Missing authentication in ABB Ability Edgenius through 3.2.3.0 exposes a critical function that can compromise confidentiality, integrity, and availability; ABB's CVSS vector describes local access, high complexity, and low privileges, while the independent assessment rates local access, low complexity, and no privileges. No public exploit code or active exploitation has been identified at time of analysis, and the supplied decision signal prioritizes remediation this week.
An out-of-bounds heap write in the MongoDB C Driver (libmongoc) can corrupt client process memory and crash the client application when an excessively long credential value is supplied through the client's connection configuration while the Windows-native Kerberos/SSPI authentication path is in use. Only client builds compiled with the Windows SSPI authentication backend and configured for Kerberos/GSSAPI are affected - specifically 1.6.0 through 1.30.13 and 2.0.0 through 2.5.6 - and the flaw is reachable only by a party who already controls the client-side configuration, requires high privileges, and is local/configuration-based rather than remotely reachable (CVSS 4.0 5.7; assessed 3.1 AV:L/AC:H/PR:H). The primary outcome is memory corruption and denial of service of the client process itself, not compromise of the MongoDB server. No public exploit code has been identified, the issue is not in CISA KEV, and vendor-released fixes are available in 1.30.14 and 2.5.7.
draw.io Desktop 31.4.2 and earlier can disclose the contents of arbitrary local files to script running in the app's own file:// origin, because the Electron main-process read handlers (readFile, getFileDrafts, getBkpFile, fileStat, isFileWritable, checkFileExists, watchFile) never apply the blessed-path authorization that the write handlers enforce. Exploitation is conditional: it requires attacker-controlled script already executing in that origin - per the advisory, a renderer XSS in the drawio webapp reached when a victim opens a malicious diagram - and the readable set is bounded by a content sniff that admits files beginning with '{' or '[' plus known diagram/media formats, or .mmd/.mermaid extensions; the impact is read-only disclosure, with no write, modification, or denial of service. The advisory publishes a PoC of the readFile IPC primitive; it is not verified as working exploit code, and no confirmed active exploitation is reported. Version 31.4.4 contains the vendor-released patch.
Arbitrary file write in the OpenShift oc client's image extract command allows an attacker who supplies a malicious container image to place content outside the intended extraction directory with the privileges of the user running oc image extract. Red Hat OpenShift Container Platform 4 is affected because the client does not properly sanitize symbolic and hard link targets that are absolute paths or sibling directories, and the impact is limited to integrity (CVSS 5.5, AV:L/UI:R). No public exploit code or confirmed active exploitation has been identified in the available intelligence, and the risk is assessed as real but non-urgent.
HPE networking products can expose limited information and permit limited integrity impact to an authenticated high-privilege administrator; the issue is network reachable with low complexity and no user interaction, and the scope-changed flag means impact may extend beyond the initially vulnerable component. The CVSS score is 5.5 (medium), and no public exploit was identified at time of analysis. Exact models and firmware versions are not identified in the provided data, so affected deployments should be confirmed against HPE bulletin hpesbnw05162en_us; this is a routine, scheduled-patch item rather than an emergency.
Arbitrary file creation outside the intended working directory affects users and automated workflows running GNU patch, specifically when automatic patch reversal processes a crafted patch whose header contains an absolute file path that is accepted instead of rejected. The result is limited to integrity impact: files can be created in arbitrary locations, but only with the permissions of the user or pipeline account executing the utility, with no confidentiality or availability impact and no privilege gain beyond that account's existing rights. Exploitation requires a local attack vector and user interaction - a victim or a CI/CD pipeline must apply the attacker-supplied patch - and no public exploit, PoC reference, or CISA KEV entry is present in the available data; the assigning vendor is Red Hat, with RHEL 6 through 10 and Red Hat Hardened Images listed as affected.
