Unauthenticated attackers positioned on the same adjacent network segment can modify data or configuration on affected HPE networking devices, reflected in a CVSS 3.1 base score of 6.5 (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N). No description, CWE, or version range was supplied with this record, so the specific component, product line and trigger must be resolved from the referenced HPE advisory (docId hpesbnw05162en_us). No public exploit code has been identified at time of analysis and the CVE is not in CISA KEV; the Layer-2 adjacency prerequisite keeps it off the directly internet-reachable attack surface.
Unauthenticated forceful browsing in the Drupal contrib module Jsonapi Role Access allows remote attackers to reach JSON:API resources that the module is supposed to restrict by role, with low confidentiality and low integrity impact and no availability effect. Sites are affected only if they run this specific contrib module at a version below the fixed release and have Drupal's JSON:API functionality active; the CVSS vector (AV:N/AC:L/PR:N/UI:N) means no credentials or user interaction are needed once the module is present. Severity is moderate (6.5) and urgency is limited: EPSS is 0.14% (3rd percentile), there is no KEV entry, and no public exploit identified at time of analysis; a vendor patch is available and the priority label is this_month.
The Drupal 'SAML SSO - Service Provider' contributed module (all versions before 3.2.0) omits an authorization check on at least one protected resource, so remote unauthenticated attackers can reach it directly through forceful browsing rather than through the intended SAML-authenticated flow. Successful abuse is bounded to low confidentiality and low integrity impact with no availability effect, and the trigger requires the module to be installed and enabled on a Drupal site plus knowledge or discovery of the specific protected URL. There is no CISA KEV listing and no public exploit identified at time of analysis; EPSS is 0.14% (3rd percentile), and a vendor patch is available.
Missing authorization in the Drupal CSS Usage Analyzer module (versions 1.0.0 through 1.0.2) allows unauthenticated remote attackers to perform forceful browsing against an internet-reachable Drupal site where the module is installed and enabled. The issue is CWE-862 with low confidentiality and integrity impact and no availability impact, rated CVSS 5.4 (moderate); the exact resource or path involved is not described in the available sources. Vendor patching is available per Drupal SA-2026-189, and no public exploit was identified at time of analysis.
Stored cross-site scripting in the Extensions for Leaflet Map WordPress plugin through version 6.0 allows an authenticated user with sufficient content-submission capability to store a script payload that executes in another user's browser when the affected page is viewed. The issue is rated CVSS 6.5 (Medium) with changed scope and required user interaction; impact is bounded to the victim's browser session rather than direct server compromise. No public exploit code or CISA KEV entry was identified in the available intelligence at time of analysis.
Stored cross-site scripting in ND Shortcodes For Visual Composer through version 7.8 allows a low-privilege authenticated WordPress user to inject script that runs in another user's browser when the affected page is viewed. The CVSS 3.1 score is 6.5 with a scope change and low confidentiality, integrity and availability impact; no CISA KEV listing or public exploit code appears in the supplied intelligence.
Stored cross-site scripting in the xootix Waitlist WooCommerce (Back in Stock Notifier) plugin through version 2.9.1 allows an authenticated low-privilege user to submit input that is later rendered as script for a victim who views the affected page. The flaw is rated CVSS 6.5 with network access, low attack complexity, PR:L and UI:R, so exploitation requires a foothold on the WordPress site plus victim interaction, and the plugin must be active alongside WooCommerce. The supplied intelligence does not include a CISA KEV entry, and no public exploit was identified at time of analysis; the vendor-reported advisory is the Patchstack page for the 2.9.1 XSS issue.
Stored cross-site scripting in the Gloriafood Restaurant Menu plugin (WordPress plugin slug menu-ordering-reservations) through version 2.4.4 lets an attacker with a valid low-privileged account on the target WordPress site persist script payloads that execute in another user's browser when that page is viewed. Because exploitation requires both an existing authenticated account (PR:L) and a separate victim to visit the stored content (UI:R), this is a moderate-priority issue rather than an emergency one; anonymous remote compromise is not possible. No public exploit code or active exploitation is indicated in the available data, and EPSS scoring was not provided.
