UI redressing and interface spoofing in Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allow a remote unauthenticated attacker to deliver an HTML email whose CSS escapes the message-body scope and restyles application chrome. The victim must open the malicious message, and the realized impact is limited to visual deception rather than code execution, data theft, or privilege change. Vendor-released patches are available in 1.6.20 and 1.7.5; no public exploit was identified at time of analysis.
An authorization bypass in the OCO-Server Self-Service Portal (all releases prior to 1.2.3 with the feature enabled) lets an authenticated low-privileged portal user queue a software-uninstall job against computers and packages for which their role holds only read visibility and no deploy permission. The uninstall handler's permission-check loop never removes rejected assignment IDs before passing the original list to CoreLogic::uninstall(), and that CoreLogic instance is built with a null SystemUser so every internal checkPermission() call returns true unconditionally - the sibling install path fails closed and is not exploitable. Impact is integrity-only (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, 6.5): a portal account can disrupt installed software on machines belonging to other users or departments by enumerating sequential computer_package.id values, provided it can already read the target resources. No CISA KEV listing or active-exploitation reporting is associated with this CVE, and vulnerability-priority scoring places it in the this_month band; a detailed public PoC reproduction accompanies the upstream advisory; it is not verified as working exploit code.
Authentication bypass in the Drupal contrib module Email Verification / SMS Verification / OTP Verification (versions 0.0.0 through below 2.4.0) allows remote, unauthenticated attackers to skip the verification step the module is meant to enforce, with CVSS 3.1 scored 6.5 (AV:N/AC:L/PR:N/UI:N, C:L/I:L/A:N). Only Drupal sites that actually install and enable this contrib module - and rely on it as an access or action gate - are exposed, and the realistic impact is bounded to bypassing that check rather than full site compromise. No public exploit has been identified at time of analysis, CISA KEV does not list the issue, SSVC rates exploitation as none with partial technical impact, and EPSS is 0.19% (8th percentile), so the available decision signals converge on a this-month, non-emergency remediation priority. A vendor patch is available.
Open redirect in the Drupal Central Authentication System (CAS) Server contrib module lets remote, unauthenticated attackers craft CAS URLs that send victims to an untrusted site, which can be used to fake the source of data and support phishing. Affected deployments are the 0.x-2.0.x branch before 2.0.4 and the 2.1.x branch from 2.1.0 through 2.1.2; the reporter scored it 6.5, but exploitation depends on a victim following the crafted URL. No public exploit was identified at time of analysis, EPSS is 0.18% (7th percentile), and vendor patches are available in 2.0.4 and 2.1.3.
An authentication bypass in the contributed Drupal module 'REST & JSON API Authentication' (versions 0.0.0 through 3.2.0) allows remote attackers to reach REST/JSON API functionality that should be gated behind the module's authentication, with low confidentiality and integrity impact and no availability impact. Only Drupal sites that have deliberately installed and enabled this optional contrib module - and exposed its API endpoints over the network - are in scope; Drupal core and sites without the module are unaffected. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N for a base score of 6.5, EPSS is 0.18% (7th percentile) and there is no CISA KEV listing, so this is a moderate-priority item; no public exploit code has been identified at time of analysis. A vendor fix is available per the Drupal advisory, and the item is prioritized as 'this_month'.
Missing authorization in the Drupal Smart Content contrib module (affected range 0.0.0 through the 3.2.1 boundary) lets an unauthenticated remote attacker perform forceful browsing to reach a restricted resource, with low confidentiality and integrity impact and no availability effect. The flaw is CWE-862, and the specific endpoint, feature, or route involved is not described in the available sources. No public exploit identified at time of analysis and there is no CISA KEV entry; the vendor has released a patch and the priority signal is this_month (moderate, not urgent).
