Unauthenticated configuration read and write in the hubcmdui web management interface of Docker-Proxy through 5.1.9 lets remote attackers call /api/config to retrieve stored WeChat webhook URLs and Telegram bot tokens and to overwrite menu item links, proxyDomain, and the monitoring webhook that receives alerts. The route lacked any authentication middleware in default deployments (CVSS 4.0 base 6.9, PR:N), so the only real prerequisite is that the hubcmdui interface is network-reachable; the credential theft is further gated by whether notification integrations were actually configured, while the config-overwrite works regardless. The vendor has published a fix (commit a173befc, stated as available), no public exploit code was identified at time of analysis, and the vuln.today priority label is 'this_month', consistent with a genuine but moderate-priority issue rather than a drop-everything emergency. Rotate any WeChat/Telegram credentials that were stored in the exposed configuration.
Unauthenticated server-side request forgery in YesWiki before 4.7.0 lets any remote visitor make the wiki server issue HTTP(S) (and, per PHP's file() wrapper support, ftp) requests to attacker-chosen hosts and ports and read the fetched response body back in the HTTP reply. The flaw lives in the wakka '[[|URL]]' raw-inclusion syntax, which is reachable without authentication through the generic page-render handler's content parameter - strip_tags() removes HTML but not wiki markup - and can also be planted stored by an editor with ACL '+' so that it fires when an anonymous visitor views the page. The vendor advisory includes a reproduction recipe (a single unauthenticated GET request observed to hit the internal host and reflect its body) confirmed against development HEAD; there is no CISA KEV listing and no independently verified public exploit package, and this is assessed as a genuine but moderate-priority issue rather than an emergency, with impact confined to confidentiality and no integrity or availability effect.
Stored cross-site scripting in GiveWP donation forms before 4.19.0.1 lets a user who already holds a custom GiveWP role with donation-form-editing capability store script in a form template setting, and the script runs in the browser of any visitor or administrator who opens the affected form. The assessed vector is AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N, so the privileged-account prerequisite and the need for victim interaction limit reach; no CISA KEV active exploitation signal is present, and a public PoC reference exists but is not verified as working exploit code.
Path traversal in the GiveWP WordPress plugin before 4.19.0.1 allows an authenticated user holding a high-privilege GiveWP custom role to read JSON-parseable files from anywhere on the server and to overwrite the plugin's stored configuration. The root cause is missing validation of a user-supplied filename before it is read from disk (CWE-22), reachable over the network with low attack complexity, but the PR:H prerequisite confines realistic abuse to insiders or to attackers who already control an account with that role. EPSS is 0.16% (5th percentile) and there is no KEV entry; a public PoC reference exists but it is not verified as working exploit code, and a vendor patch is available in 4.19.0.1.
Improper authentication in the SMS code verification flow of ruoyi-vue-pro (AuthController.java) lets remote attackers manipulate the 'mobile' and 'code' parameters to subvert login verification, yielding limited confidentiality, integrity and availability impact rather than full account takeover evidence. Versions up to and including 2026.09 are reported affected; the CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) and the independent assessment both confirm the attack is network-reachable with no privileges or user interaction, though the SMS login feature must be enabled and exposed for exploitation. A public PoC reference exists; it is not verified as working exploit code, there is no CISA KEV entry, and the item is triaged as 'this_month' priority - a genuine but moderate-priority issue rather than a top-tier emergency.
Server-side request forgery in Zylon PrivateGPT 1.0.0 and 1.0.1 lets remote unauthenticated attackers manipulate the URI argument handled by the URI Artifact Loader's load_file_from_uri function, causing the server to make attacker-influenced requests. The assessed impact is limited to low confidentiality, integrity, and availability effects with unchanged scope, and exposure depends on the URI ingestion feature being reachable by untrusted users. A public PoC reference exists but is not verified as working exploit code; no CISA KEV active exploitation is indicated in the provided data, and the priority label is this_month.
SQL injection in the Contact argument handled by /opils/staff/adddealer.php in SourceCodester Performance Indicator System 1.0 allows remote attackers to inject arbitrary SQL into the application's backend queries, with limited confidentiality, integrity and availability impact. The vendor scored it 6.9 under CVSS 4.0 (E:P), and it is a textbook low-to-moderate-priority web SQL injection rather than a top-tier emergency: the affected endpoint is a single, obscure page in a niche PHP product with very low real-world deployment, and authentication requirements are not confirmed from available data - the '/staff/' path suggests an administrative area that may require valid staff credentials even though the assessed vector carries PR:N. A public PoC reference exists; it is not verified as working exploit code, and there is no CISA KEV listing indicating active exploitation.