Server-side request forgery in Authlib's RFC 9101 JWTAuthenticationRequest (JAR) extension lets unauthenticated remote attackers who know any valid public client_id drive the authorization server's outgoing fetch of an attacker-chosen request_uri. The flaw only materialises in deployments that implemented the abstract get_request_object() hook as an unrestricted outbound fetch, exactly as Authlib's own docstrings demonstrated; the library itself performs no network request, so installations whose override already enforces a scheme/destination allowlist and retrieval limits are unaffected. Affected releases are 1.6.0 through 1.8.x, fixed in 1.9.0, and a public PoC reference exists (demonstrating the unvalidated URI reaching the hook with no network egress); it is not verified as working exploit code, and there is no KEV or active-exploitation signal. Impact is a blind primitive: fetched bodies are consumed as a JWT and never reflected, so attackers get an error-type and timing oracle for internal host and port discovery rather than direct data exfiltration.
Server-side request forgery in the Drupal Webform contributed module (versions 0.0.0 through 6.2.12 and 6.3.0 through 6.3.1) lets a user who holds a low-privileged authenticated account on the Drupal site cause the module to issue requests from the server, with limited confidentiality and integrity impact. Exploitation requires a valid account (CVSS PR:L) but no user interaction and no special complexity, so the practical barrier is simply having a foothold login on the site. The vendor has released a patch per the Drupal advisory, EPSS is low at roughly 0.20% (9th percentile), and no public exploit has been identified at time of analysis; the priority is a routine this-month remediation rather than an emergency response.
Forceful browsing in the Drupal contributed Webform module lets a low-privileged authenticated user reach webform resources that are not protected by sufficiently granular access checks, yielding partial confidentiality and integrity impact with no availability effect. The flaw affects Webform releases from 0.0.0 through 6.2.12 and 6.3.0 through 6.3.1 (EUVD narrows the ranges to before 6.2.12 and before 6.3.1), and is scored 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) per the vendor/NVD vector. Exploitation requires a valid low-privileged account on the target site, no user interaction, and network reachability; EPSS is low at 0.20% (9th percentile), there is no CISA KEV listing, and no public exploit code was identified at time of analysis, with priority classified as this_month.
Authorization bypass (CWE-639) in the myCred WordPress plugin through 4.0.0-beta.1 lets an authenticated low-privileged user - on sites with open registration, any ordinary subscriber - reference another user's record by supplying a user-controlled key, altering or disrupting data the attacker does not own. The CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) scores it 5.4: no confidentiality exposure, limited integrity and availability impact, and authentication is mandatory (PR:L), so fully anonymous attackers are out of scope. No public exploit identified at time of analysis; the specific feature or endpoint carrying the vulnerable parameter is not described in the available sources, and patch status lags - only a Patchstack database entry for 4.0.0-beta.1 is referenced, with no fixed version stated.
Low-privileged authenticated users can change eRoom WordPress plugin settings because versions through 1.7.1 fail to enforce a proper authorization check on settings-change functionality, affecting the integrity and availability of Zoom meeting and webinar configuration. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L, so a valid low-privilege account-not unauthenticated access-is the key prerequisite, with no user interaction required. No public exploit identified at time of analysis, and no CISA KEV confirmation was provided.
Stored cross-site scripting in the Drupal Webform contributed module allows an authenticated user holding a Webform-related permission to persist content that Webform later renders to other users, so a reviewer or administrator viewing that content may have script execute in their session. The flaw is a CWE-267 'privilege defined with unsafe actions' problem - a role is granted a capability whose resulting actions are not safely constrained - and it affects Webform 0.0.0 through 6.2.12 and 6.3.0 through 6.3.1, with sites on the fixed releases not exposed. Severity is moderate (CVSS 5.4; the independent assessment raises scope to changed, S:C) with a low EPSS of 0.18% (7th percentile), no CISA KEV listing, and no public exploit identified at time of analysis; the vendor reports a patch is available and the priority decision is this_month. Authentication requirements are confirmed from the CVSS vector (PR:L, low-privileged authenticated), and because the payload is stored, a second victim user must subsequently view the affected content for execution.
Reflected cross-site scripting (CVSS 5.4) affects the Drupal contrib module 'Email Verification / SMS Verification / OTP Verification' in all versions from 0.0.0 through 2.4.0, allowing an attacker who convinces a victim to open a crafted URL to execute script in that victim's browser session on the Drupal site. No authentication is required of the attacker, but exploitation depends on victim interaction (UI:R) and the specific reflecting parameter is not described in the available sources. No public exploit code or active exploitation is known, EPSS is low at 0.16% (5th percentile), and the vendor has released a patch in version 2.4.0.
