Use-after-free in libarchive's archive_entry_copy_mac_metadata() function allows an attacker who can influence the input an application feeds that API to crash the linked application or cause it to read uninitialized heap memory, yielding a CVSS 3.1 base score of 3.6 (AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L). The flaw is not remotely reachable by default and requires the consuming application to perform a self-copy in which the source buffer overlaps the entry's existing mac_metadata pointer; it is a genuinely low-priority memory-safety issue with impact limited to denial of service and minor information disclosure, with no integrity or code-execution outcome. No public exploit code and no confirmed active exploitation were identified at time of analysis, and Red Hat has published an upstream fix (libarchive PR #3318) alongside its advisory and Bugzilla tracking entry.
IBM i versions 7.3 through 7.6 contain an improper authorization flaw in the NFS server that allows a local, authenticated low-privilege attacker to bypass configured NFS export version restrictions. The vulnerability requires the NFS server to be configured with version-restricted exports to have any impact, and exploitation is limited to bypassing version controls with low confidentiality and integrity impact. This moderate-severity issue (assessed CVSS 5.4, AV:L) has no public exploit identified at time of analysis, and a vendor patch is available.
Path traversal in ClickMigrate's `revision` command lets a crafted migration name supplied via the `-m` argument escape the intended migrations directory and cause a `.sql` file to be created at an arbitrary path writable by the user running the tool. The flaw affects pip package `clickmigrate` versions before 1.0.3 and is only reachable when an attacker can influence the migration name passed to the command - for example an insecure CI/CD pipeline or automation that forwards untrusted input such as branch names or PR titles into `revision -m`; per the CVSS vector (AV:L, PR:L) the attacker needs a local execution path with user-level privileges rather than network access to a default install. Impact is limited to file creation in user-writable locations with no code execution, no data read or exfiltration, and no confidentiality impact (C:N/I:L/A:N), so this is a low-severity, low-priority issue; no public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV). A vendor-released patch is available: ClickMigrate 1.0.3.
Argument injection in libblockdev's NTFS and VFAT label-setting routines lets a local, unprivileged user smuggle command-line flags into the ntfslabel and fatlabel utilities through a filesystem label that begins with a dash. The vulnerable paths (bd_fs_ntfs_set_label() and bd_fs_vfat_set_label()) are reachable without administrator authentication via the udisks2 Filesystem.SetLabel() D-Bus method, but exploitation is strictly local and the assessed impact is low integrity only - no confidentiality or availability loss and no privilege escalation. No public exploit code has been identified at time of analysis, and the low CVSS score (3.3, AV:L/PR:L/I:L) reflects the limited blast radius rather than an unexplored attack surface.
Content spoofing and MCP handshake interference in the ckan-mcp-server DataStore Table UI resource let any frame that can reach the embedded iframe inject fabricated table rows and spoof JSON-RPC responses, including the ui/initialize handshake. All npm versions of @aborruso/ckan-mcp-server before 0.4.112 are affected; the inbound message listener never validates event.origin and outbound postMessage calls use targetOrigin '*', although cell values are HTML-escaped so this is display spoofing rather than script execution. Exploitation requires the table UI to be embedded by a context other than the trusted MCP Apps host and to be actively viewed by the user, so real-world priority is low; publicly available exploit code exists in the advisory's proof-of-concept files, and no active exploitation has been reported.
Missing initialization vector handling in IBM Db2 Genius Hub 1.0 allows a remote authenticated attacker holding low privileges to weaken the product's cryptographic protection and bypass security restrictions, resulting in a limited integrity impact. Exploitation is constrained by high attack complexity - the attacker must be able to observe or influence the affected ciphertext and benefit from favorable conditions such as repeated or predictable plaintext - and there is no confidentiality or availability impact. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the overall risk is low (CVSS 3.1 base score 3.1).
Administrator-level users of the WP Mail Logging WordPress plugin, in all versions up to and including 1.17.0, can read complete mail-log rows belonging to other users - including recipient addresses, message subjects, full message bodies, and URLs contained in them. The flaw is that the 'email_address' parameter is passed unescaped into a SQL LIKE query during the WordPress personal-data export workflow, so an attacker with administrator privileges can retrieve additional records only when their own address contains a LIKE wildcard character (for example an underscore) that coincides with another address stored in the log. Exploitation is gated by several concrete preconditions - high privileges (CVSS PR:H), a wildcard-bearing attacker address, a matching entry in the mail log, and an administrator-triggered privacy export - and no public exploit identified at time of analysis; the assigned score is 2.7, reflecting a genuinely low-priority information-disclosure issue.
