Stored cross-site scripting in the Drupal Webform contributed module allows an authenticated user holding a Webform-related permission to persist content that Webform later renders to other users, so a reviewer or administrator viewing that content may have script execute in their session. The flaw is a CWE-267 'privilege defined with unsafe actions' problem - a role is granted a capability whose resulting actions are not safely constrained - and it affects Webform 0.0.0 through 6.2.12 and 6.3.0 through 6.3.1, with sites on the fixed releases not exposed. Severity is moderate (CVSS 5.4; the independent assessment raises scope to changed, S:C) with a low EPSS of 0.18% (7th percentile), no CISA KEV listing, and no public exploit identified at time of analysis; the vendor reports a patch is available and the priority decision is this_month. Authentication requirements are confirmed from the CVSS vector (PR:L, low-privileged authenticated), and because the payload is stored, a second victim user must subsequently view the affected content for execution.
Reflected cross-site scripting (CVSS 5.4) affects the Drupal contrib module 'Email Verification / SMS Verification / OTP Verification' in all versions from 0.0.0 through 2.4.0, allowing an attacker who convinces a victim to open a crafted URL to execute script in that victim's browser session on the Drupal site. No authentication is required of the attacker, but exploitation depends on victim interaction (UI:R) and the specific reflecting parameter is not described in the available sources. No public exploit code or active exploitation is known, EPSS is low at 0.16% (5th percentile), and the vendor has released a patch in version 2.4.0.
Path traversal (CWE-22) in the Drupal contributed module Media Library Importer affects versions from 0.0.0 through 2.1.6, allowing an authenticated user with access to the module's media-import functionality to write or read files outside the intended restricted directory, with limited confidentiality and integrity impact and no availability effect. The CVSS 3.1 base score is 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N), so exploitation requires a low-privileged account and is not possible anonymously. No active exploitation has been observed (CISA SSVC Exploitation: none, EPSS 0.16%), and no public exploit code is identified in the available sources; default Drupal installations are unaffected because the module is a non-core add-on that must be explicitly installed.
The Drupal contrib module Key auth (versions 0.0.0 through 2.2.4) can store sensitive authentication data in the web browser cache because of missing or incorrect cache-control handling, a CWE-525 weakness that also reflects incorrectly configured access-control levels in the module. Low-privilege authenticated users (CVSS PR:L) could recover that cached material over the network, yielding limited confidentiality and integrity impact for a base score of 5.4. Patch data shows a vendor fix is available, EPSS is only 0.15% (4th percentile) and there is no KEV listing; no public exploit identified at time of analysis, and the priority label is this_month rather than immediate action.
Improper authorization in FreeIPA lets any enrolled host retrieve and revoke X.509 certificates belonging to other users or services, disrupting those services, because ownership is checked only by matching the host name to the certificate subject Common Name. The flaw is moderate severity (CVSS 5.4) and requires an authenticated host principal (PR:L); Red Hat tracks it for remediation this month, and no public exploit was identified at time of analysis.
The contributed Drupal module SAML SSO - Service Provider (versions 0.0.0 through 3.2.0) contains an open-redirect weakness that lets an attacker craft a link which sends a victim to an untrusted destination under the guise of the trusted Drupal site, enabling phishing and source-of-data spoofing. No authentication is required of the attacker (CVSS 3.1 vector PR:N), but the attack cannot succeed without a victim clicking the crafted link (UI:R), and impact is limited to low confidentiality and integrity effects with no availability loss. Exploitation has not been confirmed via CISA KEV and no public exploit code was identified at time of analysis; EPSS is 0.14% (3rd percentile), and the risk picture is consistent with a medium-severity, socially engineered redirect issue rather than an emergency - a vendor fix is available by upgrading past 3.2.0.
Missing authorization in the MarketKing multivendor marketplace plugin for WordPress/WooCommerce through 2.1.72 allows an authenticated low-privilege account to perform marketplace actions beyond its intended permissions, affecting limited confidentiality and integrity (CVSS 5.4, CWE-862). The flaw is network-reachable and requires only a valid low-privilege account, so sites that allow vendor or customer self-registration have broader exposure. No public exploit code or confirmed active exploitation was identified in the provided intelligence at time of analysis.