Path traversal (CWE-22) in the Drupal contributed module Media Library Importer affects versions from 0.0.0 through 2.1.6, allowing an authenticated user with access to the module's media-import functionality to write or read files outside the intended restricted directory, with limited confidentiality and integrity impact and no availability effect. The CVSS 3.1 base score is 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N), so exploitation requires a low-privileged account and is not possible anonymously. No active exploitation has been observed (CISA SSVC Exploitation: none, EPSS 0.16%), and no public exploit code is identified in the available sources; default Drupal installations are unaffected because the module is a non-core add-on that must be explicitly installed.
The Drupal contrib module Key auth (versions 0.0.0 through 2.2.4) can store sensitive authentication data in the web browser cache because of missing or incorrect cache-control handling, a CWE-525 weakness that also reflects incorrectly configured access-control levels in the module. Low-privilege authenticated users (CVSS PR:L) could recover that cached material over the network, yielding limited confidentiality and integrity impact for a base score of 5.4. Patch data shows a vendor fix is available, EPSS is only 0.15% (4th percentile) and there is no KEV listing; no public exploit identified at time of analysis, and the priority label is this_month rather than immediate action.
Improper authorization in FreeIPA lets any enrolled host retrieve and revoke X.509 certificates belonging to other users or services, disrupting those services, because ownership is checked only by matching the host name to the certificate subject Common Name. The flaw is moderate severity (CVSS 5.4) and requires an authenticated host principal (PR:L); Red Hat tracks it for remediation this month, and no public exploit was identified at time of analysis.
The contributed Drupal module SAML SSO - Service Provider (versions 0.0.0 through 3.2.0) contains an open-redirect weakness that lets an attacker craft a link which sends a victim to an untrusted destination under the guise of the trusted Drupal site, enabling phishing and source-of-data spoofing. No authentication is required of the attacker (CVSS 3.1 vector PR:N), but the attack cannot succeed without a victim clicking the crafted link (UI:R), and impact is limited to low confidentiality and integrity effects with no availability loss. Exploitation has not been confirmed via CISA KEV and no public exploit code was identified at time of analysis; EPSS is 0.14% (3rd percentile), and the risk picture is consistent with a medium-severity, socially engineered redirect issue rather than an emergency - a vendor fix is available by upgrading past 3.2.0.
Missing authorization in the MarketKing multivendor marketplace plugin for WordPress/WooCommerce through 2.1.72 allows an authenticated low-privilege account to perform marketplace actions beyond its intended permissions, affecting limited confidentiality and integrity (CVSS 5.4, CWE-862). The flaw is network-reachable and requires only a valid low-privilege account, so sites that allow vendor or customer self-registration have broader exposure. No public exploit code or confirmed active exploitation was identified in the provided intelligence at time of analysis.
Cross-site request forgery in the Drupal Tawk.to Live Chat module (versions 0.0.0 through 3.0.4) lets an unauthenticated remote attacker induce a logged-in, privileged Drupal user to submit unintended requests, with limited confidentiality and integrity impact. The attacker needs no account of their own, but exploitation requires an active victim session and user interaction (UI:R). EPSS is 0.10%, no public exploit was identified at the time of analysis, and a vendor patch is available via Drupal SA-CONTRIB-2026-184.
Arbitrary code execution in Pylint (0.15.2 through 4.0.8) stems from the linter persisting its per-module statistics as Python pickles inside PYLINT_HOME and reloading them with pickle.load on the next invocation. An attacker who can write into that cache directory - for example a shared, group-writable, or otherwise untrusted PYLINT_HOME on a multi-user host or CI runner - can drop a crafted serialized stats file with a predictable name, and code then executes with the privileges of whoever next runs Pylint against that cache. The default per-user cache (~/.cache/pylint) is writable only by the invoking user, so exploitation requires a non-default or misconfigured shared cache plus local write access; no public exploit code or confirmed active exploitation was identified at time of analysis, and the vuln.today priority label is 'this_month'.
