NetBox MCP Server 1.2.0 and earlier, when started with TRANSPORT=http, exposes its MCP HTTP endpoint with no authentication at all, so any host that can reach the listening port can open a valid MCP session and call all four NetBox read tools without supplying a token or credential. The flaw is conditional rather than universal: the default stdio transport is unaffected, and exposure requires an operator to select HTTP transport and leave the endpoint (default port 8000) network-reachable - a configuration the project README's three Docker examples actively encourage by pairing HOST=0.0.0.0 with -p 8000:8000 and no authentication guidance. The impact is read-only disclosure of the NetBox inventory and audit data (devices, IPs, VLANs, racks, circuits, VMs, changelogs including usernames), with no integrity or availability effect, and the advisory includes reproduction steps confirmed against v1.2.0 while no CISA KEV entry or other active-exploitation reporting was supplied.
Heap memory corruption, task reference-count corruption and assertion panics can occur in Tokio 1.54.0 when an application polls tokio::time::Interval on the multi-threaded runtime, because Interval::poll_tick (including .tick().await) may drop an internal timer entry without synchronizing with the time driver thread that is firing it, yielding a use-after-free on the timer's waker and task state in safe Rust. The exposure is narrow: only the single affected release (since yanked) combined with the multi-threaded runtime flavor and use of Interval, while Sleep and Timeout are explicitly unaffected. This is a memory-safety and reliability defect driven by the application's own concurrent timer usage rather than attacker-controlled input - no public exploit code has been identified at time of analysis, and realistic adversarial exploitation is strongly limited; a fix ships in Tokio 1.54.1.
Stored cross-user HTML injection in Part-DB's BOM validation results allows a user who can create or edit a Part name to plant markup that is later rendered unescaped in a different user's browser. The malicious Part name is interpolated into translated validation messages and output through Twig's |raw filter, so it executes as HTML when the victim imports a BOM CSV that references the poisoned Part ID; the advisory reports that the current Content Security Policy blocks inline JavaScript, confining impact to injected links, forms, tracking images and CSS-based UI redressing inside a trusted page rather than script execution or direct data compromise. Exploitation requires two authenticated low-privilege accounts (the advisory reproduced it with the non-admin Editor preset) and victim-side interaction (performing a BOM import), and a public proof-of-concept with payload and reproduction steps is published in the GHSA. Part-DB through 2.12.1 is affected; version 2.12.2 contains the fix.
Wasmtime 46.0.0 through 48.0.6 and 49.0.0 through 49.0.3 can be panicked by a malicious guest that induces a type mismatch when a host-created component-model stream or future is lowered back into guest code with a different payload type. Exposure is narrow: only embedders that create streams or futures with StreamReader::new or FutureReader::new, pass them through guest code, receive them back through a type-erased path such as StreamAny, FutureAny, Val::Stream or Val::Future, and then forward them to a guest function expecting a different payload type are affected; the result is a host crash (denial of service) with no code execution or data exposure. The issue is fixed in 48.0.7 and 49.0.4, and no public exploit was identified at the time of analysis.
Predictable and reused DHCPv4 transaction identifiers in the Zephyr RTOS DHCP client (subsys/net/lib/dhcpv4/dhcpv4.c, versions 1.7.0 through 4.4.2) allow an attacker who has observed or learned a single identifier to forge BOOTP replies that the client accepts. Because parsing applies the router and DNS options to the interface before any state check, one accepted datagram can repoint the device's default gateway and resolvers at attacker-chosen addresses, redirecting its traffic; during RENEWING or REBINDING a forged ACK re-binds the lease with attacker parameters and a forged NAK drops the address and restarts configuration. Remote unauthenticated exploitation is scored CVSS 3.1 5.6 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L), the weakness is rated non-emergency on the available signals, and no public exploit code has been identified at time of analysis; fixes are merged upstream and in the v4.4, v4.3 and v3.7 branches, with 4.5.0 projected as the first fixed release.
Speed Optimizer (a WordPress plugin) before 7.8.5 lets a non-Super-Admin site administrator on a multisite network create or overwrite network-wide options, because the plugin checks neither network-level privilege nor which option is being changed. This is an authenticated privilege-escalation / broken-authorization issue affecting only multisite deployments; single-site WordPress installs are not exposed since they have no Super Admin versus network-option distinction. There is no confirmed active exploitation (not in CISA KEV), no public exploit code identified at time of analysis, and EPSS data was not provided; the practical risk is bounded to trusted or compromised subsite administrators.
