Missing authorization in TDuck Survey Form through 5.3 allows any authenticated, low-privileged user to read another form owner's raw settings by calling GET /user/form/setting/{key} with the 8-character form key embedded in a public survey fill link. The endpoint returns the form write password, the owner's notification e-mail address and associated WeChat openIds, which can be chained into form tampering and targeted phishing; a valid account is required (CVSS PR:L, so risk is higher where self-service registration is open), no user interaction is needed, and no public exploit identified at time of analysis. Severity is modest rather than critical because disclosure is confined to per-form settings and the attacker must authenticate first.
Attackers holding any valid account on roncoo-education through 25.0.0-RELEASE can close other users' pending orders or read their course IDs and prices by supplying a victim's order number to the platform's payment 'cancel' and 'continue' endpoints, which never verify that the order belongs to the requesting user. Impact is limited to low confidentiality and integrity loss - pending order state changes and disclosure of course identifiers and prices - with no exposure of payment funds, credentials, or server control, since exploitation requires authentication and knowledge or enumeration of valid order numbers. No public exploit code has been confirmed at the time of analysis and there is no CISA KEV entry, although a public technical writeup of the flaw is referenced; no vendor patch was identified in the supplied data.
Remote, unauthenticated clients can crash libIEC61850-based MMS servers running versions prior to 1.6.2 by writing an RptID value longer than 129 bytes to a report control block and then triggering report serialization via General Interrogation (GI). The oversized identifier overflows a fixed 130-byte stack buffer that is later wrapped as a temporary MmsValue and handed to MmsValue_setVisibleString, whose resize path attempts to free non-heap (stack) memory - an invalid free that terminates the server process. Impact is availability-only (CVSS 5.3, A:L) with no code execution, data disclosure, or integrity effect, and no public exploit has been identified at time of analysis; the issue is fixed in upstream version 1.6.2.
Argument injection in Seanime v3.7.0 through v3.10.3 lets unauthenticated clients on the same LAN or a shared Tailnet smuggle attacker-controlled flags into the ffmpeg command line, achieving arbitrary file write and file truncation as the user running seanime. The flaw is reachable because the application's privileged-settings guard did not treat a switch of transcodeHwAccel to 'custom' (with attacker-supplied decodeFlags/encodeFlags in transcodeHwAccelCustomSettings) as a protected change, so a crafted mediastream or HLS playlist request is executed with the injected options appended verbatim to ffmpeg's argument vector. This is rated Medium (CVSS 4.0 5.3, AV:A/AC:L/PR:N/UI:N/VC:L/VI:L/VA:N); exploitation is bounded to adjacent-network reachability and requires a trusted LAN/localhost origin, no public exploit code has been identified at time of analysis, and no confirmed active exploitation (CISA KEV) has been reported.
Missing authorization in the WP Chill Passster WordPress plugin (content-protector) through version 4.3.18 allows unauthenticated remote attackers to bypass the plugin's gated-content access controls and read content that the site owner intended to restrict. According to the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), exploitation requires no authentication, no user interaction, and no non-default configuration, but the impact is confined to low-level confidentiality loss - no data modification, code execution, or site takeover. There is no public exploit identified at time of analysis, and the flaw only matters on sites that actively use Passster's protection feature to gate content; sites that do not gate content with the plugin are unaffected.
Unauthenticated attackers can exploit a missing authorization flaw in YITH PayPal Express Checkout for WooCommerce (versions up to and including 1.61.0) to gain unauthorized access to limited sensitive information. Tracked as CVE-2026-111409 and classified as CWE-862, the vulnerability has a CVSS 3.1 base score of 5.3 due to a low confidentiality impact only (C:L/I:N/A:N). No public exploit code or confirmed active exploitation has been identified at time of analysis, but the plugin's default configuration exposes an unauthenticated endpoint.
Missing authorization in the BookIt WordPress plugin (Liquid Web / StellarWP), in all versions through 2.6.0.5, allows remote unauthenticated attackers to reach a protected plugin action that should be restricted to privileged users, resulting in unauthorized modification of site data. The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, score 5.3) confirms exploitation is network-based, unauthenticated, low complexity and requires no user interaction, but impact is confined to integrity - there is no confidentiality or availability loss and no scope change, so this is a moderate-priority broken access control issue rather than a full site takeover. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the exact endpoint or feature lacking the capability check is not specified in the available description and should be confirmed against the Patchstack advisory.