Denial of service in OpenTelemetry Python (opentelemetry-api through 1.45.0) lets a single unauthenticated request carrying an oversized W3C tracestate header burn roughly 6-12 seconds of CPU, and on asyncio servers stall every other connection on the event loop for that duration. The flaw is a quadratic-time regex split in TraceState.from_header that is reached automatically through the default tracecontext propagator, so any service instrumented with something like opentelemetry-instrumentation-asgi is affected without special configuration; exploitation is gated by the fronting HTTP parser's header-size limit, with gunicorn and uvicorn's h11 parser rejecting the header while waitress and uvicorn's default httptools parser accept it. A working proof-of-concept with measured timings is included in the upstream advisory (public PoC reference), but no confirmed active exploitation (CISA KEV) is indicated in the supplied intelligence, and the assessed CVSS of 5.3 reflects availability-only impact (C:N/I:N/A:L).
Uncontrolled resource consumption in Roundcube Webmail's CSS proxy endpoint (utils/modcss) lets an attacker who can make the server fetch a stylesheet from an attacker-controlled host exhaust server memory, because the fetched response was buffered in full with no size cap and no read timeout. The problem affects releases before 1.6.20 and 1.7.x before 1.7.5, and the resulting impact is availability-only - no data disclosure or modification (CWE-770, A:L). Reaching modcss in normal deployments presupposes a valid webmail session (the assessed vector is PR:L), and no public exploit code or in-the-wild exploitation has been identified at time of analysis. Vendor-released patches exist in 1.6.20 and 1.7.5.
Roundcube Webmail installations before 1.6.20 and 1.7.x releases before 1.7.5 can be tricked into loading attacker-controlled remote content from an HTML email without the recipient's consent. The built-in HTML sanitizer (rcube_washtml) only recognized a limited set of CSS escape spellings of the url() token, so a sender can write the same FuncIRI reference as \000075rl(, u\72 l(, or u\rl( inside a presentation attribute or an SVG SMIL animation and slip past the remote-content blocker when the victim simply opens the message. The result is limited to privacy leakage - read receipts, client IP address, and tracking-pixel-style confirmation of message display - with no code execution, data disclosure, integrity, or availability impact; a vendor patch ships in 1.6.20 and 1.7.5, and no public exploit code was identified at time of analysis.
Remote-content blocking bypass in Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 lets a remote unauthenticated attacker send a crafted HTML email that causes external content to load when the victim opens the message, disclosing the recipient’s client IP address and confirming that the message was read. The flaw is a privacy issue limited to metadata disclosure-no email content, credentials, or code execution is exposed-and it matters only when Roundcube’s remote-content blocking is enabled. No public exploit code was identified at the time of analysis; exploitation requires the victim to open the specific message (CVSS 3.1 UI:R).
GeoJSON documents written through the MongoDB C# Driver can be persisted with duplicate geometry members, so the server and the driver resolve different values for the same record and affected documents may become unreadable through the driver, interrupting application read paths. Exposure is limited to applications running driver versions 1.8.0 up to but not including 3.13.0 that copy user-supplied field names into GeoJSON extra members and allow those names to collide with reserved members such as type and coordinates; standard GeoJSON usage without attacker-controlled extra-member names is unaffected. The CVSS 4.0 base score is 5.3 (authenticated, network-reachable, confidentiality none, integrity low, availability low), no public exploit was identified at time of analysis, and the vendor has released 3.13.0 as the fix.
Path traversal in the squirrelmail_usercopy migration plugin of Roundcube Webmail allows an authenticated low-privilege user to read files outside the configured SquirrelMail data directory and have their contents imported into their own account. Only deployments prior to 1.6.20, and 1.7.x prior to 1.7.5, that have the plugin enabled with squirrelmail_driver set to 'file' and a populated squirrelmail_data_dir are affected; the disclosure is read-only (confidentiality impact only, no integrity or availability loss) and requires the attacker to control a login name containing a slash. No public exploit code has been identified at time of analysis, and the weakness is confined to a non-default SquirrelMail-migration component rarely deployed in production, so this is a medium-severity (CVSS 5.3) information-disclosure issue rather than a high-priority emergency.
Information disclosure in webpack-dev-server 5.1.0 through 5.2.6 and 6.0.0 lets an unauthenticated network peer reach the unauthenticated /webpack-dev-server/open-editor endpoint and bypass Host validation with a malformed Host such as 'file:badport', causing URL construction to throw. In the default non-production mode the resulting HTTP 500 includes the full exception stack trace, exposing absolute filesystem paths, installed module locations, and internal source line numbers; the server stays up, so there is no denial of service. Exploitation requires the dev server to be network-reachable, and no public exploit was identified at time of analysis.