Path traversal (CWE-22) in the Apache Camel camel-docling component leaves an absolute-path bypass open after the CVE-2026-40047 fix, letting a party who controls the CamelDoclingCustomArguments header point the docling CLI subprocess at any directory the Camel process can already read. Affected are camel-docling 4.15.0 before 4.18.5 and 4.19.0 before 4.22.2; the 4.15.x-4.17.x and 4.19.x-4.21.x lines are end-of-life and will not be fixed. Rated CVSS 3.1 5.4 medium (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L), exposure is limited to CLI mode (the default) where a route forwards externally influenced values into the Camel header namespace or a consumer maps incoming headers without Camel's default header filtering; no public exploit identified at time of analysis.
HTTP request smuggling in Twisted's twisted.web server (twisted.web.http.HTTPChannel, versions 26.4.0 and earlier) lets remote attackers fold a hidden Content-Length header into an ordinary header value using a bare carriage return or bare line feed, because the parser rejects NUL bytes but not the other two control characters RFC 9110 section 5.5 requires it to reject. The impact is realized only when Twisted sits behind a front-end proxy or load balancer that treats a bare CR or LF as a line terminator: the front end frames one request, Twisted frames another, and the attacker can slip a request past front-end access controls, poison a shared connection so a later client receives the wrong response, or poison a cache. No authentication (PR:N) and no user interaction (UI:N) are required, but attack complexity is high (AC:H) because of the proxy dependency, no code execution results in any configuration, there is no KEV listing or confirmed active exploitation, and the GitHub advisory includes a PoC request sequence that has not been independently verified as working exploit code.
Concurrent booking requests against OpenReception's appointment booking software before 2.2.2 let a booking client holding a valid appointment token place unlimited overlapping appointments into a single agent time slot, corrupting the exclusivity guarantee of the booking calendar and denying availability to other clients. The server-side availability check runs as a plain SELECT that is not atomic with the appointment insert, so a burst of parallel requests with identical agentId, appointmentDate and duration all pass the check before any of them commits. The vendor advisory publishes a reproduction procedure (20 concurrent POSTs to the add-to-tunnel endpoint, all returning 200, followed by a single request returning 409), the issue is rated moderate (CVSS 5.4, PR:L, no confidentiality impact) and is fixed in 2.2.2; vuln.today priority places handling in the this_month bucket, and no active exploitation is confirmed (CISA KEV not listed).
Expression language injection in the Apache Camel camel-aws2-s3 producer allows a user who can choose object names in a bucket that a Camel route consumes to have Simple expressions of their choosing evaluated inside the Camel process, because the object name arriving in the CamelAwsS3Key message header is passed to the Simple language whenever it contains ${ or $simple{. Deployments on 4.8.0 through 4.18.4 and 4.19.0 through 4.22.1 are affected only where a route passes exchanges from an aws2-s3 consumer to an aws2-s3 producer with that header intact; the attacker must already hold write access to the consumed bucket (authenticated, PR:L), and reading an evaluated value back additionally requires visibility of object names in the destination bucket, which is why the assessed severity is medium (CVSS 5.4). No public exploit code or confirmed active exploitation was identified at time of analysis.
OpenStack Ironic deployments running versions before 39.0.1 expose DELETE and GET operations through the vendor_passthru API path, allowing an authenticated low-privileged Ironic API user to proxy those requests to a managed node's Redfish BMC - for example, to delete accounts on the BMC's Redfish service. Scoring 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N), the flaw requires valid Ironic credentials and a node configured with a Redfish-based BMC, so it is not reachable by an unauthenticated attacker and impact is bounded to low confidentiality and integrity effects. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; per the vulnerability priority assessment this is a this-month item rather than an emergency.
Authenticated Zimbra Collaboration Suite users with Briefcase access can publish a document that renders attacker-controlled content under the Zimbra origin, because the DefangFilter stylesheet sanitizer fails to clean the trailing ASCII segment of a stylesheet containing non-ASCII characters. The surviving CSS URL references let a shared application/x-zimbra-doc document pull in external resources and display a credential-collection form built from Zimbra's own visual assets. Exploitation requires the victim to open the document in a browser that renders that content type inline, and credential theft requires a further form submission, so the practical impact is a medium-severity (CVSS 5.4, scope-changed) content-spoofing/phishing primitive rather than direct code execution; no public exploit identified at time of analysis, and ZCS 10.1.16 and 10.1.20 are reported affected (EUVD lists versions up to and including 10.1.20).
