Undetected tampering with PGP-encrypted messages is possible in the Apache Camel Crypto PGP data format because unmarshal() only validated the OpenPGP modification detection code when the incoming message used the integrity-protected packet type, and the packet type is selected by the message producer. Deployments running Camel 4.0.0 through 4.18.4 or 4.19.0 through 4.22.0 that decrypt externally supplied PGP ciphertext are affected; unauthenticated remote attackers who can produce those messages, or rewrite them in transit, can substitute the legacy symmetrically encrypted data packet and have malleated content accepted without any integrity failure. Impact is limited to integrity (silent forgery or modification of decrypted content) with no confidentiality or availability loss, so this is a genuine but moderate-severity flaw rather than an emergency; no public exploit code was identified at time of analysis and there is no confirmed active exploitation (CISA KEV) - exploitation requires the attacker to control or intercept the message bytes, which is why the vector carries AC:H.
Improper credential verification in the Apache Camel camel-shiro security processor lets a remote attacker whose request names an already-in-use principal ride a thread-bound Shiro subject and skip the password check entirely. Affected are Camel 4.0.0 through 4.18.4 and 4.19.0 through 4.22.0 that secure routes with ShiroSecurityPolicy, particularly when alwaysReauthenticate=false keeps subjects long-lived on pooled worker threads; the CVSS:3.1 vector is AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N (5.9), reflecting unauthenticated network reachability gated by high attack complexity. Because exploitation depends on thread-pool reuse timing and an exact principal-name match, it is non-deterministic rather than reliably reproducible, and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis. Successful abuse yields access to protected routes and their data as the impersonated principal, with no integrity or availability impact assessed.
Apache Camel's Docling component implicitly interprets String message bodies by prefix, letting attacker-influenced content trigger server-side request forgery (bodies beginning with http:// or https://) or local file disclosure (bodies beginning with / or containing a backslash) without any endpoint option to pin the interpretation mode. Affected are Camel 4.15.0 through 4.18.4 and 4.19.0 through 4.22.0; the flaw is unauthenticated from the component's perspective (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N, 5.9) but requires that a route actually forward externally influenced String bodies into a docling endpoint, and confidentiality-only impact is rated High. No public exploit code or CISA KEV entry is associated at time of analysis; EPSS data was not provided. Vendor-released patches exist (4.23.0, 4.22.1, 4.18.5) along with new opt-in hardening options.
Denial of service in the Zephyr RTOS Bluetooth Classic Hands-Free Profile (HF role) allows a remote Audio Gateway peer to permanently leak entries from the fixed HFP TX buffer pool and then deadlock the Bluetooth RX thread, hanging the device until reboot. The bug lives in subsys/bluetooth/host/classic/hfp_hf.c: hfp_hf_disconnected() cancels work items and clears hf->acl but never drains the AT-command buffers queued on hf->tx_pending, and it leaves BT_HFP_HF_FLAG_CONNECTED set, while hfp_hf_create() memsets a reused HF slot without checking whether any work item is still pending or running. Only builds with CONFIG_BT_HFP_HF enabled are affected, and the attacker must reach an established, authenticated HFP session (paired/SSP devices have L2CAP authentication enforced before the RFCOMM channel is reachable), so this is an adjacent-range, authenticated-session availability issue rather than a drive-by one. No public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), but the per-cycle leak is trivially repeatable by any connected AG.
Improper authentication in the dotnet eShop Catalog API's AddApplicationServices configuration lets unauthenticated remote attackers bypass authentication controls and achieve limited confidentiality, integrity, and availability impact on catalog data; affected builds are up to commit 913acea66708a59595351174cee9b29f37179d29. The CVSS v4 vector records Proof-of-Concept exploit maturity (E:P), so publicly available exploit code exists, but there is no confirmed active exploitation (not in CISA KEV). Because eShop is a Microsoft reference/sample application rarely exposed in production, practical risk is moderate and bounded to low-impact catalog-level effects.
Heap buffer overflow in GPAC MP4Box's AC4 descriptor parser can crash the process when a local user opens a crafted AC4 file, producing a denial of service. Affected builds include the 2.5-DEV-rev1593-gfe88c3545-master development snapshot; the CVSS 3.1 vector is AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, so exploitation requires victim interaction and affects availability only. EPSS is 0.22% (12th percentile), and no public exploit identified at time of analysis; an upstream fix commit is referenced.
