Cisco Snort 3's Teredo detection engine can be forced to restart by a crafted Teredo packet, interrupting packet inspection on Cisco Open Source Snort 3, Cisco Secure Firewall Threat Defense (FTD) Software, and Cisco UTD Snort IPS Engine Software deployments that actually inspect Teredo traffic. The issue is remotely reachable without authentication or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L), but impact is availability-only: a temporary engine restart and inspection gap rather than persistent compromise or code execution. No public exploit was identified at time of analysis, and exploitation depends on the target's Snort engine receiving and parsing Teredo packets.
Crafted GRE packets can cause Cisco Snort 3's Detection Engine to restart, temporarily interrupting packet inspection in Cisco Secure Firewall Threat Defense, the Cisco UTD Snort IPS engine, and open-source Snort 3 deployments that inspect GRE traffic. The issue is incomplete error checking during GRE parsing and is reachable by unauthenticated remote attackers with no user interaction (CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L). No public exploit was identified at time of analysis, and the practical constraint is that the malicious GRE packet must traverse a Snort-inspected path.
Denial of service in Cisco Snort 3 allows an unauthenticated, remote attacker to restart the detection engine by sending a single crafted UDP NetFlow packet, interrupting packet inspection. The issue affects Cisco Open Source Snort 3, Cisco Secure Firewall Threat Defense (FTD) Software, and Cisco UTD Snort IPS Engine Software when NetFlow detection is active and the crafted packet reaches the parser; Cisco rates it CVSS 5.8 (AV:N/AC:L/PR:N/UI:N/S:C/A:L). This is a moderate-priority availability issue, with no public exploit identified at time of analysis, and exploitation depends on NetFlow traffic being in the sensor's inspection path.
Denial of service in Cisco Snort 3 allows unauthenticated remote attackers to restart the Snort 3 Detection Engine by sending crafted SMTP packets with malformed MIME header fields over an established connection. The defect is missing error checking during SMTP MIME header parsing (CWE-805), and successful exploitation only affects availability, forcing a restart that can briefly interrupt inspection. Affected deployments include Cisco Open Source Snort3, Secure Firewall Threat Defense (FTD) software, and UTD Snort IPS Engine software that actively inspect SMTP traffic; no public exploit has been identified at time of analysis.
Stored cross-site scripting in Splunk SOAR (On-premises) versions below 8.7.0 lets a user holding a role with the install_apps capability embed attacker-controlled HTML/script in an installed app's documentation, which is later rendered unsanitized in the browser of any user who opens that documentation page. Exploitation is not at-will: the vendor requires a second, privileged-but-distinct victim to be phished into viewing the malicious documentation, and the attacker must already possess the trusted install_apps permission, so the CVSS 3.1 score is a moderate 5.7 (AV:N/AC:H/PR:H/UI:R, C:H/I:H/A:N). Successful exploitation lets the attacker act with the victim's privileges - reading data and performing actions the documentation viewer is authorized for; the fix is vendor-released in Splunk SOAR 8.7.0, and no public exploit code was identified at time of analysis.
Local privilege escalation in the Secure Firewall Posture module of Cisco Secure Client lets an authenticated local user send crafted IPC messages to a local socket and perform limited privileged file writes as SYSTEM or root; on macOS and Linux this can be extended to full root. The flaw affects Secure Client installations with the Posture module on Windows, macOS, and Linux, with the highest practical risk on macOS/Linux. No public exploit code or active exploitation was identified at time of analysis, and exploitation requires prior local account access plus the Posture module running.
Missing authentication in the Plan Management Form of dhikshitha29 Insurance-Management-System lets unauthenticated remote attackers alter insurance plan records by posting to /Admin/includes/AddNewPlan-inc.php. The flaw affects a rolling-release, self-hosted PHP project for which no version-specific fix is available; publicly available exploit code exists, and a project issue report remains unanswered. Impact is limited to integrity of plan data (assessed CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), with no confidentiality or availability effect and no confirmed active exploitation.