Missing authorization in the Arraytics WP Event Solution WordPress plugin (versions through 4.1.26) allows unauthenticated remote attackers to bypass access controls and modify plugin-controlled data, as reflected by the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N (low integrity impact only, no confidentiality or availability loss). This moderate-severity CWE-862 flaw requires only that the vulnerable plugin be installed and network-reachable on a WordPress site; no authentication or user interaction is needed. At time of analysis, no public exploit identified and the issue is not listed in CISA KEV.
Information disclosure in the MapSVG WordPress plugin (mapsvg-lite-interactive-vector-maps) through version 8.16.1 lets unauthenticated remote attackers retrieve sensitive data that a site has embedded in its MapSVG maps and content, because a missing authorization check (CWE-862) fails to properly gate access to that stored data. Per the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N (5.3), no credentials or user interaction are needed and only network reachability to the affected site is required, while impact is confined to confidentiality with no integrity or availability effect and no public exploit identified at time of analysis. Practical risk therefore depends on what operators have placed inside MapSVG content: sites storing only public map data face negligible real impact, whereas those that embedded secrets or private records in map fields should treat this as a live exposure.
Cross-tenant server ID enumeration in the Nezha monitoring dashboard (versions 1.7.0 through 2.3.14) lets an authenticated low-privilege member map other tenants' server IDs by sweeping sequential identifiers against the getServerConfig and setServerConfig endpoints and distinguishing 'permission denied' responses from success payloads. According to the authoritative assessment, exploitation requires a valid member account plus a shared, multi-tenant deployment where more than one user's servers coexist; on a single-tenant self-hosted install there are no other tenants to enumerate, sharply reducing real impact. It yields server-ID mapping rather than configuration contents, secrets, or control, and stays confined to a low-severity information-disclosure outcome (C:L, I:N, A:N). No public exploit code was identified at time of analysis, and this CVE is not in CISA KEV; vendor patch version 2.3.15 is available.
Authorization bypass in eladmin through 2.7 allows an authenticated user who holds the delegated user:edit or user:del permission to modify, disable, reassign, or delete accounts that lie outside their assigned department data scope, because the PUT and DELETE handlers on /api/users omit the department check that the corresponding read endpoints enforce. The attacker must already possess a department-scoped user-manager role and be able to identify target user ids in other departments, so this is not an unauthenticated flaw (CVSS 4.0 vector rates privileges required as High; independent assessment scores CVSS 3.1 5.1 with PR:L). Impact is limited to account-state integrity and availability of other departments' accounts, with no confidentiality exposure and no code execution; there is no public exploit identified at time of analysis.
BuildAdmin through 2.3.9 contains an insecure direct object reference in the backend admin-profile edit endpoint (routine/AdminInfo/edit), allowing an authenticated administrator who holds that permission to overwrite another administrator's profile by manipulating the id parameter. The writable fields are avatar, nickname, email, mobile and motto; because altered email and mobile values commonly drive administrative account recovery and notification flows, the meaningful escalation path is takeover of a super administrator account rather than mass compromise. No public exploit code and no CISA KEV listing were identified at time of analysis, so this is a low-to-moderate priority issue whose exploitation requires an already-privileged backend session with the specific permission granted.
Site-scoped authorization bypass in SiteServer SSCMS through 7.4.0 allows an authenticated administrator who holds Channels permission on one site to read and overwrite another site's channel records by supplying a foreign channel ID to the ChannelsController Get and Update APIs. This CWE-639 IDOR breaks multi-site isolation for channel metadata such as names, file paths, templates, link URLs, and custom fields, but requires privileged tenant-admin access and a multi-site deployment; single-site installations and users without Channels permission are effectively unaffected. The provided CVSS 5.1 (CVSS 4.0) and the independent assessed CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N both indicate a moderate, privilege-gated issue, and no public exploit identified at time of analysis.