Stored cross-site scripting in the WordPress plugin Off-Canvas Sidebars & Menus (Slidebars) through version 0.5.9 lets an authenticated user holding only low privileges place unsanitized input into a page that is later rendered in another user's browser, executing script in that victim's session (CVSS 6.5, scope changed). Per the assessed vector (PR:L/UI:R) the attacker must already hold a valid WordPress account and must persuade a victim to view the affected page; confidentiality, integrity and availability impact are each rated Low and confined to the browser context rather than server compromise. No public exploit code or CISA KEV entry is associated with this issue at time of analysis, and no EPSS score was supplied, so the decision signal is this-month remediation rather than emergency response.
Stored cross-site scripting in the WordPress plugin Elementor Addon Elements (all versions through 1.14.4) lets an authenticated low-privilege user inject script-bearing content into Elementor widget fields that is later rendered to other users. Because the malicious payload is persisted rather than reflected, any higher-privileged user who views the affected page or post - an editor or administrator reviewing content, for example - executes the script in their own session, enabling session or account takeover within the WordPress installation. The vendor assigns a moderate CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L); there is no confirmed active exploitation (not listed in CISA KEV) and no public exploit code identified at time of analysis, though the low complexity and contributor-level prerequisite make it a realistic risk on multi-author or self-registration-enabled sites.
Stored cross-site scripting in the H5P WordPress plugin through 1.17.9 allows authenticated users with low-level content permissions to inject persistent script into H5P interactive content, which then executes when a victim such as an administrator views the affected page. The issue is rated CVSS 6.5 with vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, reflecting the need for an authenticated authoring account and victim user interaction; no public exploit identified at time of analysis.
OS command injection (CWE-78) in the Drupal 'Cloud' contributed module affects versions 0.0.0 through 7.0.1 and allows an authenticated, low-privileged user to execute arbitrary OS commands, with high impact on confidentiality and integrity and no assessed availability impact. Exploitation requires user interaction and high attack complexity, so successful attacks depend on conditions beyond the attacker's direct control; the module is not part of Drupal core, so sites that do not run it are unaffected. EPSS is low (0.63%, 50th percentile), no CISA KEV listing or public exploit was identified at time of analysis, and the vendor has released a fixed version (7.0.1).
Remote unauthenticated attackers can bypass intended access controls in Cozmoslabs Paid Member Subscriptions through version 3.1.2, reaching plugin functionality that should be gated by membership or access-level rules. The flaw is a missing authorization weakness (CWE-862) rated CVSS 6.5, with low confidentiality and integrity impact and no availability effect; exploitation requirements beyond a reachable WordPress site running the plugin are not fully described in the available sources. No public exploit has been identified at time of analysis, and this is a moderate-priority issue rather than an emergency.
KNIME Business Hub deployments before 1.19.0 fail to enforce network compartmentalization between execution contexts, so an authenticated remote user can reach open network ports on executors that belong to a different execution context. By default no ports are open on executors, meaning the exposure exists only where deployed workflows themselves open listening ports and the attacker knows the target executor's IP address, which keeps realistic risk conditional. The issue is fixed in version 1.19.0, a manual network-policy workaround is available, and no public exploit code was identified at time of analysis.
Blind server-side request forgery in PhpSpreadsheet allows an attacker-supplied spreadsheet (or HTML document) to steer the reading server's outbound image fetch to an internal address, because the operator's isWhitelisted callback is checked only against the initial external-image URL and never against HTTP redirect hops. Only deployments that have explicitly called setAllowExternalImages(true) - the default in BaseReader is false - and that also configure a whitelist which permits the attacker's redirecting host are exposed; those prerequisites make this a non-default configuration issue rather than a universal one. Impact is bounded: the fetched body is validated with isImage() and the temporary file is deleted, so the response is not returned to the attacker and the primitive is limited to triggering blind GET requests, coarse internal reachability probing and reaching endpoints such as cloud metadata services. A public PoC reference describing the redirect chain exists; it is not verified as working exploit code, and there is no confirmed active exploitation (CISA KEV).