Apache bRPC 1.17.0 and earlier can be aborted by a remote attacker sending a crafted HTTP/2 HEADERS block: the HPACK dynamic table is sized assuming a larger minimum entry size, so 121 minimal 33-byte entries (3993 bytes, under the 4096-byte default) fit without triggering byte-based eviction, overflow the ring buffer's fixed slot count, and hit CHECK(!_header_queue.full()), terminating the process. The h2 parser is compiled in and enabled on every bRPC server port and decodes HPACK headers before any Authenticator check, so exploitation is pre-authentication and requires only that the port accept h2/gRPC traffic; affected deployments are bRPC at or below 1.17.0 on any platform. Impact is limited to availability (process crash, no code execution or data exposure); no public exploit code or confirmed active exploitation was identified at time of analysis. This is one of 35 defects fixed in the bRPC 1.18.0 release, which also addresses related HTTP/2 resource-consumption issues tracked as CVE-2026-78058 and CVE-2026-78066.
Electron's HID and USB permission checks mishandle the requesting frame's origin, so an app whose setPermissionCheckHandler authorizes devices by origin can be tricked into granting WebHID/WebUSB access to a cross-origin untrusted iframe that was never meant to receive it. Only applications that both delegate the 'hid' or 'usb' permission to an untrusted cross-origin frame via permissions policy and make device decisions on the reported origin are exposed, and a matching device must also be attached; default configurations are not affected. Unauthenticated remote attackers can trigger the logic remotely (CVSS 3.1 AV:N/PR:N), but with high attack complexity and low confidentiality/integrity impact scored at 5.4 with a scope change. No public exploit code and no confirmed active exploitation were identified at time of analysis; fixed in 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.5.
Electron mis-attributes pointerLock permission requests originating from cross-origin iframes, causing session.setPermissionRequestHandler() to receive the top-level frame's requestingUrl and isMainFrame values instead of the actual requesting frame's. Applications that embed untrusted iframe content and grant pointer lock based on the requesting origin can therefore be tricked into granting the permission under the top-level page's identity, allowing an embedded attacker-controlled frame to capture the pointer (integrity and availability impact only, no confidentiality impact). Exploitation requires a user gesture and an affected Electron version prior to 42.11.9, 43.7.6, 44.5.0, or 45.0.0-alpha.13; apps that already deny pointerLock for untrusted content are not affected. No public exploit code was identified at time of analysis and the issue is not in CISA KEV, so real-world risk is limited to the narrow population of apps whose permission handlers trust origin strings for pointer lock.
Origin confusion in Electron's external protocol handling lets a launch request be attributed to a document other than the one that actually initiated it, so the requestingUrl handed to session.setPermissionRequestHandler can name trusted content for a launch requested by untrusted content. Applications running Electron prior to 42.11.3, 43.7.0, 44.3.0, or 45.0.0-alpha.5 are exposed only if they both grant openExternal based on that requesting origin and permit untrusted content to open or navigate windows, in which case attacker-supplied content may reach an OS-registered external application such as a mail client or custom URL handler. Exploitation additionally depends on a timing condition where the initiating document is gone when the request reaches the browser (a popup whose opener navigated away, or a server redirect to the external URL), which is why the assessed vector carries AC:H; no public exploit code has been identified at time of analysis, and the issue is not confirmed actively exploited (CISA KEV).
Stored cross-site scripting (CWE-79) affects Nuxt 3.13.0 through 4.6.1 when server islands are combined with useHeadSafe: the island renderer serializes raw head input without preserving the safe-input marker, so NuxtIsland re-inserts it as an ordinary head entry and the allowlist no longer strips event-handler attributes or executable script. A victim must load the poisoned island page for the payload to fire. This is a genuine but conditional, medium-severity issue: the vulnerable pattern requires application code that passes attacker-controlled data into useHeadSafe inside a .server.vue component or a NuxtIsland-rendered component, which is non-default developer code. No public exploit identified at time of analysis, and no KEV listing is present.