SQL injection in the Registration component of krupalshah Employee Recruitment System (/source/registerform3.php) allows unauthenticated remote attackers to manipulate the pemail argument and influence database queries, with low confidentiality, integrity, and availability impact per the assessed CVSS:3.1 vector. The product is unsupported and distributed through rolling releases without version identifiers, so the CPE wildcard covers all deployments up to commit 922ff6d208278282e7c8e36d70d9ae356adec9fe. A public PoC reference exists; it is not verified as working exploit code, and no CISA KEV confirmation of active exploitation is available; the issue is moderate-priority rather than an emergency.
Unauthenticated SQL injection in the Registration Wizard of krupalshah EmployeeRecruitmentSystem (PHP file /source/registerform2.php) lets remote attackers manipulate the university, institute, branch, degree, status, cpi, semester or experience arguments that flow into a mysql_query call, allowing them to read or alter backend data. The project is a rolling-release PHP application that the maintainer no longer supports and did not respond to the disclosure, so no fixed release is identified; the affected code is confirmed only up to commit 922ff6d208278282e7c8e36d70d9ae356adec9fe, and the CPE wildcard leaves the full affected version range undefined. A public PoC reference exists but is not verified as working exploit code, and there is no confirmed active exploitation (no CISA KEV entry); exploitation is bounded by the product's rarity and by whether a deployment exposes or disables public registration.
SQL injection in the registration endpoint (/source/registerform1.php) of krupalshah EmployeeRecruitmentSystem lets remote, unauthenticated attackers inject arbitrary SQL through the firstname, middlename, lastname, gender, birthdate, state, statespecify, city and cityspecify parameters, with low confidentiality, integrity and availability impact per the assessed CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). The project ships as a rolling release with no version identifiers, the maintainer was contacted and did not respond, and the codebase is no longer supported, so there is no fixed build to upgrade to. A public PoC reference exists in a GitHub issue tracker; it is not verified as working exploit code, and there is no confirmed active exploitation (no CISA KEV listing) - the practical constraint on this CVE is footprint, not exploitability, and it is triaged for handling this month.
GiveWP WordPress plugin before 4.19.0.1 allows authenticated users holding a custom fundraising role to edit, publish, and read pages owned by other users, including administrators, because page-capability requests are checked against the wrong page. The defect is a broken authorization issue (CWE-863) in the plugin’s page-level capability handling, and exploitation requires an existing fundraising-role account on an affected site. EPSS is low at 0.13% and there is no CISA KEV entry, but a public PoC reference exists and is not verified as working exploit code; the vendor has released 4.19.0.1 as the fixed version.
Memory exhaustion in the llm-multimodal component of smg 1.7.0 through 1.10.1 allows a remote, unauthenticated attacker to exhaust server memory by supplying a JPEG whose header declares enormous dimensions (libjpeg-turbo accepts up to 65500x65500, roughly 12 GiB of RGB output). The libjpeg-turbo path in crates/multimodal/src/jpeg_turbo.rs sizes the decoded buffer with an unchecked width x height x 3 multiplication and applies no ceiling, while the pure-Rust fallback decoder was already bounded at 512 MiB, so only the turbo decode path is exposed. Impact is availability-only (medium severity; no code execution, integrity or confidentiality effect), a public PoC reference exists but is not verified as working exploit code, and vendor fixes are available in 1.11.0. This is a medium-severity denial-of-service issue, not a high-priority emergency.
Server-side request forgery in EyouCMS 1.8.0 through 1.8.3 allows remote attackers to make the server issue HTTP requests to attacker-chosen destinations through the remote_file_to_local function in application/function.php, which retrieves a remote file by URL without validating the target. Per the independent assessment the vector is network-reachable with no privileges or user interaction required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N), producing low confidentiality, integrity and availability impact, and the PoC reference suggests the path is reachable from the unauthenticated front end. There is no confirmed active exploitation (not in CISA KEV); a public PoC reference exists but is not verified as working exploit code. The vendor was contacted and did not respond, no fixed version is listed in the evidence, and the issue is scheduled for remediation within the current month based on the assigned priority.
SQL injection in SourceCodester Performance Indicator System 1.0 lets a remote attacker inject arbitrary SQL through the 'Contact' argument handled by /opils/staff/save_profile.php, potentially reading or altering data in the underlying database. The assessed impact is limited to Low across confidentiality, integrity and availability (CVSS 3.1 base 6.9, AV:N/AC:L/PR:N/UI:N), so exposure is partial rather than full application takeover. A public PoC reference exists in a GitHub issue; it is not verified as working exploit code, and no confirmed active exploitation is reported - the vuln.today decision label is 'this_month', indicating a genuine but non-emergency issue concentrated in a niche PHP application unlikely to be widely deployed in production.
