Code execution in THU-MIG YOLOE's AutoBackend model loader allows a local attacker to run arbitrary Python by supplying a crafted model whose imgsz, names, or kpt_shape metadata is passed to eval() in ultralytics/nn/autobackend.py; the victim must load the untrusted artifact, so this is not a network-facing trigger. Publicly available exploit code exists, but there is no CISA KEV confirmation, and the combination of local access, crafted-file prerequisite, user interaction, and limited deployment of this research project yields LOW real-world priority.
Unauthenticated customer-record disclosure in the LatePoint appointment booking plugin for WordPress, affecting all versions up to and including 5.7.4, allows remote attackers to harvest the first name, last name, email address, phone number and notes of every customer in the database by enumerating UUID prefixes through the steps__load_step AJAX endpoint using the params[customer[uuid]] parameter. Exploitation is strictly gated on a non-default configuration: the plugin's 'Field used for authentication' setting must be set to 'Disable ability to login' (guest checkout mode), so sites using default login-based authentication are not exposed. No public exploit code was identified at time of analysis; the AC:H rating reflects the request-heavy prefix enumeration required, which rate limiting or a WAF may slow or detect but does not prevent on an unprotected site.
Unauthenticated term-name enumeration in the Patreon WordPress plugin (versions below 1.10.0) lets remote attackers query taxonomy terms, including non-public and custom taxonomies that WordPress normally keeps off the front end. Successful exploitation leaks only the names of terms, not post content, credentials, or personally identifiable information, and no write access is gained, so the practical value depends on whether a site defines private or otherwise non-public taxonomies whose labels are themselves sensitive (for example internal customer segments or unpublished categorization schemes). The assessed vector (AV:N/AC:L/PR:N/UI:N, C:L) reflects a low-impact but easily reachable disclosure; no public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has released 1.10.0 to address the missing authorization check.
Session expiration bypass in Coder before 2.23.0 lets authenticated OIDC users retain access after their identity provider token expires when the IdP does not issue a refresh token. Because the APIKey cookie can auto-extend by 24 hours on each successful use, a user who keeps using Coder can remain logged in beyond OIDC authorization; exploitation requires a specific non-default OIDC deployment, and no public exploit was identified at time of analysis.