Splunk Enterprise deployments below 10.4.4 expose Data Management SPL2 preview jobs and results to authenticated users who hold the preview_data_management_pipeline or edit_data_management_pipeline_job capability, because the Data Management REST API checks the capability but never verifies that the referenced preview job belongs to the requester. This lets such a user read or delete other users' preview jobs and their output by referencing an out-of-scope job ID. The exposure is limited: the vulnerable REST API only exists when the non-default Edge Processor feature is explicitly turned on, and the attacker must already have a valid account with one of the two specific capabilities. No public exploit code has been identified at time of analysis and there is no CISA KEV listing.
The deprecated functions connectors endpoints (/admin/v2/functions/connectors and /admin/v3/functions/connectors) in Apache Pulsar fail to enforce the super-user authorization check that the equivalent worker connectors endpoint (/admin/v2/worker/connectors) applies, so any authenticated client can read the catalog of installed Pulsar IO connector types regardless of its role. Pulsar 2.4.1 through 4.0.13 and 4.1.0 through 4.2.4 are affected when authentication and authorization are enabled; unauthenticated requests are rejected unless the operator has explicitly configured anonymous access with an anonymous user role. Impact is confined to metadata disclosure - connector names, descriptions, and source/sink/configuration class names, not configured instances or credentials - and no public exploit code has been identified at time of analysis.
An authenticated Apache Pulsar client that holds no permission whatsoever on a target topic can read that topic's registered schema and register new schema versions on topics in other namespaces or tenants, because the broker's GetSchema and GetOrCreateSchema binary-protocol commands checked only that the connection was authenticated and skipped the topic-level authorization check applied to other topic commands. Deployments are exposed only when both authentication and authorization are enabled, and practical exploitation requires a client that speaks the binary protocol directly, since the standard Pulsar client performs an authorized topic lookup first that masks the missing check (GetSchema affected from 2.2.0, GetOrCreateSchema from 2.5.0, up to the fixed 4.0.14 and 4.2.5 releases). Impact is bounded: only schema metadata such as record field names and types is disclosed (never message payloads), and unauthorized schema registration is constrained by the topic's schema compatibility and auto-update policies, though a bad schema version can break legitimate producers and consumers until an administrator corrects it. No public exploit code was identified at time of analysis, and this is a moderate, administratively correctable authorization gap rather than a drop-everything priority.
Slack Morphism 1.0.0 through 2.27.0 writes the correct Slack request HMAC into its error output when signature verification fails, so anyone who can both hit the app's Slack callback endpoint and read its application or service logs can use the verifier as a chosen-message HMAC oracle and replay a fully signed request within Slack's five-minute freshness window - without ever knowing the signing secret. The exposure only occurs in deployments using the default Axum or Hyper listener error handler, which logs `SlackEventWrongSignatureError` (including the public `generated_hash` field) at error level; applications with a custom handler that suppresses the hash are not affected. The vendor released 2.28.0 to remove the expected signature from the error type, and no public exploit code has been identified at time of analysis; real-world risk is bounded by the mandatory log-read access, the tight replay window, and the fact that a forged request is confined to the exact body and timestamp the oracle signed.
Message spoofing and user impersonation in Trudesk through 1.2.11 allow authenticated users to inject messages as other accounts into conversations they do not belong to by supplying arbitrary owner and cId values to POST /api/v1/messages/send. The vulnerability is an incomplete fix for CVE-2022-1931, rated CVSS 5.3 with integrity-only impact and requiring a valid low-privilege session (PR:L); it is a moderate-severity integrity issue rather than a top-tier priority, and no public exploit identified at time of analysis.
Path traversal in Trudesk through 1.2.11 allows any authenticated user to overwrite other accounts' avatar images by tampering with the _id and username fields of the profile image upload form. The flaw is an incomplete fix for CVE-2022-1752: a username such as /../../../x escapes the intended public/uploads/users directory, though writes are constrained to png, jpg, jpeg, and gif files and no confidentiality or availability impact is assessed (CVSS 5.3, PR:L, UI:N). No public exploit code or confirmed active exploitation was identified at time of analysis, and the issue is a moderate, authentication-gated integrity problem rather than a top-tier priority.