GPAC MP4Box 2.4 contains a use-after-free in the filter pipeline that can crash the process when it processes a crafted media file. The CVSS vector requires local access and user interaction (AV:L/UI:R) with no privileges required (PR:N); impact is limited to availability (A:H), with no confidentiality or integrity effect. No public exploit was identified at time of analysis, and EPSS is low at 0.17% (6th percentile), consistent with a low-priority, high-noise issue rather than an emergency.
A heap use-after-free in GPAC/MP4Box (build 2.5-DEV-rev1593-gfe88c3545-master) lets a local attacker crash the tool by getting a victim to open a crafted AC4 audio file, producing a denial of service with no confidentiality or integrity impact. The flaw sits in the AC4 configuration cleanup path (gf_odf_ac4_cfg_clean_list in /odf/descriptors.c) and the surrounding AC4 substream-group and presentation parsing, which the upstream fix hardens with null checks, array bounds validation and de-duplication of temporary group lists before freeing. Scoring is CVSS 3.1 5.5 (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H), EPSS is low at 0.17% (6th percentile) and there is no CISA KEV entry; a public PoC reference exists in the upstream GitHub issue and a linked social-media post, but it is not verified as working exploit code. The upstream fix commit e02d1fd24cdc26acb1b236ab38b3832cffcae21b is available, and no released patched version was independently confirmed.
IBM Storage TS4500 Library versions 1.1.1.6 through 1.12.0.3 fail to invalidate a session after logout, allowing an authenticated user who obtains or retains a still-valid session identifier to impersonate another user. Exploitation requires a second user to have logged out and the attacker to possess that session token, so impact is limited to multi-user or insider scenarios and the issue is moderate severity/low urgency. Patch is available per IBM advisory node/7292613; no public exploit identified at time of analysis.
Denial of service in GIMP is triggered by importing a crafted SBZ palette file that lacks a color-model attribute, causing a NULL pointer dereference during string comparison in the palette parser. The flaw affects GIMP as packaged in Red Hat Enterprise Linux 6 through 10, requires local delivery of a malicious file and user interaction to import it, and results only in application crash with no confidentiality, integrity, or code-execution impact. No public exploit code or confirmed active exploitation was identified at time of analysis.
SQL injection in the Criminal Management System (vraj404) up to commit 2808d057e7ddc5295519a487365b0cacfd0ba8c4 lets remote unauthenticated attackers influence SQL queries through the home.php Submission Form parameters id, name, offName, crime, dob, arrDate, crimeDate, sex, address, folder and others, with limited confidentiality, integrity and availability impact. Publicly available exploit code exists, but no CISA KEV entry was provided, and the project uses a rolling release model with no fixed version or vendor response reported.
The FileBasedKeyLifecycleManager in Apache Camel's PQC (post-quantum cryptography) component writes generated private key material to disk using whatever permissions the process umask produces instead of restricting the file to its owner, so on hosts with a permissive umask such as 022 the unencrypted private key is group- and world-readable. Affected are Apache Camel 4.12.0 through 4.18.4 and 4.19.0 through 4.22.0 that use this component to persist key material; an attacker who already holds a separate local account on the same host can read the key file and then forge signatures or break key exchanges performed by that deployment. The CVSS 3.1 vector (AV:L/PR:L/C:H) confines this to a local, authenticated party - no public exploit code has been identified at time of analysis and there is no CISA KEV listing - and the vendor assesses severity as low because the remote sender that Camel's threat model targets is not the exposure path.
Apache Camel's camel-mllp component writes HL7 clinical message payloads containing protected health information into ordinary application logs, because the logPhi option defaulted to true and two additional code paths logged payload content even when an operator had explicitly set logPhi=false. Deployments running Camel 4.0.0 through 4.18.4, or 4.19.0 through 4.22.0, that use the MLLP transport for healthcare integration are exposed out of the box; anyone who can read the resulting logs - local authenticated users per the CVSS vector (AV:L/PR:L, C:H) - can recover patient data that was never meant to land in general-purpose log storage with its broader retention, aggregation and access surface. This is a genuine data-exposure defect but a low-urgency one in attacker terms, since it is not remotely triggerable and merely requires pre-existing log read access; no public exploit code was identified at time of analysis, and vendor patches are available. Note that simply setting logPhi=false is not a complete workaround, as two code paths continue to log payloads until the fix is applied.
