Unauthenticated attackers who already know a victim's WooCommerce cart session identifier can tamper with that victim's abandoned-cart record in Cart Abandonment Recovery for WooCommerce before 2.2.0, for example by unsubscribing them from recovery emails or applying an arbitrary coupon to their restored cart. The plugin fails to verify cart-recovery token integrity and still accepts an unsigned legacy token format (CWE-287), but the per-victim session-identifier prerequisite makes the attack non-blind and drives high attack complexity, confining impact to low-severity integrity changes with no confidentiality or availability effect. Publicly available exploit code exists, there is no CISA KEV listing, and this is a genuinely low-priority authentication/integrity bypass.
Information disclosure in GitLab CE/EE allows an authenticated user with no membership in a private project to read the title of a confidential issue when a merge request in a public project references that issue and a viewer-independent fragment cache serves per-user-redacted rendered content. Affected releases are GitLab CE/EE 15.0 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1; the issue is low severity (CVSS 3.5) because only the title is exposed and the cross-project reference and cache conditions must align. Publicly available exploit code exists, and vendor patches are available in 19.3.6, 19.4.3, and 19.5.1.
Node.js's experimental Permission Model can be bypassed in fs.realpathSync, letting JavaScript already running inside a permission-restricted process resolve filesystem paths that fall outside the granted scope and infer information about them. The flaw is local and low severity (assessed CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N): it only matters when the process was started with the --permission flag (or --experimental-permission in older releases) and the attacker can execute code inside that process, such as partially trusted plugin, template or sandboxed code; default Node.js deployments without the Permission Model are unaffected, and there is no integrity or availability impact. It is fixed in the 26.12.1 security release (2026-10-21) and is rated 'Low' in the vendor's own list of fixes; a public PoC reference exists as a GitHub gist but is not verified as working exploit code, no active exploitation is confirmed, and priority is monitor.
Authenticated users of GitLab Enterprise Edition can bypass a required merge request approval policy on a protected branch under specific synchronization conditions, weakening the branch's approval gate without gaining any read or availability impact. The flaw affects EE versions from 17.4 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1, and Community Edition is unaffected because approval policies are an EE feature. GitLab has released fixed versions, but publicly available exploit code exists (a HackerOne report is referenced), and the CVSS score is only 3.1 (AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N), consistent with a low-priority integrity issue rather than a high-risk compromise.
Predictable root credential generation in D-Link DCS-6501LH firmware 3.03.02, via mydlink_set_root_pwd in /mnt/mtd/aoni_ipc, can give remote attackers root/Telnet access if they can reach the exposed service and derive the weak credential; the attack is high-complexity and the real-world priority is assessed as LOW. CWE-1391 covers the use of weak credentials, and the independent assessment rates confidentiality, integrity, and availability impact as high once the credential is obtained, while the CNA CVSS 4.0 score is 2.9. Publicly available exploit code exists, but no CISA KEV active exploitation is reported in the supplied data.
GitLab Enterprise Edition lets a group Owner re-enable AI-backed GitLab Duo data egress for their group and all descendant projects even after an instance administrator has explicitly locked Duo availability for that group, defeating the administrator's control (CWE-863). Only EE instances on 19.2 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 are affected, and only where an admin lock was actually configured; Community Edition and instances without a Duo lock are unaffected. Requirements are strict - an authenticated group Owner on the target group (CVSS PR:H, 2.7 score) - so this is a trusted-insider bypass with limited integrity impact, not a mass-exploitable flaw; publicly available exploit code exists via a HackerOne report, and no active exploitation has been confirmed (not in CISA KEV).
Customer record disclosure in the WordPress Appointment Booking Plugin before 5.7.5 allows any authenticated agent-level user to read and enumerate personal information for customers managed by other agents, because the plugin's customer retrieval and search functions omit the agent-to-customer assignment check (CWE-639). The issue is remotely reachable but requires an existing agent credential (no anonymous access), has confidentiality-only impact, and is low severity at CVSS 2.7 (independently assessed as PR:L rather than the supplied PR:H). Publicly available exploit code exists, and vendor fixes are available in 5.7.5, but there is no CISA KEV confirmation of active exploitation.