Stored cross-site scripting in Part-DB Server 2.12.2 and earlier allows an authenticated user with attachment-upload permission to plant a JavaScript-bearing SVG that executes in the Part-DB origin whenever another user opens the attachment inline at /attachment/{id}/view. Because sanitization is decided from the user-controlled filename extension, naming the SVG payload with a non-SVG extension such as .jpg skips the sanitizer entirely, while the response still carries Content-Type: image/svg+xml; this can lead to session hijacking or account takeover of whichever user - potentially an administrator - views the file. Rated CVSS 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) with the vendor also citing CWE-434 alongside CWE-79; not listed in CISA KEV, and the advisory ships a public proof-of-concept reproduction (curl upload steps) rather than confirmed working exploit code; fixed in 2.12.3.
Unauthenticated-output path traversal in the Apache Camel camel-docling component (4.15.0 before 4.18.5 and 4.19.0 before 4.22.2) lets an authenticated remote attacker who can place a value into the CamelDoclingOutputFilePath header force the docling CLI subprocess to write its converted Markdown, HTML, JSON or text output into any directory writable by the Camel process. The header value is handed verbatim to docling's --output flag with no normalization and no endpoint option to confine it, so absolute paths and '..' segments are accepted as given; the content written is limited to the conversion of the supplied document, and the attacker cannot control the exact bytes or the file name beyond choosing the directory. Exposure is narrowed by Camel's default HeaderFilterStrategy (JMS and Kafka consumers strip Camel-namespace headers) and by the fact that the docling-serve mode does not use this header at all. No public exploit code or active exploitation is known at time of analysis, but the release lines 4.15.x-4.17.x and 4.19.x-4.21.x are end-of-life and will never receive a fix.
Authenticated users holding the WordPress Editor role or higher can bypass the Depicter - Popup & Slider Builder plugin's upload checks (before version 4.8.2) to place files with active non-.php extensions into the site's public uploads directory, yielding stored script execution within the site origin. The plugin validates only a client-supplied MIME type and a case-sensitive block on the .php extension, so alternate active extensions or case variants slip through; whether that stored script escalates to server-side code execution depends on the web server's handler mapping and is not guaranteed. Rated CVSS 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N), with no public exploit identified at time of analysis and no confirmed active exploitation (CISA SSVC: Exploitation none, Automatable no), making this a moderate-urgency, this-month remediation item rather than an emergency.
The run_script tool in AWS MCP Server screened submitted Python with an incomplete denylist of disallowed inputs, so an authenticated remote user could craft a script that slipped past the validator and executed arbitrary code inside their own isolated session environment. The requirement for a valid session (PR:L) and the per-session isolation of the execution sandbox bound the impact to low confidentiality and integrity on the user's own environment, with no cross-session, cross-tenant or host-level effect described; CVSS 4.0 base score is 5.3. AWS remediated the issue service-side and states no customer action is required, and no public exploit code or PoC has been identified at time of analysis.
Forged calendar invitations in Zimbra Collaboration Suite 10.1.16 and 10.1.21 can be inserted under another user's ORGANIZER identity by an unauthenticated external sender when automatic invitation insertion is enabled. The resulting event carries attacker-chosen meeting details and reminders but is not created in the claimed organizer's calendar, so impact is limited to calendar integrity (CVSS 5.3) rather than data access or code execution. No public exploit was identified at time of analysis; the priority is this-month remediation, not emergency response.
iCalendar REPLY handling in Zimbra Collaboration Suite 10.1.16 and 10.1.21 fails open when the sender identity is null, allowing an unauthenticated sender who knows a meeting's UID, the organizer address and the target attendee address to forge that attendee's response and silently change their participation status in the organizer's calendar. The modification is applied automatically during message delivery, with no organizer or attendee interaction, but the impact is confined to integrity of the attendee's PARTSTAT value - there is no data disclosure or service disruption, which is consistent with the CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N score of 5.3. No public exploit code is confirmed in the supplied intelligence and there is no CISA KEV entry; the practical limiting factor is that the meeting UID must be known or guessed, which the sources describe as often non-trivial.
Zimbra Collaboration Suite 10.1.16 and 10.1.21 process iCalendar CANCEL and REQUEST components without verifying that the email sender is authorized to act as the listed organizer, so an unauthenticated sender who knows a meeting's UID, organizer address, and a current or higher sequence number can cancel, move to Trash, or replace an existing meeting in the recipient's calendar. The calendar update is handled automatically during mail delivery, requiring no recipient interaction, but the assessed impact is limited to integrity of individual calendar entries with no confidentiality or availability loss and no code execution. The issue is rated moderate priority; no public exploit identified at time of analysis, and there is no CISA KEV confirmation of active exploitation.