Missing authorization in the SchedulePress (WP Scheduled Posts) WordPress plugin before 5.3.5 allows authenticated Contributor-level users to alter the status and publish date of posts they do not own, including unpublishing or rescheduling administrator content and pushing other users' pending or draft posts live. The root cause is that the wpsp_el_editor_form AJAX handler and the related PostPanel REST routes validated only the edit_post capability - which a Contributor already holds for their own drafts - instead of publish_post, and the wpsp-el-editor nonce is not bound to a specific post, so it can be reused against any post ID. Exploitation requires a provisioned low-privilege account and access to the Elementor editor modal from which the nonce is harvested; no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, with impact bounded to integrity/availability of post scheduling and no data disclosure. The vendor has released 5.3.5 to address the flaw.
Trudesk through 1.2.11 lets any authenticated low-privilege user forge the authorship of ticket activity by supplying an arbitrary ownerId or owner value in postComment, postInternalNote, and ticket-create requests, so comments and internal notes can appear to come from an administrator and tickets can be attributed to another user. The flaw is an integrity-only authorization bypass (CWE-639) with a moderate CVSS score of 5.3; default configurations are affected because ownership is taken from client input rather than the session. No public exploit code or CISA KEV entry was identified at time of analysis, and confidentiality and availability are not impacted.
Trigger.dev before 4.5.2 allows authenticated project members to set unvalidated alert-channel webhook URLs, enabling blind server-side request forgery against loopback, internal, or cloud metadata endpoints. An attacker with a project account can create such an alert channel and trigger alerts to probe internal service reachability and cause signed POST requests to be sent to attacker-chosen destinations, although response bodies are not returned to the attacker. This is a medium-severity issue (CVSS 4.0 base 5.3; assessed CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) with a limited risk profile; no public exploit identified at time of analysis.
Missing authorization in Chamilo LMS's AiController::openAnswerGrade endpoint allows any authenticated user, including an ordinary student, to obtain AI grading feedback for other students' exam attempts by enumerating exeId and questionId values. This exposes other students' open-answer content and consumes the instance's AI quota; the flaw affects versions from 2.0.0-alpha.4 before 2.0.0-RC.3 and is fixed in RC.3. No public exploit identified at time of analysis, and the endpoint requires the AI grading feature to be enabled.
EKKOLearnAI ekko-studio through 1.0.6 lets an authenticated low-privilege user supply an attacker-controlled output_path to the Media Generation API, which the saveGeneratedImages handler in packages/server/src/modules/studio/controllers/media.ts passes into a file operation without adequate path validation. Successful abuse gives limited file integrity and availability impact (CVSS:3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) with no confidentiality disclosure per the authoritative assessment, and requires a valid account plus network reachability to the media-generation endpoint - anonymous attackers cannot trigger it. No public exploit code was identified at time of analysis, exploitation has not been confirmed in the wild, and an upstream fix exists as commit 1d42459c292f89e412f7f6243829e7fed2e85bf5 (PR #3404) that removes the ordinary-user ability to request custom image/video output paths.
Cross-site scripting in PHPOffice PHPPresentation 1.2.0's HTML writer lets attacker-influenced PPTX content execute script when the generated HTML is viewed in a browser. The writer emits text runs, hyperlink relationship targets, and shape descr attributes without HTML or attribute escaping, so applications that convert untrusted presentations to HTML and serve that output are exposed. This is a medium-severity library issue with no public exploit identified at time of analysis; exploitation requires the application to use the affected writer and a victim to view the crafted HTML, making real-world risk bounded and context-dependent.
Concurrent task operations in the a2a-rs Rust A2A server (through 0.4.4) can drive the in-memory task store into an inconsistent state, because InMemoryTaskStore::update performs a check-then-act sequence on a task's state without holding a lock across the decision and the write. An authenticated client able to submit task operations, and able to issue concurrent cancel or update requests for the same task ID, can win the timing window and overwrite a terminal task state or cause both of two competing cancels to be processed; impact is limited to task-state integrity and low availability effects, with no confidentiality loss. Exploitation requires the in-memory backend to be configured and is probabilistic, and no public exploit code was identified at time of analysis; CISA KEV does not list this issue.
