Stored cross-site scripting in Trudesk through 1.2.11 allows any authenticated user to upload script-bearing HTML or SVG files through the uploadlogo, uploadpagelogo, and uploadfavicon branding endpoints, which are then served unauthenticated from /assets/. Exploitation requires a valid low-privileged account (CVSS PR:L) and victim interaction when a page referencing the asset is loaded (UI:P); the impact is limited to integrity and cross-site scripting rather than remote code execution. No public exploit identified at time of analysis, and the CVSS 4.0 base score is 5.1 (medium).
Cross-site request forgery in WWBN AVideo before 24.0 allows an attacker to make a logged-in user's private playlists public, remove playlist videos, or forge video suggestions by luring the victim to an attacker-controlled page with an auto-submitting form. The flaw exists in legacy endpoints such as playlistStatus.php that are not covered by the application's .json.php-only autoCSRFGuard() token check. Exploitation requires an active authenticated AVideo session and user interaction, and no public exploit code was identified at time of analysis; impact is limited to the victim's playlist and suggestion state rather than server or account takeover.
An out-of-bounds read in device-mapper-multipath's multipathd daemon allows local users who can submit commands to the daemon's control interface to read past the end of a buffer by supplying a command whose format string ends in a trailing percent character, exposing unintended daemon memory (limited information disclosure) or crashing multipathd to cause a denial of service. Local attackers need no prior privileges on the host per the CVSS vector (PR:N), but exploitation requires a local account on a system where multipathd is running and reachable. Affected products include Red Hat Enterprise Linux 6, 7, 8, 9 and 10 plus Red Hat OpenShift Container Platform 4, which ships the component in its RHEL-based node stack. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; impact is bounded to confidentiality and availability (5.1, C:L/A:L), with no code execution or integrity impact.
Incorrect authorization in hMailServer's Sender Rewriting Scheme (SRS) handling (versions 6.2.1 through 6.3.6) allows an authenticated, low-privileged party holding a valid server-signed SRS address to relay mail through the server to arbitrary external recipients without satisfying the SMTP authentication that the relay rules normally impose. The flaw only matters when SRS forwarding is explicitly enabled (it is off by default), and the signed token remains usable for roughly 21 days, so exposure is bounded to deployments that use the feature and to attackers who can obtain a token - either as the recipient of a forwarded message or as an account holder who forwards mail to an outside mailbox. Fixed in release 6.3.7; no public exploit identified at time of analysis.
Authorization flaw in Apache Pulsar's Functions Worker trigger REST endpoint allows an authenticated user who holds function-management permission on a namespace to cause the Worker to publish caller-controlled messages to a configured input topic that the user is not authorized to produce to, including topics in other tenants. Exploitation requires the Worker's own broker-client identity to be authorized to produce to the target topic and, in Pulsar 2.3.0 and later, to list that topic's subscriptions, which in practice mainly holds when the Worker identity is a superuser; no function instance needs to be running and no function code is executed. This is a moderate-severity integrity issue rather than a critical priority, and no public exploit was identified at time of analysis; vendor fixes are available in 4.0.14 and 4.2.5.
Server-side request forgery in the Metasploit Framework FTP client libraries lets a rogue or compromised FTP server redirect an operator's data connection to an arbitrary host and port by supplying a crafted 227 PASV (or 229 EPSV) response. The flaw affects Metasploit Framework builds containing the pre-fix lib/metasploit/framework/ftp/client.rb, lib/msf/core/exploit/remote/ftp.rb, and lib/rex/proto/ftp/client.rb code, and is rated CVSS 4.7 (Medium) with UI:R because the operator must actively connect to the malicious server. No public exploit identified at time of analysis; exploitation yields blind outbound TCP connectivity only, consistent with C:L/I:N/A:N.