An authorization bypass in Incus (the Go-based container and VM manager) allows an authenticated user holding instance-creation rights in a restricted project to reach the pull-mode migration path that restricted projects are supposed to block, by sending a clustered migration request with 'refresh' set against an instance they already own. The result is server-side request forgery: the clustered Incus daemon opens an outbound TLS websocket connection to an attacker-chosen URL and trusts an attacker-supplied certificate, letting the user probe services reachable from the server. Standalone servers are explicitly not affected, no configuration or storage bypass results from the refresh, and no public exploit has been identified at the time of analysis.
Security-rule bypass in mod_qos allows unauthenticated remote attackers to conceal prohibited request values from configured QoS/security inspection. The flaw is an off-by-one pointer calculation in the code path that merges request-body parameters with an existing URL query, so the string evaluated for policy is truncated while the actual request remains unchanged. This is a moderate-severity (CVSS 5.3) control bypass affecting Apache HTTP Server deployments that rely on mod_qos query/parameter filtering; no public exploit was identified at time of analysis.
Update operator injection in the MongoDB C# Driver (versions 2.13.0 up to, but not including, 3.13.0) lets a replacement document submitted through FindOneAndReplace be interpreted by the server as an update document when its top-level field names begin with a dollar sign, which the other replace code paths already reject. Only applications that build replacement-document top-level field names from untrusted input are exposed, and an authenticated, low-privileged user of such an application can then alter the single document already selected by the application's own filter - no records outside that filter are reachable, and there is no confidentiality or availability impact, only unintended modification of that document's contents. There is no public exploit identified at time of analysis, no confirmed active exploitation (not in CISA KEV), and the vendor has released a fixed version (3.13.0), making this a code-hygiene and defense-in-depth fix to schedule rather than an emergency.
SmileCDR HAPI FHIR contains a moderate-severity authorization bypass in the FHIR conditional create operation: an authenticated user with CREATE but not READ permission can receive the contents of an existing resource when the conditional create predicate matches it. Exploitation requires valid low-privilege credentials and a predicate that successfully identifies the target resource, so disclosure is constrained by how guessable or enumerable the search criteria are. No public exploit was identified at time of analysis; the supplied priority is this_month.
Bytebase before 3.16.0 contains an authorization bypass in the UpdateIssueComment handler that lets authenticated users with any project role, including Project Viewer, overwrite issue comments in projects they cannot access. The attacker supplies a comment UID from a foreign project while setting the parent to an issue in their own project, and the handler modifies the comment without verifying the parent-child relationship. The assessed impact is limited to comment integrity (CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N); no public exploit was identified at time of analysis, and the vendor has released 3.16.0 as the fix.
Open redirect in the OpenBao UI's OIDC identity provider allows attackers to craft OIDC links that send unauthenticated users to attacker-controlled destinations, enabling phishing or credential theft. OpenBao versions before 2.6.3 are affected, and exploitation requires the UI to be explicitly enabled (it is disabled by default via `ui = false`) and a victim to click a crafted link. No public exploit has been identified at time of analysis, and the vendor has released patches in 2.6.3 and 2.7.0.
Blind server-side request forgery in WWBN AVideo before 29.4.0 allows authenticated users with uploader privileges to make the server issue GET requests to arbitrary internal hosts by storing a videoLink that points to an attacker-controlled redirector. The initial URL passes isSSRFSafeURL(), but get_headers() follows the 302 without re-validating the redirect target, and the resulting embed-versus-video render difference gives a blind oracle for internal port and service reachability. Only a limited confidentiality/integrity impact is achievable (CVSS 5.3, PR:L, scope-changed) and no public exploit code or confirmed active exploitation was identified at time of analysis; a vendor patch exists in 29.4.0.
Information disclosure in the WP Desk ShopMagic WooCommerce plugin (versions through 4.9.1) allows remote attackers to retrieve embedded sensitive data from an externally accessible file or directory, with confidentiality-only impact rated Low. The supplied CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates the issue can be reached over the network without authentication or user interaction, and the plugin is a WordPress/WooCommerce automation tool, so exposed site data may be at risk. This is a moderate-severity disclosure flaw rather than a top-tier priority; no public exploit code has been identified at time of analysis and the CVE is not in CISA KEV, with a this_month priority label.