Cross-site request forgery in the Drupal Tawk.to Live Chat module (versions 0.0.0 through 3.0.4) lets an unauthenticated remote attacker induce a logged-in, privileged Drupal user to submit unintended requests, with limited confidentiality and integrity impact. The attacker needs no account of their own, but exploitation requires an active victim session and user interaction (UI:R). EPSS is 0.10%, no public exploit was identified at the time of analysis, and a vendor patch is available via Drupal SA-CONTRIB-2026-184.
Arbitrary code execution in Pylint (0.15.2 through 4.0.8) stems from the linter persisting its per-module statistics as Python pickles inside PYLINT_HOME and reloading them with pickle.load on the next invocation. An attacker who can write into that cache directory - for example a shared, group-writable, or otherwise untrusted PYLINT_HOME on a multi-user host or CI runner - can drop a crafted serialized stats file with a predictable name, and code then executes with the privileges of whoever next runs Pylint against that cache. The default per-user cache (~/.cache/pylint) is writable only by the invoking user, so exploitation requires a non-default or misconfigured shared cache plus local write access; no public exploit code or confirmed active exploitation was identified at time of analysis, and the vuln.today priority label is 'this_month'.
Denial of service in OpenTelemetry Python (opentelemetry-api through 1.45.0) lets a single unauthenticated request carrying an oversized W3C tracestate header burn roughly 6-12 seconds of CPU, and on asyncio servers stall every other connection on the event loop for that duration. The flaw is a quadratic-time regex split in TraceState.from_header that is reached automatically through the default tracecontext propagator, so any service instrumented with something like opentelemetry-instrumentation-asgi is affected without special configuration; exploitation is gated by the fronting HTTP parser's header-size limit, with gunicorn and uvicorn's h11 parser rejecting the header while waitress and uvicorn's default httptools parser accept it. A working proof-of-concept with measured timings is included in the upstream advisory (public PoC reference), but no confirmed active exploitation (CISA KEV) is indicated in the supplied intelligence, and the assessed CVSS of 5.3 reflects availability-only impact (C:N/I:N/A:L).
Uncontrolled resource consumption in Roundcube Webmail's CSS proxy endpoint (utils/modcss) lets an attacker who can make the server fetch a stylesheet from an attacker-controlled host exhaust server memory, because the fetched response was buffered in full with no size cap and no read timeout. The problem affects releases before 1.6.20 and 1.7.x before 1.7.5, and the resulting impact is availability-only - no data disclosure or modification (CWE-770, A:L). Reaching modcss in normal deployments presupposes a valid webmail session (the assessed vector is PR:L), and no public exploit code or in-the-wild exploitation has been identified at time of analysis. Vendor-released patches exist in 1.6.20 and 1.7.5.
Roundcube Webmail installations before 1.6.20 and 1.7.x releases before 1.7.5 can be tricked into loading attacker-controlled remote content from an HTML email without the recipient's consent. The built-in HTML sanitizer (rcube_washtml) only recognized a limited set of CSS escape spellings of the url() token, so a sender can write the same FuncIRI reference as \000075rl(, u\72 l(, or u\rl( inside a presentation attribute or an SVG SMIL animation and slip past the remote-content blocker when the victim simply opens the message. The result is limited to privacy leakage - read receipts, client IP address, and tracking-pixel-style confirmation of message display - with no code execution, data disclosure, integrity, or availability impact; a vendor patch ships in 1.6.20 and 1.7.5, and no public exploit code was identified at time of analysis.
Remote-content blocking bypass in Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 lets a remote unauthenticated attacker send a crafted HTML email that causes external content to load when the victim opens the message, disclosing the recipient’s client IP address and confirming that the message was read. The flaw is a privacy issue limited to metadata disclosure-no email content, credentials, or code execution is exposed-and it matters only when Roundcube’s remote-content blocking is enabled. No public exploit code was identified at the time of analysis; exploitation requires the victim to open the specific message (CVSS 3.1 UI:R).