Limited information disclosure in MongoDB C# Driver versions 2.26.0 through before 3.13.0 allows unauthenticated remote attackers to surface residual bytes from earlier same-thread processing when an application deserializes crafted BSON into certain primitive collection types. The leak is bounded to a limited amount of data belonging to other requests or principals and depends on exploitable residue being present on the thread at parse time; no public exploit was identified at time of analysis, and the vendor released 3.13.0 as the fix. The vuln.today priority label is this_month.
Path traversal in Checkmarx ast-cli's tar extraction logic on Linux and macOS (versions before 2.3.51) allows a crafted archive containing absolute or '../' entries to write files outside the install directory, including executable files at arbitrary filesystem paths. The only path to exploitation described in the advisory is substituting the archive served at download.checkmarx.com that ast-cli fetches when installing the Vorpal ASCA real-time engine or the SCA Resolver, so the dominant precondition is control of that distribution artifact plus a victim running the install (user interaction required). Windows builds perform the path validation and are unaffected; no public exploit code was identified at time of analysis.
Incorrect authorization checks in Amazon Athena engine version 3 query processing allowed an authenticated AWS principal to read cross-account metadata - specifically AWS account identifiers and SQL statement text - belonging to other AWS accounts. Query results themselves and any data held in Amazon S3 or other connected data sources were never exposed through this flaw, and the CVSS 4.0 score of 6.3 reflects that the confidentiality impact is confined to the downstream (scope-changed) component rather than the vulnerable service. AWS fixed the issue service-side on October 7, 2026, so no customer action is required; there is no CISA KEV listing and no public exploit identified at time of analysis.
A race condition in Traefik's NTLM and Kerberos (Negotiate) backend authentication path lets remote unauthenticated attackers who can multiplex concurrent requests over a single HTTP/2 or HTTP/3 connection corrupt the per-connection sticky round tripper slot, orphaning backend connections, breaking connection-bound authentication, or crashing the proxy. Only deployments that explicitly enable Negotiate backend authentication and accept multiplexed HTTP/2 or HTTP/3 traffic are exposed; exploitation requires winning a timing-dependent race (high attack complexity), and impact is limited to availability and connection integrity with no confidentiality or integrity loss. No public exploit code or CISA KEV entry was identified at time of analysis, making this a moderate, availability-focused issue rather than a top-tier emergency. Affected releases are Traefik 2.11.x before 2.11.58 and 3.x before 3.7.14; vendor patches are available.
Denial of service in com.vaadin.external.google:android-json 0.0.20131108.vaadin1 allows any application that parses untrusted JSON with this artifact to be forced to abort the parsing thread: a roughly 20 KB document of nested arrays drives unbounded recursion until a raw java.lang.StackOverflowError is thrown instead of a catchable JSONException. The flaw is unauthenticated per the CVSS vector (PR:N) and trivial to trigger (AC:L), though it only matters where the application actually routes untrusted JSON through this specific repackaged library; impact is limited to availability of the parsing thread, with no confidentiality or integrity effect. The artifact is a 2013 repackage of third-party org.json classes that is published once and unmaintained, and the maintainer states no fixed version will ever be released, so remediation means replacing the dependency. No public exploit code and no CISA KEV entry were identified at time of analysis; priority per the decision signal is this month, and the risk is bounded because larger thread stacks raise the nesting depth required to trigger the overflow.