Authenticated users with attachment create/edit permissions can bypass the configured MAX_ATTACHMENT_FILE_SIZE limit in Part-DB when server-side attachment downloads are enabled, because the 'Download external file' code path (downloadURL() in src/Services/Attachments/AttachmentSubmitHandler.php) streams the remote response directly to disk without checking Content-Length or counting bytes. Repeatedly storing oversized files can exhaust disk space, causing failed uploads, database or cache write failures, and denial of service for other users. The issue affects Part-DB versions through 2.13.1 (composer package part-db/part-db-server, CPE cpe:2.3:a:part-db:part-db-server) and is fixed in 2.13.2; no public exploit code is confirmed beyond the advisory's own proof of concept, and EPSS/KEV data were not provided in the source material.
Authenticated users holding the API access permission can bypass the configured maximum attachment file size in Part-DB by submitting base64-encoded file data through the JSON-LD attachment API, which decodes and stores the payload without applying the MAX_ATTACHMENT_FILE_SIZE check enforced for browser uploads. Repeated oversized uploads let such a user gradually exhaust server disk space, degrading or denying service to other users; confidentiality and integrity are unaffected. The flaw is fixed in Part-DB 2.13.2, and a working proof-of-concept (a 5 MB attachment stored despite a 1M limit) is published in the vendor advisory; no confirmed active exploitation is known, and the decision label is 'this_month'.
Unauthenticated key injection into OpenReception appointment-booking software 2.1.0 and earlier lets a remote actor write an arbitrary ML-KEM-768 public key into any tenant's staff-crypto recipient directory under an existing user id, violating the product's guarantee that the recipient list is not attacker-writable and that appointment data is end-to-end encrypted to staff only. Because booking clients encrypt each appointment's tunnel key to every active staff key returned tenant-wide, the injected key becomes a persistent unauthorized recipient of tunnel keys for all appointments booked after injection. The integrity impact is confirmed (CVSS 5.3, C:N/I:L/A:N, CWE-863) and exploitation is bounded: only user ids without an existing active key can be targeted due to a unique index, and retrieving ciphertext plus the matching staffKeyShare still requires a valid staff session, so plaintext recovery is latent and depends on a separate exposure. A public proof-of-concept with full reproduction steps is published in the upstream advisory; no patch is available and no in-the-wild exploitation is reported.
Conditional-content bypass in the Otter Blocks plugin for WordPress before 3.2.8 lets unauthenticated visitors read block content that the site owner deliberately gated - to specific roles, logged-in users, the post author, particular categories or tags, or, on the Pro tier, Stripe purchasers - by retrieving a published post through the WordPress REST API, which renders the blocks without applying the plugin's visibility conditions. The result is disclosure of restricted text only: no integrity or availability impact, and exploitation depends entirely on the site actually using visibility conditions to hide sensitive content inside REST-exposed published posts. Patch status is a vendor-released fix in 3.2.8; EPSS is 0.15% (4th percentile), there is no CISA KEV listing, and no public exploit identified at time of analysis.
Username enumeration in Cacti 1.2.30 and earlier allows unauthenticated remote attackers to determine which accounts exist by submitting candidate usernames to the web login form and comparing the returned 'Access Denied!' message, where the only difference is the capitalization of the letter 'f' in 'failed'/'Failed'. The disclosure is limited to account validity (CVSS 5.3, C:L) and provides no authentication bypass, data access, or code execution on its own; its value emerges when the harvested usernames feed brute-force, credential-stuffing, or social-engineering follow-ons. The flaw is fixed in Cacti 1.2.31; a public proof-of-concept reference exists in the vendor advisory (screenshots of the two responses), though it is not verified as working exploit code, and no confirmed active exploitation has been reported - the issue is triaged for handling within a normal monthly patch cycle.
Unauthenticated Solr query injection in the Goobi viewer spatial search endpoint (GET /api/v1/index/{solrField}/spatial/search) lets remote attackers slip local-param syntax and boolean operators through the region parameter and bypass the access-condition filter, exposing metadata for access-restricted georeferenced records. Affected deployments are goobi-viewer-core from 22.04 up to but not including 26.05; disclosure is bounded to the map-feature payload the server renders - geographic coordinates, the document PI, and the metadata values placed into each feature's label/entities by the deployment's geomap templates - because the returned field set comes from a server-side allow-list, while non-georeferenced records and the unstored full-text field are unreachable this way and the sibling heatmap endpoint is unaffected. No public exploit code was identified at time of analysis, and the vendor issued a patch in 26.05.