SQL injection in SourceCodester Performance Indicator System 1.0 lets remote attackers alter SQL statements executed by /opils/staff/edit_dealer.php through the Contact parameter, potentially reading or tampering with dealer records and other data in the underlying database. The supplied scoring (CVSS 4.0 6.9, AV:N/AC:L/PR:N/UI:N, E:P) describes network-reachable exploitation without privileges or user interaction, although the 'staff' path segment suggests the page may normally sit behind a staff login, so true unauthenticated reachability in a default deployment is unconfirmed. A public PoC reference exists; it is not verified as working exploit code, and no confirmed active exploitation has been reported.
The WP Stripe Checkout WordPress plugin before 1.2.2.62 accepts Stripe webhook callbacks without verifying their signature whenever no signing secret has been configured, which the advisory describes as the plugin's default state. Because the CVSS vector is PR:N, unauthenticated remote attackers can POST a forged payment-completion notification to the webhook endpoint and cause a completed order to be created without any payment being made. Impact is limited to integrity (C:N/I:L/A:N, CVSS 5.3) and does not extend to data disclosure or denial of service; EPSS is low at 0.15% (4th percentile) and no CISA KEV listing is present, though a public PoC reference exists that is not verified as working exploit code.
Unauthenticated visitors can read the content and settings of GiveWP donation forms that remain in draft, pending, private or scheduled status on WordPress sites running versions before 4.19.0.1. The plugin omits a status or capability check on its public front-end form-rendering route, so a form ID or slug can expose configuration that WordPress otherwise keeps non-public; impact is confined to confidentiality, with no write access or code execution. No CISA KEV entry is present and EPSS is 0.14% (3rd percentile); a public PoC reference exists but is not verified as working exploit code, and the vendor has released 4.19.0.1.
Unauthenticated order fraud in the Chikkili- Google Pay India for WooCommerce WordPress plugin through version 1.0.6 allows remote attackers to mark arbitrary WooCommerce orders as paid without any payment being made, because the plugin accepts payment notifications without verifying that they originated from the payment provider. The flaw is confined to sites that have installed and activated this plugin alongside WooCommerce and the Google Pay India payment method; impact is integrity-only (fraudulent paid status), with no confidentiality or availability effect and no code execution. No confirmed working exploit code is available - only a public reference that has not been verified as working exploit code - and EPSS is low at 0.14% (3rd percentile), consistent with a moderate business-logic issue rather than a top-priority emergency.
Missing capability checks in the WPVR WordPress plugin before 9.1.3 let authenticated users holding the Contributor role or higher drive the plugin's tour setup wizard and create or publish tour content, including arbitrary post metadata, that their role would not normally permit. Sites running WPVR from 8.5.55 up to 9.1.3 are affected, and the decisive exposure factor is whether untrusted people are granted Contributor-or-above accounts on those sites. Exploitation is not confirmed in the wild (no CISA KEV entry), EPSS is low at roughly 0.17 percent (6th percentile), and while a public PoC reference exists, it is not verified as working exploit code; impact is limited to integrity, with no stated confidentiality or availability effect.
Path traversal in Leon's built-in '/download model' command lets an attacker who supplies a crafted model URL write attacker-controlled content to arbitrary filesystem paths writable by the Leon process, escaping the intended LLM models directory. All Leon builds prior to commit 50df142 are affected (CPE cpe:2.3:a:leon-ai:leon:*), and exploitation depends on the operator being tricked into running '/download model' with a URL whose final segment percent-encodes '../' or '..\' separators - the assessed vector is AV:N/AC:L/PR:N/UI:R with integrity-only impact (I:H, C:N/A:N), so no attacker authentication is needed but no write occurs without that operator action. No CISA KEV listing or EPSS signal was present in the supplied intelligence; the upstream fix includes regression tests that exercise the encoded-traversal payloads, but no verified public exploit code was identified. This is a genuine but moderate-priority integrity flaw, not a drop-everything emergency, and a maintainer fix exists in commit 50df142 (PR #594).
Memory exhaustion denial of service in ImageMagick 6.x before 6.9.13-58 and 7.x before 7.1.2-33 occurs when various decoders process images containing crafted XMP profiles and leak memory on each pass. Remote, unauthenticated attackers can repeatedly supply such images to upload, thumbnail, or conversion pipelines to gradually exhaust memory, although a single request has only limited availability impact. Vendor patches are available in 6.9.13-58 and 7.1.2-33, and no public exploit was identified at time of analysis.
Memory exhaustion in ImageMagick's XML parsing code lets remote, unauthenticated attackers degrade availability by feeding crafted, deeply nested XML-bearing input (for example SVG/MSVG or other XML-based formats the library parses) until an allocation cleanup path fails to release memory at the parser's nesting-depth limit. ImageMagick 6.x before 6.9.13-58 and 7.x before 7.1.2-33 are affected; the CVSS 4.0 score of 6.9 reflects low availability-only impact, since each malicious request leaks only a bounded amount and sustained or repeated requests are needed to exhaust memory. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; vendor-released fixes exist in 7.1.2-33 and 6.9.13-58.