SQL injection (CWE-89, base CVSS 6.5) in the amazee.ai Private AI Provider Drupal contrib module lets an attacker inject into SQL statements executed by the module's database layer, with high confidentiality impact and limited integrity impact in the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N). Every site running the module in versions 0.0.0 through 1.3.7, or 1.4.0 through 1.4.3, is affected; exposure is bounded because this is a contrib module that most Drupal installations do not deploy. No confirmed active exploitation (not in CISA KEV) and no public exploit code were identified at time of analysis, and EPSS is low at 0.17% (6th percentile), but the vendor has published a security advisory and a patched release, and the standard Drupal contrib upgrade path applies. Note the published CVE vector scores PR:N while the independent assessment scores PR:L, so the privilege level an attacker needs is not consistently confirmed across sources.
Unauthenticated attackers positioned on the same adjacent network segment can modify data or configuration on affected HPE networking devices, reflected in a CVSS 3.1 base score of 6.5 (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N). No description, CWE, or version range was supplied with this record, so the specific component, product line and trigger must be resolved from the referenced HPE advisory (docId hpesbnw05162en_us). No public exploit code has been identified at time of analysis and the CVE is not in CISA KEV; the Layer-2 adjacency prerequisite keeps it off the directly internet-reachable attack surface.
Unauthenticated forceful browsing in the Drupal contrib module Jsonapi Role Access allows remote attackers to reach JSON:API resources that the module is supposed to restrict by role, with low confidentiality and low integrity impact and no availability effect. Sites are affected only if they run this specific contrib module at a version below the fixed release and have Drupal's JSON:API functionality active; the CVSS vector (AV:N/AC:L/PR:N/UI:N) means no credentials or user interaction are needed once the module is present. Severity is moderate (6.5) and urgency is limited: EPSS is 0.14% (3rd percentile), there is no KEV entry, and no public exploit identified at time of analysis; a vendor patch is available and the priority label is this_month.
The Drupal 'SAML SSO - Service Provider' contributed module (all versions before 3.2.0) omits an authorization check on at least one protected resource, so remote unauthenticated attackers can reach it directly through forceful browsing rather than through the intended SAML-authenticated flow. Successful abuse is bounded to low confidentiality and low integrity impact with no availability effect, and the trigger requires the module to be installed and enabled on a Drupal site plus knowledge or discovery of the specific protected URL. There is no CISA KEV listing and no public exploit identified at time of analysis; EPSS is 0.14% (3rd percentile), and a vendor patch is available.
Missing authorization in the Drupal CSS Usage Analyzer module (versions 1.0.0 through 1.0.2) allows unauthenticated remote attackers to perform forceful browsing against an internet-reachable Drupal site where the module is installed and enabled. The issue is CWE-862 with low confidentiality and integrity impact and no availability impact, rated CVSS 5.4 (moderate); the exact resource or path involved is not described in the available sources. Vendor patching is available per Drupal SA-2026-189, and no public exploit was identified at time of analysis.
Stored cross-site scripting in the Extensions for Leaflet Map WordPress plugin through version 6.0 allows an authenticated user with sufficient content-submission capability to store a script payload that executes in another user's browser when the affected page is viewed. The issue is rated CVSS 6.5 (Medium) with changed scope and required user interaction; impact is bounded to the victim's browser session rather than direct server compromise. No public exploit code or CISA KEV entry was identified in the available intelligence at time of analysis.
Stored cross-site scripting in ND Shortcodes For Visual Composer through version 7.8 allows a low-privilege authenticated WordPress user to inject script that runs in another user's browser when the affected page is viewed. The CVSS 3.1 score is 6.5 with a scope change and low confidentiality, integrity and availability impact; no CISA KEV listing or public exploit code appears in the supplied intelligence.