Authenticated IBM MQ clients can cause a bounded denial of service and obtain limited information about process memory layout in IBM MQ Operator and IBM MQ Advanced Container Images deployments by sending a specially crafted request that triggers an out-of-bounds read. The issue requires a valid MQ client session and network access to the queue manager listener, and impact is limited to availability and low-confidentiality disclosure rather than code execution or data modification. No public exploit was identified at time of analysis, and IBM has published a vendor patch.
Refresh-token validation failure in the ForgeRock Key Manager component used by WSO2 API Manager, Universal Gateway, and API Control Plane allows a remote attacker who possesses a valid refresh token to present it as an access token and reach protected resources without completing the required client-credential exchange. The CVSS 3.1 score is 5.4 with AC:H because exploitation is gated by prior acquisition of a refresh token; no public exploit code and no CISA KEV entry are identified in the provided data.
HTML injection (CWE-80) in IBM Cloud Pak System 2.3.6.0 and 2.3.6.1 lets a remote attacker who already holds valid credentials on the web interface inject malicious HTML/script that executes in another user's browser within the hosting site's security context. Impact is limited to low confidentiality and integrity effects (CVSS 5.4) and requires both a legitimate authenticated account and a victim subsequently viewing the injected content, so it is a routine patch-management item rather than an urgent one. No public exploit code or confirmed active exploitation was identified in the available data; the vendor has published a fix advisory.
Missing authorization in the Surfer WordPress plugin through 1.8.0.744 lets an authenticated low-privileged user exploit an incorrectly configured access-control check to read or modify limited site data over the network without user interaction. The issue is rated CVSS 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N), and no public exploit was identified at time of analysis.
Missing authorization in ThimPress LearnPress through 4.4.10 allows authenticated low-privilege users, such as self-registered students or subscribers, to perform actions they should not be permitted to perform against LMS-managed data. The flaw is medium severity (CVSS 5.4, CWE-862), remotely reachable with low complexity, and requires only a low-privilege authenticated account with no victim user interaction (PR:L/UI:N). No public exploit code or CISA KEV active exploitation is identified at time of analysis.
Information disclosure in IBM Concert 1.0 through 3.0.0 exposes schema suggestion data to network-reachable attackers; the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication or user interaction is required, although the impact is limited to low confidentiality loss with no integrity or availability effect. The flaw is rated 5.3 (moderate) and is chiefly useful for reconnaissance rather than direct compromise. No public exploit code or CISA KEV entry was identified at time of analysis, and patch availability is documented in the vendor advisory.
Log injection in IBM Concert 1.0 through 3.0.0 lets remote unauthenticated attackers corrupt or forge log records by supplying input containing special or control characters that the product writes to its log files without neutralization. The CVSS 3.1 score is 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), so the only assessed impact is limited integrity damage to log data - there is no code execution, data disclosure, or availability loss. No public exploit code or confirmed active exploitation was identified at time of analysis, and real-world severity depends on how downstream log consumers (viewers, SIEM parsers, audit reviews) handle unescaped content.
MISP before 2.5.48 can leak restricted tag metadata to a remote synchronization peer because its push-preparation routine removes non-exportable tags only after processing the entire report set, leaving all but the final report unsanitized. The issue affects authenticated MISP deployments that push events containing multiple event reports to another MISP server, and the same logic can also emit an empty report and cause the remote instance to fail saving the event. It is a low-severity confidentiality issue with no public exploit identified at time of analysis.
Token-less deployments of MemTensor's memmy-agent Memory Service expose POST /api/v1/admin/shutdown to unauthenticated remote requests, letting an attacker shut the service down and cause a low-impact denial of service. All versions up to 1.0.9, 1.1.1 and 1.2.2 are listed as affected (CPE: cpe:2.3:a:memtensor:memmy-agent:*), and the issue is rated only 2.3 under CVSS 4.0 (with our own assessment of 3.1/AV:N/AC:H/PR:N/UI:R/A:L) because exploitation is gated by a victim visiting an attacker-controlled page, by specific browser cross-origin behavior, and by the admin token being left unconfigured. Publicly available exploit code exists (the upstream GitHub issue and VulDB entry), but the practical risk is limited to internet-exposed instances running in the default, token-less state - the endpoint is designed for local use and the cross-origin behavior was reportedly tightened in later changes.