Trigger.dev before 4.5.12 allows holders of a read-only, capability-restricted user-actor token to create production alert channels through the legacy personal access token helper, redirecting deployment and error alerts to attacker-controlled webhooks. The flaw requires an already-issued low-privileged UAT and affects only deployments on versions prior to 4.5.12; impact is limited to low confidentiality and integrity with no availability effect. No public exploit identified at time of analysis, and the vendor has released a fixed version.
Server-side request forgery in Trigger.dev before 4.5.10 allows authenticated project members with webhook configuration rights to bypass the platform's SSRF protections and direct alert-channel webhooks at internal services hosted in the 198.18.0.0/15 benchmarking range. Exploitation is bounded: responses are not returned to the attacker, so impact is limited to blind internal probing and limited state-changing POST requests (CVSS 4.0 5.3, PR:L, VC:L/VI:L). No public exploit code or confirmed active exploitation was identified at time of analysis, and the issue only matters for deployments that route reachable internal services in that CIDR.
Server-side request forgery in HarnessRouter's 'Targets Test Endpoint' (gateway/app.py) lets an authenticated caller holding a valid API key submit an arbitrary 'base_url' that the server fetches and whose response is returned to the caller, so affected deployments up to 0.31.12 can be induced to reach internal, loopback or cloud-metadata addresses (e.g., 169.254.169.254). The practical exposure is concentrated on shared/cloud deployments, since the vendor's fix deliberately keeps allowing internal http(s) destinations when the instance is self-hosted on the operator's own network. There is no public exploit identified at time of analysis and no CISA KEV listing; the vendor has released v0.31.13 (commit 1c4b1fc1f89737dabd089ac1d1c174a57f764e28) as the fix.
NLnet Labs Unbound through 1.26.1 can be driven to excessive CPU consumption by DNS responses containing many chained compression pointers, degrading resolver performance for legitimate clients. The root cause is that Unbound caps pointer traversal per domain-name operation but lacks an aggregate budget for inbound decompression work, allowing repeated expensive lookups within a single crafted message. The vendor rates this 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L); exploitation requires recursive-query access plus control of an ordinarily delegated authoritative server, and no public exploit identified at time of analysis.
Blind server-side request forgery in Trigger.dev (all versions up to and including 4.5.1, fixed in 4.5.2) lets an authenticated tenant with permission to create or edit a WEBHOOK alert channel supply an arbitrary URL that the multi-tenant webapp server later POSTs to when an alert fires. Because the URL is persisted with no host allowlist or private-IP/metadata blocklist and the server-side fetch follows redirects, a tenant can coerce the server into probing internal hosts and ports through a delivery success/timing oracle, issue state-changing POSTs to internal services, or reach IMDSv1 via a redirect to 169.254.169.254. Exploitation requires a valid account or project PAT and the ability to fire an alert such as a deployment or run failure; the attack is blind and POST-only (the body is a fixed HMAC-signed alert payload), so it does not yield arbitrary GET-based data exfiltration, and impact is markedly higher on cloud hosts with reachable IMDSv1 and no egress filtering. No public exploit tooling was identified at time of analysis, though the upstream advisory documents a reproduction proven against a self-hosted instance.
Authorization bypass in Trudesk through 1.2.11 allows any authenticated user with the default tickets:update role grant to modify or mass-close tickets outside their assigned groups via PUT /api/v1/tickets/:id and PUT /api/v2/tickets/batch. The vendor CVSS 4.0 score is 5.3, and the independent assessment rates it CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, reflecting integrity-only impact on ticket status, subject, group, priority, and assignee fields. No public exploit code was identified at time of analysis and there is no CISA KEV confirmation.