Stored cross-site scripting in the xootix Waitlist WooCommerce (Back in Stock Notifier) plugin through version 2.9.1 allows an authenticated low-privilege user to submit input that is later rendered as script for a victim who views the affected page. The flaw is rated CVSS 6.5 with network access, low attack complexity, PR:L and UI:R, so exploitation requires a foothold on the WordPress site plus victim interaction, and the plugin must be active alongside WooCommerce. The supplied intelligence does not include a CISA KEV entry, and no public exploit was identified at time of analysis; the vendor-reported advisory is the Patchstack page for the 2.9.1 XSS issue.
Stored cross-site scripting in the Gloriafood Restaurant Menu plugin (WordPress plugin slug menu-ordering-reservations) through version 2.4.4 lets an attacker with a valid low-privileged account on the target WordPress site persist script payloads that execute in another user's browser when that page is viewed. Because exploitation requires both an existing authenticated account (PR:L) and a separate victim to visit the stored content (UI:R), this is a moderate-priority issue rather than an emergency one; anonymous remote compromise is not possible. No public exploit code or active exploitation is indicated in the available data, and EPSS scoring was not provided.
Stored cross-site scripting in the WordPress plugin Off-Canvas Sidebars & Menus (Slidebars) through version 0.5.9 lets an authenticated user holding only low privileges place unsanitized input into a page that is later rendered in another user's browser, executing script in that victim's session (CVSS 6.5, scope changed). Per the assessed vector (PR:L/UI:R) the attacker must already hold a valid WordPress account and must persuade a victim to view the affected page; confidentiality, integrity and availability impact are each rated Low and confined to the browser context rather than server compromise. No public exploit code or CISA KEV entry is associated with this issue at time of analysis, and no EPSS score was supplied, so the decision signal is this-month remediation rather than emergency response.
Stored cross-site scripting in the WordPress plugin Elementor Addon Elements (all versions through 1.14.4) lets an authenticated low-privilege user inject script-bearing content into Elementor widget fields that is later rendered to other users. Because the malicious payload is persisted rather than reflected, any higher-privileged user who views the affected page or post - an editor or administrator reviewing content, for example - executes the script in their own session, enabling session or account takeover within the WordPress installation. The vendor assigns a moderate CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L); there is no confirmed active exploitation (not listed in CISA KEV) and no public exploit code identified at time of analysis, though the low complexity and contributor-level prerequisite make it a realistic risk on multi-author or self-registration-enabled sites.
Stored cross-site scripting in the H5P WordPress plugin through 1.17.9 allows authenticated users with low-level content permissions to inject persistent script into H5P interactive content, which then executes when a victim such as an administrator views the affected page. The issue is rated CVSS 6.5 with vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, reflecting the need for an authenticated authoring account and victim user interaction; no public exploit identified at time of analysis.
OS command injection (CWE-78) in the Drupal 'Cloud' contributed module affects versions 0.0.0 through 7.0.1 and allows an authenticated, low-privileged user to execute arbitrary OS commands, with high impact on confidentiality and integrity and no assessed availability impact. Exploitation requires user interaction and high attack complexity, so successful attacks depend on conditions beyond the attacker's direct control; the module is not part of Drupal core, so sites that do not run it are unaffected. EPSS is low (0.63%, 50th percentile), no CISA KEV listing or public exploit was identified at time of analysis, and the vendor has released a fixed version (7.0.1).
Remote unauthenticated attackers can bypass intended access controls in Cozmoslabs Paid Member Subscriptions through version 3.1.2, reaching plugin functionality that should be gated by membership or access-level rules. The flaw is a missing authorization weakness (CWE-862) rated CVSS 6.5, with low confidentiality and integrity impact and no availability effect; exploitation requirements beyond a reachable WordPress site running the plugin are not fully described in the available sources. No public exploit has been identified at time of analysis, and this is a moderate-priority issue rather than an emergency.
KNIME Business Hub deployments before 1.19.0 fail to enforce network compartmentalization between execution contexts, so an authenticated remote user can reach open network ports on executors that belong to a different execution context. By default no ports are open on executors, meaning the exposure exists only where deployed workflows themselves open listening ports and the attacker knows the target executor's IP address, which keeps realistic risk conditional. The issue is fixed in version 1.19.0, a manual network-policy workaround is available, and no public exploit code was identified at time of analysis.