Authorization bypass in Cal.com and cal.diy through 6.2.0 allows any authenticated user to manipulate the ID argument in the webhook creation procedure and attach or alter webhooks on team-scoped event types or team webhooks without being an ADMIN or OWNER. The pre-patch code verified only eventType.userId, so team-owned resources were reachable by non-members; impact is limited to webhook configuration and secrets rather than full account takeover (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L). No public exploit was identified at time of analysis, and an upstream fix is proposed in PR #30223 but a released patched version was not independently confirmed.
Authorization bypass in sglang-router (sgl-model-gateway) through 0.3.2 allows an authenticated holder of a data-plane API key to reach the /ha/* mesh high-availability management routes that are meant to require the control-plane Admin role. Such a caller can read cluster topology, write gossiped configuration, modify global rate limits, and invoke POST /ha/shutdown to quietly dissolve HA coordination. Exploitation requires mesh/HA coordination mode to be deployed and a valid data-plane credential; no public exploit code has been identified at time of analysis, and a vendor patch is available.
Server-side request forgery in Sigma File Manager through 2.2.0 allows a malicious extension or poisoned catalog entry to point extension download commands at loopback, RFC1918, or cloud metadata endpoints, with the fetched response materializing as a file inside the extension directory rather than being streamed back to the attacker. The Tauri/Rust backend's validate_remote_url() in src-tauri/src/extensions/security.rs inspects the URL string but never checks the IP addresses the hostname resolves to, so a name resolving to 127.0.0.1 or 169.254.169.254 passes validation. Exploitation is conditional on the user installing or adding the attacker-supplied extension (CVSS 3.1 AV:N/AC:L/PR:N/UI:R, C:L only); no public exploit code identified at time of analysis and the issue is not in CISA KEV. Risk is highest when the app runs on a cloud instance exposing an instance-metadata endpoint.
Mass assignment in FlyCms through commit edfdf724 lets any authenticated low-privileged user POST extra User bean fields to /ucenter/account_update and persist protected account columns. An attacker can alter their own review status, rename the account, or set a victim's username, email, or mobile number to collide with an existing account and block that victim's login. The flaw is rated medium severity (CVSS 4.0 base 5.3, CWE-915); no public exploit code or confirmed active exploitation was identified at time of analysis.
Authentication bypass in the TP-Link Tapo C210 V3.60 DS JSON API allows attackers on the adjacent network to execute protected camera operations, including pan-tilt-zoom (PTZ) control, without a valid authenticated session. The flaw is rated moderate severity (CVSS 5.3; CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) because exploitation is confined to the same LAN/Wi-Fi segment and the impact is limited to camera functionality manipulation rather than full device takeover. No public exploit code was identified at time of analysis, and CISA KEV status does not indicate active exploitation; TP-Link has released patched firmware.
Username enumeration in WSO2 Identity Server allows unauthenticated remote attackers to distinguish valid accounts from invalid ones by observing inconsistent responses from the authentication endpoint when a supplied username does not exist. The issue affects deployments using the Email OTP Authenticator and WSO2 Carbon Abstract OTP Authenticator, and it is a low-to-moderate severity information-disclosure flaw (CVSS 5.3) rather than a direct path to credential theft, data access, or code execution. No public exploit code was identified at time of analysis, and the practical risk comes from chaining discovered usernames with brute-force, password-spraying, or social-engineering campaigns.
Static-file disclosure in Hono's serveStatic middleware (versions 4.12.4 through 4.13.10) lets remote attackers read files that routing-level access controls were meant to protect, by requesting a malformed percent-encoded path such as '/static/%%36%31dmin/secret.txt' that only normalizes to the protected path during serveStatic's second decode. Affected deployments are those that guard a sub-prefix of the static root with upstream middleware (for example app.use('/static/admin/*', auth) in front of serveStatic('/static/*')); attackers gain read-only access to files already inside the configured static root, with no traversal outside it and no write or availability impact, giving CVSS 3.1 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) with authentication requirements not applicable per the PR:N vector. No public exploit code or CISA KEV entry was identified at time of analysis; exploitation requires the specific non-default middleware-on-sub-prefix layout, so real-world risk is a moderate, conditional information-disclosure issue rather than a critical one.