An insecure direct object reference (IDOR) in the ThinkAdmin 'think-plugs-admin' plugin, versions through 1.0.81, allows an authenticated administrator who holds the admin/file.edit permission node - but who is not a super administrator - to read and overwrite other administrators' file records. By requesting or POSTing a target record id together with columns such as xurl, hash, or uuid, the attacker can disclose download URLs, tamper with stored file metadata, or reassign ownership of records belonging to other admins. Exploitation requires a valid privileged admin session and a deployment with multiple administrators, and there is no public exploit code identified at time of analysis and no CISA KEV listing, so real-world risk is a bounded, medium-severity authorization flaw (CWE-639) rather than a systemic compromise path.
PKP Open Journal Systems through 3.5.0-5 contains an insecure direct object reference (CWE-639) in its subscription management forms, letting an authenticated journal manager or subscription manager read subscriber details belonging to other journals via the editSubscription endpoint and reassign those subscriptions to their own journal via updateSubscription, which revokes the legitimate owners' access. Because subscription identifiers are sequential, the flaw is trivially enumerable, but exploitation requires a privileged account on at least one journal and a multi-journal installation where other journals' subscription records actually exist; single-journal deployments face negligible exposure and there is no public exploit identified at time of analysis.
A stored/DOM cross-site scripting flaw in tarteaucitron.js (CWE-79) affects all releases before 1.37.0 and allows an attacker who can place markup on a page - for example a CMS author or contributor - to inject a 'data-url' or 'data-src' attribute holding a javascript: URL next to a benign-looking 'url' attribute. Because getElemAttr resolves the 'data-' prefixed attribute into an iframe src while the https-only regex guard validates the unprefixed attribute, the javascript: scheme is never rejected and the injected script executes in the site's origin. The vendor rates this Medium (CVSS 5.1, 4.0 vector), our independent assessment scores it CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, and there is no public exploit identified at time of analysis; the authoring-privilege (PR:L) and victim-interaction (UI:P/UI:R) prerequisites limit realistic abuse to multi-author or user-generated-content environments.
Improper verification of cryptographic signatures in IBM Db2 Genius Hub 1.0 allows local attackers to bypass JWT signature validation, leading to partial information disclosure and data integrity loss. The flaw requires local access (AV:L) with no authentication or user interaction, but its impact is limited to low confidentiality and integrity (C:L/I:L), making it a moderate-severity, lower-priority issue. No public exploit has been identified, and IBM has released a patch.
Mattermost versions 11.10.x through 11.10.0, 11.7.x through 11.7.9, 11.9.x through 11.9.1, and 11.8.x through 11.8.5 fail to validate the invited recipient's email address when redeeming team or guest invitation tokens, enabling an authenticated user who obtains a forwarded or leaked invite link to join a team or access private channels without authorization. The flaw is rated CVSS 5.0 (moderate severity) and requires an attacker with an existing authenticated account plus a valid, unredeemed invitation token originally issued to a different email address; no victim user interaction is needed. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor advisory is MMSA-2026-00747.
Local privilege escalation in the EA Javelin Anticheat standalone installer (builds 1.0.14329371, 1.0.14547437, 1.0.14789537 and 1.0.14940698) on Windows lets an authenticated, non-administrative user rewrite the EAAntiCheatService service configuration and executable path so that the service subsequently runs attacker-controlled code as NT AUTHORITY\SYSTEM. Exploitation is narrow: it only applies to hosts where the standalone installer was executed manually, standard EA App and Steam game installations are explicitly unaffected, and the weak service permissions self-heal as soon as any integrated EA game title is launched. EA rates the issue CVSS 5.0 (AV:L/AC:H/PR:L/UI:R), while independent assessment scores it higher (AV:L/AC:H/PR:L/UI:N with high confidentiality, integrity and availability impact) because a silent service-path hijack yields full host compromise; no public exploit was identified at time of analysis, although a third-party technical writeup on the flaw is referenced, and the vendor-released fix is version 1.0.14940699.
Authenticated SQL injection in the FluentCart WordPress eCommerce plugin, affecting all versions up to and including 1.7.0, lets users who hold shop-management privileges slip attacker-chosen keys into an unprepared bulk-product-update query and read arbitrary data out of the site's database. The vulnerable path is the product bulk-update flow, and on FluentCart Pro installs the non-administrator 'Manager' shop role carries the products/edit permission and can therefore trigger it without administrator access - which is why the effective privilege requirement is moderate rather than high. Reported by Wordfence, this is a genuine but constrained issue rather than an urgent fire-drill: no public exploit code and no confirmed active exploitation were identified at time of analysis, and impact is confined to confidentiality (database read/extraction) with no integrity or availability effect.