Remote unauthenticated denial of service in Apache bRPC through 1.17.0 allows any peer that can reach an HTTP/2 or gRPC (h2) listener to abort the server process with a single crafted HEADERS frame. The HPACK dynamic table's ring buffer is sized by byte capacity rather than slot count, so a peer can insert 121 minimal 33-byte entries (3,993 bytes, still under the default 4,096-byte budget) without triggering eviction and then hit a CHECK(!_header_queue.full()) assertion that terminates the process. The h2 parser is enabled by default on every bRPC server port and decodes headers before any Authenticator check, so no credentials, user interaction, or non-default configuration are required; no public exploit code was identified at time of analysis, but a vendor fix exists and the flaw was addressed together with a large batch of other HTTP/2 parsing issues in bRPC 1.18.0.
Cross-environment authorization bypass in Trigger.dev before 4.5.6 lets holders of lower-trust environment secret keys (dev, preview, or CI) cancel in-progress production deployments inside the same project. The cancel path resolves deployments through DeploymentService.getDeployment, which filters on projectId only and never on environmentId, so a key that is refused with a 404 when reading a production deployment through the correctly environment-scoped GET route can still abort it while it sits in PENDING, INSTALLING, BUILDING, or DEPLOYING state. Impact is moderate (CVSS 5.3, authenticated with PR:L): the flaw cannot cross project boundaries, cannot read or exfiltrate deployment data, and only cancels rather than modifies or creates deployments; no public exploit code was identified at time of analysis, and the issue is fixed in 4.5.6.
Missing authorization in WarehousePG 7.2.1 through 7.6.0 allows any authenticated, low-privileged database role to call gp_log_backend_memory_contexts() without a GRANT and bypass the superuser-only restriction on PostgreSQL's underlying pg_log_backend_memory_contexts(). An attacker with a valid login can force segment backends for other sessions, including superuser sessions, to write memory-context details such as cached query text into segment server logs they cannot read, and can repeat the call to amplify log volume. No public exploit code or confirmed active exploitation is identified in the provided intelligence, and the assessed impact is limited to low availability loss with no confidentiality or integrity impact within the vulnerable component.
Read-only authenticated ArcadeDB accounts can persistently rewrite edge-type storage declarations because the ALTER TYPE schema-flag path skips the UPDATE_SCHEMA permission check, letting a low-privileged user flip 'lightweight' and 'unique' flags on edge types across releases 26.8.1 up to (but not including) 26.10.1. The command can be delivered as a bare ALTER TYPE edgeType WITH lightweight = true statement over the HTTP, gRPC, or Bolt command API and survives as a lasting schema change, so integrity of the graph model is affected while no data disclosure, deletion, or outage is described. The issue requires an authenticated account with at least read-only privileges (CVSS PR:L), is not remotely unauthenticated, and no public exploit code or CISA KEV entry is associated with it at time of analysis; a fixed release, 26.10.1, has been published by the vendor.
ArcadeDB versions 26.2.1 through 26.10.0 expose a missing authorization check in the Bolt protocol handler that lets any user holding credentials for one database read schema metadata - labels and index definitions - belonging to other databases on the same server. Because the handler trusts the attacker-supplied db field in RUN or BEGIN messages rather than validating the caller's authorization for that database, a low-privileged authenticated user can pivot across tenants with a single message field and calls to db.labels() or SHOW INDEXES. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; impact is confined to read-only information disclosure (no data content, no writes, no availability effect), so real risk concentrates in multi-database or multi-tenant deployments that depend on database-level isolation.
Authenticated users with credentials for any single ArcadeDB database can issue a SHOW DATABASES query over the Bolt protocol to enumerate every database name on the instance, exposing tenant or project identifiers beyond their authorized database. The issue affects ArcadeDB versions from 26.2.1 before 26.10.1 and is rooted in a missing authorization check (CWE-862) in the Bolt handler; impact is limited to database-name disclosure rather than database contents. The assessed CVSS 3.1 score is 5.3, reflecting network reachability but a requirement for valid credentials and only low confidentiality impact; no public exploit identified at time of analysis.