GeoJSON documents written through the MongoDB C# Driver can be persisted with duplicate geometry members, so the server and the driver resolve different values for the same record and affected documents may become unreadable through the driver, interrupting application read paths. Exposure is limited to applications running driver versions 1.8.0 up to but not including 3.13.0 that copy user-supplied field names into GeoJSON extra members and allow those names to collide with reserved members such as type and coordinates; standard GeoJSON usage without attacker-controlled extra-member names is unaffected. The CVSS 4.0 base score is 5.3 (authenticated, network-reachable, confidentiality none, integrity low, availability low), no public exploit was identified at time of analysis, and the vendor has released 3.13.0 as the fix.
Path traversal in the squirrelmail_usercopy migration plugin of Roundcube Webmail allows an authenticated low-privilege user to read files outside the configured SquirrelMail data directory and have their contents imported into their own account. Only deployments prior to 1.6.20, and 1.7.x prior to 1.7.5, that have the plugin enabled with squirrelmail_driver set to 'file' and a populated squirrelmail_data_dir are affected; the disclosure is read-only (confidentiality impact only, no integrity or availability loss) and requires the attacker to control a login name containing a slash. No public exploit code has been identified at time of analysis, and the weakness is confined to a non-default SquirrelMail-migration component rarely deployed in production, so this is a medium-severity (CVSS 5.3) information-disclosure issue rather than a high-priority emergency.
Information disclosure in webpack-dev-server 5.1.0 through 5.2.6 and 6.0.0 lets an unauthenticated network peer reach the unauthenticated /webpack-dev-server/open-editor endpoint and bypass Host validation with a malformed Host such as 'file:badport', causing URL construction to throw. In the default non-production mode the resulting HTTP 500 includes the full exception stack trace, exposing absolute filesystem paths, installed module locations, and internal source line numbers; the server stays up, so there is no denial of service. Exploitation requires the dev server to be network-reachable, and no public exploit was identified at time of analysis.
An authorization bypass in Incus (the Go-based container and VM manager) allows an authenticated user holding instance-creation rights in a restricted project to reach the pull-mode migration path that restricted projects are supposed to block, by sending a clustered migration request with 'refresh' set against an instance they already own. The result is server-side request forgery: the clustered Incus daemon opens an outbound TLS websocket connection to an attacker-chosen URL and trusts an attacker-supplied certificate, letting the user probe services reachable from the server. Standalone servers are explicitly not affected, no configuration or storage bypass results from the refresh, and no public exploit has been identified at the time of analysis.
Security-rule bypass in mod_qos allows unauthenticated remote attackers to conceal prohibited request values from configured QoS/security inspection. The flaw is an off-by-one pointer calculation in the code path that merges request-body parameters with an existing URL query, so the string evaluated for policy is truncated while the actual request remains unchanged. This is a moderate-severity (CVSS 5.3) control bypass affecting Apache HTTP Server deployments that rely on mod_qos query/parameter filtering; no public exploit was identified at time of analysis.
Update operator injection in the MongoDB C# Driver (versions 2.13.0 up to, but not including, 3.13.0) lets a replacement document submitted through FindOneAndReplace be interpreted by the server as an update document when its top-level field names begin with a dollar sign, which the other replace code paths already reject. Only applications that build replacement-document top-level field names from untrusted input are exposed, and an authenticated, low-privileged user of such an application can then alter the single document already selected by the application's own filter - no records outside that filter are reachable, and there is no confidentiality or availability impact, only unintended modification of that document's contents. There is no public exploit identified at time of analysis, no confirmed active exploitation (not in CISA KEV), and the vendor has released a fixed version (3.13.0), making this a code-hygiene and defense-in-depth fix to schedule rather than an emergency.
SmileCDR HAPI FHIR contains a moderate-severity authorization bypass in the FHIR conditional create operation: an authenticated user with CREATE but not READ permission can receive the contents of an existing resource when the conditional create predicate matches it. Exploitation requires valid low-privilege credentials and a predicate that successfully identifies the target resource, so disclosure is constrained by how guessable or enumerable the search criteria are. No public exploit was identified at time of analysis; the supplied priority is this_month.
Bytebase before 3.16.0 contains an authorization bypass in the UpdateIssueComment handler that lets authenticated users with any project role, including Project Viewer, overwrite issue comments in projects they cannot access. The attacker supplies a comment UID from a foreign project while setting the parent to an issue in their own project, and the handler modifies the comment without verifying the parent-child relationship. The assessed impact is limited to comment integrity (CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N); no public exploit was identified at time of analysis, and the vendor has released 3.16.0 as the fix.