Server-side request forgery in Metasploit Framework before 6.5.7 allows an attacker-controlled HTTP server to redirect requests made through send_request_cgi! to arbitrary hosts reachable from the operator's network, including internal HTTP services. The CVSS 3.1 vector (4.7, AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N) reflects that no privileges are required but the operator must interact with the malicious endpoint, and scope is changed because internal services can be reached. No public exploit was identified at time of analysis, and the issue is fixed in 6.5.7 via a new HttpRedirectPolicy that defaults to same_host.
hMailServer 6.0.0 through 6.3.6 writes SMTP SASL authentication exchanges to its log in cleartext for several common mechanisms, so a local user who can read the log - or anyone handed a copy of it - can recover mailbox credentials. Exposure requires SMTP logging to be enabled, which is off by default, plus local read access to the log files; on Windows before 6.3.6 every local user could read the log folder, lowering that barrier considerably. Captured material includes AUTH PLAIN passwords sent before EHLO or with non-standard spacing, XOAUTH2/OAUTHBEARER bearer tokens and SCRAM-SHA-256 client proofs (from 6.2.0, with logged salt and iteration count permitting offline guessing) and GSSAPI authenticators (from 6.3.2); CVSS 3.1 scores this 4.7 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N), and no public exploit was identified at time of analysis. Fix is released in v6.3.7.
hMailServer 6.2.25 through 6.3.6 exposes server-wide REST traffic counters to domain-confined authenticated users because GET /api/v1/metrics/history bypasses the authorization gate used by report routes. A domain administrator, an auditor role scoped to selected domains, or an API key limited to named domains can read 30-day aggregate traffic history for the entire server, though no message content, account data, or configuration beyond those counters is disclosed. No public exploit code has been identified at time of analysis, and the issue is assessed as a low-to-moderate priority information-disclosure flaw, not an urgent threat.
Missing authorization checks in Splunk Web's search-time sourcetype renaming feature let authenticated users who lack the admin and power roles create, move, edit, or delete their own sourcetype renaming configurations inside apps they are not permitted to access. Splunk Enterprise deployments below 10.4.4, 10.2.8, 10.0.11, and 9.4.16 are affected, but only when Splunk Web is enabled, since the missing permission check lives in that code path. Impact is limited to the integrity of renaming configurations in otherwise inaccessible apps - no confidentiality or availability effect - giving this a low CVSS of 4.3 (PR:L, I:L); no public exploit code was identified at time of analysis, so this is a genuinely low-priority issue despite affecting a widely deployed product.
Improper authorization in the Splunk Enterprise REST API allows an authenticated user without the 'admin' or 'power' roles to relocate field extractions and field transformations into apps they are not permitted to read, because the move operation never validates destination-app access. The issue affects deployments running versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, and carries a CVSS score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), reflecting a limited integrity impact with no confidentiality or availability loss. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so this is a low-to-moderate priority hardening item rather than an urgent exposure, though the required credential is a low-privilege one that many environments grant broadly.
Information disclosure in Splunk Enterprise (below 10.4.4, 10.2.8, 10.0.11, and 9.4.16) and Splunk Secure Gateway (below 3.10.12, 3.9.26, and 3.8.73) allows an authenticated user who does not hold the admin or power roles to view dashboard and report listings beyond the requested filter scope. The flaw is a low-severity (CVSS 4.3) NoSQL-style filter injection in Secure Gateway that is limited to objects the user can already access, so it widens listing visibility rather than granting access to forbidden objects. No public exploit code or CISA KEV entry was identified at time of analysis, and exposure requires that Secure Gateway be in use.
Missing authorization in Splunk SOAR (on-premises) below 8.7.0 allows any authenticated user who lacks the Automation Broker edit permission to retrieve the Automation Broker Docker Compose configuration file, which discloses the SOAR instance URL, the container image location, and the Broker version. The endpoint returns the file without enforcing the permission check that is supposed to gate it, so a legitimate low-privileged account can obtain deployment metadata it should not see. Impact is confined to confidentiality (CVSS 4.3, PR:L, C:L) with no secrets, credentials, or write access exposed; there is no public exploit identified at time of analysis and the issue is not in CISA KEV. Instances on 8.7.0 or later are not affected.