Unauthenticated remote attackers can bypass access controls in the Drupal Webform contributed module to read data that should be restricted, affecting versions 0.0.0 through 6.2.12 and 6.3.0 through 6.3.1. Rated CVSS 5.3 with low confidentiality impact only, the flaw cannot modify or delete content and does not affect availability, so exposure is limited to unauthorized disclosure via direct requests to access-controlled Webform resources. No public exploit code or active exploitation is confirmed at time of analysis, and EPSS sits at 0.20% (9th percentile), consistent with a moderate rather than urgent patching priority.
Unauthenticated remote attackers can bypass authorization checks in the Drupal Webform contributed module and reach resources they are not entitled to via forceful browsing, with the impact confined to limited confidentiality exposure (C:L; no integrity or availability effect). Sites are affected if they run Webform releases inside the ranges listed by the vendor and EUVD (0.0.0 through 6.2.12, and 6.3.0 through 6.3.1); the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N puts the score at 5.3, meaning no credentials or user interaction are needed against a default install. Exploitation pressure is currently low - EPSS 0.20 percent (9th percentile), no CISA KEV entry, and no public exploit identified at time of analysis - and a vendor patch is available, so this is a moderate-severity information-exposure issue to schedule rather than an emergency.
Missing authorization in Drupal's Webform Submissions Delete contributed module, versions 0.0.0 through 1.2.0, allows remote attackers to delete stored webform submissions by directly requesting the deletion route, affecting integrity only. The module must be installed and enabled on a site holding submissions; the CVSS vector is AV:N/AC:L/PR:N/UI:N with I:L, though the supplied sources do not explicitly confirm whether anonymous or low-privileged access suffices. No public exploit has been identified at time of analysis, EPSS is 0.19% (8th percentile), a vendor patch is available, and the priority is this_month rather than emergency.
Stored cross-site scripting in Mistune's `Include` directive (fixed in 3.3.0) allows an attacker who can plant a `.html`/`.xhtml`/`.htm` file anywhere the renderer can read it to have that file's contents emitted as raw `block_html` and executed in the application's origin. Real-world exposure is narrow and highly conditional: the deployment must explicitly enable `RSTDirective([Include()])`, construct the renderer with `escape=False`, run in a filesystem context where `state env['__file__']` is set, and the attacker must already have a separate file-write primitive plus a victim who views the rendered page - with the documented default `escape=True` the included HTML is entity-escaped and the chain fails. No CISA KEV listing or active exploitation is reported; a working proof-of-concept reproduction (verified against mistune 3.2.1) is published in the upstream GitHub advisory, and the bug is rated this_month in priority rather than emergency.
Missing authorization (CWE-862) in the ЮKassa для WooCommerce (yookassa) WordPress plugin affects all versions through 2.17.3 and lets remote, unauthenticated requests reach functionality that should require proper access-control checks. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, 5.3) indicates the exposure is limited to low confidentiality impact, with no integrity or availability effect and no user interaction required. The specific endpoint, action, or plugin configuration that triggers the missing check is not described in the available sources, and there is no CISA KEV entry or confirmed public exploit code at time of analysis; the vuln.today priority decision is 'this_month', pointing to limited rather than urgent real-world risk.
Unauthenticated visitors to WordPress sites running the miniOrange Page Restriction WordPress (WP) plugin through version 1.6.0 can reach pages and posts the plugin was configured to protect, disclosing content administrators intended to keep private. The issue is a missing authorization check (CWE-862) rated CVSS 5.3, with impact limited to confidentiality - no integrity or availability effect - so its real-world severity depends on how sensitive the restricted pages are. No public exploit identified at time of analysis and no confirmed active exploitation; the priority signal places it in the 'this month' remediation window rather than an emergency response.