Blind server-side request forgery in PhpSpreadsheet allows an attacker-supplied spreadsheet (or HTML document) to steer the reading server's outbound image fetch to an internal address, because the operator's isWhitelisted callback is checked only against the initial external-image URL and never against HTTP redirect hops. Only deployments that have explicitly called setAllowExternalImages(true) - the default in BaseReader is false - and that also configure a whitelist which permits the attacker's redirecting host are exposed; those prerequisites make this a non-default configuration issue rather than a universal one. Impact is bounded: the fetched body is validated with isImage() and the temporary file is deleted, so the response is not returned to the attacker and the primitive is limited to triggering blind GET requests, coarse internal reachability probing and reaching endpoints such as cloud metadata services. A public PoC reference describing the redirect chain exists; it is not verified as working exploit code, and there is no confirmed active exploitation (CISA KEV).
Limited information disclosure in MongoDB C# Driver versions 2.26.0 through before 3.13.0 allows unauthenticated remote attackers to surface residual bytes from earlier same-thread processing when an application deserializes crafted BSON into certain primitive collection types. The leak is bounded to a limited amount of data belonging to other requests or principals and depends on exploitable residue being present on the thread at parse time; no public exploit was identified at time of analysis, and the vendor released 3.13.0 as the fix. The vuln.today priority label is this_month.
Path traversal in Checkmarx ast-cli's tar extraction logic on Linux and macOS (versions before 2.3.51) allows a crafted archive containing absolute or '../' entries to write files outside the install directory, including executable files at arbitrary filesystem paths. The only path to exploitation described in the advisory is substituting the archive served at download.checkmarx.com that ast-cli fetches when installing the Vorpal ASCA real-time engine or the SCA Resolver, so the dominant precondition is control of that distribution artifact plus a victim running the install (user interaction required). Windows builds perform the path validation and are unaffected; no public exploit code was identified at time of analysis.
Incorrect authorization checks in Amazon Athena engine version 3 query processing allowed an authenticated AWS principal to read cross-account metadata - specifically AWS account identifiers and SQL statement text - belonging to other AWS accounts. Query results themselves and any data held in Amazon S3 or other connected data sources were never exposed through this flaw, and the CVSS 4.0 score of 6.3 reflects that the confidentiality impact is confined to the downstream (scope-changed) component rather than the vulnerable service. AWS fixed the issue service-side on October 7, 2026, so no customer action is required; there is no CISA KEV listing and no public exploit identified at time of analysis.
A race condition in Traefik's NTLM and Kerberos (Negotiate) backend authentication path lets remote unauthenticated attackers who can multiplex concurrent requests over a single HTTP/2 or HTTP/3 connection corrupt the per-connection sticky round tripper slot, orphaning backend connections, breaking connection-bound authentication, or crashing the proxy. Only deployments that explicitly enable Negotiate backend authentication and accept multiplexed HTTP/2 or HTTP/3 traffic are exposed; exploitation requires winning a timing-dependent race (high attack complexity), and impact is limited to availability and connection integrity with no confidentiality or integrity loss. No public exploit code or CISA KEV entry was identified at time of analysis, making this a moderate, availability-focused issue rather than a top-tier emergency. Affected releases are Traefik 2.11.x before 2.11.58 and 3.x before 3.7.14; vendor patches are available.