Improper certificate validation in the OpenVPN 3 Core library versions 3.4 through 3.11.7 lets an attacker bypass Extended Key Usage (EKU) restrictions during certificate validation, so a certificate that an EKU policy should reject for a given role can still be accepted. The flaw (CWE-295) is rated 6.3 with a network vector, no privileges and no user interaction, but high attack complexity and a present attack requirement reflect that the bypass only matters in deployments that actually depend on EKU constraints as a security control and that the attacker must supply an otherwise trust-chain-valid certificate. No public exploit has been identified at time of analysis and there is no KEV listing; per the vuln.today priority it is tracked for this month, and the vendor (OpenVPN) has published a security announcement.
Checkmarx ast-cli through 2.3.59 fetches the Vorpal ASCA real-time engine and SCA Resolver helper binaries from download.checkmarx.com during its auto-update flow and extracts and executes them without verifying a checksum, so an attacker who could substitute the served archive could get an arbitrary binary executed on developer machines and CI runners. Triggering the vulnerable path requires either a developer using the Checkmarx VSCode/JetBrains extension (which invokes ASCA) or someone running 'cx scan sca-realtime' on an affected version, and exploitation further requires control of the vendor's download endpoint or interception of the download - a high, attacker-uncontrolled barrier reflected in the elevated attack complexity. The vendor has released 2.3.60, which verifies the download against a published SHA-256 checksum before extraction; no public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), placing it in the this_month priority bucket.
OpenBao deployments that rely on role-scoped rate-limit quotas can have those quotas bypassed when a request is sent with a form-encoded body or with a forwarded client certificate, because role resolution fails and the backend-specific quota rule is not enforced. The affected ranges are OpenBao before 2.6.4 and 2.7.0 before 2.7.1; a caller with legitimate access to the token-issuance path can repeatedly issue tokens without consuming the configured role-based rate-limit budget. This is a moderate-severity control bypass rather than an urgent emergency, and no public exploit was identified at the time of analysis; vendor patches are available in 2.6.4 and 2.7.1.
Stored cross-site scripting in OpenCATS before 0.12.0 lets a low-privileged authenticated user plant HTML/JavaScript in the name or title field of a Candidate, Company, Contact, Job Order, or List, which lib/MRU.php's getFormatted() stores unsanitized and renders unescaped in the 'Recent' (MRU) navigation panel present on nearly every page. The script fires only when another user opens or views the poisoned record, so exploitation is a second-order trigger limited by the need for a valid account (PR:L) and by victim interaction (UI:P); meaningful privilege escalation depends on the viewer holding elevated rights such as Site Administrator, in which case session/cookie theft could yield administrative control. Impact is assessed as moderate (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, scope changed) and no public exploit code or active exploitation was identified at time of analysis; the vendor has released 0.12.0 with the escaping fix.
KNIME Business Hub releases prior to 1.19.0 lack an authorization check between users who reach a DataApp through the same 'link without login', letting any holder of that link list - and in some cases access - jobs created by other users through it. The exposure is limited to that per-link job scope rather than the whole Hub, and only exists where an operator has deliberately created and distributed a login-less link; the vendor's documented workaround of removing all such links eliminates the condition entirely. No public exploit code or active exploitation is identified in the available data, and the reported CVSS 4.0 base score is 6.3 (assessed CVSS 3.1: AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N), giving this a moderate, this-month remediation priority rather than an urgent one.
Reflected cross-site scripting in LocalStack 4.9.2 lets a remote, unauthenticated attacker execute arbitrary JavaScript in a victim's browser when the victim opens a crafted URL while interacting with the LocalStack web interface. The CVSS 3.1 score is 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), reflecting the required user interaction and browser-scoped impact. No confirmed active exploitation is reported (not in CISA KEV) and EPSS is 0.15% (4th percentile); a public write-up reference exists but is not verified as working exploit code.