Missing authorization in the Brainstorm Force SureDash WordPress plugin through 1.12.2 allows unauthenticated, network-based attackers to reach functionality that should require access checks, with low confidentiality impact and no integrity or availability impact under the assessed CVSS vector. The vulnerable endpoint and protected resource are not described in the available sources, so default-configuration exploitability cannot be confirmed, and realistic impact depends on the site's SureDash access-level configuration. No public exploit identified at time of analysis and no CISA KEV entry is present; the priority is this_month, consistent with a moderate, not emergency-level, issue.
SureDash WordPress plugin through 1.12.2 contains a missing authorization flaw (CWE-862) that can expose low-sensitivity information to unauthenticated remote attackers. The Patchstack description ties exploitation to incorrectly configured access-control security levels, but the specific endpoint and whether a non-default access-level configuration is required are not specified in the supplied sources; impact is limited to confidentiality with no integrity or availability effect. No public exploit was identified at time of analysis, and the issue is assessed as moderate severity and low priority (decision label: this_month).
Falcon - WordPress Optimizations & Tweaks plugin through 2.12.0 exposes restricted information to unauthenticated remote attackers because of a missing authorization check (CWE-862). The CVSS 3.1 score is 5.3 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, indicating network reachability, low attack complexity, no authentication or user interaction, and only a low confidentiality impact with no integrity or availability impact. No public exploit was identified at time of analysis; the primary precondition is that a WordPress site runs the vulnerable plugin version and exposes the affected code path.
An unauthenticated, network-reachable information disclosure issue affects an HPE networking product documented in HPE security bulletin hpesbnw05162en_us; the CVSS 5.3 score reflects low integrity impact with no confidentiality or availability loss per the vendor's vector. Because no description was published, the specific feature, protocol, or configuration that triggers the flaw is not described in the available sources, and affected version ranges must be read directly from the HPE advisory. No public exploit code or CISA KEV confirmation accompanies this record, and the medium severity plus low impact place it in a this-month remediation window rather than an emergency one.
Majestic Support WordPress plugin through version 1.2.1 contains a missing authorization flaw that allows unauthenticated remote attackers to perform limited unauthorized modifications. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) confirms network reachability with no privileges or user interaction required, and the impact is bounded to integrity with no confidentiality or availability effect. No public exploit code or active exploitation is identified at time of analysis, and the precise vulnerable endpoint is not described in the available sources.
Sunshine Photo Cart, a WordPress plugin for client photo galleries and proofing, does not enforce an authorization check on part of its functionality in versions up to and including 3.7.5, allowing unauthenticated remote requests to make limited unauthorized modifications. Per the CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), the flaw is network-reachable without credentials or user interaction, and the impact is confined to integrity with no confidentiality or availability effect and unchanged scope, giving a medium severity of 5.3. No public exploit code or confirmed active exploitation is associated with this CVE in the available data; the originating advisory is Patchstack's plugin vulnerability database entry, and the specific vulnerable endpoint or action handler is not described in the available sources.
Missing authorization in Wpmet Metform through version 4.3.2 lets unauthenticated remote attackers trigger a restricted plugin action without the required access check, with integrity-only impact (CVSS 5.3). The flaw is CWE-862 and requires no privileges or user interaction; the exact endpoint is not named in the available data. No public exploit code or confirmed active exploitation was identified at time of analysis.
OpenBao before 2.6.4 and 2.7.x before 2.7.1 allows an authenticated holder of a renewable token issued through the Kubernetes Auth method to keep renewing it after the backing Kubernetes service account has been deleted, extending access that should have ended. The flaw is an insufficient session-expiration check (CWE-613) in the Kubernetes Auth token-renewal path, which does not re-verify that the service account token originally used for authentication is still valid. Fixes are available in OpenBao 2.6.4 and 2.7.1; no public exploit was identified at time of analysis, and the available assessment rates this as a moderate-priority issue rather than an emergency.
Functionality misuse in the Drupal Webform contributed module (versions 0.0.0 through 6.2.12 and 6.3.0 through 6.3.1) lets remote, unauthenticated attackers circumvent interaction-frequency controls such as submission or rate limits on affected forms. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, score 5.3) limits impact to low integrity misuse with no confidentiality or availability effect, and exploitation requires that a deployed site actually use the affected frequency-control feature; the precise trigger is not described in the available sources. No public exploit is identified at time of analysis, EPSS is 0.15% (4th percentile), the vuln.today priority label is this_month, and a vendor patch is available.