Authenticated WordPress users with at least the Contributor role can set attacker-chosen prices for existing products in Simple Shopping Cart before 5.3.3, and any visitor can then add those items to the cart at the manipulated price. The plugin does not validate submitted product prices against an owner-only reference value, so the impact is limited to price integrity rather than data disclosure or service disruption. Publicly available exploit code exists, but there is no KEV entry confirming active exploitation, and the issue is low priority because the attacker must already hold Contributor access.
Path traversal in Tenstorrent tt-metal up to and including 0.80.0 lets a malicious model checkpoint direct the loader to read a safetensors shard from outside the checkpoint directory, because weight_map filenames in model.safetensors.index.json are joined onto the checkpoint path without containment checking. The weakness is reachable remotely but gated by user interaction: someone must actually load an untrusted or attacker-supplied checkpoint, and the impact is read-oriented (an out-of-directory shard is pulled into the loaded state dict) rather than direct code execution, which is why the assessed severity is low (CVSS 3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N; upstream CVSS 4.0 score 2.1). Publicly available exploit code exists and the vendor has released a fix in v0.81.0-dev20261016; there is no indication of confirmed active exploitation (CISA KEV).
Path traversal in the Jackrong Finetuning Guide's Qwen MTP GGUF pipeline lets an unauthenticated remote attacker supply a crafted MTP weight_map whose shard_name value contains traversal sequences, causing files outside the intended model directory to be accessed when a victim runs the extract_mtp_heads function. The affected code is qwen-mtp-gguf/scripts/qwen_mtp_gguf_pipeline.py through commit ef2b17f2798cd18cd85375080c35a58397ad0d09, distributed as a rolling release with no tagged versions. Publicly available exploit code exists, but impact is limited to low confidentiality, integrity, and availability with required user interaction, and there is no CISA KEV listing at time of analysis.
Path/file inclusion in oretnom23 File Management System PHP lets remote attackers influence the 'page' parameter processed by index.php's include() call, enabling limited local file disclosure or inclusion of attacker-controlled content. The application is distributed as a rolling release with no version identifiers, and the project has not provided a fixed build. No authentication is required (PR:N) but exploitation depends on passive user interaction (UI:P); publicly available exploit code exists, and impact is assessed as LOW (C:L/I:L/A:L).
Authenticated path traversal in wiki-go 1.9.1 and earlier lets low-privileged users abuse the Files Rename API to move or rename files outside the wiki's documents or pages/home storage roots. The flaw is in RenameFileHandler's handling of the currentPath and newName arguments, which accept traversal sequences such as ../ or absolute/backslash paths; publicly available exploit code exists. The vendor fixed it in 1.9.2, and the moderate CVSS 5.3 reflects limited confidentiality, integrity, and availability impact rather than code execution; no CISA KEV confirmation was provided.
Path traversal in Leomoon wiki-go through 1.9.1 allows authenticated users with editor-level privileges to read, overwrite, move, or restore documents outside the configured wiki documents directory via crafted paths to the editor and version API endpoints. The flaw is remotely reachable over HTTP but requires a valid editor session (CVSS PR:L); publicly available exploit code exists, and the vendor fixed it in 1.9.2. It is a moderate-risk issue rather than a top-priority one because untrusted users cannot exploit it without editor access.
SQL injection in itsourcecode Online Cake Ordering System 1.0 allows a low-privileged authenticated remote attacker to manipulate the ID parameter handled by /orderdetail.php and influence backend database queries, with partial confidentiality, integrity, and availability impact per the assessed vector. Publicly available exploit code exists, but no CISA KEV entry or confirmed active exploitation is indicated in the supplied data. The application is a niche open-source PHP product, so realistic exposure is limited to deployed instances reachable by authenticated users.
Authenticated SQL injection in ProjectWorlds Advanced Library Management System 1.0 lets a low-privileged user who can reach the returned-book search form inject SQL through the datefrom or dateto parameters and read sensitive database contents. The flaw is a CWE-89 mysqli_query concatenation issue in returned_book_search.php; exploitation requires a valid account (CVSS PR:L) but no user interaction. Publicly available exploit code exists, and while no CISA KEV entry confirms active exploitation, this is a moderate-to-low real-world priority because the authentication prerequisite limits anonymous internet-wide attacks.