Unauthenticated Solr query injection in the legacy RSS servlet (RssResolver, GET /rss/) of Goobi viewer-core prior to 26.05 lets an attacker alter the Solr query so that the trailing access-condition filter becomes optional, causing bibliographic metadata for access-restricted records to appear in the generated RSS feed. The exposed fields are limited to those the feed renders - title, author, publisher, place/year, shelfmark, URN, persistent identifier and record link - while full text is not stored in Solr and restricted thumbnails stay separately gated, so the practical impact is low-confidentiality disclosure plus count/oracle queries against the index. No public exploit code was identified at time of analysis; exploitation only yields sensitive results on instances that actually hold access-restricted records, and the vendor shipped a fix in 26.05 (tracked for patching this month by vuln.today prioritisation).
Solr local-parameter injection in Goobi viewer core (23.03 through 26.05) lets unauthenticated remote attackers slip structural Solr parameters past the shared SolrTools.cleanUpQuery() sanitizer by wrapping them in a second pair of braces ({{!...}}): the greedy regex strips only the outer pair and a valid {!...} local parameter is forwarded to Solr. Any endpoint that routes user-supplied query strings through cleanUpQuery is exposed, and injected parent/child block joins, graph traversal or function queries can reveal which open-access top-level records have access-restricted sub-documents, although the outer access-condition filter still applies so the restricted content itself is not returned. The issue is fixed in 26.05, no public exploit was identified at time of analysis, and priority is assessed as this-month rather than immediate.
Unauthenticated visitors can bypass the image-captcha requirement on baserCMS mail forms by posting directly to the public Web API endpoint POST /baser/api/bc-mail/mail_messages/add/{mailContentId}.json, whose add() action and MailMessagesService::create() never invoke BcCaptchaService::check() the way the web-UI MailController::submit() flow does. Only mail forms that are still accepting submissions and have auth_captcha enabled are exposed (5.0.0 through 5.3.1 and 5.4.0 through 5.4.1); closed forms are still rejected by the isAccepting() guard added for CVE-2026-30878. A successful bypass lets an attacker script repeated submissions that flood the administrator inbox, cause the site's own mail server to send attacker-influenced auto-replies to third-party addresses when the form has an email field, and accumulate mail_messages rows when save_info is enabled; severity is 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), there is no CISA KEV entry, and the upstream advisory supplies code-level reproduction steps rather than confirmed working exploit tooling.
Unauthenticated visitors can turn a baserCMS site into a relay for unsolicited mail: submitting a comma-separated address list in an email-type field of a public mail form causes the site's single auto-reply to be delivered to every listed third party, under the site's own sender identity and with partially attacker-controlled body content. Affected are baserCMS 5.2.5 through 5.4.1, but only where a mail form was created in the admin panel with a field of type 'Email' and the separate optional VALID_EMAIL server-side format check was left disabled - the default state for newly created fields; the bundled Contact form enables VALID_EMAIL and is explicitly not affected, and browser-side type=email validation does not stop crafted requests. Severity is moderate (CVSS 5.3, integrity-only, no confidentiality or availability impact), no confirmed active exploitation (not in CISA KEV), and the advisory documents reproduction steps rather than released exploit code; the practical damage is reputational and deliverability-related, since the site's sending domain may be treated as a spam source and the admin only sees a single ordinary inquiry record.
Information disclosure in the Apache Camel CoAP component (org.apache.camel:camel-coap) lets a remote unauthenticated CoAP client read internal deployment detail - class and package names, the string form of a value such as the path of a file body, and backend host names or connection detail carried by the underlying cause - when the consumer cannot build its response after the route has already completed. Only deployments running 4.0.0 through 4.18.4 or 4.19.0 through 4.22.1 with routes consuming from coap, coaps, coap+tcp or coaps+tcp endpoints are exposed, and only where a remote client can make the completed response unconvertible, which depends on how the route is written; that dependency is why the practical attack complexity is high rather than low. Confidentiality of internal detail is the only impact - there is no code execution, data modification or denial of service - and no public exploit has been identified at time of analysis; the issue was found by an independent researcher and fixed by the vendor.