Denial of service in com.vaadin.external.google:android-json 0.0.20131108.vaadin1 allows any application that parses untrusted JSON with this artifact to be forced to abort the parsing thread: a roughly 20 KB document of nested arrays drives unbounded recursion until a raw java.lang.StackOverflowError is thrown instead of a catchable JSONException. The flaw is unauthenticated per the CVSS vector (PR:N) and trivial to trigger (AC:L), though it only matters where the application actually routes untrusted JSON through this specific repackaged library; impact is limited to availability of the parsing thread, with no confidentiality or integrity effect. The artifact is a 2013 repackage of third-party org.json classes that is published once and unmaintained, and the maintainer states no fixed version will ever be released, so remediation means replacing the dependency. No public exploit code and no CISA KEV entry were identified at time of analysis; priority per the decision signal is this month, and the risk is bounded because larger thread stacks raise the nesting depth required to trigger the overflow.
Improper certificate validation in the OpenVPN 3 Core library versions 3.4 through 3.11.7 lets an attacker bypass Extended Key Usage (EKU) restrictions during certificate validation, so a certificate that an EKU policy should reject for a given role can still be accepted. The flaw (CWE-295) is rated 6.3 with a network vector, no privileges and no user interaction, but high attack complexity and a present attack requirement reflect that the bypass only matters in deployments that actually depend on EKU constraints as a security control and that the attacker must supply an otherwise trust-chain-valid certificate. No public exploit has been identified at time of analysis and there is no KEV listing; per the vuln.today priority it is tracked for this month, and the vendor (OpenVPN) has published a security announcement.
Checkmarx ast-cli through 2.3.59 fetches the Vorpal ASCA real-time engine and SCA Resolver helper binaries from download.checkmarx.com during its auto-update flow and extracts and executes them without verifying a checksum, so an attacker who could substitute the served archive could get an arbitrary binary executed on developer machines and CI runners. Triggering the vulnerable path requires either a developer using the Checkmarx VSCode/JetBrains extension (which invokes ASCA) or someone running 'cx scan sca-realtime' on an affected version, and exploitation further requires control of the vendor's download endpoint or interception of the download - a high, attacker-uncontrolled barrier reflected in the elevated attack complexity. The vendor has released 2.3.60, which verifies the download against a published SHA-256 checksum before extraction; no public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), placing it in the this_month priority bucket.
OpenBao deployments that rely on role-scoped rate-limit quotas can have those quotas bypassed when a request is sent with a form-encoded body or with a forwarded client certificate, because role resolution fails and the backend-specific quota rule is not enforced. The affected ranges are OpenBao before 2.6.4 and 2.7.0 before 2.7.1; a caller with legitimate access to the token-issuance path can repeatedly issue tokens without consuming the configured role-based rate-limit budget. This is a moderate-severity control bypass rather than an urgent emergency, and no public exploit was identified at the time of analysis; vendor patches are available in 2.6.4 and 2.7.1.
Stored cross-site scripting in OpenCATS before 0.12.0 lets a low-privileged authenticated user plant HTML/JavaScript in the name or title field of a Candidate, Company, Contact, Job Order, or List, which lib/MRU.php's getFormatted() stores unsanitized and renders unescaped in the 'Recent' (MRU) navigation panel present on nearly every page. The script fires only when another user opens or views the poisoned record, so exploitation is a second-order trigger limited by the need for a valid account (PR:L) and by victim interaction (UI:P); meaningful privilege escalation depends on the viewer holding elevated rights such as Site Administrator, in which case session/cookie theft could yield administrative control. Impact is assessed as moderate (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, scope changed) and no public exploit code or active exploitation was identified at time of analysis; the vendor has released 0.12.0 with the escaping fix.
KNIME Business Hub releases prior to 1.19.0 lack an authorization check between users who reach a DataApp through the same 'link without login', letting any holder of that link list - and in some cases access - jobs created by other users through it. The exposure is limited to that per-link job scope rather than the whole Hub, and only exists where an operator has deliberately created and distributed a login-less link; the vendor's documented workaround of removing all such links eliminates the condition entirely. No public exploit code or active exploitation is identified in the available data, and the reported CVSS 4.0 base score is 6.3 (assessed CVSS 3.1: AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N), giving this a moderate, this-month remediation priority rather than an urgent one.