Authenticated server-side request forgery (SSRF) in wiki-go versions up to 1.9.1 allows logged-in users to make the server fetch arbitrary internal or cloud-metadata URLs through the fetch-metadata endpoint in internal/handlers/metadata_api.go. The pre-patch handler only checked the URL scheme (http/https) and never validated the resolved destination IP, so an attacker with valid credentials can read limited confidential responses from reachable internal services (confidentiality impact only, no integrity or availability impact). Publicly available exploit code exists, and the vendor fixed the issue in 1.9.2 by adding outbound URL destination validation.
SQL injection in the /deleteproduct.php endpoint of itsourcecode Online Cake Ordering System 1.0 allows authenticated low-privilege users to manipulate the ID parameter and run arbitrary SQL against the application database. The issue is remotely reachable but requires a valid account (CVSS 5.3, PR:L), and publicly available exploit code exists via a GitHub issue; no CISA KEV active exploitation is confirmed. This is a moderate priority because the niche PHP project is unlikely to be internet-exposed and exploitation is gated by authentication.
SQL injection in itsourcecode Sales-and-Inventory-System lets authenticated low-privilege attackers alter database queries via the ID parameter in /pages/cust_edit.php, compromising confidentiality, integrity, and availability at a low level. Publicly available exploit code exists through a published GitHub issue, but no CISA KEV entry confirms active exploitation; the independent assessment rates this as a moderate, not high-priority issue. The vendor uses rolling releases and has not responded, so no fixed version is available and defenses must focus on input validation and access control.
SQL injection in ProjectWorlds Advanced Library Management System 1.0 allows a low-privileged authenticated remote attacker to manipulate the admin_id argument in profile.php and alter backend mysqli_query statements, with limited confidentiality, integrity, and availability impact per the assessed CVSS 3.1 vector. Publicly available exploit code exists and the issue is remotely reachable, but authentication is required and no CISA KEV active-exploitation confirmation is present.
Authenticated SQL injection in itsourcecode Sales-and-Inventory-System allows a low-privilege logged-in user to inject arbitrary SQL through the ID argument of the /pages/cust_searchfrm.php customer search endpoint, potentially exposing or modifying backend database records. The project ships as a rolling release, so no discrete version numbers exist; all builds up to commit 0a3c45a78aaff3601b8cf9ce8ba82ff5c345caac are affected. Publicly available exploit code exists in the form of a public GitHub issue report, but there is no CISA KEV listing and no confirmed active exploitation; the vendor was notified through that issue and has not responded, and no vendor-released patch has been identified.
SQL injection in Projectworlds Advanced Library Management System 1.0 allows an authenticated low-privilege user to manipulate the dateto and datefrom parameters in report_search.php and potentially read or modify limited database data. Publicly available exploit code exists, but the product is a demonstration/academic PHP application with an extremely narrow deployment footprint, so overall risk is low.
Authenticated SQL injection in itsourcecode Sales-and-Inventory-System allows a low-privileged user to manipulate the ID parameter on /pages/cust_del.php and alter database queries, with limited confidentiality, integrity, and availability impact. The product is unversioned, so all deployments are potentially affected, and publicly available exploit code exists; there is no CISA KEV confirmation of active exploitation. Signals are mixed but converge on a moderate, not urgent, priority because a valid login is required and the flaw is confined to a single endpoint.
Path traversal in the comment-deletion handler of LeoMoon Studios wiki-go through 1.9.1 allows an authenticated wiki administrator to delete files outside the intended comments directory by supplying traversal sequences (such as ../, ..\, or URL-encoded %2e%2e) in the documentPath argument of the comment-deletion request. Because the endpoint is reachable remotely and requires no user interaction, a malicious or compromised admin account can remove arbitrary files writable by the wiki-go process, affecting integrity and availability (assessed CVSS:3.1 AV:N/AC:L/PR:H/UI:N/C:N/I:L/A:L); the file contents are not exposed. Publicly available exploit code exists and the flaw is described in a GitHub security advisory, but there is no indication of active exploitation in the wild. The issue is a genuine but modest-priority one, primarily constrained by the administrative-privilege prerequisite, and is fixed in version 1.9.2.
Path traversal in DT42 BerryNet through 3.10.2 lets low-privilege remote users read file metadata outside the intended model directory by supplying a crafted label to DLModelManager.get_model_meta. Exploitation requires valid low-level credentials and some user interaction, and the assessed impact is limited to low confidentiality disclosure with no integrity or availability effect. Publicly available exploit code exists, and no confirmed active exploitation is indicated in the provided intelligence.