Server-side request forgery in the PingOne groups endpoint of Devolutions Server 2026.3.8.0 and earlier lets an authenticated user with low privileges supply an attacker-controlled PingOne configuration in a request parameter and cause the server to act on it, resulting in exfiltration of the stored PingOne application secret. The issue carries a CVSS base score of 2.6 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N), is limited to a confidentiality impact on the PingOne secret, and only affects instances where the PingOne integration is configured with a stored application secret. No public exploit code has been identified at time of analysis, and a vendor patch is available.
PHP object injection in 10up Distributor before 2.3.2 allows an authenticated Contributor-level user on a connected source WordPress site to store a serialized-PHP-shaped string as post meta, which the destination site's set_meta() function in includes/utils.php then unserializes a second time, instantiating attacker-influenced objects on the receiving site. Real-world impact is heavily gated: exploitation requires a configured Distributor push/pull relationship between two sites and a usable PHP gadget (POP) chain in the destination's loaded plugins or themes, otherwise object instantiation accomplishes little. Tracked as CWE-502 with a CVSS 4.0 base score of 2.3 (independent assessment: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L) and no public exploit identified at time of analysis, this is a low-priority hardening issue rather than an urgent, actively exploited flaw.
An insecure direct object reference in Jeepay through version 3.2.9 lets an authenticated merchant user who holds the ENT_DIVISION_RECEIVER_DELETE entitlement delete profit-sharing (division) receiver records belonging to a different merchant. The flaw stems from the delete handler validating ownership against the wrong column - the caller's receiver-group ownership rather than the receiver record itself - so an attacker who owns a group whose id collides with a victim's receiver id can pass the check and remove that receiver. Exploitation requires a provisioned merchant account with the specific delete permission plus an id collision (reflected in the assessed CVSS as AC:H/AT:P), and impact is limited to deletion of receiver records with no read access to victim data; no public exploit code has been identified at time of analysis, and the issue is assessed as genuinely low priority.
Client-side page freezing in tarteaucitron.js before 1.37.0 allows an attacker to hang a visitor's browser tab by forcing the cookie-purge routine to evaluate a catastrophic-backtracking regular expression built from an unescaped cookie name. The library constructs a RegExp from each cookie name without escaping regex metacharacters, so a name planted as a cookie on a sibling subdomain, or supplied through an injected purgeBtn element's data-cookie attribute, can drive exponential backtracking when the purge action runs. Exploitation is unauthenticated per the CVSS vector (PR:N) but is heavily constrained: it requires an attacker-controlled cookie name (or DOM injection) plus the victim actually clicking the purge control, and the only consequence is a frozen page - no confidentiality or integrity impact. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and the issue is assessed as low priority (CVSS 4.0 base 2.3; independently assessed CVSS 3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L).
Heap out-of-bounds read in the FreeRDP Windows client (versions 3.30.0 up to but not including 3.32.0) lets a malicious or compromised RDP server feed a malformed clipboard file-transfer reply that the client misinterprets, crashing the client or corrupting an internal stream-size value. The attack is only reachable when a user connects to the hostile server and then actively pastes a remote file, so the attacker must control the server side and the victim must perform the triggering UI action; there is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV). Scoring is low by every available signal - CVSS 4.0 base 2.3 and an independently assessed CVSS 3.1 vector of AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L - so this should not be treated as a priority patch under normal circumstances.
Apache Answer through 2.0.2 can continue to honor sessions that should have been invalidated after a central account was suspended or deleted, because the User Center login integration creates first-login sessions that omit the user's external identity. An authenticated user (CVSS vector PR:L) who already holds such a session can keep issuing requests that bypass the central suspension/deletion check until the session expires or is manually revoked. Exploitation requires the User Center integration to be configured and the attacker to hold a valid pre-suspension session; no public exploit code or confirmed active exploitation was identified at time of analysis, and deployments not using User Center are unaffected. The vendor has released version 2.0.3, which fixes the issue.
Missing authorization checks in Apache Answer through 2.0.2 let an authenticated user perform mutations on non-public content they are not permitted to access, producing limited confidentiality and integrity impact on the affected instance rather than account or host takeover. Assessed severity is moderate (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) and the flaw requires a valid account, making instances that allow open or self-service registration the most exposed. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (CISA KEV); upgrading to Apache Answer 2.0.3 is the fix.
Apache Answer through 2.0.2 fails to invalidate visit tokens after a user's access is revoked, allowing an authenticated user to continue accessing previously known private uploaded files using a stale token. This insufficient session expiration flaw (CWE-613) requires the attacker to have been a legitimate user who obtained a valid token before revocation and to already know the specific file locations; it does not allow discovery of unknown private content. No public exploit code or active exploitation has been identified at time of analysis, and upgrading to version 2.0.3 remediates the issue.