Authenticated SQL injection in the WP Booking System - Booking Calendar plugin for WordPress (all versions up to and including 2.1.0.1) lets a user with Administrator-level privileges or above inject arbitrary SQL via the AJAX 'data[orderby]' parameter and read sensitive records from the site database. The attack path is constrained: the orderby value only reaches the SQL query builder when the booking AJAX handler takes the use_ajax branch, which requires the targeted calendar to contain more than 200 bookings - a non-default state that an Administrator can deliberately create. This issue is not listed in CISA KEV and no public exploit code was identified at time of analysis; a confidentiality-only impact (CVSS 4.9, PR:H, no user interaction) keeps the practical risk low-to-moderate, and the vendor has released 2.1.0.2 to fix it.
Authenticated SQL injection in PeerBanHelper versions 5.0.0 through releases before 9.3.15 enables a high-privileged web API user to read arbitrary data from the configured SQLite, MySQL, or PostgreSQL database by supplying an unrecognized field value to the /api/statistic/analysis/field endpoint. Exploitation requires valid admin-panel credentials (CVSS PR:H) and reachable API access, with no user interaction needed. CVE-2026-62362 is rated medium severity (CVSS 4.9), is fixed in 9.3.15, and has no public exploit identified at time of analysis.
Debug-level logging in Mattermost Server can write authentication secrets - session tokens and OAuth access tokens - into server log entries without sanitization, allowing anyone who can read those logs to impersonate authenticated users. Affected releases are 11.7.x through 11.7.10, 11.8.x through 11.8.5, 11.9.x through 11.9.1, and 11.10.x through 11.10.1 (Mattermost advisory MMSA-2026-00763); the vendor scores it 4.5 (MEDIUM) under CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N. Exploitation is prerequisite-heavy rather than opportunistic: the server must be running with debug-level logging (not the default production setting) and the attacker must already hold read access to those logs via filesystem access, a centralized log/SIEM viewer role, or a compromised log pipeline, and the assessed vector (AV:L/AC:H/PR:H/UI:N) reflects that local, high-privilege access barrier. There is no public exploit identified at time of analysis and no KEV listing; impact is confidentiality-only, as stolen tokens enable user impersonation while the flaw itself produces no direct integrity or availability loss.
Mattermost 11.7.x through 11.10.x fails to invalidate the stored AD/LDAP bind password whenever other connection settings - such as the directory server address - are changed in the System Console, so the previously saved plaintext credential is carried over to the new configuration. An authenticated System Console administrator (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, base 4.9) can then trigger the LDAP Test Connection / diagnostics feature, which transmits that retained plaintext bind password to the configured server address, potentially an attacker-controlled host set by the same admin. There is confirmed no CISA KEV entry and no public exploit identified at time of analysis, and no EPSS score was supplied; exploitation is gated behind high-privilege System Console access, an existing AD/LDAP integration with a stored bind password, and the deliberate admin action of pointing the connection at a hostile host, making this a genuine but moderate-priority confidentiality issue rather than an emergency.
Account takeover in Mattermost 11.7.x through 11.10.0 lets an authenticated attacker who already holds a valid OAuth bearer token for a specific target user permanently hijack that user's SSO-backed account: the POST /api/v4/users/login/switch endpoint fails to reject OAuth application sessions, so the attacker can switch the account to password authentication, set an attacker-controlled password, and detach the account from its identity provider (CWE-863 Incorrect Authorization; CVSS 4.4, CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N). Exploitation is heavily constrained - the victim must have an identity-provider-backed account, the attacker must obtain a victim-scoped OAuth token (typically by getting the user to authorize a malicious OAuth application), attack complexity is assessed as high, and deployments without SSO or OAuth applications are not exposed. No public exploit identified at time of analysis, and there is no confirmed active exploitation (Mattermost advisory MMSA-2026-00758).
Code injection in ImprintLab Medical-SAM-Adapter 0.1.0-alpha and 0.1.0 allows a local, low-privileged attacker to execute arbitrary code in the context of the user who loads a crafted model file. The flaw resides in the AutoBackend model-loading path (models/MobileSAMv2/ultralytics/nn/autobackend.py), where the imgsz, names, or kpt_shape metadata fields are passed into a dynamically evaluated expression without neutralization (CWE-95). Publicly available exploit code exists, and the project has not responded to the issue report; exploitation requires local access and victim interaction to load the malicious model, limiting impact to Low confidentiality, integrity, and availability.