Path traversal in the qwen-mtp-gguf conversion script within Jackrong-llm-finetuning-guide allows authenticated low-privileged remote attackers to manipulate the weight_map argument and direct file operations outside intended directories, but the victim must run the conversion pipeline. Impact is limited to low confidentiality and integrity effects with no scope change, and exposure is narrow because the affected code is a niche Qwen MTP-to-GGUF conversion utility; publicly available exploit code exists.
SQL injection in ProjectWorlds Advanced Library Management System 1.0 allows authenticated administrators to inject SQL through the firstname, middlename, lastname, address, branch, or type parameters in edit_member.php. The medium-severity flaw (CVSS 4.0 base 5.1; assessed CVSS 3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L) primarily threatens library member data confidentiality and integrity, with limited availability impact, and requires a high-privilege session to exploit. Publicly available exploit code exists, though no CISA KEV entry confirms active exploitation at time of analysis.
Out-of-bounds memory read in Electron's macOS offscreen rendering (OSR) path lets an attacker who already has code execution inside the GPU process feed inconsistent frame geometry - a content_rect or pixel_size not backed by the underlying shared-memory mapping or IOSurface - to the main process, which then reads past the end of the mapped buffer while building paint-event images. The result is disclosure of main-process memory contents or an application crash, and exploitation is confined to macOS applications that enable OSR; Windows, Linux, and default windowed Electron apps are unaffected. This is a sandbox/boundary-escalation step rather than a standalone entry point: the assessed vector is CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:L (3.9), and attack complexity is high with no public exploit identified at time of analysis. Fixed upstream in Electron 42.11.6, 43.7.3, 44.4.3, and 45.0.0-alpha.9.
Out-of-bounds memory read in Electron's frame-capture path (webContents.beginFrameSubscription) affects all versions prior to 42.11.6, 43.7.3, 44.4.3, and 45.0.0-alpha.9. The main process trusted frame geometry and pixel-format metadata relayed from the GPU process - content_rect, coded_size, pixel_size, and pixel_format - without validating it against the actual shared-memory or IOSurface mapping, so a malicious set of values causes the browser to read past the end of the buffer while assembling captured frames, leaking process memory or crashing the app. Exploitation requires that the target application actually use the frame-subscription API and that the attacker already hold code execution inside the GPU process through some other bug; no public exploit code and no active exploitation were identified at time of analysis, and the CVSS 3.9 score reflects that steep prerequisite rather than the severity of the memory-safety class.
Path traversal in the Undertow web server's PathResourceManager, which serves static files from the filesystem, lets remote attackers read files outside the intended static-content root when a symbolic link resolves into a sibling directory whose name begins with the same characters as an authorized safe directory (for example 'reports' versus 'reports-internal'). The root cause is a string-prefix check that never verifies a full path-segment or directory boundary, so it fails to confirm the link's canonical target actually resides inside the approved directory. Affected deployments are those bundling Undertow's static resource handling, as reflected by Red Hat's CPEs for JBoss Enterprise Application Platform 7 and 8, Red Hat Fuse 7, Red Hat Build of Apache Camel for Spring Boot 4, Red Hat Single Sign-On 7, and RHEL 8/9 packages; the assessed severity is low (CVSS 3.1 base 3.7, AV:N/AC:H/PR:N/UI:N/C:L/I:N/A:N) because exploitation demands a pre-existing symlink plus a directory-name collision, and the outcome is limited to low-confidentiality file disclosure with no write or availability impact. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the signals align on low real-world risk.
Denial of TLS certificate issuance and renewal in Progressive Robot hMailServer 6.0.0 through 6.3.6 stems from the ACME HTTP-01 challenge responder handling only one connection at a time. A remote unauthenticated attacker can open idle connections during a certificate authority validation so the single worker waits up to five seconds per connection and the CA request times out, causing validation failure; sustained interference across renewals can let the certificate expire and make clients reject the server's TLS, although mail service continues on the current certificate until then. The issue is low-severity and availability-only, with no public exploit identified at time of analysis, and is fixed in 6.3.7, which serves up to 64 concurrent connections.