An information disclosure flaw in the Otter Blocks WordPress plugin before 3.2.8 lets unauthenticated remote attackers retrieve data through a REST API endpoint that should not be publicly readable, because the plugin treats any post marked 'published' as public without checking actual readability. Affected sites are those running versions 3.1.1 through 3.2.7; exposed data is limited to manual excerpts of password-protected posts and titles/content of non-public post types, with WooCommerce coupon codes and descriptions additionally exposed on sites running WooCommerce. This is a moderate, confidentiality-only issue (CVSS 5.3); no public exploit code or active exploitation is identified at time of analysis, and a vendor patch is available.
Sensitive-value disclosure in Elixir's plug_crypto library allows a single unauthenticated request carrying a wrong-typed argument or a missing header to push the application's secret key base, a derived 32-byte encryption key, or the configured secret an API key is compared against into the Plug.Cowboy/Bandit error log and into crash_reason Logger metadata that error trackers forward. Applications on plug_crypto from 1.0.0 before 2.2.1, or on the bundled Plug.Crypto shipped in plug from 1.6.3 before 1.7.0, are affected; the request itself does not hand the secret to the attacker, so exploitation additionally depends on a separate party having read access to those logs or to the error tracker, which is why the assessed vector carries PR:H despite the unauthenticated trigger. No public exploit code was identified at time of analysis, and patched releases (plug_crypto 2.2.1, plug 1.7.0) are available from the vendor.
Reflected cross-site scripting in CGM CLININET (confirmed through version 2026.MS3, with later releases possibly affected) lets a remote attacker supply a crafted URL whose embedded JavaScript or HTML is reflected into the application's response and executed in a clinician's browser, enabling session-cookie theft and actions performed with the victim's privileges. The attacker needs no credentials to build the link, but the payload only fires if an already-authenticated user is persuaded to open it, which is the main limiting factor; impact stays within the victim's browser session rather than the server. This is a moderate, not top-tier, priority for the current month, and no public exploit code was identified at time of analysis. The issue was reported to CERT Polska and is tracked as CWE-79.
Reflected cross-site scripting in the VertiGIS WebOrderSystem CustomerAdministration (KundenManager) portal allows an unauthenticated attacker to run JavaScript in a privileged user's browser by delivering a crafted URL whose searchValue parameter contains script code. The victim must be logged into the portal and open the link; because such users can change other accounts' passwords, including administrators', without the old password, successful exploitation can lead to account takeover or lockout. Version 7.0.8.6 is confirmed affected (the latest at time of testing) and the vendor has not stated which other versions are affected; no public exploit was identified at time of analysis and the priority is this_month (medium, CVSS 4.0 5.1).
Stored cross-site scripting in VertiGIS GIS Portal's ASMobile business-reference field can be carried into an order and executed in the OrderAdministration (AuftragsManager) portal of VertiGIS WebOrderSystem when a highly privileged user opens that order. Exploitation requires an authenticated ASMobile user who can create a business reference and place an order, followed by the privileged administrator interaction; WebOrderSystem 7.0.8.6 is confirmed affected, while other versions are unverified. No public exploit was identified at time of analysis, and the available signals indicate a moderate, not urgent, risk (CVSS 4.0 base 5.1; decision this_month).
Isar 0.11 and later create /etc/apt/trusted.gpg.d during bootstrap as the calling build user rather than root, so the apt keystore inside the generated image carries non-root ownership. If that build user's uid happens to match an unprivileged account inside the image, whoever controls that in-image account can rewrite existing repository signing keys or drop in new ones and quietly defeat apt's repository integrity checks. Exploitation is local only and conditional: per the advisory, key tampering is just one link in a chain and must be paired with manipulation of a remote repository or interception of non-secure apt traffic, and images with an immutable rootfs or that never invoke apt are unaffected. No public exploit code was identified at time of analysis and there is no KEV entry; the assessed risk is medium-severity with low-to-moderate real-world urgency, suited to a normal monthly patch cycle.
Stored cross-site scripting in GFI Archiver before 15.14 lets authenticated users inject arbitrary web script or HTML through the report name parameter in the MailInsights scheduled report configuration, which is saved by ReportScheduling.btnSaveReport_Click() without output encoding. The payload executes in the browser of the user who created that scheduled report when they later view /Archiver/MailInsights.aspx, so the practical impact is self-XSS within the same account rather than a direct cross-user attack. The vendor has released version 15.14 to address the issue; no public exploit was identified at time of analysis, and the vendor CVSS 4.0 base score is 5.1 (medium).