Cross-site request forgery in the REST API of Progressive Robot hMailServer 6.0.0 through 6.3.6 lets an attacker-controlled web page drive a victim administrator's browser to issue state-changing API calls - creating domains, accounts or API keys, or altering settings - without the attacker ever reading a response. The flaw exists because the server's cross-site defenses (a custom header check plus a SameSite=Strict cookie) were applied only to cookie-based sessions, while the REST API's HTTP Basic authentication is silently cached by the browser after the sign-in box is answered and re-sent on cross-site top-level form posts, whose bodies the server parses regardless of declared content type. Exploitation is conditional: it requires a live cached Basic credential and the administrator visiting the hostile page (UI:R, AC:H), impact is integrity-only and blind (C:N/I:H), and no public exploit code was identified at time of analysis. Fixed in hMailServer 6.3.7.
Cross-site request forgery in Trigger.dev before 4.5.6 lets remote attackers terminate an authenticated user's session by luring them to the GET-based /logout endpoint, causing loss of unsaved work. The victim must be logged in and must load an attacker-controlled, URL-encoded link; no data is read or modified. Vendor-released patch 4.5.6 is available, and no public exploit identified at time of analysis.
NLnet Labs Unbound through 1.26.1 can expose a cache-level side-channel when operators explicitly configure unwanted-reply-threshold greater than 0, a non-default setting. An external observer who can send response-like UDP datagrams to the resolver’s current upstream source port can use the resulting RRset/message-cache clear as an oracle to test whether a candidate port is in use; by keeping a concurrent query window open and then performing birthday-style TXID guessing, this can become a feasible cache-poisoning path. The issue is assessed as low-to-moderate risk, with no public exploit identified at time of analysis.
Cross-site request forgery in Trigger.dev webapp before 4.5.12 lets an attacker who knows a target organization ID trick an already-authenticated member into opening an unredeemed /integrations/slack/callback URL, causing the organization's Slack alert integration to connect to an attacker-controlled workspace. The flaw is a CWE-352 session-binding failure in the organization-level Slack OAuth state handling; exploitation requires user interaction and an already-authenticated member, and impact is limited to hijacking operational alert delivery rather than full account compromise. There is no CISA KEV entry, no public exploit identified at time of analysis, and the vendor has released 4.5.12.
Authorization bypass in Zephyr RTOS's experimental devmux pseudo-driver allows an unprivileged local user-mode thread to read or change which downstream device a multiplexer forwards to, letting it suppress, redirect, or flip console, log, and shell output. Only builds with CONFIG_USERSPACE=y, CONFIG_DEVMUX=y (and its CONFIG_DEVICE_MUTABLE dependency), and a zephyr,devmux devicetree node are affected, and the CVSS 3.1 score is 5.3 with vector AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. No public exploit identified at time of analysis, and the impact is bounded to the devicetree-fixed downstream device set with no memory-corruption path.
Unauthenticated remote attackers can bypass access controls on Cisco Unified Communications Manager (Unified CM) and Unified CM Session Management Edition (Unified CM SME) by sending a crafted HTTP request to the device's web interface. The flaw is rated CVSS 5.3 (AV:N/AC:L/PR:N/UI:N, integrity-only impact) - no credentials or user interaction are needed, but the consequence is limited to reaching parts of the network outside the attacker's intended scope rather than data disclosure or denial of service. No public exploit code and no confirmed active exploitation were identified at time of analysis, so exposure is primarily determined by whether the HTTP service is reachable from untrusted network segments.
An infinite-loop flaw in the Snort 3 Detection Engine's GTP codec lets remote, unauthenticated attackers restart the detection engine and disrupt inspection by sending a single crafted, fragmented UDP datagram carrying GTP extension headers (CVSS 5.3, availability-only, CWE-835). Cisco Open Source Snort 3, Cisco Secure Firewall Threat Defense (FTD) software, and Cisco UTD Snort IPS Engine software are all affected, but only deployments that actually inspect GTP traffic - typically mobile-core, telecom, or specifically configured sensor placements - are realistically reachable. No public exploit code or confirmed active exploitation was identified at time of analysis, and the outcome is a temporary detection-engine restart rather than host compromise; the practical risk is a window of lost or degraded inspection coverage.