Open redirect in the OpenBao UI's OIDC identity provider allows attackers to craft OIDC links that send unauthenticated users to attacker-controlled destinations, enabling phishing or credential theft. OpenBao versions before 2.6.3 are affected, and exploitation requires the UI to be explicitly enabled (it is disabled by default via `ui = false`) and a victim to click a crafted link. No public exploit has been identified at time of analysis, and the vendor has released patches in 2.6.3 and 2.7.0.
Blind server-side request forgery in WWBN AVideo before 29.4.0 allows authenticated users with uploader privileges to make the server issue GET requests to arbitrary internal hosts by storing a videoLink that points to an attacker-controlled redirector. The initial URL passes isSSRFSafeURL(), but get_headers() follows the 302 without re-validating the redirect target, and the resulting embed-versus-video render difference gives a blind oracle for internal port and service reachability. Only a limited confidentiality/integrity impact is achievable (CVSS 5.3, PR:L, scope-changed) and no public exploit code or confirmed active exploitation was identified at time of analysis; a vendor patch exists in 29.4.0.
Information disclosure in the WP Desk ShopMagic WooCommerce plugin (versions through 4.9.1) allows remote attackers to retrieve embedded sensitive data from an externally accessible file or directory, with confidentiality-only impact rated Low. The supplied CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates the issue can be reached over the network without authentication or user interaction, and the plugin is a WordPress/WooCommerce automation tool, so exposed site data may be at risk. This is a moderate-severity disclosure flaw rather than a top-tier priority; no public exploit code has been identified at time of analysis and the CVE is not in CISA KEV, with a this_month priority label.
Unauthenticated remote attackers can bypass access controls in the Drupal Webform contributed module to read data that should be restricted, affecting versions 0.0.0 through 6.2.12 and 6.3.0 through 6.3.1. Rated CVSS 5.3 with low confidentiality impact only, the flaw cannot modify or delete content and does not affect availability, so exposure is limited to unauthorized disclosure via direct requests to access-controlled Webform resources. No public exploit code or active exploitation is confirmed at time of analysis, and EPSS sits at 0.20% (9th percentile), consistent with a moderate rather than urgent patching priority.
Unauthenticated remote attackers can bypass authorization checks in the Drupal Webform contributed module and reach resources they are not entitled to via forceful browsing, with the impact confined to limited confidentiality exposure (C:L; no integrity or availability effect). Sites are affected if they run Webform releases inside the ranges listed by the vendor and EUVD (0.0.0 through 6.2.12, and 6.3.0 through 6.3.1); the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N puts the score at 5.3, meaning no credentials or user interaction are needed against a default install. Exploitation pressure is currently low - EPSS 0.20 percent (9th percentile), no CISA KEV entry, and no public exploit identified at time of analysis - and a vendor patch is available, so this is a moderate-severity information-exposure issue to schedule rather than an emergency.
Missing authorization in Drupal's Webform Submissions Delete contributed module, versions 0.0.0 through 1.2.0, allows remote attackers to delete stored webform submissions by directly requesting the deletion route, affecting integrity only. The module must be installed and enabled on a site holding submissions; the CVSS vector is AV:N/AC:L/PR:N/UI:N with I:L, though the supplied sources do not explicitly confirm whether anonymous or low-privileged access suffices. No public exploit has been identified at time of analysis, EPSS is 0.19% (8th percentile), a vendor patch is available, and the priority is this_month rather than emergency.
Stored cross-site scripting in Mistune's `Include` directive (fixed in 3.3.0) allows an attacker who can plant a `.html`/`.xhtml`/`.htm` file anywhere the renderer can read it to have that file's contents emitted as raw `block_html` and executed in the application's origin. Real-world exposure is narrow and highly conditional: the deployment must explicitly enable `RSTDirective([Include()])`, construct the renderer with `escape=False`, run in a filesystem context where `state env['__file__']` is set, and the attacker must already have a separate file-write primitive plus a victim who views the rendered page - with the documented default `escape=True` the included HTML is entity-escaped and the chain fails. No CISA KEV listing or active exploitation is reported; a working proof-of-concept reproduction (verified against mistune 3.2.1) is published in the upstream GitHub advisory, and the bug is rated this_month in priority rather than emergency.