Authenticated NETCONF peers can crash libyang-based servers such as netopeer2 by sending an rpc <action> envelope containing non-whitespace character data to lyd_parse_op(), causing an uninitialized pointer free in lydxml_env_netconf_rpc() and possible heap corruption. The issue affects libyang through 6.4.13 and is a moderate-priority, authenticated denial-of-service flaw: exploitation requires an established NETCONF session, and whether the result is a reliable crash or heap corruption depends on memory state (AC:H/AT:P). No CISA KEV entry or confirmed working exploit code is described in the supplied data; a public technical writeup is referenced, and a vendor patch commit is available.
libmongocrypt 1.0.0 through 1.21.0 builds requests to AWS, Azure and GCP key management services with unvalidated values from key vault documents, KMS provider configuration and KMS responses, so a user with authenticated write access to the key vault collection can alter request structure or token claims that the library signs with application credentials. This medium-severity issue (CVSS 6.0) requires that prior write access and a subsequent key-management operation, meaning an unauthenticated external attacker has no path; no public exploit was identified at time of analysis. The vendor fixed the issue in libmongocrypt 1.21.1 by validating inputs before interpolation into KMS HTTP requests.
Cross-organization insecure direct object reference in Lotus (uselotus/lotus) through 0.10.2 lets an authenticated user or a valid API key from any organization read, cancel, update, switch plans on, or modify add-ons of another tenant's subscription - and therefore alter that tenant's billing - by supplying the victim's subscription_record_id to SubscriptionViewSet. The handler resolves the object from the unscoped queryset rather than the organization-filtered one, so tenant isolation is not enforced; no special configuration is needed because this is the default code path on multi-organization deployments. An upstream fix exists in pull request #802 / commit 1375d5140795d72251c89f47200879b9bd1d6d96, but no released patched version is independently confirmed, and no public exploit code was identified at time of analysis; the practical constraint is that the target subscription_record_id is a UUID and must be known or enumerated.
Uncontrolled recursion in Silicon Labs EmberZNet 9.1.1 and earlier allows a device that has already joined the same Zigbee mesh to crash or hang a target node by sending a malformed Price Cluster Publish Billing Period command, producing a high availability impact with no confidentiality or integrity effect. Exposure is narrow by design: only nodes that implement the Price Cluster are affected, and the triggering frame must originate from an already-commissioned device on the same network, so the PR:L metric reflects network membership rather than arbitrary remote reach. The issue is not listed in CISA KEV and no public exploit was identified at time of analysis; the priority signal places it in the current month's remediation queue rather than emergency patching.
Malformed Discover Attributes commands sent to EmberZNet 9.1.1 and earlier can drive the Zigbee stack into an unreachable-exit loop, causing a denial of service on devices that support manufacturer-specific clusters. The attacker must already control a device joined to the same Zigbee network, so this is not reachable by an off-network or internet-based attacker; impact is availability-only (CVSS 4.0 base 6.0, assessed CVSS 3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H) with no confidentiality or integrity effect. There is no CISA KEV entry and no public exploit identified at time of analysis, and the vuln.today decision label is this_month.
Silicon Labs EmberZNet 9.1.1 and earlier crashes when a device that is already a member of the Zigbee network sends a malformed GetGroupMembership message to a node that implements the Group Cluster, because the request is handled without sufficient bounds checking on a stack buffer (CWE-121). Only a limited number of values can be written and no route to remote code execution was observed, so the practical outcome is a denial of service against the affected node rather than takeover. The CVSS 4.0 vector requires low privileges (PR:L) and prior network presence, the affected software is a constrained embedded stack, and no public exploit has been identified at time of analysis; this is a medium-severity availability issue rather than a high-impact priority, and the vendor-reported decision label places remediation in the current monthly cycle.