Unauthenticated privilege escalation in the WP Compress - Instant Performance & Speed Optimization plugin for WordPress (all versions up to and including 7.25.00) allows remote attackers with no WordPress account to gain plugin-administrator-equivalent control over the plugin's optimization, CDN and critical-CSS settings. The chain is two-stage: the stored plugin API key is first leaked by the unauthenticated `wpc_send_critical_remote` nopriv AJAX action, but only when the external critical-CSS service returns an `apiResults` field that causes `initCritical()` to echo the key via `wp_send_json_success`; the harvested key is then replayed as the `apikey` parameter to the `start_comms` dispatcher, which performs no capability check and no nonce verification before passing attacker-controlled `group`, `setting` and `value` parameters into `change_setting()`, writing them into the `WPS_IC_SETTINGS` option without an allow-list and causing `checkAndAddCaps()` to grant the `manage_wpc_settings` capability to arbitrary roles, including Subscriber. The assessed severity is moderate - CVSS 4.8 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N) - unauthenticated per the vector (PR:N) but rated high complexity because the API-key disclosure depends on the external critical-CSS service response; impact is scoped to the plugin's settings surfaces rather than full WordPress site administration, and no public exploit code and no confirmed active exploitation (not in CISA KEV) were identified at time of analysis.
Arbitrary shortcode execution in the Popup Box plugin for WordPress (ays-pro) versions 6.4.1 through 6.4.2 lets unauthenticated remote attackers invoke any shortcode registered on the site with attacker-chosen attributes, because client-controlled IP-related HTTP headers are folded into a popup body and then run through do_shortcode(). The attack is only reachable when a site administrator has manually inserted the %%user_ip_address%% token into a popup's Custom Content body, so default installations and sites that never use that token are not affected; impact is bounded by the shortcodes already installed (no direct PHP injection), which is why the assessed vector scores only 4.8 with high attack complexity. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor reference points to a fix in 6.4.3.
A stack out-of-bounds read in Antiword 0.37 and earlier (prop8.c, vGet8PapInfo and vGet8ChrInfo) allows a crafted .doc file containing malformed FKP pages to drive run counts and grpprl offsets past the end of a 512-byte stack buffer, crashing the parser or corrupting style parsing. Exploitation is local and gated by user interaction: a victim must be given the file and invoke antiword on it (AV:L/UI:P), and the assessed impact is availability-only with no confidentiality, integrity, or code-execution effect. The attack is unauthenticated per the CVSS 4.0 vector (PR:N), no public exploit is identified at time of analysis, and the CVSS 4.0 base score of 4.8 (MEDIUM) likely overstates its operational urgency given the limited impact and delivery prerequisites.
Code injection in Ultralytics FastSAM's AutoBackend model-loading path lets a crafted model file execute arbitrary Python when its metadata entries (imgsz, names, kpt_shape) are passed into a dynamically evaluated expression from session.get_modelmeta().custom_metadata_map in ultralytics/nn/autobackend.py. The attack is bounded to the local model-loading surface - there is no network-facing exposure - and requires that a user or process loads an attacker-supplied model artifact, so the practical prerequisite is delivering a malicious model to a victim rather than obtaining privileges on the host. VulDB rates it 4.8 (medium) under CVSS 4.0 with low confidentiality/integrity/availability impact and PR:L/UI:N, while our independent assessment scores it CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, i.e. higher impact and requiring user interaction instead of prior authentication; no CISA KEV listing or public exploit code is present in the supplied data, and the maintainers were notified via a GitHub issue but have not responded, so no vendor-released patch is identified at time of analysis.
Safing Portmaster before 2.2.5 exposes a local update endpoint, POST /api/v1/updates/from-url, that is registered with api.PermitAnyone and therefore performs no authorization check, allowing any unprivileged local process to point the updater at an attacker-controlled index URL and bypass both version checks and auto-apply settings. The result is a forced downgrade that can only install releases legitimately signed by Safing, so the practical impact is the reintroduction of previously patched vulnerabilities rather than execution of arbitrary attacker-supplied code, and exploitation requires low-privileged local access (CVSS PR:L) with no user interaction and cannot be performed remotely. Fixed in 2.2.5 by removing the endpoint entirely; no public exploit identified at time of analysis.
