker must already have privileged write access to the repository (per the assessed vector, CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:N/I:H/A:H) plus the borg key and passphrase for encrypted or authenticated repositories, and the victim must subsequently run `borg extract` on that archive, since `borg create` never emits such items. Vendor-released fixes are available in 1.4.5 and 2.0.0b22, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Symlink following in Terragrunt's `terragrunt catalog` command (versions before v1.1.1) lets a local attacker who can write to the shared system temporary directory have the victim's clone preparation operations follow a planted symlink, deleting an existing `<repoName>` directory outside the intended temp root and repopulating that path with the cloned catalog repository contents - all executed in the victim's own security context. The attacker must know in advance which repository URL the victim will catalog so they can pre-compute the deterministic path `<tmp>/catalog-<base64 sha1 of repo URL>` and plant the symlink before the run, and they control only the symlink's parent directory because the leaf name is fixed to `<repoName>`. The issue is not remotely exploitable, requires a shared multi-user or CI host plus a victim-initiated `terragrunt catalog` run, and no public exploit code has been identified at time of analysis; consistent with the independent assessment (CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:L), the impact is limited to low integrity and availability effects with no confidentiality impact, and exposure is minimal on single-user machines with no untrusted local processes.
CVE-2026-93879 is a vulnerability attributed to Ubuntu that currently cannot be characterized: no description, no CWE, no CVSS vector, no CPE data, and no advisory references were supplied in the available intelligence. Because neither the affected package nor the vulnerable feature is identified, the concrete impact - whether denial of service, privilege escalation, information disclosure, or remote code execution - cannot be stated, and authentication requirements, user interaction, and attack vector are unconfirmed from the provided data rather than assumed. No public exploit code and no CISA KEV entry are associated with this identifier (no public exploit identified at time of analysis), and risk cannot be meaningfully assessed until the Ubuntu Security Notice and the corresponding upstream advisory are published.
Ubuntu tracks CVE-2026-109117 within its distribution package set, but the supplied intelligence contains no description, no affected component, no CWE, no CVSS vector, and no CPE data, so the concrete security impact cannot be stated. Risk cannot be meaningfully assessed from the provided data. No public exploit identified at time of analysis, and no EPSS score or CISA KEV entry was supplied; the issue is reported only by the vendor:ubuntu source, which typically denotes a flaw in an Ubuntu-packaged upstream project. Until the Ubuntu Security Notice and the NVD record are retrieved to identify the vulnerable package, version range, and attack prerequisites, the exposure of any given host cannot be estimated and remediation cannot be scoped.