Credential disclosure in NewType Infortech's NT OneAPP mobile application allows remote attackers to obtain a logged-in user's NUP Portal passcode by luring them through an HTTP Basic Authentication challenge raised from unvalidated content loaded in the app's WebView. Successful exploitation requires the victim to already be authenticated and to actively respond to the spoofed challenge, and the vendor describes additional undocumented preconditions, so the flaw is conditional and not reliably reproducible across deployments; no public exploit code or confirmed in-the-wild activity is associated with it at time of analysis. Rated medium severity (CVSS 4.0 base 5.9; independently assessed CVSS 3.1 5.8 with high attack complexity and required user interaction).
Heap memory corruption in the Apache mod_qos module allows a remote attacker to crash the web server process by holding many concurrent low-rate connections open, overflowing the fixed-size array the module uses to record client IP addresses. The vulnerable code path is only reached when mod_qos connection rate monitoring (per-client connection tracking directives) is enabled, and the attacker must simultaneously sustain a large number of slow connections to exceed the allocated buffer - reflected in the CVSS 3.1 score of 5.9 (AV:N/AC:H/PR:N/UI:N/A:H) and the AC:H rating. No public exploit code or confirmed active exploitation was identified at time of analysis; the practical barrier is the non-default configuration plus the sustained-connection effort required.
Denial of service in Wasmtime's wasi:http implementation allows an attacker-controlled WebAssembly guest to panic and crash the host embedding by setting the between-bytes-timeout request option to zero. Wasmtime 46.0.0 through 48.0.3 and 49.0.0 through 49.0.1 are affected when embedders expose wasi:http APIs with the default-send-request Cargo feature enabled, which is the default; the issue requires low privileges (PR:L) and has availability-only impact. No public exploit was identified at time of analysis, and fixed releases 48.0.4 and 49.0.2 clamp the timeout to 1 nanosecond.
Host memory exhaustion (denial of service) in the Wasmtime WebAssembly runtime: a malicious WebAssembly guest can drive the WASIp2 write-zeroes method on the wasmtime-wasi SinkOutputStream into an unbounded host allocation, consuming available memory on the embedding host. Only embeddings that do not configure stdout/stderr streams are exposed, since unconfigured stdio falls back to SinkOutputStream, whose check-write limit was previously unlimited; embeddings with explicitly configured streams enforce their own limits and are not affected. The assessed vector (AV:N/AC:H/PR:L/UI:N, availability-only impact) supports a moderate, conditional risk, and no public exploit code was identified at time of analysis, though the flaw is a partial-fix bypass of an earlier advisory (GHSA-852m-cvvp-9p4w).
Wasmtime 47.0.0 through 48.0.3 and 49.0.0 through 49.0.1 accept ill-formed WebAssembly components in which a core module imports a tag whose type is a subtype of the imported tag's declared type, which the specification forbids; a malicious guest can use this to mis-type an exception object payload and corrupt the runtime's GC heap, causing Wasmtime to panic. Exposure requires the WebAssembly exceptions proposal to be enabled (on by default from 47.0.0) and the embedding to instantiate untrusted guest components, and the CVSS vectors indicate authenticated remote access with user interaction. Impact is bounded to availability: the GC heap is designed to tolerate corruption, so the vendor-characterised outcome is a host panic rather than code execution, yielding a moderate-severity denial-of-service rather than an emergency; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Header injection in Roundcube Webmail's Bounce (resend) action affects installations before 1.6.20 and 1.7.x before 1.7.5, where rcube_mime::decode_address_list() failed to strip control characters from decoded From display-names, allowing CRLF sequences in an RFC 2047 encoded word to insert arbitrary headers into the message produced when a user resends it. Attackers need only deliver a crafted email and persuade the victim to invoke Bounce; unauthenticated remote attackers can trigger it, but the mandatory user interaction confines abuse to targeted social-engineering scenarios with integrity-only impact. No public exploit code or confirmed active exploitation was identified at time of analysis, and vendor patches are released in 1.6.20 and 1.7.5.