Unbound 1.0.1 through 1.26.1 can be induced to downgrade a configured island-of-security trust anchor to insecure when a remote unauthenticated attacker injects a forged NSEC response with the SOA bit cleared. The flaw affects only resolvers configured with both a root trust anchor and an additional trust-anchor for an island whose parent is provably insecure under the root chain, and it causes the DNSSEC validator to accept and cache the NSEC without the required RRSIG validation. Impact is integrity-only (CVSS 3.7, AC:H), and no public exploit code was identified at time of analysis.
Node.js 26.12.0 can cache invalid ZIP local headers within its zlib handling, so an application that passes attacker-influenced ZIP or zlib data through those APIs may end up with corrupted header state affecting integrity of subsequently processed data. The vendor rates this Low, scope is unchanged, and only integrity impact is assessed (C:N/I:L/A:N) with high attack complexity, meaning exploitation depends on specific application behavior rather than merely running Node.js. The fix ships in Node.js 26.12.1; no public exploit code has been confirmed at time of analysis and EPSS/KEV signals are absent from the available data.
Node.js 26.12.0 mishandles filesystem permission tree nodes for wildcard path grants when the experimental Permission Model is enabled, potentially permitting file access beyond the intended grant scope. The issue is local, requires high attack complexity, and only affects deployments that explicitly enable the Permission Model with wildcard --allow-fs-read/--allow-fs-write specifications and allow an attacker to execute code inside that restricted context. It is rated low severity (CVSS 3.6); no public exploit identified at time of analysis, and Node.js 26.12.1 contains the vendor fix.
An out-of-bounds read in the Zephyr RTOS Bluetooth Classic A2DP host stack allows a paired BR/EDR peer to retrieve roughly 245 bytes of adjacent RAM from the victim device over the air. The bug is reachable only in firmware built with CONFIG_BT_CLASSIC and CONFIG_BT_A2DP that registers at least one non-SBC codec endpoint (MPEG1, MPEG2, ATRAC or vendor), because the SBC path pins the codec IE length to 4 bytes; the attacker must also have completed pairing since the AVDTP L2CAP channel enforces BT_SECURITY_L2 (CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). Impact is limited to read-only disclosure of a bounded region of RAM with no write primitive or code execution, and no public exploit code was identified at time of analysis.
Acronis Cyber Infrastructure before builds 6.0.1-112, 6.1.1-64, and 6.2.1-71 contains an improper authorization check (CWE-863) that allows a high-privileged authenticated user to read and modify sensitive data beyond the intended scope. The issued CVSS 3.3 vector (AV:N/AC:H/PR:H/UI:N/C:L/I:L/A:N) reflects network reachability but requires prior high-privilege access and difficult-to-reproduce conditions, with only partial confidentiality and integrity impact and no availability impact. No public exploit was identified at time of analysis and the issue is not listed in CISA KEV, so exploitation appears limited to specific authorized-but-overprivileged scenarios.
A file descriptor leak in the containers/storage Go library's archive.ApplyLayer and ApplyUncompressedLayer functions causes descriptors to be left open whenever corrupt or malicious image layers or tar streams are unpacked, and repeated processing of such inputs can exhaust the hosting process's file descriptor limit. The weakness is unauthenticated in CVSS terms (PR:N) but local in scope (AV:L) and requires the victim to actually process attacker-influenced layers (UI:R), so an attacker must first get malformed image content in front of a build, pull, or sync loop. Impact is availability-only and confined to the affected process (C:N/I:N/A:L, S:U): no code execution and no data exposure; a single bad input does not cause denial of service, only sustained repetition does. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, and EPSS scoring was not supplied with the source data.
Electron's chrome.tabs.query() implementation returned the url and title of every tab in a session to extensions that held neither the 'tabs' permission nor a matching host permission, letting a loaded extension enumerate the URLs and titles of all webContents in that session. Only applications that explicitly pull in extensions they do not fully trust via session.extensions.loadExtension are exposed, and only on builds prior to 42.11.1, 43.5.1, 44.1.1, and 45.0.0-alpha.4; unauthenticated remote attackers cannot reach the flaw without such an extension already running inside the app. The disclosed data is limited to tab URLs and titles (no page content, DOM, cookies, or code execution), no public exploit code was identified at time of analysis, and the issue does not appear on CISA KEV, consistent with its low CVSS 3.1 score.