Online Clinic Management System (subhajitkhan/online-clinic-management-system) fails to enforce its appointment-booking workflow correctly, allowing a low-privilege authenticated user to manipulate requests to the patappointtime.php Booking Handler and alter booking state. The project is a niche self-hosted PHP application, and the CVSS 4.0 base score of 5.3 reflects low integrity and availability impact confined to the booking workflow, with no confidentiality exposure. A public PoC reference exists in the form of an upstream GitHub issue; it is not verified as working exploit code, and there is no confirmed active exploitation. The vendor was notified early via an issue report but has not responded, and the fix is identified as commit e9ee77a8827a1446220fa07ee693dc4d9a29a578.
Reflected cross-site scripting in LocalStack 4.9.2 lets a remote, unauthenticated attacker execute arbitrary JavaScript in a victim's browser when the victim opens a crafted URL while interacting with the LocalStack web interface. The CVSS 3.1 score is 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), reflecting the required user interaction and browser-scoped impact. No confirmed active exploitation is reported (not in CISA KEV) and EPSS is 0.15% (4th percentile); a public write-up reference exists but is not verified as working exploit code.
Password handling in patientregistration.php of subhajitkhan's online-clinic-management-system (through commit e9ee77a8827a1446220fa07ee693dc4d9a29a578) fails to encrypt the pat_pswd and doc_pswd credential values, exposing sensitive data (CWE-311). The vendor's CVSS 4.0 score of 5.3 reflects a network-reachable but low-privilege-authenticated precondition (PR:L, no user interaction); our independent assessment rates it CVSS 3.1 5.3 with only low confidentiality impact and no integrity or availability effect. No CISA KEV entry exists and no public exploit has been verified - the referenced GitHub issue #9 is a public PoC reference only and is not confirmed working exploit code - so the practical risk is constrained by the project's small deployment footprint and the low impact, keeping this at routine, non-emergency priority.
Authenticated NETCONF peers can crash libyang-based servers such as netopeer2 by sending an rpc <action> envelope containing non-whitespace character data to lyd_parse_op(), causing an uninitialized pointer free in lydxml_env_netconf_rpc() and possible heap corruption. The issue affects libyang through 6.4.13 and is a moderate-priority, authenticated denial-of-service flaw: exploitation requires an established NETCONF session, and whether the result is a reliable crash or heap corruption depends on memory state (AC:H/AT:P). No CISA KEV entry or confirmed working exploit code is described in the supplied data; a public technical writeup is referenced, and a vendor patch commit is available.
libmongocrypt 1.0.0 through 1.21.0 builds requests to AWS, Azure and GCP key management services with unvalidated values from key vault documents, KMS provider configuration and KMS responses, so a user with authenticated write access to the key vault collection can alter request structure or token claims that the library signs with application credentials. This medium-severity issue (CVSS 6.0) requires that prior write access and a subsequent key-management operation, meaning an unauthenticated external attacker has no path; no public exploit was identified at time of analysis. The vendor fixed the issue in libmongocrypt 1.21.1 by validating inputs before interpolation into KMS HTTP requests.
Cross-organization insecure direct object reference in Lotus (uselotus/lotus) through 0.10.2 lets an authenticated user or a valid API key from any organization read, cancel, update, switch plans on, or modify add-ons of another tenant's subscription - and therefore alter that tenant's billing - by supplying the victim's subscription_record_id to SubscriptionViewSet. The handler resolves the object from the unscoped queryset rather than the organization-filtered one, so tenant isolation is not enforced; no special configuration is needed because this is the default code path on multi-organization deployments. An upstream fix exists in pull request #802 / commit 1375d5140795d72251c89f47200879b9bd1d6d96, but no released patched version is independently confirmed, and no public exploit code was identified at time of analysis; the practical constraint is that the target subscription_record_id is a UUID and must be known or enumerated.