Remote unauthenticated denial of service in Apache bRPC through 1.17.0 allows a network attacker to abort the server process by sending a crafted HPACK header block over HTTP/2 or gRPC. The h2 parser is enabled by default on bRPC server ports and processes headers before authentication, so any exposed h2/gRPC listener is at risk. No public exploit identified at time of analysis, and the impact is limited to availability (process crash).
Paid AI features in GitLab Enterprise Edition can be accessed without a valid subscription by authenticated users on affected deployments because billing eligibility is not consistently enforced server-side. The issue affects all versions from 17.8 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1, with Community Edition and instances that do not expose the subscription-gated AI features out of scope. No public exploit was identified at time of analysis, and exploitation requires a valid GitLab EE account on an affected version.
Authorization bypass in the H5P WordPress plugin (versions through 1.17.9) lets an authenticated user manipulate a user-controlled object key to defeat the plugin's access-control checks and modify H5P content they are not authorized to change. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) limits impact to integrity only, with no confidentiality or availability effect, and low-privilege authentication is a hard prerequisite, so this is a moderate, not high-priority, issue. No public exploit code or CISA KEV entry is associated with this CVE in the available data (no public exploit identified at time of analysis).
DigitalME eRoom WordPress plugin versions through 1.7.1 exposes a network-reachable action without proper authorization checks, allowing an authenticated low-privilege user such as a subscriber to make limited integrity changes. The CVSS 4.3 vector requires existing credentials and confines impact to integrity only, so this is a low-to-moderate priority issue rather than a critical one; no public exploit identified at time of analysis and no active exploitation has been reported.
Cross-site request forgery bypass in Electron before 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.6 lets untrusted content loaded by a desktop app make credentialed requests to other sites by corrupting how the framework attributes the initiator of links opened into new windows. Because Electron re-issued such top-level navigations as application-initiated loads rather than preserving the originating page's identity, the request could be judged same-site, causing SameSite=Strict cookies to be attached and Sec-Fetch-Site to omit the true initiator. Rated CVSS 4.2 (AV:N/AC:H/PR:N/UI:R, C:L/I:L/A:N), exploitation requires an app that both loads untrusted content and allows it to open popups (popups are disabled by default), a victim who opens the crafted link into a new window, and a target site that depends on SameSite cookies rather than anti-CSRF tokens; no public exploit code identified at time of analysis and the issue is not in CISA KEV.
Keycloak can bypass mandatory OTP enrollment during login when a realm orders the 'Update User Locale' required action before 'Configure OTP,' allowing an attacker who already holds a valid password to access the account without setting up the required one-time password credential. The issue affects Red Hat build of Keycloak and Red Hat Single Sign-On 7 and carries a low CVSS score of 4.2 because exploitation requires a non-default administrative ordering and prior knowledge of valid credentials. No public exploit code has been identified at time of analysis.
A race condition in Zephyr RTOS's Infineon PSOC 6 BLESS Bluetooth HCI driver lets a connected BLE peer within radio range obtain small amounts of adjacent RAM (up to one HCI/ACL payload) or cause duplicate-dropped HCI packets, because the driver stores its outgoing TX descriptor in a file-scope static that is populated before the serialising semaphore is taken. Only builds using hci_infineon_psoc6_bless.c with CONFIG_BT_HCI_ACL_FLOW_CONTROL=y (the default on this driver's boards) and an application that returns -EINPROGRESS from its L2CAP recv callback and later calls bt_l2cap_chan_recv_complete() are realistically exposed, since that pattern moves the ACL buffer unref onto a preemptible thread that calls bt_send() directly, outside the cooperative TX work queue. Impact is bounded - the driver only reads through the descriptor, so there is no write primitive, no memory corruption, and the leaked bytes are not attacker-chosen; the assessed vector is CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L (4.2). No public exploit identified at time of analysis; an upstream fix commit is published alongside a GitHub security advisory.