Missing authorization (CWE-862) in the ЮKassa для WooCommerce (yookassa) WordPress plugin affects all versions through 2.17.3 and lets remote, unauthenticated requests reach functionality that should require proper access-control checks. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, 5.3) indicates the exposure is limited to low confidentiality impact, with no integrity or availability effect and no user interaction required. The specific endpoint, action, or plugin configuration that triggers the missing check is not described in the available sources, and there is no CISA KEV entry or confirmed public exploit code at time of analysis; the vuln.today priority decision is 'this_month', pointing to limited rather than urgent real-world risk.
Unauthenticated visitors to WordPress sites running the miniOrange Page Restriction WordPress (WP) plugin through version 1.6.0 can reach pages and posts the plugin was configured to protect, disclosing content administrators intended to keep private. The issue is a missing authorization check (CWE-862) rated CVSS 5.3, with impact limited to confidentiality - no integrity or availability effect - so its real-world severity depends on how sensitive the restricted pages are. No public exploit identified at time of analysis and no confirmed active exploitation; the priority signal places it in the 'this month' remediation window rather than an emergency response.
Missing authorization in the Brainstorm Force SureDash WordPress plugin through 1.12.2 allows unauthenticated, network-based attackers to reach functionality that should require access checks, with low confidentiality impact and no integrity or availability impact under the assessed CVSS vector. The vulnerable endpoint and protected resource are not described in the available sources, so default-configuration exploitability cannot be confirmed, and realistic impact depends on the site's SureDash access-level configuration. No public exploit identified at time of analysis and no CISA KEV entry is present; the priority is this_month, consistent with a moderate, not emergency-level, issue.
SureDash WordPress plugin through 1.12.2 contains a missing authorization flaw (CWE-862) that can expose low-sensitivity information to unauthenticated remote attackers. The Patchstack description ties exploitation to incorrectly configured access-control security levels, but the specific endpoint and whether a non-default access-level configuration is required are not specified in the supplied sources; impact is limited to confidentiality with no integrity or availability effect. No public exploit was identified at time of analysis, and the issue is assessed as moderate severity and low priority (decision label: this_month).
Falcon - WordPress Optimizations & Tweaks plugin through 2.12.0 exposes restricted information to unauthenticated remote attackers because of a missing authorization check (CWE-862). The CVSS 3.1 score is 5.3 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, indicating network reachability, low attack complexity, no authentication or user interaction, and only a low confidentiality impact with no integrity or availability impact. No public exploit was identified at time of analysis; the primary precondition is that a WordPress site runs the vulnerable plugin version and exposes the affected code path.
An unauthenticated, network-reachable information disclosure issue affects an HPE networking product documented in HPE security bulletin hpesbnw05162en_us; the CVSS 5.3 score reflects low integrity impact with no confidentiality or availability loss per the vendor's vector. Because no description was published, the specific feature, protocol, or configuration that triggers the flaw is not described in the available sources, and affected version ranges must be read directly from the HPE advisory. No public exploit code or CISA KEV confirmation accompanies this record, and the medium severity plus low impact place it in a this-month remediation window rather than an emergency one.
Majestic Support WordPress plugin through version 1.2.1 contains a missing authorization flaw that allows unauthenticated remote attackers to perform limited unauthorized modifications. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) confirms network reachability with no privileges or user interaction required, and the impact is bounded to integrity with no confidentiality or availability effect. No public exploit code or active exploitation is identified at time of analysis, and the precise vulnerable endpoint is not described in the available sources.
Sunshine Photo Cart, a WordPress plugin for client photo galleries and proofing, does not enforce an authorization check on part of its functionality in versions up to and including 3.7.5, allowing unauthenticated remote requests to make limited unauthorized modifications. Per the CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), the flaw is network-reachable without credentials or user interaction, and the impact is confined to integrity with no confidentiality or availability effect and unchanged scope, giving a medium severity of 5.3. No public exploit code or confirmed active exploitation is associated with this CVE in the available data; the originating advisory is Patchstack's plugin vulnerability database entry, and the specific vulnerable endpoint or action handler is not described in the available sources.