Permanent deletion of existing vulnerability records in GitLab EE is possible for authenticated users holding only read-only permissions when a specific error-handling path is triggered, because cleanup logic fails to distinguish pre-existing records from newly created ones. The issue affects GitLab EE from 17.8 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1, and is rated CVSS 3.1 (AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N) with high attack complexity and only low integrity impact. There is no public exploit identified at time of analysis, and the independent assessment classifies this as a low-severity, low-priority issue.
Authorization bypass in Apache Pulsar (2.8.0 through 4.0.13 and 4.1.0 through 4.2.4) allows an authenticated user holding only namespace- or topic-level consume permission to clear backlogs, expire messages for all subscriptions, or delete subscriptions that the namespace's Prefix subscription authentication mode or per-subscription role grants should deny them. The flaw only affects brokers with authentication/authorization enabled, the default authorization provider in use, and namespaces that actually configure Prefix subscription auth mode or explicit subscription permissions; default deployments are unaffected because consume permission already authorizes these operations there. Impact is limited to subscription-state integrity - cursor advancement, subscription removal, and skipping of not-yet-replicated geo-replication messages - with no message disclosure, no policy modification, and no broker availability impact; no public exploit identified at time of analysis and CVSS scores remain low (2.3 per the vendor's CVSS 4.0 vector).
Missing authorization checks in the Apache Pulsar broker admin REST endpoints for non-persistent topics allow an authenticated user holding only produce or consume permission on a topic or its namespace to read, replace, or delete that topic's entry filter policy. Only non-persistent topics on Pulsar 3.3.0 through 4.0.13 and 4.1.0 through 4.2.4 are affected; persistent topics, namespace-level policies, and versions before 3.3.0 are not. Real impact is tightly gated: the operator must have deployed entry filter implementations (the filters directory is empty by default) and must have set allowOverrideEntryFilters=true (default false), and even then only subscription dispatchers created after the change are affected, so conversation of the vulnerable policy only reshapes which already-installed filters withhold messages. No public exploit code was identified at time of analysis, and despite the accompanying 'RCE' tag the description confirms the flaw does not permit loading filter code or running arbitrary code in the broker.
Cross-tenant information disclosure in Apache Pulsar's transaction administration REST API allows any authenticated user - including an account granted no permissions - to read transaction coordinator and transaction metadata belonging to other tenants. The flaw is reachable only when broker authentication and authorization are enabled and transaction support is turned on via transactionCoordinatorEnabled, which is disabled by default; affected read endpoints under /admin/v3/transactions validate authentication and broker/coordinator locality but skip tenant, namespace, and topic authorization checks. Exposure is limited to metadata and statistics such as coordinator service URLs, transaction topic and subscription names, the opening principal, and pending-acknowledgement state; message contents cannot be read and transactions cannot be aborted, scaled, or otherwise modified. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor-assessed severity is low (CVSS 4.0 base 2.3; independently assessed CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
Apache Pulsar's WebSocket service performs an incomplete authorization check when a WebSocket consumer supplies a dead letter policy via consumer endpoint query parameters, letting an authenticated user who holds only CONSUME permission on a subscribed topic cause messages to be written into a topic of their choosing - potentially in another tenant's namespace - because the deadLetterTopic's PRODUCE permission is never verified and the write is performed with the WebSocket service's own broker client identity. Affected releases are 2.3.0 through 4.0.13 and 4.1.0 through 4.2.4; the practical exposure is limited because webSocketServiceEnabled is off by default, the attacker must be an authenticated user, the WebSocket service's broker role must already hold PRODUCE on the target, and the target must accept a schema-less producer (schema validation is not enforced by default). Impact is limited to unauthorised message injection with low integrity and availability effect (dead-letter messages are distinguishable by their properties, but those properties are unauthenticated and cannot be trusted to establish origin); no public exploit code or CISA KEV-listed active exploitation was identified at time of analysis.
pypdf versions before 6.21.1 can be induced to hand /DCTDecode-labeled image streams to the wrong Pillow image parser when the optional Pillow dependency is installed, allowing a crafted PDF to trigger unintended decoding of non-JPEG data. The attack requires the victim to load or extract the affected image with pypdf, and the assessed impact is limited to low availability effects with no confidentiality or integrity loss. No public exploit was identified at time of analysis, and the issue is fixed in 6.21.1 by restricting Pillow to the JPEG format.