In ikus060/ikus-soft rdiffweb 7.1.1, the repository containment check relies on a string prefix comparison (startswith) instead of a true filesystem path-boundary check, so a percent-encoded traversal sequence (%2e%2e) in the request path lets the browse, restore, history, and delete operations resolve to a path outside the intended repository. The attack surface is narrow: the actor must already be an authenticated user with permissions on the target, the target must be a sibling directory whose name begins with the operated repository's path string, and the victim must be socially induced to issue the crafted request (CVSS 3.1 rating 4.6; our independent assessment is more conservative at 3.1 given AC:H). The realistic outcome is a user operating on - or deleting - data other than the repository being displayed; no confidentiality impact is involved because the user only reaches data they already have rights to. No public exploit code was identified at time of analysis, and there is no KEV entry.
Denial of service in IBM i's Digital Certificate Manager (DCM) for System TLS allows a local, high-privileged attacker to prevent secure network connections from starting or cause fallback to non-secure connections. Affected versions are IBM i 7.3, 7.4, 7.5, and 7.6. No public exploit code or active exploitation has been identified at time of analysis, and the requirement for authenticated, high-privilege local access makes this a moderate-severity, low-urgency issue.
An out-of-bounds memory read in MariaDB Server's spatial (GIS) functions lets an authenticated but low-privileged database user pass a truncated WKB MultiPolygon or MultiLineString to ST_Area, ST_Centroid, or GLength and have the parser read past the end of the allocated buffer, returning adjacent heap bytes as a geometry result or error path. Affected releases are MariaDB 10.6.1 through the fixes in 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2; exploitation requires valid credentials and the ability to submit attacker-controlled spatial data (CVSS 4.3, PR:L), and the leak is primarily useful as an ASLR-bypass primitive inside a larger exploit chain rather than as a standalone compromise. No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV, so it should be treated as low-to-moderate priority and scheduled with routine patching; the vendor advisory GHSA-p7v9-24h4-mch8 and MDEV-40328 document the issue.
Subscriber-level users on WordPress sites running Image Hub 1.2.0 and earlier can extract six third-party image-service API credentials from admin-page HTML and then use an exposed AJAX nonce to overwrite those stored credentials. The plugin emits Giphy, Openverse, Pexels, Pixabay, and Unsplash key options via wp_localize_script, and the image_hub_update_settings AJAX handler lacks a capability check, allowing the same low-privilege attacker to modify settings through update_option(). No public exploit identified at time of analysis; the assessed risk is a moderate, patch-priority information-disclosure and integrity issue rather than an emergency.
Openwave Webtop Media Transcoder fails to enforce the administrator-defined file-type restrictions that are meant to limit which documents may be converted, so an authenticated webmail user can reach the transcoding function outside the normal Webmail UI and have unintended document types processed. The flaw carries a CVSS v3.1 score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L), meaning any exploitation is confined to a low availability impact - no loss of confidentiality or integrity - and it requires a valid authenticated webmail account (PR:L). No public exploit code has been identified at time of analysis, KEV status is not indicated, and no EPSS score was supplied; this is a low-severity, authenticated-only issue that does not warrant priority remediation.
Authorization bypass in the LPagery (Bulk Page Generator) plugin for WordPress, affecting all versions up to and including 3.1.0, allows any authenticated user with subscriber-level privileges or above to create, modify, and delete LPagery-managed pages and bulk page-generation jobs that should be restricted to administrators. The plugin fails to enforce authorization checks (CWE-862) on its LPagery REST/OAuth endpoints, and on default fresh installations where the Freemius integration has not been opted into, the AES-256-CBC key used to validate Bearer tokens collapses to the publicly known SHA-256 hash of an empty string, making those tokens forgeable by any authenticated user. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; the CVSS 3.1 base score is 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), consistent with a low-integrity-impact flaw gated behind an authenticated account.