Missing authorization in Wpmet Metform through version 4.3.2 lets unauthenticated remote attackers trigger a restricted plugin action without the required access check, with integrity-only impact (CVSS 5.3). The flaw is CWE-862 and requires no privileges or user interaction; the exact endpoint is not named in the available data. No public exploit code or confirmed active exploitation was identified at time of analysis.
OpenBao before 2.6.4 and 2.7.x before 2.7.1 allows an authenticated holder of a renewable token issued through the Kubernetes Auth method to keep renewing it after the backing Kubernetes service account has been deleted, extending access that should have ended. The flaw is an insufficient session-expiration check (CWE-613) in the Kubernetes Auth token-renewal path, which does not re-verify that the service account token originally used for authentication is still valid. Fixes are available in OpenBao 2.6.4 and 2.7.1; no public exploit was identified at time of analysis, and the available assessment rates this as a moderate-priority issue rather than an emergency.
Functionality misuse in the Drupal Webform contributed module (versions 0.0.0 through 6.2.12 and 6.3.0 through 6.3.1) lets remote, unauthenticated attackers circumvent interaction-frequency controls such as submission or rate limits on affected forms. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, score 5.3) limits impact to low integrity misuse with no confidentiality or availability effect, and exploitation requires that a deployed site actually use the affected frequency-control feature; the precise trigger is not described in the available sources. No public exploit is identified at time of analysis, EPSS is 0.15% (4th percentile), the vuln.today priority label is this_month, and a vendor patch is available.
Missing authorization in the Drupal contributed module Calculate Working Days (versions 0.0.0 through 2.0.3, fixed in 2.0.3) lets unauthenticated remote requests reach routes or pages that should be gated by a permission check, a forceful-browsing style access-control bypass scored CVSS 5.3. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) exploitation requires no authentication or user interaction, but the impact is limited to a Low integrity effect with no confidentiality or availability consequences, and only sites that have installed and enabled this specific contributed module in a pre-2.0.3 release are exposed. No public exploit has been identified at time of analysis, there is no CISA KEV listing, EPSS is 0.14% (3rd percentile), and SSVC records exploitation as none with partial technical impact.
Forceful browsing in the Drupal contributed module Unpublished Node Permissions (versions 0.0.0 through 1.8.0) lets unauthenticated remote visitors retrieve unpublished node content by requesting a node's URL or ID directly, bypassing the access restriction the module is meant to enforce. Only Drupal sites that have installed and enabled this non-core module are exposed, and the impact is confined to confidentiality of unpublished content, with no modification or denial of service. No public exploit identified at time of analysis; EPSS is 0.14% (3rd percentile) and a vendor patch is available per the Drupal security advisory, so this is a moderate-severity information-disclosure issue to be scheduled for patching this month rather than an emergency.
Unauthenticated remote retrieval of embedded sensitive data is possible in the Drupal contrib module 'SAML SSO - Service Provider' versions 0.0.0 through 3.2.0, because the module ships a hard-coded credential (CWE-798) rather than generating or requiring a site-specific secret. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, 5.3 Medium) is confidentiality-only: an attacker can read exposed data but cannot modify it or cause denial of service. EPSS is 0.14% (3rd percentile), there is no KEV listing and no public exploit identified at time of analysis, so the issue is genuine but non-urgent; a vendor patch is available and upgrading past 3.2.0 removes the flaw.
Excessive resource allocation in the Drupal contributed Combined image style module, affecting versions 0.0.0 through 1.0.7, can let remote unauthenticated requests that depend on user interaction drive resource consumption and degrade availability (CVSS 4.3, CWE-770). Only Drupal sites with this non-core module installed and enabled are exposed, and confidentiality and integrity are unaffected. This is a low-to-moderate priority issue rather than an emergency, and no public exploit was identified at time of analysis.