Client-side script execution can be triggered in Nuxt applications running with pages disabled (all versions prior to 4.6.0) when attacker-controlled input bound to NuxtLink's `to` prop carries a leading ASCII C0 control character ahead of a `javascript:` URL. The no-pages router classifies the value as an internal route before the script-protocol check runs, so the unsafe href is emitted into server-rendered HTML; the victim must click the link for script to run in the application's origin. The issue is an incomplete fix for CVE-2026-53722, is unauthenticated (PR:N) but gated by significant preconditions - pages-disabled mode, reflected untrusted input, and a user click - and there is no public exploit identified at time of analysis; Nuxt 4.6.0 resolves it.
CSS injection in Astro's server-side View Transition generator (versions 7.1.0 through 7.3.2) lets attacker-controlled strings placed into animation properties - duration, delay, easing, direction, fillMode, or animation name - break out of their generated declaration because the ';', '{' and '}' delimiters are serialized unescaped. An application is only affected if it feeds untrusted input into those transition properties; stock Astro sites using hardcoded values are not exploitable. The framework still escapes literal less-than characters, so the injected content cannot close the style element, inject HTML, or execute JavaScript - impact is confined to CSS-level UI manipulation (hiding, repositioning or spoofing content, adding generated text, and conditional resource loads that may leak data already present in selectable DOM attributes). Severity is low (CVSS 4.0 base 2.3; independently assessed as CVSS 3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N), with no public exploit identified at time of analysis and a vendor fix released in Astro 7.3.3.
Fail-open topic initialization in Apache Pulsar (1.22.0-incubating through 4.0.13, and 4.1.0 through 4.2.4) causes the broker to silently disable a namespace's encryption_required policy for a topic whenever any step of persistent-topic loading fails, such as a metadata-store read error or a topic-level policy load failure. An authenticated client that already holds produce permission on the affected topic (CVSS PR:L) can then publish unencrypted messages that the broker accepts and stores, so the namespace's end-to-end encryption guarantee is lost for that topic; the impact is integrity-only, since already-encrypted messages and the encryption keys are never exposed. Exploitation depends on an operational initialization failure the attacker neither triggers nor controls, and the condition recurs on every topic reload (unload, bundle reassignment, broker restart) while the root cause persists - no public exploit code identified at time of analysis, and CISA KEV does not list this issue.
WarehousePG 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0 allow an authenticated low-privileged user who can open a utility-mode connection to invoke gp_add_coordinator_standby(), named gp_add_master_standby() in WHPG 6 and kept as an alias in WHPG 7, without the superuser check enforced by sibling segment add/remove functions. On a cluster with no standby coordinator configured, this creates a fake gp_segment_configuration entry that blocks administrators from adding a real standby until a superuser removes it. The issue is low severity and limited to integrity and availability impact with no user-data exposure; no public exploit was identified at time of analysis and it is not confirmed actively exploited (CISA KEV).
Trigger.dev before 4.5.12 permits an authenticated project member to prematurely complete another member's DEVELOPMENT-environment waitpoint by knowing the victim's friendly waitpoint ID and submitting a crafted completion request, bypassing the per-user ownership check. The impact is low and limited to integrity of a pending development waitpoint; production environments are not affected. No public exploit was identified at the time of analysis, and a vendor patch is available.
SvelteKit (@sveltejs/kit) versions before 3.0.0 can emit attacker-influenceable HTML or JavaScript into prerendered pages when an application passes untrusted data into a cache-control header via setHeaders; the value is inserted unescaped into a <meta http-equiv="cache-control"> tag. Exploitation requires a prerendered page plus an untrusted header value at prerender/build time, and the injected payload executes only when a user later visits that page (UI:P/UI:R), so impact is confined to the victim's browser context. This is a low-severity XSS issue (CVSS 2.3; assessed CVSS:3.1 vector with C:L/I:L), with no public exploit identified at time of analysis and no CISA KEV confirmation.
Reflected cross-site scripting in itsourcecode Online Cake Ordering System 1.0 allows unauthenticated remote attackers to execute script in a victim's browser via the useruid parameter on /404.php, provided the victim opens a crafted link. Publicly available exploit code exists, and the CVSS 4.0 score of 2.1 reflects the requirement for user interaction and limited impact; no CISA KEV active exploitation is reported.