fpdf2 through 2.8.7 dereferences image resource references supplied to FPDF.image(), write_html() HTML <img src> values, SVG <image href>/xlink:href values and template image fields, so attacker-controlled content rendered by an integrating application can trigger outbound HTTP(S) requests to attacker-chosen internal or external destinations (CWE-918 SSRF) as well as attempts to open raw local filesystem paths. The impact is bounded: local content is only embedded when the referenced path resolves to a valid supported image or SVG resource, and file:// URLs are not specially handled, so the local-path case requires a raw path such as '../../file.png'. The vendor scores this 5.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N), exploitation depends entirely on the application passing untrusted values into those APIs without an allowlist or restrictive policy, and no public exploit code has been identified at time of analysis; version 2.8.8 introduces a configurable resource_access_policy whose default blocks private, loopback and link-local network targets.
Missing authentication in ABB Ability Edgenius through 3.2.3.0 exposes a critical function that can compromise confidentiality, integrity, and availability; ABB's CVSS vector describes local access, high complexity, and low privileges, while the independent assessment rates local access, low complexity, and no privileges. No public exploit code or active exploitation has been identified at time of analysis, and the supplied decision signal prioritizes remediation this week.
An out-of-bounds heap write in the MongoDB C Driver (libmongoc) can corrupt client process memory and crash the client application when an excessively long credential value is supplied through the client's connection configuration while the Windows-native Kerberos/SSPI authentication path is in use. Only client builds compiled with the Windows SSPI authentication backend and configured for Kerberos/GSSAPI are affected - specifically 1.6.0 through 1.30.13 and 2.0.0 through 2.5.6 - and the flaw is reachable only by a party who already controls the client-side configuration, requires high privileges, and is local/configuration-based rather than remotely reachable (CVSS 4.0 5.7; assessed 3.1 AV:L/AC:H/PR:H). The primary outcome is memory corruption and denial of service of the client process itself, not compromise of the MongoDB server. No public exploit code has been identified, the issue is not in CISA KEV, and vendor-released fixes are available in 1.30.14 and 2.5.7.
draw.io Desktop 31.4.2 and earlier can disclose the contents of arbitrary local files to script running in the app's own file:// origin, because the Electron main-process read handlers (readFile, getFileDrafts, getBkpFile, fileStat, isFileWritable, checkFileExists, watchFile) never apply the blessed-path authorization that the write handlers enforce. Exploitation is conditional: it requires attacker-controlled script already executing in that origin - per the advisory, a renderer XSS in the drawio webapp reached when a victim opens a malicious diagram - and the readable set is bounded by a content sniff that admits files beginning with '{' or '[' plus known diagram/media formats, or .mmd/.mermaid extensions; the impact is read-only disclosure, with no write, modification, or denial of service. The advisory publishes a PoC of the readFile IPC primitive; it is not verified as working exploit code, and no confirmed active exploitation is reported. Version 31.4.4 contains the vendor-released patch.
Arbitrary file write in the OpenShift oc client's image extract command allows an attacker who supplies a malicious container image to place content outside the intended extraction directory with the privileges of the user running oc image extract. Red Hat OpenShift Container Platform 4 is affected because the client does not properly sanitize symbolic and hard link targets that are absolute paths or sibling directories, and the impact is limited to integrity (CVSS 5.5, AV:L/UI:R). No public exploit code or confirmed active exploitation has been identified in the available intelligence, and the risk is assessed as real but non-urgent.
HPE networking products can expose limited information and permit limited integrity impact to an authenticated high-privilege administrator; the issue is network reachable with low complexity and no user interaction, and the scope-changed flag means impact may extend beyond the initially vulnerable component. The CVSS score is 5.5 (medium), and no public exploit was identified at time of analysis. Exact models and firmware versions are not identified in the provided data, so affected deployments should be confirmed against HPE bulletin hpesbnw05162en_us; this is a routine, scheduled-patch item rather than an emergency.