Information disclosure in Cisco Expressway Series (Expressway-C and Expressway-E) lets an unauthenticated, remote attacker read sensitive data from devices that use Mobile and Remote Access (MRA) provisioning, with a CVSS score of 5.3 and confidentiality-only impact. The root cause is insufficient authorization checks on HTTP requests handled during MRA provisioning, so a crafted URL can return information the requester is not authorized to see; no integrity or availability impact is assessed. No public exploit code or CISA KEV entry was identified at time of analysis, and realistic exposure is concentrated on internet-facing Expressway-E deployments that offer MRA.
Missing authorization in the Magepeople WpTravelly tour-booking-manager plugin for WordPress (versions through 2.3.5) lets remote unauthenticated attackers reach functionality that should require a capability or role check, exposing data that would otherwise be restricted to privileged users. Per the authoritative assessment, exploitation only requires the plugin to be installed and active on a default configuration - no credentials and no user interaction - but the achievable impact is limited to confidentiality (read-only disclosure), with no write, modification, or denial-of-service capability, which keeps this a moderate rather than high priority issue. There is no KEV listing and no public exploit code identified at time of analysis, though Patchstack classifies the flaw under its 'Authentication Bypass' / broken access control category.
Out-of-bounds read in NTPsec ntpd before 1.2.6 can crash the daemon or disclose limited memory when an attacker controls the serial data from a Motorola Oncore GPS receiver and sends a PPS Control (@@Gc) reply with an out-of-range mode byte. Only deployments built and configured with the Motorola Oncore refclock driver and attached to an Oncore-family receiver are exposed, making this a stratum-1 time-server scenario rather than a default configuration. Exploitation requires control of the receiver’s serial path (AV:P), though no authentication is needed once that access is achieved (PR:N); no public exploit code or confirmed active exploitation was identified in the available data.
Double-completion of an RTIO submission in the Zephyr RTOS Broadcom AFBR-S50 time-of-flight sensor driver corrupts the RTIO submission pool, causing aliased submissions, writes through already-released RX buffers, and duplicate completions delivered to the application. Only firmware builds that compile in the driver for devicetree compatible brcm,afbr-s50 are affected; the error branch can be triggered by anyone within optical range of the sensor through harsh ambient light, sharp distance transitions, or SPI transfer errors, with no board contact and no authentication required (CVSS 3.1 5.2, AV:P/AC:L/PR:N, C:N/I:L/A:H). No public exploit code was identified at time of analysis, and because the attacker cannot control the corrupted content the realistic outcome is memory corruption and denial of service rather than directed code execution.
Local privilege escalation in Checkmk 2.5.0p14 allows a low-privileged local user to execute code as root on monitored hosts where the Checkmk agent runs the 'mk-oracle' plugin, by writing a malicious library into an Oracle client library directory of an Oracle home listed in 'oratab', or by modifying 'oratab' itself. Exploitation requires three simultaneous preconditions - local access to the host, the non-default mk-oracle plugin explicitly enabled, and write permission to those Oracle paths - so opportunistic or remote exploitation is infeasible, and no public exploit code was identified at time of analysis (not listed in CISA KEV). Impact is rated on a scope-changed model because the root-run agent process can affect components beyond the plugin itself.
Authenticated super-admins in Snipe-IT before 8.7.0 can abuse the 'Test Webhooks' feature as a blind server-side request forgery primitive to probe internal network addresses, including loopback and RFC1918 ranges. By pointing a webhook at an arbitrary internal host and port and then comparing the 4xx versus 5xx responses returned by the test function, an attacker can map live hosts and open ports across the internal network. Rated 5.1 (medium) with PR:H, this is a defense-in-depth and reconnaissance issue rather than an urgent priority: exploitation is gated behind the highest privilege tier, the impact is confined to information disclosure through port/host enumeration, and there is no public exploit identified at time of analysis. The SSRF primitive is removed in Snipe-IT 8.7.0.