FlyCms (through commit edfdf724) fails to enforce object-level authorization in the /ucenter/action/{modelCode}/{id}/counter and /ucenter/action/compose endpoints, letting any registered user tamper with numeric fields - price, stock, points - on content rows belonging to other accounts. The root cause is ActionService.counter(), which calls a checkRowOwner routine that never actually compares the requesting user to the row's owner. Exploitation requires only a self-registered account (authenticated, PR:L) and does not expose data or disrupt availability, so the practical damage depends on whether business-critical numeric fields are in use. No public exploit code or active exploitation was identified at time of analysis.
Authenticated non-owner team members in BoxyHQ Enterprise SaaS Starter Kit through 1.6.0 can perform billing actions reserved for team owners because the Stripe payment API routes skip the team_payments permission check. MEMBER and ADMIN accounts can create portal links and checkout sessions, list products, view invoices, change payment methods, and alter subscriptions on teams that use the built-in Stripe integration. No public exploit code or confirmed active exploitation was identified at time of analysis, and the flaw is limited to provisioned members of the targeted team.
Sensei LMS WordPress plugin versions before 4.26.4 contain a broken access control flaw in the legacy save_new_message handler, allowing any authenticated user, including an unprivileged Subscriber, to create a private message addressed to the author of an arbitrary course, lesson, or quiz post. The handler checks only a generic nonce and does not verify course enrollment or restrict post_id to valid post types, bypassing the enrollment checks in the newer REST send-message controller. Impact is limited to message/spam injection with low integrity impact; no public exploit identified at time of analysis and real-world risk is low-to-moderate.
Cross-site request forgery in Locust (through 2.46.7) lets a remote attacker stop running load tests and wipe recorded statistics in the web UI by luring an operator to a malicious page that issues GET requests to /stop and /stats/reset. No attacker authentication is required, but exploitation depends on operator interaction and on the Locust web UI being reachable from the victim's browser; impact is confined to integrity and availability of test runs and results, with no code execution or data disclosure (CVSS 4.0 score 5.3). No public exploit code was identified at time of analysis, and this is best treated as a low-to-moderate defense-in-depth flaw rather than an urgent threat.
Dolibarr up to and including 23.0.2 uses a weakened Content-Security-Policy on its document-serving endpoints: htdocs/document.php and htdocs/viewimage.php define MAIN_SECURITY_FORCECSP with form-action 'self' instead of the stricter form-action 'none'. This is a defense-in-depth protection-mechanism failure, not a directly exploitable injection flaw; meaningful abuse generally requires a separate content-injection primitive to place a malicious form into content served from those endpoints, which constrains real-world exploitability. The CVSS vector requires authenticated access (PR:L) and no user interaction, and the issue is assessed as moderate-to-low priority; no public exploit was identified at time of analysis, and upgrading to 24.0.0 resolves it.
Local file disclosure in docling-core through 2.102.0 allows remote attackers to make crafted DoclingDocument JSON or YAML embed readable local images as base64 when the document is exported with ImageRefMode.EMBEDDED or rendered to HTML. The bypass supplies plain filesystem paths in ImageRef URIs, evading the allow_image_file_uri gate that in the vulnerable code only guarded file:// URIs. Impact is limited to PIL-parseable images within settings.max_image_decoded_size, though path existence can also be inferred from error behavior; no public exploit was identified at time of analysis.
Credential leak in the GDevelop desktop app through 5.6.284 allows unauthenticated remote attackers to exfiltrate a victim's gd_resource cloud session cookie by embedding an attacker-controlled resource URL in a crafted project file, which downloadLocalFile() requests with the cookie attached regardless of destination host; this exposes private GDevelop cloud project resources. Exploitation requires the victim to open the malicious project while holding an active GDevelop cloud session, so impact is limited to confidentiality (CVSS 4.0 base 5.3, medium; independent assessment CVSS 3.1 5.3, UI:R). No public exploit code or CISA KEV entry was identified in the provided intelligence at time of analysis.
