BigFix Platform installations that still ship a Mozilla CA certificate bundle (PEM) dated before 2026/10/20 continue to trust certificates whose private keys are known to be compromised, so an attacker holding an on-path position can impersonate the remote servers BigFix validates and tamper with the files the application downloads. Successful exploitation requires that stale bundle to be present, a privileged man-in-the-middle position, and a certificate chained to one of the compromised keys, which is why the assessed severity is moderate rather than urgent (CVSS 3.1 base 6.8, AV:N/AC:H/PR:N/UI:R). No public exploit code or PoC reference was identified at time of analysis, and the flaw does not affect installations already running the 2026/10/20 or later bundle shipped with BES Support v1520 and above.
Brainstorm Force SureDash through 1.12.2 does not enforce authorization for low-privileged users, allowing an authenticated WordPress account to read data intended for higher-privileged roles; the issue is scored CVSS 6.5 with confidentiality-only impact. The flaw is CWE-862 missing authorization, and no public exploit was identified at time of analysis. Sites that allow untrusted user registration have the larger exposure because a low-privileged account is the prerequisite.
Missing authorization in the Quadlayers WP Social Feed Gallery (insta-gallery) plugin for WordPress through version 5.0.13 allows unauthenticated remote attackers (CVSS:3.1/AV:N/AC:L/PR:N/UI:N) to reach functionality that should sit behind an access-control check, yielding low confidentiality and low integrity impact with no availability impact. The flaw is CWE-862 (Missing Authorization) and is rated 6.5, so it does not by itself provide full site takeover, code execution, or data destruction - a moderate-severity, likely-low-urgency issue rather than a top-tier emergency. No public exploit code or PoC reference was identified at time of analysis, there is no CISA KEV entry, and no vendor-released patch version is identified in the available data; the priority label assigned by vuln.today is 'this_month'.
Reflected cross-site scripting in the WordPress plugin Ad Inserter (versions through 2.8.18) lets a low-privilege actor craft a request or URL carrying a script payload and execute it in a victim's browser once that victim is persuaded to follow the link. Rated medium severity at CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L), the flaw is non-persistent and requires victim interaction, so abuse depends on social engineering rather than a silent remote compromise. No confirmed active exploitation (not in CISA KEV) and no working exploit code is documented in the available sources; the report originates from Patchstack and is prioritized as a this-month item, with applicability limited to Ad Inserter up to and including 2.8.18.
Stored cross-site scripting in the All-in-One Video Gallery WordPress plugin through 4.9.7 allows an authenticated low-privileged user to persist script content that runs when another user views the affected page. The flaw is rated CVSS 6.5 (CWE-79) and requires user interaction for the stored payload to execute; no public exploit or CISA KEV entry is identified in the provided data, and vuln.today prioritizes it as a this_month item rather than an emergency.
Missing authorization in the WpEvently (mage-eventpress) WordPress plugin through 5.7.8 is a medium-severity (CVSS 6.5) flaw that lets unauthenticated remote attackers reach functionality lacking proper access control checks, with low confidentiality and integrity impact and no availability impact. The issue is CWE-862 and is tagged as an authentication bypass; no CISA KEV confirmation was supplied and no public exploit identified at time of analysis. The Patchstack advisory is the available reference, and the exact vulnerable endpoint or action is not named in the supplied sources.
Malformed DNS replies can crash the parser in lua-resty-dns before 0.24, causing resolver:query() to raise an uncaught Lua exception that aborts the request and breaks name resolution for that worker. The flaw sits in parse_section() and _decode_name(), which trust the resource-record lengths declared in the received message and previously truncated over-long TXT/SOA data instead of rejecting it; a short A RDATA, short AAAA RDATA, truncated record header, or excessive compression pointers is enough to trigger the failure. Exploitation requires the attacker to control the queried authoritative nameserver or to spoof its response (off-path spoofing also has to win the transaction-ID race), so no authentication or user interaction is needed but network position against the resolver's upstream is; impact is limited to availability (aborted lookups, failed resolution) with no code execution, data exposure, or integrity loss. No public exploit has been identified at time of analysis and the issue is not in CISA KEV; a vendor patch is available in v0.24.
Unitree Go2 firmware up to the 1.1.13, 1.1.14.1, and 1.1.15.1 releases contains a chat_go WebSocket client that does not validate TLS server certificates, allowing a man-in-the-middle to impersonate the WSS server and potentially read or alter traffic. Exploitation requires the attacker to first obtain a privileged network intercept position, which the assessment rates as high complexity and difficult; no authentication or user interaction is required once that position exists. The vendor has confirmed the issue, no public exploit code has been identified at time of analysis, and this is a moderate, not emergency, priority.