Improper authorization in the similar-question search of Apache Answer through 2.0.2 allows an authenticated user to retrieve metadata belonging to non-public questions they are not entitled to see. The issue is remotely reachable, low complexity, and requires only a valid account plus use of the similar-question search feature, matching the assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, so impact is confined to information disclosure of question metadata with no effect on integrity or availability. No public exploit code has been identified at time of analysis and there is no confirmation of active exploitation (not in CISA KEV); the vendor-stated fix is Apache Answer 2.0.3.
Unauthenticated information disclosure in Apache Answer through 2.0.2 allows remote attackers to read comments tied to non-public (restricted) content by browsing public user profiles, which are rendered without re-checking the visibility of the parent content. The issue is network-reachable, requires no authentication or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), and is bounded to comment disclosure - no content bodies, credentials, or write capability are exposed, and instances hosting only public Q&A material have little to leak. No public exploit code has been identified at time of analysis and there is no indication of active exploitation; users should upgrade to version 2.0.3, which fixes the issue.
Apache Answer through 2.0.2 leaks metadata belonging to hidden questions to unauthenticated visitors through publicly reachable answer-profile pages, letting anyone who can reach the instance learn about hidden questions and read metadata that was never meant to be public. The disclosure is metadata only, not the full hidden-question content, so real-world sensitivity depends on whether the deployment treats the existence of hidden questions as confidential; no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV. The assessed severity is low-to-moderate (CVSS 3.1 5.3, AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), with the vendor-released fix in Apache Answer 2.0.3.
Missing visibility authorization checks in Apache Answer through 2.0.2 let remote, unauthenticated attackers retrieve the invited-user list attached to non-public questions that they should not be able to see. The flaw is limited to information disclosure - an attacker who can reach the invite-lookup functionality and reference a private question identifier can enumerate the users invited to that question, but cannot modify content or disrupt the service. The vendor rates this low severity, our independent assessment concurs (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), no public exploit code has been identified at time of analysis, there is no indication of confirmed active exploitation, and no EPSS score was supplied; upgrading to Apache Answer 2.0.3 resolves the issue.
Incorrect permission mapping in Apache Answer through 2.0.2 allows an authenticated user who holds only the question.unpin permission to hide or restore questions without holding question.hide or question.show. The flaw is only reachable in non-default installations where an administrator has built a custom role that grants question.unpin while separately withholding question.hide and question.show; where Apache Answer ships its stock bundled permissions, the mis-gated check is never satisfied and the issue is not exploitable. No public exploit code has been identified at time of analysis and this is not confirmed actively exploited (not in CISA KEV); the assessed impact is bounded to integrity of question visibility state (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N), and upgrading to 2.0.3 resolves it.
Stored cross-site scripting in Apache Answer through 2.0.2 allows an attacker who can control the contents of a data source consumed by the question importer to persist raw, unsanitized HTML that is later rendered to every viewer of the imported question, including privileged users. The importer bypasses the normal Markdown-to-HTML sanitization path applied to ordinary user content, so the injected markup survives storage and executes in the browser of anyone who opens the affected question - no additional victim interaction beyond viewing is required, but the attacker must first reach the administrative/trusted import workflow. The issue is rated low severity by the vendor and carries an assessed vector of CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N; no public exploit code has been identified at time of analysis and there is no indication of active exploitation. A vendor-released patch is available in Apache Answer 2.0.3.
Resource exhaustion in Apache Kylin 4.0.0 through 5.0.4 lets an attacker who already holds project admin permission abuse a cache API to drive computed-column processing into unbounded resource allocation, degrading or denying availability of the Kylin service. The weakness is reachable only by authenticated users with high privileges (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L), so a compromised or malicious project administrator account is a prerequisite; there is no confidentiality or integrity impact and no public exploit identified at time of analysis. Severity is low, no CISA KEV entry or public exploit exists, and the vendor-released fix is Kylin 5.0.5 (tracked as KYLIN-6112).
Apache Kylin 4.0.0 through 5.0.4 ship a default startup profile that leaves the security (authentication) settings disabled, so a Kylin instance launched with that default profile may be reachable over the network without the intended access controls; the advisory explicitly states that any deployment with the security settings profile turned on is not impacted. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) makes this a low-severity configuration-hardening flaw with limited confidentiality and integrity impact and no availability impact, and no public exploit code was identified at time of analysis. The vendor has fixed the issue in Apache Kylin 5.0.5, tracked as KYLIN-6113 (resolution: Fixed).