Authenticated Teacher-role users can modify course content they do not own in Sensei LMS before 4.26.4 by abusing the add_new_module_term AJAX handler, which validates only a generic nonce rather than per-course edit permissions. Attackers can reuse a nonce from their own course metabox to call wp_set_object_terms against arbitrary course IDs, enabling unauthorized assignment of module taxonomy terms on courses owned by other teachers or administrators. No public exploit code has been identified at time of analysis; impact is integrity-only and most meaningful on multi-author sites, while single-instructor deployments have negligible exposure.
Authenticated customers on Thelia e-commerce stores can bypass coupon usage limits by exploiting order-payment timing, allowing them to obtain discounts beyond a coupon's configured cap. The flaw affects Thelia before 3.1.5 and 3.2.x before 3.2.4, requires a valid customer account plus a usage-limited coupon and a pay-later or cancellation workflow, and carries a moderate CVSS 4.0 score of 5.3 with integrity-only impact; no public exploit identified at time of analysis.
Frappe CRM before 1.74.0 allows authenticated Sales Users to attach attacker-written notes and tasks to other users' call logs, leads, and deals by supplying arbitrary call_sid values to the add_note_to_call_log and add_task_to_call_log endpoints. The endpoints lack a frappe.has_permission('CRM Call Log', 'write', ...) ownership check, so impact is limited to integrity of annotations-no confidentiality or availability effect-and exploitation requires a valid Sales User session rather than anonymous access. Vendor patches are available in v1.74.0; no public exploit identified at time of analysis.
Frappe CRM before 1.81.2 allows authenticated Sales Users to read, mark read, or delete other users' CRM Notification records by querying the frappe.client endpoints with a to_user filter or by passing a victim's user argument to the mark_as_read API. The missing-authorization flaw (CWE-862) exists because the CRM Notification doctype defines no permission query conditions or has_permission hook and the API trusted a caller-supplied user value; System Manager and Administrator accounts are exempt, and impact is confined to notification records rather than core CRM data. Rated medium severity (CVSS 5.3), it requires an authenticated Sales User account and works against default configurations; no public exploit code or confirmed active exploitation was identified at time of analysis, and vendor-released patch 1.81.2 is available.
Server-side request forgery in KitchenOwl through 0.7.10 lets an authenticated household member abuse the recipe-import feature to make the backend fetch attacker-influenced URLs a second time without IP filtering, potentially reaching loopback, private-network, or cloud-metadata services and reading their responses. The attacker must host a publicly reachable page titled "KitchenOwl" whose path matches /recipe/<id> so that local-instance detection fires and the follow-up requests.get() runs outside the hardened client. Impact is limited to information disclosure from internal services reachable by the server (no write, no code execution), and exploitation requires a valid household account; no public exploit code was identified at time of analysis and the issue is not in CISA KEV.
Missing authorization in YITH WooCommerce Product Bundles through 2.29.0 lets unauthenticated remote attackers invoke access-controlled plugin functionality and perform a limited, low-integrity action on WordPress/WooCommerce sites running the plugin. The CVSS 3.1 score is 5.3 (AV:N/AC:L/PR:N/UI:N) with no confidentiality or availability impact; no public exploit was identified at time of analysis, and there is no CISA KEV entry.
Missing authorization in the FluentForm WordPress plugin through 6.2.15 allows unauthenticated remote attackers to perform an integrity-impacting state-changing action without proper access-control checks (CVSS 5.3, CWE-862). The vulnerability affects sites running FluentForm at or below 6.2.15 and is bounded to integrity-only impact, with no confidentiality or availability loss per the assessed vector. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was provided.
Missing authorization (CWE-862) in the VideoWhisper Broadcast Live Video WordPress plugin through version 7.3.7 allows unauthenticated, remote attackers to reach plugin functionality that should be access-controlled, exposing limited confidential data or restricted operations (CVSS 3.1 score 5.3, confidentiality-only). Default installations are exposed because the CVSS vector is PR:N/UI:N, but no public exploit code was identified at time of analysis and there is no CISA KEV confirmation of active exploitation. No vendor-released patch version is identified in the available data.