InternScience InternAgent 1.5.0 contains an untrusted-control-sphere inclusion flaw (CWE-829) in the LoRA loading logic reached through the 'train' function in tasks/AutoChem/code/experiment.py, where an attacker-influenced base_model_name_or_path value causes functionality to be pulled from outside the intended trust boundary. The assessed impact is limited to integrity (CVSS 3.1: 5.3, AV:N/AC:L/PR:N/UI:R, I:L only, no confidentiality or availability impact), and exploitation is not passive - a legitimate operator must run the training routine with the malicious path value. A public PoC reference exists; it is not verified as working exploit code, and there is no KEV confirmation of active exploitation; this is a moderate-severity issue slated for this month's remediation cycle rather than an emergency.
Reflected cross-site scripting in phpIPAM through 1.8.3 can execute attacker-supplied script in a victim operator's browser when the deviceid argument in the Rack Link Creation popup (app/tools/racks/show-rack-popup.php) is manipulated and a crafted link is loaded. The vector records PR:N, but rack management is an authenticated operator feature and pre-authentication reachability of this endpoint is not confirmed, so that prerequisite should be verified for each deployment; impact is confined to the victim's browser session. A public PoC reference exists but is not verified as working exploit code, no CISA KEV entry is present, and the priority decision is monitor.
LiteSpeed Cache, the WordPress caching plugin maintained by Hai Zheng, inserts sensitive information into the data it sends back to clients, exposing content that should not be readable by outside parties in releases through 7.9. The CVSS 5.9 score pairs high confidentiality impact with high attack complexity, so while the flaw can be reached unauthenticated over the network with no user interaction, exploitation depends on a specific condition the public sources do not describe. No public exploit was identified at time of analysis, and the single Patchstack reference does not list a fixed version, so any site currently running LiteSpeed Cache 7.9 or earlier remains in scope.
phpIPAM through 1.8.3 contains a reflected cross-site scripting flaw in upgrade/index.php where the REQUEST_URI value is reflected without sanitization. Exploitation requires a high-privilege authenticated administrator to be lured into following a crafted request, and impact is limited to low integrity with no confidentiality or availability effect; a public PoC reference exists but is not verified as working exploit code, and the issue is rated low priority (monitor).
Cross-project target tampering in Cervantes v1.3-beta lets anyone holding a valid account on a multi-project instance tamper with penetration-testing targets owned by other projects, including modifying or deleting them, which undermines the integrity of scopes, results and the security reports generated from them. The exposure is limited to integrity and availability of target records (CVSS 5.4, C:N/I:L/A:L), and exploitation presupposes a deployment that hosts more than one project, since a single-project instance exposes no foreign targets. No public exploit code has been identified at time of analysis, a vendor patch advisory is published, and this is a moderate-priority issue, not an emergency, so remediation fits a this-month cycle.
An insecure direct object reference in the manager-api of xiaozhi-esp32-server before 0.9.8 lets any authenticated account read other users' device address books by supplying a victim's device MAC to the /device/address-book/{macAddress} endpoint, disclosing contact MACs, aliases, call permissions and owning user IDs. The flaw requires only a normal or self-registered account plus knowledge of the target device MAC (CVSS v4.0 5.3, CVSS v3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), and impact is confined to confidentiality with no write or denial-of-service capability. It is not in CISA KEV and no working exploit code has been confirmed; a public technical writeup of the flaw exists, and the vendor has released a fix in v0.9.8.
Authenticated members of Yudao Cloud (yudao-cloud) through 2026.09 can read other members' after-sale operation logs through an insecure direct object reference in the mall trade module, exposing refund amounts, status transitions and timestamps. The endpoint GET /app-api/trade/after-sale-log/list accepts arbitrary, sequentially enumerable afterSaleId values without an ownership check, giving a read-only confidentiality impact rated CVSS 5.3 (PR:L). No CISA KEV entry or confirmed active exploitation is indicated; a public technical writeup reference exists but is not verified as working exploit code, and the vendor has published a fix commit.