Cross-site request forgery in Splunk Enterprise allows an unauthenticated attacker to trick a user who holds the edit_federated_providers capability into disabling all configured federated search providers, temporarily preventing federated searches from retrieving remote data. The issue affects releases below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, and exploitation requires the victim to be authenticated, privileged, and induced to click a crafted link; no public exploit code was identified at time of analysis.
Null-pointer dereference in Qt's VectorImage QML type lets a crafted SVG crash Qt-based applications that parse and render it, causing a local denial of service. The flaw affects Qt builds that expose the VectorImage QML type; an unauthenticated local user must deliver the SVG and a victim must actively open or load it, and impact is limited to availability with no code execution or data exposure. No public exploit identified at time of analysis, and the issue is low-to-moderate priority because exploitation requires a specifically exposed SVG rendering path and user action.
PowerDNS Recursor can have its EDNS Client Subnet (ECS) hardening bypassed by a crafted EDNS OPT pseudo-record whose owner name is not the root label, weakening the intended ECS restrictions rather than directly enabling code execution or full cache poisoning. The issue affects 5.3.x releases before 5.3.12 and 5.4.x releases before 5.4.8, and exploitation is only meaningful where incoming ECS handling is enabled (for example use-incoming-edns-subnet), a non-default deployment mode. No public exploit code, KEV entry, or EPSS score was provided; our independent assessment is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N, and no public exploit was identified at time of analysis.
A single unauthenticated request can abort an Apache bRPC server (versions before 1.18.0) that has been explicitly configured to accept nshead frames through the ubrpc mcpack2 adaptor, because an integer underflow in UnparsedValue::as_string() turns a zero-length string field into a SIZE_MAX resize() call whose uncaught std::length_error terminates the process with SIGABRT. Per the independent assessment this rates CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, but the reachable surface is non-default: stock open-source bRPC registers the ubrpc/nshead_mcpack protocols as client-only, so only deployments following the NsheadService + UbrpcMcpack2Adaptor pattern are exposed. No public exploit code or confirmed active exploitation was identified at time of analysis, and impact is confined to availability - no code execution or data exposure is described.
TLS endpoint impersonation in Apache bRPC before 1.18.0 allows an on-path attacker who can redirect or intercept a client Channel connection to present a CA-trusted certificate for a different identity and impersonate the intended TLS server, affecting confidentiality and integrity. The flaw is only reachable when client-side TLS peer verification (VERIFY_PEER) is enabled, the connection crosses an untrusted network, and the client trusts a CA capable of issuing certificates for other names; HTTPS Channels that verify the URL host are not affected. No public exploit was identified at time of analysis, and the assessed CVSS 3.1 vector is AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N.
Remote denial of service affects Apache bRPC deployments before 1.18.0 when built on platforms where plain char is unsigned, notably ARM64. Unauthenticated attackers can send a crafted request URI containing a high-bit byte (0x80-0xFF) to an HTTP server, triggering out-of-bounds reads in URL parsing; the case-insensitive header-name lookup is also reachable through APIs that process untrusted header names, such as the HTTP/2 HPACK path, and the result can be a process crash. x86_64 builds with signed plain char are not affected, and no public exploit identified at time of analysis.
Memory exhaustion denial of service in Apache bRPC before 1.18.0 allows remote unauthenticated peers to push buffered message data past the configured max_body_size limit when the service uses non-progressive HTTP/1, non-progressive HTTP/2, memcache, or couchbase parsing paths. The assessed vector is network-reachable, low-complexity, unauthenticated denial of service (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), with impact limited to availability. No public exploit was identified at time of analysis, and progressive HTTP reading is not affected because it uses bounded buffering.