Error responses from the Apache Camel gRPC consumer component can leak internal exception details to remote callers: when a route behind a gRPC consumer fails, the exception's message is copied into the gRPC status description, which is transmitted back across the wire rather than kept server-side like the status cause. Unauthenticated remote callers who can provoke a route failure on an affected deployment (Camel 4.0.0 before 4.18.5, or 4.19.0 before 4.22.1) may read class and package names, filesystem paths, host names and connection detail embedded in those messages, at CVSS 5.3 with confidential-impact-only. The leak is conditional on the exception text itself carrying sensitive content and on the gRPC consumer being reachable, so real-world exposure varies by route; there is no public exploit identified at time of analysis and no confirmed active exploitation. Vendor patches are published (4.23.0, plus LTS 4.18.5 and 4.22.1), and the fixed builds default a new muteException option to true so patched deployments stop leaking unless they explicitly opt out.
Apache Camel's CXF component leaks internal deployment detail back to SOAP clients when a route behind a CXF SOAP consumer fails with an exception that the service contract does not declare - CXF copies the exception message into the SOAP faultstring and, when configured to do so, the stack trace into the fault detail. Deployments running Camel 4.0.0 through 4.18.4 or 4.19.0 through 4.22.0 with an exposed CXF SOAP consumer are affected; an external caller who can provoke an undeclared failure can read class and package names and whatever the exception message carries, at CVSS 3.1 base 5.3 (AV:N/AC:L/PR:N/UI:N/C:L/I:N/A:N, CWE-209). Declared @WebFault exceptions are intentionally unaffected because they are part of the published contract. No public exploit code has been identified at time of analysis, and the issue is a read-only disclosure rather than code execution or data modification.
Error messages written back over the socket by the Apache Camel camel-mina consumer leak internal deployment details to any remote peer that can provoke a processing failure. Affected deployments are Camel 4.0.0 through 4.18.4 and 4.19.0 through 4.22.0 that use camel-mina as a consumer (socket server) in sync mode, where the peer is unauthenticated per the CVSS vector (AV:N/AC:L/PR:N/UI:N) and the impact is limited to confidentiality (C:L) with no integrity or availability effect. The exposure ranges from exception class and message text under the textline codec to a fully serialised exception with its cause chain under the object codec; exploitability depends on the attacker reaching the socket and triggering a failure, and no public exploit code or confirmed active exploitation was identified at time of analysis - treat this as moderate-severity hardening rather than an urgent threat.
Apache Camel's camel-knative HTTP consumer writes the full exception - class name, message, and stack trace - back to the remote caller whenever an exchange fails on the consumer side, letting any external sender provoke a route failure and harvest internal deployment detail (package and class names, host names, file paths, route shape, and any configuration or connection strings embedded in exception messages). The flaw affects Camel from 4.0.0 before 4.18.5 and from 4.19.0 before 4.22.1; camel-knative was the last HTTP-family consumer not yet aligned with the muteException behaviour introduced for the other HTTP consumers under CAMEL-23651. Rated CVSS 5.3 (AV:N/AC:L/PR:N/UI:N, C:L only), it requires the Knative HTTP consumer to be reachable by untrusted callers and an induced processing failure; no public exploit code was identified at time of analysis and there is no indication of active exploitation.
Authenticated MISP users who can read or edit server settings can obtain module-declared secrets and change settings that module authors intended to be CLI-only in versions before 2.5.48. The flaw is caused by server-side rebuilding of module settings for API use dropping the redacted and cli_only flags, affecting the servers/getSetting and servers/serverSettingsEdit endpoints; instances without enabled modules declaring those flags are not exposed. No public exploit identified at time of analysis, and the vendor has provided a patch commit (6c02f0f5c) with fixed versions at 2.5.48 or later.
MISP deployments before 2.5.48 leave orphaned child records behind when an event is deleted, so threat-intelligence metadata such as event report tags, event graph entries, proposal (shadow attribute) correlations, fuzzy ssdeep correlation chunks and attachment/malware-sample scan results persist in the database after the parent event is gone. Triggering the incomplete cleanup requires an authenticated user with event-deletion privileges (PR:H), and actual information exposure is further gated on those orphaned rows being reachable through other application queries or administrative interfaces that do not validate parent-event existence; the vendor vector accordingly scores only a low integrity impact with no confidentiality or availability impact. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the flaw is fixed upstream in commit 5f78634af, shipping in MISP 2.5.48.