Authenticated vendor-level users of the Dokan multivendor marketplace plugin for WordPress (all versions up to and including 5.2.1) can reset the WordPress account password of any customer who has placed at least one order with their store, by supplying an arbitrary value to the 'password' parameter of the plugin's REST customers endpoint. The flaw is a CWE-639 insecure direct object reference: the endpoint's object-level guard only verifies that the target user is one of the requesting vendor's own customers, and never blocks changes to login-identity fields, so a vendor can overwrite the stored password hash and then log in as that customer for a limited account takeover. Vendor access required to exploit this can be self-obtained through the public 'I am a vendor' registration flow when that option is enabled, but the practical impact is bounded - the attacker must already hold a vendor or custom-level account and can only target customers with an existing order relationship; no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis.
Authenticated Mattermost users can degrade message post-processing latency for every member of the channels they share by storing an oversized list of custom mention keywords (notify_props.mention_keys) on their own profile, which the server then matches against each post. Because the matching routine scales quadratically and multibyte/Unicode keywords add per-character cost, and neither the number nor the size of stored keywords is capped, each post the attacker's channel peers send or receive is processed far more expensively on the attacker's behalf. Impact is confined to availability degradation (CVSS 4.3, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L; CWE-770); no data exposure or crash is involved, valid authentication plus at least one shared channel is required, and no public exploit has been identified at time of analysis.
An authorization bypass in Arcane before 2.11.0 lets anyone holding a valid environment-scoped access token reach administrator-only routes by presenting that token in the X-Arcane-Agent-Token header, which skips the WithAdminRequired check. The exposed surface is the manager's Go pprof diagnostic interface under /api/debug/pprof/*, so the practical impact is read-only disclosure of runtime and profiling data plus possible profiling overhead, not code execution or configuration change (CVSS 4.3, CWE-863). Exploitation is authenticated - the attacker must already possess a legitimate environment access token (CVSS PR:L) - and no public exploit code has been identified at time of analysis; the flaw is corrected in Arcane 2.11.0.
Authenticated WordPress users holding Contributor-level access or higher can publish, unpublish, or bulk-delete any map created with the Wp Map Block plugin, including maps owned by administrators, because the plugin's Maps_Controller REST endpoints through version 3.0.0 rely on a permission callback that only checks edit_posts and never validates object ownership or publish-level capability. Successful abuse either hides published maps from every public page site-wide or forces draft maps to become publicly visible, and the bulk branch additionally deletes wpmb_map posts outright. Impact is confined to the integrity of map post status with no code execution path; no public exploit code was identified at time of analysis, and this is a medium-severity broken-access-control issue (CVSS 4.3) rather than a critical compromise.
Improper access control in Devolutions Server 2026.3.8.0 and earlier lets an authenticated remote user who has only the general Edit permission - but who was explicitly not granted the Edit asset permission - change an asset's stored contact password by issuing a crafted request straight to the partial-save endpoint, skipping the UI-level authorization check (CWE-863). The consequence is confined to partial integrity loss (CVSS 4.3, AV:N/AC:L/PR:L/UI:N, C:N/I:L/A:N): no data disclosure or availability impact, and the attacker must already hold a valid account with Edit rights, so this is not a privilege-escalation path to full administrative control. No KEV listing, no active exploitation and no public exploit code were identified at time of analysis, and SSVC/EPSS-style signals (Exploitation: none, Automatable: no, Technical Impact: partial) place this at low real-world priority; the flaw is fixed in 2026.3.10.
Authenticated PAM checkout users on Devolutions Server 2026.3.8.0 and earlier can manipulate the just-in-time (JIT) elevation settings embedded in a checkout update request to delete arbitrary Active Directory groups or preserve elevated privileges that should have been dropped at checkout. The flaw is a server-side trust issue: the application accepts client-supplied JIT elevation parameters without re-validating them, so an attacker only needs a provisioned account that already holds PAM checkout access. There is no public exploit identified at time of analysis, exploitation is not listed in CISA KEV, and the vendor has released a patched version; CVSS scores are modest (4.3 vendor base; independent assessment 4.3 with Scope:Changed, reflecting limited integrity and availability impact rather than confidentiality loss).
Information disclosure in Mattermost release lines 11.7.x, 11.8.x, 11.9.x and 11.10.x (up to 11.7.10, 11.8.5, 11.9.1 and 11.10.1 respectively) allows an authenticated user to learn the channel ID of a private channel that another user is actively viewing. The user status API endpoints return an unsanitized active-channel field, so any provisioned account on the same server - with no membership in the target private channel, which is precisely the flaw - can query another user's status and observe which private channel that user is currently reading. The exposure is limited to the channel identifier itself, not its contents, name or membership, but it still reveals the existence of private channels and correlates named users with sensitive collaboration spaces. Rated CVSS 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), this is a low-to-moderate urgency issue rather than an emergency, and no public exploit has been identified at time of analysis.