Improper input validation in the Appointment Booking component of subhajitkhan's Online Clinic Management System (source tree up to commit e9ee77a) lets a logged-in low-privilege user tamper with the day, time and appdate parameters handled by patappointtime.php. The result is low-integrity and low-availability impact on booking data with no confidentiality exposure, rated 5.1 under CVSS 4.0; exploitation requires an authenticated booking-capable account and some user interaction. The project maintainer was notified through an issue report but has not responded, and the referenced public PoC is an unverified issue-report link rather than confirmed working exploit code, so no public working exploit has been established at time of analysis.
Uncontrolled recursion in Silicon Labs EmberZNet 9.1.1 and earlier allows a device that has already joined the same Zigbee mesh to crash or hang a target node by sending a malformed Price Cluster Publish Billing Period command, producing a high availability impact with no confidentiality or integrity effect. Exposure is narrow by design: only nodes that implement the Price Cluster are affected, and the triggering frame must originate from an already-commissioned device on the same network, so the PR:L metric reflects network membership rather than arbitrary remote reach. The issue is not listed in CISA KEV and no public exploit was identified at time of analysis; the priority signal places it in the current month's remediation queue rather than emergency patching.
Malformed Discover Attributes commands sent to EmberZNet 9.1.1 and earlier can drive the Zigbee stack into an unreachable-exit loop, causing a denial of service on devices that support manufacturer-specific clusters. The attacker must already control a device joined to the same Zigbee network, so this is not reachable by an off-network or internet-based attacker; impact is availability-only (CVSS 4.0 base 6.0, assessed CVSS 3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H) with no confidentiality or integrity effect. There is no CISA KEV entry and no public exploit identified at time of analysis, and the vuln.today decision label is this_month.
Silicon Labs EmberZNet 9.1.1 and earlier crashes when a device that is already a member of the Zigbee network sends a malformed GetGroupMembership message to a node that implements the Group Cluster, because the request is handled without sufficient bounds checking on a stack buffer (CWE-121). Only a limited number of values can be written and no route to remote code execution was observed, so the practical outcome is a denial of service against the affected node rather than takeover. The CVSS 4.0 vector requires low privileges (PR:L) and prior network presence, the affected software is a constrained embedded stack, and no public exploit has been identified at time of analysis; this is a medium-severity availability issue rather than a high-impact priority, and the vendor-reported decision label places remediation in the current monthly cycle.
Cross-site scripting in the 'Query' argument handled by patdocmsg.php in subhajitkhan's online-clinic-management-system (all code through commit e9ee77a8827a1446220fa07ee693dc4d9a29a578) allows an authenticated low-privilege user to inject script that executes in another user's browser when that second user views the affected page. The vendor has been notified through a public issue report but has not responded, and no fixed version is available; a public PoC reference exists (GitHub issue #8), but it is not verified as working exploit code and there is no confirmed active exploitation (CISA KEV). Priority is low - the project is an obscure individual GitHub repository, authentication and victim interaction are both required, and the assessed impact is confined to low integrity with no confidentiality or availability loss.
Credential disclosure in NewType Infortech's NT OneAPP mobile application allows remote attackers to obtain a logged-in user's NUP Portal passcode by luring them through an HTTP Basic Authentication challenge raised from unvalidated content loaded in the app's WebView. Successful exploitation requires the victim to already be authenticated and to actively respond to the spoofed challenge, and the vendor describes additional undocumented preconditions, so the flaw is conditional and not reliably reproducible across deployments; no public exploit code or confirmed in-the-wild activity is associated with it at time of analysis. Rated medium severity (CVSS 4.0 base 5.9; independently assessed CVSS 3.1 5.8 with high attack complexity and required user interaction).