Maintenance-mode state on OpenStack Ironic nodes can be toggled through the general node-update path (PATCH /v1/nodes/{ident}) rather than the dedicated maintenance endpoint, allowing an authenticated API user to change a node's maintenance flag while bypassing the authorization check applied on the intended route. All Ironic releases before 39.0.1 are affected; the bypass is intermittent, as the description states the change succeeds only 'sometimes', and the exact triggering conditions are not described in the available sources. No public exploit code and no active exploitation have been identified at time of analysis, and the practical impact is confined to integrity and availability of node state (assessed CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L, CWE-424).
An authenticated denial of service in the Twisted IMAP4 server (twisted.mail.imap4.IMAP4Server) lets any user who can log in and SELECT a mailbox freeze the entire process by sending a SEARCH command with an inline literal carrying a negative octet count. The advisory demonstrates this with a roughly ten-byte command (SEARCH {-100}...), after which the single-threaded reactor spins at full CPU and stops serving not only other IMAP connections but also any SMTP or POP3 services co-hosted in the same process; no connection timeout can fire because the reactor itself is frozen, so recovery requires a restart. The issue affects Twisted 26.4.0 and earlier and is fixed in 26.10.0rc1; exploitation requires valid credentials (per the assessed vector PR:L, and the advisory notes any low-privilege account suffices), and the upstream advisory includes a public proof-of-concept command sequence. This is a genuine but moderate-priority availability issue rather than a drop-everything emergency, and it is confined to the minority of Twisted deployments that actually expose the IMAP4 server.
Download Monitor before 5.3.5 on WordPress multisite allows a subsite administrator to approve arbitrary filesystem locations, causing the plugin to serve readable files from outside the uploads directory-including files belonging to other subsites-to unauthenticated visitors. Single-site installations are explicitly unaffected, and exploitation requires an authenticated subsite-admin account on a multisite deployment. No public exploit has been identified at time of analysis (SSVC exploitation: none), making this a moderate-priority issue concentrated in multi-tenant, agency, or hosted networks with untrusted subsite operators.
Stored cross-site scripting in the CustomerAdministration portal (KundenManager) of VertiGIS WebOrderSystem lets an authenticated, highly privileged portal user plant JavaScript inside editable employee properties such as 'secondName', which is then persisted and executed in the browser of any other privileged user who opens the edited entry or the corresponding user-group overview, running in that victim's authenticated portal session. Version 7.0.8.6, the latest available at the time of testing, is confirmed affected, and the vendor has not provided information on other versions. Severity is modest (CVSS 4.0 base score 4.8; the independently assessed CVSS 3.1 vector requires high privileges and user interaction), no public exploit code and no CISA KEV entry were identified at time of analysis, and exposure is further limited because both the injecting and the receiving accounts must hold employee-management rights in the portal.
KNIME Analytics Platform LTS before 5.8.4, when deployed as an executor in KNIME Server or KNIME Business Hub, writes configured proxy credentials into startup log files, allowing anyone who can read those logs to recover the credentials and use the proxy as the user who configured the proxy settings. Exploitation is local and requires read access to the executor's logs; standalone Analytics Platform installations not acting as a Server/Hub executor are outside the described scenario. The issue is low severity (CVSS 4.0 base score 4.8; assessed CVSS 3.1 local/low with low confidentiality impact), and no public exploit identified at time of analysis.
Expired OAuth 2.0 access tokens continue to be accepted by the camel-keycloak KeycloakSecurityPolicy when token introspection is enabled (useTokenIntrospection=true) and the default introspection result cache is active. Because both shipped caches (ConcurrentMapTokenCache, CaffeineTokenCache) expire entries on a fixed insertion-time TTL rather than being bounded by the token's exp claim, and KeycloakSecurityProcessor only re-checks the introspection response's active flag, a token cached shortly before it expired remains usable for up to introspectionCacheTtl seconds after expiry - 60 seconds by default, or 300-600 seconds where the documentation's internal-services guidance was followed. An authenticated holder of a token that was valid moments earlier can therefore keep exercising exactly the roles and permissions that token already carried; no forgery or privilege escalation is possible, introspection is not enabled by default, and the local JWT verification path is unaffected. No public exploit code or exploitation activity is identified in the available data, and the overall risk is assessed as medium severity with low urgency.