Flagged-post review status in Mattermost can be inferred by authenticated users who lack content-reviewer permissions, because the affected API performs other validations before checking the caller's permissions, producing a distinguishable response for flagged versus unflagged posts. The issue affects 11.10.x through 11.10.0, 11.9.x through 11.9.1, 11.8.x through 11.8.5, and 11.7.x through 11.7.9 (advisory MMSA-2026-00754), and exploitation requires a valid account on a deployment that actually uses the post-flagging/moderation feature, with attacker access limited to a single binary signal and no exposure of post content or reviewer details. Rated CVSS 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N); no public exploit identified at time of analysis, and this is a genuinely low real-world priority.
Private team metadata in Mattermost Server can be enumerated by any authenticated user who lacks the permission to list private teams, because the team search functionality fails to exclude private teams from public search results. An attacker with a valid low-privileged account can send a modified team-search request and retrieve the ID, name, and display name of private teams they are not authorized to see. The issue affects Mattermost 11.7.x through 11.7.9, 11.8.x through 11.8.5, 11.9.x through 11.9.1, and 11.10.x through 11.10.0, and is rated low severity (CVSS 3.1 4.3, AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) with only metadata disclosure - no message content, membership lists, or credentials are exposed; no public exploit was identified at time of analysis.
Improper authorization in Apache Answer 2.0.2 and earlier allows holders of a valid global API key to retrieve answer content tied to questions that are hidden, deleted, or still pending review. The defect is in the MCP (Model Context Protocol) answer-retrieval tool, which returns content without honoring the per-question visibility state, so an authenticated key holder - an insider, a third-party integration, or anyone using a leaked key - can read material the Q&A platform intended to withhold. It is not reachable by anonymous remote attackers, impact is limited to information disclosure with no modification or denial of service, and no public exploit identified at time of analysis; CISA KEV does not list this issue.
Mattermost servers running 11.7.x through 11.7.9, 11.8.x through 11.8.5, 11.9.x through 11.9.1, and 11.10.x through 11.10.0 fail to restrict Slack import account binding to system-administrator-initiated imports, so an authenticated attacker holding team admin privileges can force-add existing Mattermost users to their own team and then forge posts attributed to those users' identities. The attacker only needs to be an authenticated insider with the team-admin role and to supply a crafted Slack export archive containing the target users' email addresses; no victim interaction is required (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, base score 4.3). Impact is confined to integrity - unauthorized team membership and identity-forged content - with no confidentiality loss or availability impact, and there is no public exploit identified at time of analysis and no CISA KEV listing, making this a moderate-priority insider-abuse issue rather than an urgent remote-code-execution or data-breach emergency.
Topic-title disclosure in the Discourse Doc Categories plugin lets an authenticated user who holds edit rights on a documentation index topic learn the titles of private messages and topics in read-restricted categories that the user is not authorized to view. The index refresh routine resolves linked topic titles without enforcing viewer authorization, so the leaked titles appear in the generated index structure even though the underlying topic contents remain inaccessible. Rated CVSS 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) with no public exploit identified at time of analysis and no confirmed active exploitation; the issue is largely confined to non-default Discourse instances that have this plugin installed and actively used, and the fix is a targeted authorization filter in the upstream commit b15d4de02ad29d7c9525346afee51fef4a2c605a.
Wheels 4.0.0 through 4.1.2 performs case-insensitive path-containment checks on case-sensitive filesystems, so a pre-existing symlink pointing to a case-distinct sibling directory can bypass canonical-path validation for zip entries, package mappings, development assets/docs, guide images, and image tags. This permits limited unauthorized file disclosure outside the intended root; a separate CLI database-dump write path can write outside the application root only when the CLI POST action, loopback access, and password gate are all satisfied, and only to an existing writable case-distinct sibling directory. The issue is fixed in Wheels 4.2.0; exploitation of the primary flaw depends on deployment on a case-sensitive filesystem with the necessary pre-existing symlink, and no public exploit was identified at time of analysis.