Heap memory corruption in the Apache mod_qos module allows a remote attacker to crash the web server process by holding many concurrent low-rate connections open, overflowing the fixed-size array the module uses to record client IP addresses. The vulnerable code path is only reached when mod_qos connection rate monitoring (per-client connection tracking directives) is enabled, and the attacker must simultaneously sustain a large number of slow connections to exceed the allocated buffer - reflected in the CVSS 3.1 score of 5.9 (AV:N/AC:H/PR:N/UI:N/A:H) and the AC:H rating. No public exploit code or confirmed active exploitation was identified at time of analysis; the practical barrier is the non-default configuration plus the sustained-connection effort required.
Denial of service in Wasmtime's wasi:http implementation allows an attacker-controlled WebAssembly guest to panic and crash the host embedding by setting the between-bytes-timeout request option to zero. Wasmtime 46.0.0 through 48.0.3 and 49.0.0 through 49.0.1 are affected when embedders expose wasi:http APIs with the default-send-request Cargo feature enabled, which is the default; the issue requires low privileges (PR:L) and has availability-only impact. No public exploit was identified at time of analysis, and fixed releases 48.0.4 and 49.0.2 clamp the timeout to 1 nanosecond.
Host memory exhaustion (denial of service) in the Wasmtime WebAssembly runtime: a malicious WebAssembly guest can drive the WASIp2 write-zeroes method on the wasmtime-wasi SinkOutputStream into an unbounded host allocation, consuming available memory on the embedding host. Only embeddings that do not configure stdout/stderr streams are exposed, since unconfigured stdio falls back to SinkOutputStream, whose check-write limit was previously unlimited; embeddings with explicitly configured streams enforce their own limits and are not affected. The assessed vector (AV:N/AC:H/PR:L/UI:N, availability-only impact) supports a moderate, conditional risk, and no public exploit code was identified at time of analysis, though the flaw is a partial-fix bypass of an earlier advisory (GHSA-852m-cvvp-9p4w).
Wasmtime 47.0.0 through 48.0.3 and 49.0.0 through 49.0.1 accept ill-formed WebAssembly components in which a core module imports a tag whose type is a subtype of the imported tag's declared type, which the specification forbids; a malicious guest can use this to mis-type an exception object payload and corrupt the runtime's GC heap, causing Wasmtime to panic. Exposure requires the WebAssembly exceptions proposal to be enabled (on by default from 47.0.0) and the embedding to instantiate untrusted guest components, and the CVSS vectors indicate authenticated remote access with user interaction. Impact is bounded to availability: the GC heap is designed to tolerate corruption, so the vendor-characterised outcome is a host panic rather than code execution, yielding a moderate-severity denial-of-service rather than an emergency; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Header injection in Roundcube Webmail's Bounce (resend) action affects installations before 1.6.20 and 1.7.x before 1.7.5, where rcube_mime::decode_address_list() failed to strip control characters from decoded From display-names, allowing CRLF sequences in an RFC 2047 encoded word to insert arbitrary headers into the message produced when a user resends it. Attackers need only deliver a crafted email and persuade the victim to invoke Bounce; unauthenticated remote attackers can trigger it, but the mandatory user interaction confines abuse to targeted social-engineering scenarios with integrity-only impact. No public exploit code or confirmed active exploitation was identified at time of analysis, and vendor patches are released in 1.6.20 and 1.7.5.
fpdf2 through 2.8.7 dereferences image resource references supplied to FPDF.image(), write_html() HTML <img src> values, SVG <image href>/xlink:href values and template image fields, so attacker-controlled content rendered by an integrating application can trigger outbound HTTP(S) requests to attacker-chosen internal or external destinations (CWE-918 SSRF) as well as attempts to open raw local filesystem paths. The impact is bounded: local content is only embedded when the referenced path resolves to a valid supported image or SVG resource, and file:// URLs are not specially handled, so the local-path case requires a raw path such as '../../file.png'. The vendor scores this 5.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N), exploitation depends entirely on the application passing untrusted values into those APIs without an allowlist or restrictive policy, and no public exploit code has been identified at time of analysis; version 2.8.8 introduces a configurable resource_access_policy whose default blocks private, loopback and link-local network targets.