Cross-scope OAuth token reuse in Apache Camel's camel-oauth component (org.apache.camel:camel-oauth 4.19.0 through 4.22.1) lets a profile be handed a bearer token that was obtained under a different profile's scope or client secret. The resolver keeps tokens in a static, JVM-wide cache keyed only on the token endpoint and client ID, so two profiles sharing an identity provider client but differing in requested scope or secret collide on one entry. The result is an outbound call carrying a token that grants broader authority than the calling profile was configured for, or that was issued by a different client secret; the trigger requires a deployment defining multiple colliding profiles with caching (default-enabled) left on, and no public exploit has been identified at time of analysis.
Arbitrary module import in the hydra-ray-launcher plugin for Hydra lets an attacker who controls configuration values or command-line overrides force the application process to import any installed Python module via a crafted ${ray_pkg_version:<module>} interpolation, executing that module's import-time side effects. Affected releases are the legacy line from 1.1.0.dev1 up to but excluding 1.2.2, and the Hydra 1.4 line from 1.4.0.dev4 up to but excluding 1.4.0rc2; the resolver is registered during plugin discovery even when a different launcher is selected, so simply switching launchers does not remove the exposure. Impact is bounded: the resolver cannot install attacker code or pass arbitrary function arguments, and meaningful harm depends on a module with a damaging import side effect already being installed and importable, so this is a moderate, locally-triggered integrity issue rather than an urgent one - no public exploit code was identified at time of analysis and there is no confirmed active exploitation (CISA KEV).
Stored/DOM cross-site scripting exists in the conda-forge.org website, where two React components render bot-generated status strings as raw HTML, so a feedstock maintainer who can influence captured autotick-bot output could execute script in the conda-forge.org origin for any visitor who expands the affected entry on the public status or migration pages. The flaw is confirmed in the current main branch (commits 85748ad2368a and prior) and affects a rolling deployment with no tagged releases; at time of analysis there is no vendor-released patch, no confirmed public exploit code, and no CISA KEV listing. The assessed severity is Medium (CVSS 3.1 AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N): the missing sanitization is proven against live production data, but end-to-end weaponization was not demonstrated and reliable delivery of an executing payload into captured build or traceback output is non-trivial.
Spreadsheet formula injection in Part-DB through 2.13.1 lets an authenticated user who holds the '@parts.import' permission store formula-prefixed strings (for example =1+1) in user-controlled part fields via CSV import, which are later written into XLSX/XLS exports as live formula cells instead of plain text. The payload does not execute inside Part-DB itself; it only becomes dangerous when a second user with read access to those parts runs the export at /parts/export and opens the file in spreadsheet software that evaluates formulas, so impact is limited to data exposure, external reference requests, or misleading content in the victim's client (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, medium). A detailed public PoC using a benign =1+1 payload accompanies the GitHub advisory; it is a demonstrated reference and is not verified as working exploit code for data exfiltration, and there is no KEV listing or evidence of active exploitation. Risk is concentrated in multi-user deployments where semi-trusted users can seed part data that more privileged users later export.
Zimbra Collaboration Suite compares the hostname in an emailed form's action attribute against the request hostname before the browser applies URL canonicalization, so a percent-encoded hostname slips past the email sanitizers and the browser then submits the form to the real Zimbra origin with the recipient's session cookie attached. The flaw sits in DefangFilter and the OWASP ActionAttributePolicy used by the Classic web client, and is reported in ZCS 10.1.16 and 10.1.21; an unauthenticated sender can deliver the crafted email, but exploitation requires the recipient to open it in Classic and manually submit the form (CVSS 4.3, CWE-180). It does not defeat CSRF tokens, so any state-changing outcome additionally depends on a Zimbra endpoint that accepts the resulting authenticated request without token validation; no public exploit code or active exploitation has been identified at time of analysis, and a vendor patch is available.
Zimbra Collaboration Suite 10.1.16 and 10.1.21 permit an authenticated user to inject LDAP filter conditions through attribute names in SearchCalendarResourcesRequest and then use repeated matching queries to recover readable calendar-resource attributes such as internal mailbox hostnames and mail transport routes. The impact is scoped to calendar-resource objects and the LDAP service account's permissions, with no data modification or privilege escalation. This is a genuine but modest-severity information-disclosure issue rather than an emergency, and no public exploit identified at time of analysis.
Zimbra Collaboration Suite 10.1.16 and 10.1.20 allow any authenticated local user to plant forged 'shared with me' file records in another user's mailbox through FileSharedWithMeRequest without victim interaction, with impact limited to integrity. The request bypasses delegated-account authorization and accepts attacker-selected metadata, owner identifiers, and declared sizes without validating a corresponding document share. No public exploit identified at time of analysis.