Metadata tampering and sensitive-information exposure in Apache Kylin 4.0.0 through 5.0.4 let a network-reachable attacker replace job metadata through the job service/job-metadata interface, with the assessed CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N) indicating unauthenticated access and low confidentiality and integrity impact. Exploitation is gated by deployment exposure: the vendor explicitly scopes impact as minor unless job services are exposed to the public internet, which it describes as uncommon. The independent assessment rates real-world priority as LOW, and no public exploit code or CISA KEV listing was identified at time of analysis; upgrading to 5.0.5 remediates the issue.
Insufficient validation of JDBC data source configuration in Apache Kylin 4.0.0 through 5.0.4 allows an authenticated user who can create or modify a JDBC source definition to influence how Kylin resolves and connects to external databases, yielding limited confidentiality and integrity impact (assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N). The vendor explicitly characterizes the impact as minor unless Kylin backend services are exposed to a public network, making network exposure the primary risk amplifier rather than the flaw itself. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the fix is available in Apache Kylin 5.0.5 (tracked as KYLIN-6111).
SQL injection in Apache Kylin 4.0.0 through 5.0.4 lets an authenticated user who can reach the table metadata API pass unsanitized 'tables'/'names' input that is concatenated into a SparkSQL command, yielding limited data exposure and limited integrity impact (assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N). The vendor explicitly scopes real-world impact as moderate because the default and most common deployment is query-only mode, which constrains attackers largely to reading data rather than writing or taking over the cluster; non-default modes would likely increase impact. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the issue is resolved by upgrading to Apache Kylin 5.0.5.
Unauthenticated access to Apache Kylin's in-house broadcast API combined with polymorphic deserialization of attacker-supplied data exposes Kylin 4.0.0 through 5.0.4 to high-impact compromise of the affected service, assessed as network-reachable without privileges or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The vendor classifies the issue as 'moderate' severity but notes that practical risk is concentrated on Kylin instances whose broadcast endpoint is directly reachable from a public network, which Apache describes as 'not common'; typical internal-only deployments are considered largely unimpacted. No CISA KEV entry, EPSS score, or public exploit code was present in the source data, so there is no public exploit identified at time of analysis, and this assessment rests almost entirely on the Apache advisory, which recommends upgrading to Apache Kylin 5.0.5.
Missing authorization on the JDBC source-configuration update function in Apache Kylin 4.0.0 through 5.0.4 allows an authenticated, low-privileged user to modify a project's data-source connection settings, producing a high integrity impact (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N) with only limited confidentiality exposure and no availability impact. The vendor explicitly frames exposure as network-bounded: risk is concentrated on Kylin services directly reachable from the public network, described as uncommon, while in-house deployments behind network controls are mostly not impacted. No public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score was supplied with the source data.
Server-side request forgery in the Apache Kylin job-driver UI proxy (versions 4.0.0 through 5.0.4) allows an attacker to induce the Kylin job service to issue requests to attacker-chosen destinations, potentially reaching internal services or cloud metadata endpoints that the Kylin host can access. The vendor explicitly scopes real-world risk to deployments where the job service and its UI proxy are directly exposed to the public network, describing that configuration as uncommon and stating that in-house, segmented Kylin deployments are 'mostly not impacted'; exploitation prerequisites are therefore dominated by network exposure rather than by any inherent weakness in default internal deployments. No public exploit code, EPSS score, KEV listing, or vendor-published CVSS vector was available at time of analysis, so there is no public exploit identified at time of analysis and the issue carries a moderate severity rating; upgrading to 5.0.5 removes the condition (tracked as KYLIN-6104).
Arbitrary file deletion outside the intended backup directory is possible in Apache Kylin 4.0.0 through 5.0.4 via a path-confinement bypass in the metadata backup deletion feature, allowing an attacker who can reach that function to delete files elsewhere on the Kylin host (assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H - integrity and availability impact, no confidentiality impact; PR:L indicates low-privilege authenticated access). The dominant limiting factor is exposure: Apache states the issue 'most' affects Kylin services directly reachable from the public network, which the vendor describes as uncommon, while in-house, non-exposed deployments are mostly not impacted. No public exploit code, EPSS score, or CISA KEV listing was identified at time of analysis, and a vendor fix is available in Apache Kylin 5.0.5 (tracked as KYLIN-6105).
Cross Site Scripting vulnerability in InstantASP ltd, InstantForum.NET v.4.1.4 allows an attacker to execute arbitrary code via reflecting un-sanitized input from query string parameters directly into the HTML response without proper output encoding