Arbitrary file creation outside the intended working directory affects users and automated workflows running GNU patch, specifically when automatic patch reversal processes a crafted patch whose header contains an absolute file path that is accepted instead of rejected. The result is limited to integrity impact: files can be created in arbitrary locations, but only with the permissions of the user or pipeline account executing the utility, with no confidentiality or availability impact and no privilege gain beyond that account's existing rights. Exploitation requires a local attack vector and user interaction - a victim or a CI/CD pipeline must apply the attacker-supplied patch - and no public exploit, PoC reference, or CISA KEV entry is present in the available data; the assigning vendor is Red Hat, with RHEL 6 through 10 and Red Hat Hardened Images listed as affected.
Server-side request forgery in Authlib's RFC 9101 JWTAuthenticationRequest (JAR) extension lets unauthenticated remote attackers who know any valid public client_id drive the authorization server's outgoing fetch of an attacker-chosen request_uri. The flaw only materialises in deployments that implemented the abstract get_request_object() hook as an unrestricted outbound fetch, exactly as Authlib's own docstrings demonstrated; the library itself performs no network request, so installations whose override already enforces a scheme/destination allowlist and retrieval limits are unaffected. Affected releases are 1.6.0 through 1.8.x, fixed in 1.9.0, and a public PoC reference exists (demonstrating the unvalidated URI reaching the hook with no network egress); it is not verified as working exploit code, and there is no KEV or active-exploitation signal. Impact is a blind primitive: fetched bodies are consumed as a JWT and never reflected, so attackers get an error-type and timing oracle for internal host and port discovery rather than direct data exfiltration.
Server-side request forgery in the Drupal Webform contributed module (versions 0.0.0 through 6.2.12 and 6.3.0 through 6.3.1) lets a user who holds a low-privileged authenticated account on the Drupal site cause the module to issue requests from the server, with limited confidentiality and integrity impact. Exploitation requires a valid account (CVSS PR:L) but no user interaction and no special complexity, so the practical barrier is simply having a foothold login on the site. The vendor has released a patch per the Drupal advisory, EPSS is low at roughly 0.20% (9th percentile), and no public exploit has been identified at time of analysis; the priority is a routine this-month remediation rather than an emergency response.
Forceful browsing in the Drupal contributed Webform module lets a low-privileged authenticated user reach webform resources that are not protected by sufficiently granular access checks, yielding partial confidentiality and integrity impact with no availability effect. The flaw affects Webform releases from 0.0.0 through 6.2.12 and 6.3.0 through 6.3.1 (EUVD narrows the ranges to before 6.2.12 and before 6.3.1), and is scored 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) per the vendor/NVD vector. Exploitation requires a valid low-privileged account on the target site, no user interaction, and network reachability; EPSS is low at 0.20% (9th percentile), there is no CISA KEV listing, and no public exploit code was identified at time of analysis, with priority classified as this_month.
Authorization bypass (CWE-639) in the myCred WordPress plugin through 4.0.0-beta.1 lets an authenticated low-privileged user - on sites with open registration, any ordinary subscriber - reference another user's record by supplying a user-controlled key, altering or disrupting data the attacker does not own. The CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) scores it 5.4: no confidentiality exposure, limited integrity and availability impact, and authentication is mandatory (PR:L), so fully anonymous attackers are out of scope. No public exploit identified at time of analysis; the specific feature or endpoint carrying the vulnerable parameter is not described in the available sources, and patch status lags - only a Patchstack database entry for 4.0.0-beta.1 is referenced, with no fixed version stated.
Low-privileged authenticated users can change eRoom WordPress plugin settings because versions through 1.7.1 fail to enforce a proper authorization check on settings-change functionality, affecting the integrity and availability of Zoom meeting and webinar configuration. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L, so a valid low-privilege account-not unauthenticated access-is the key prerequisite, with no user interaction required. No public exploit identified at time of analysis, and no CISA KEV confirmation was provided.