Mistune 3.2.1 through 3.2.x (fixed in 3.3.0) mishandles the ':figwidth:' option of the '.. figure::' RST directive, concatenating it unvalidated into the rendered '<figure style="width:...">' attribute, so an attacker who controls markdown input can append arbitrary CSS declarations. Only deployments that explicitly enable the RST directives plugin with the Figure directive registered are exposed - this is not the library's default configuration - and a victim must render the crafted page (UI:P). The result is CSS injection limited to style-level effects such as forcing the browser to fetch attacker-controlled url() resources for data exfiltration, layout/visibility tampering and attribute-prefix probing; it cannot execute JavaScript in the page origin. The vendor has released 3.3.0, no CISA KEV entry exists, and the advisory includes a reporter-verified PoC snippet demonstrating the injection against 3.2.1.
KNIME Business Hub deployments prior to 1.19.0 contain a broken CSRF protection mechanism (CWE-352) that lets an attacker change the state of resources on behalf of a logged-in user without that user noticing. Exploitation requires the victim to have an active, authenticated Hub session and to be lured into passive interaction with attacker-controlled content, after which the browser's forged state-changing request is not rejected; impact is limited to low-integrity modifications with no confidentiality or availability effect. The vendor released a fix in version 1.19.0, and no public exploit code or confirmed active exploitation was identified at time of analysis; the only complete remedy stated by the vendor is upgrading to 1.19.0 or later.
Authenticated users with access to remote workflow editing in KNIME Business Hub before 1.19.0 can exhaust server-side resources, leading to intermittent failure or unavailability of workflow execution. The flaw is availability-only, with no confidentiality or integrity impact, and requires valid credentials with workflow-editing access; no public exploit was identified at time of analysis. KNIME rates it moderate at CVSS 5.3 and states that upgrading to 1.19.0 is the only remediation because no workaround is possible.
Silicon Labs' Z-Wave SDK accepts crafted ZWAVE_CMD_NODES_EXIST messages without adequate source verification, allowing nodes to be removed from a Z-Wave mesh network. Only devices that have already joined the network can send such messages, so the realistic attacker is a compromised or malicious paired node rather than an arbitrary remote party. The flaw affects SDK 8.1.1 and earlier on 700/800 series devices and 6.85.02 and earlier on 500 series devices; it is rated 5.3 (CVSS 4.0) with low integrity and availability impact, no confidentiality impact, and no public exploit identified at time of analysis.
Server-side request forgery in crawlseo before 0.2.4 lets an authenticated user with site-edit and crawl-trigger permission point the crawler at internal services and cloud metadata endpoints by registering a domain whose DNS answer falls in a reserved range or is rebound after validation. The crawler's isPrivateIp() blocklist omits RFC 6598 CGNAT, RFC 6890, TEST-NET-1/2/3 and several reserved IPv6 ranges, and the pre-flight-validated address is not pinned to the outbound socket, so a TOCTOU DNS-rebinding answer is accepted at connect time. Exfiltration is constrained to what the crawl results API returns for the fetched page (title, description, headings, status code and links), making this a reconnaissance-grade leak of subsequent-system data with no integrity or availability impact; no confirmed working exploit code is public at time of analysis, though a researcher gist describing the issue is referenced.
Insecure direct object reference in QloApps (Webkul) through 1.7.0 lets any holder of a valid customer account act on other customers' bookings: by submitting a foreign id_service_product_order_detail alongside their own id_order to OrderDetailController::displayAjaxSubmitRefundRequest(), the attacker can create refund records against someone else's service line, cancel that line, and corrupt refund quantities. The impact is confined to integrity and availability (CVSS 4.0 base 5.3; assessed CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) - no data disclosure - and exploitation requires authentication plus knowledge or enumeration of other customers' service-line identifiers, with no victim interaction. No CISA KEV entry exists and no public exploit was identified at time of analysis; the vendor has published fix references and priority guidance places this in the this-month remediation window.
Authenticated users in Bytebase before 3.16.0 can read task-run data belonging to projects they hold no permission on, because the rollout service handlers resolved tasks and task runs by UID alone without verifying they belonged to the project and plan named in the request. The practical result is cross-project disclosure of execution logs, database session details, and rollback SQL - a confidentiality-only issue with no write or availability impact, requiring a valid account with permission on at least one project. Bytebase 3.16.0 contains the fix (PR #19554); no public exploit code was identified and the flaw is not in CISA KEV, so this is a moderate-severity, this-month remediation item rather than an emergency, with the caveat that sequential integer UIDs make enumeration of foreign objects straightforward.