Authenticated users of ONEARMY community-platform before 2.165.2 can mark other users' notifications as read by iterating sequential notification IDs against the POST /api/notifications/:id/read endpoint, which updated the notifications table by ID alone without verifying ownership. The effect is integrity-only and confined to users in the same tenant: victims silently lose unread indicators for replies, comments and new-content notices, and may miss activity they would otherwise respond to. The vendor has released 2.165.2 with the ownership check, and a public technical writeup of the IDOR exists; no public exploit code or active exploitation is confirmed (not in CISA KEV), and the vendor-assigned CVSS 4.0 score is 5.3 (assessed as CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), so priority is this-month rather than emergency.
DaybydayCRM through 2.2.1 lets any authenticated account - including a low-privileged employee - take over project assignment by sending a PATCH or POST request to /projects/updateassign/{external_id} with an arbitrary user_assigned_id, because ProjectsController::updateAssign() never enforces the can-assign-new-user-to-project permission. The impact is a limited-integrity authorization bypass: project ownership and the notifications that follow can be redirected to an attacker-chosen user, while no data is disclosed and availability is unaffected (CVSS 5.3, CWE-862). A valid session plus knowledge or enumeration of a target project's external_id is required, no public exploit code was identified at the time of analysis, and the issue is not listed in CISA KEV.
Incorrect authorization in BookStack's AttachmentController allows an authenticated user who holds attachment permissions to reach attachments belonging to other users' unpublished draft pages by enumerating sequential attachment IDs, then download, rename, relink or replace those files. Only BookStack deployments before 26.09.2 are affected, and the flaw is bounded to draft-page attachments rather than published content or the wider application, giving low confidentiality and integrity impact (CVSS 4.0 base 5.3; assessed CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) with no victim interaction required. No public exploit code or active exploitation has been identified at time of analysis, and the vendor has shipped a fix in BookStack 26.09.2.
Missing authorization in RosarioSIS before 12.9.1 lets an authenticated teacher write referrals, eligibility codes, attendance entries and final grades for students outside their own course periods by submitting arbitrary student IDs to the save handlers MakeReferral.php, EnterEligibility.php, InputFinalGrades.php and TakeAttendance.php. The flaw requires valid teacher-level credentials (CVSS 4.0 base 5.3, PR:L) and is confined to record integrity within the same school - there is no confidentiality or availability impact and no anonymous attack path. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; the vendor has released fix version 12.9.1.
Cervantes (alpha 0.3 through v1.3-beta) contains an insecure direct object reference that lets any authenticated low-privileged user on a shared instance read sensitive project findings, proof-of-concept details, credentials, and client information, and change finding status or transfer findings into projects they own. The attack is network-reachable, needs no user interaction, and primarily compromises confidentiality with a lower integrity impact; availability is not affected. No public exploit identified at time of analysis, and the vendor references patch information in its Grayback advisories.
Authorization bypass in Scada-LTS 2.8.0 lets a low-privileged authenticated user read data outside their assigned scope by tampering with the 'ids' parameter handled by HttpServletRequest.getParameter in AmChartValuesAPI.java (the AmCharts Data API). Only confidentiality is affected and only at a low level, with no integrity or availability impact and no victim interaction required; the attacker must already hold a valid account on the web application and be able to reach the API endpoint. The vendor acknowledges the issue and states a security-hardened release is in preparation, while a published exploit is referenced and the CVSS 4.0 vector carries E:P; CISA KEV does not list this CVE and the priority label is monitor, so no confirmed active exploitation is established.
Integer truncation in Ghidra's decompiler packed-stream parser (PackedDecode::skipAttribute and skipAttributeRemaining in marshal.cc) causes the parser cursor to under-skip string attributes when a crafted length such as 0x100000000 is supplied, so the cursor remains inside attacker-controlled string data that is then decoded as legitimate protocol elements. Any Ghidra release before 12.2 is affected; an analyst must open or import a malicious packed stream such as a crafted .sla file, after which the decompiler process can be made to misinterpret data, inject attributes into its input stream, or crash. Impact is bounded to the decompiler process with no confidentiality effect and only limited integrity/availability impact; no public exploit was identified at time of analysis and the issue is not in CISA KEV, so this is a low-priority, patch-when-convenient fix rather than an emergency.
Web::Simple versions before 0.035 for Perl allocate a buffer sized by the Content-Length header for urlencoded body parameters. Web::Dispatch::ParamParser::get_unpacked_body_from reads an application/x-www-form-urlencoded body using a single read call, with no cap and the return value ignored. Perl's read grows the buffer to the requested length before reading, so the declared Content-Length determines the allocation. An attacker can trigger this through any route whose dispatch specification has a % body-parameter match, such as sub (POST + %name=), sending a Content-Length far larger than the body actually sent. No authentication is involved.