Unauthenticated memory exhaustion in 'rclone serve s3' (streaming multipart implementation shipped in 1.75.0 through 1.75.1) lets a network client defeat the configured multipart reorder-memory cap by holding two concurrent current-part PUT requests that each declare a 5e18-byte body, wrapping the signed int64 accounting counter negative so later out-of-order parts bypass the buffer check and are retained in RAM. Only availability is affected - the reporter demonstrated a bounded 1 MiB-limit run admitting six 8 MiB out-of-order parts and roughly 50 MiB of RSS growth, with no confidentiality or integrity impact shown. Exploitation requires the documented anonymous deployment (no --auth-key or --auth-proxy) with a reachable listener, and the attacker must actually transmit the body bytes; a public PoC reproducer accompanies the advisory, and no confirmed active exploitation (CISA KEV) or EPSS signal is present in the supplied data, so this is a genuine but bounded availability risk rather than a top-tier emergency.
Rclone's `serve webdav` command from 1.64.0 through 1.75.1 grants unauthenticated namespace enumeration because both HTTP auth middlewares in `lib/http` short-circuit every OPTIONS request, not just genuine CORS preflights. A remote attacker with no credentials and no user interaction can send OPTIONS to any path and read the returned `Allow` header, whose value differs for an existing file, an existing collection and a missing path, revealing the existence and type of arbitrarily named files and directories. The exposure is metadata-only - no file contents, listings or writes are reachable - and the flaw does not affect `serve http`, `serve restic` or `rcd`; a vendor patch is available in 1.75.2 and the advisory includes public proof-of-concept reproduction steps verified by the reporter, while no confirmed active exploitation has been recorded (not in CISA KEV).
Unauthenticated server-side request forgery in NiubiGEO before 0.3.2 allows remote attackers to make the server fetch loopback, private-network, link-local, or cloud metadata addresses by supplying a crafted domain value to POST /audit-plan; the fetched response is returned in the plan's siteEvidence JSON, making this a full-response read SSRF. No authentication or user interaction is required, but the endpoint must be network-reachable and the audit/site-evidence feature invoked. No public exploit code was identified at time of analysis, and the vendor has released v0.3.2 with public-URL validation and per-redirect address pinning.
Unauthenticated SQL injection in the login handler of mansi-k Restaurant_IMS, a PHP-based restaurant information management system. The login_id and epsw parameters of lsmodal.php reach a database query without proper sanitisation, so a remote attacker who can reach the login modal can inject SQL before authenticating, with low confidentiality, integrity and availability impact per the assessed CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). The project is distributed as a rolling release at commit d7ad49f61ab7cc1ec6eb359ac2b5378bdbde0694, the vendor did not respond to the disclosure, no vendor patch is identified, and no public exploit code was identified at time of analysis; the practical exposure limit is that the codebase is a niche project with a small reachable population.
SQL injection in the SiYuan note-taking kernel's history search handlers (all builds up to and including v3.8.6) lets anyone holding a valid admin API token read the contents of history.db beyond what the history API is meant to expose, including content, titles and paths of previously deleted documents. The flaw is privileged rather than remote-unauthenticated: the actor must already possess the workspace admin token, obtain it from ws/conf/conf.json, complete the login flow, or operate inside a client that holds it, such as a malicious plugin or the MCP history tool. Impact is read-only confidentiality loss against history.db - no integrity or availability effect - and the vendor advisory ships a reproduction that was validated against a source-built v3.8.6 kernel; no confirmed active exploitation (CISA KEV) was reported and the priority label is this_month.
SiYuan's MCP asset tool fails to block dotenv-style secret files, so an attacker who can drive an authenticated MCP client can copy a file such as ~/.env from the server host into the workspace and then read it back over HTTP from /assets/. The flaw is an incomplete fix of GHSA-p23f-cm6q-2qp8: the sensitive-path check is a 17-entry home-dotfile blacklist (.ssh, .aws, .kube, .docker, .gnupg, .git-credentials, credentials*, id_*) that omits .env, .env.local, .env.production, ~/Library, other users' home directories and Windows AppData. Public proof-of-concept reproduction steps exist and were executed against a self-hosted SiYuan 3.8.6 lab; because the MCP server must be exposed and the attacker needs a valid SiYuan API token, the issue is a moderate, not emergency, priority (this_month).
ImageMagick releases before 7.1.2-33 leak a small amount of heap memory when the MAT decoder exits through a specific error path, so an unauthenticated remote attacker who can submit crafted MAT files repeatedly to a long-lived process can slowly accumulate memory and degrade availability. There is no confidentiality or integrity impact - the weakness is an availability-only resource exhaustion issue and each individual file leaks only a small amount of memory. The vendor has released a fix in 7.1.2-33, and no public exploit code was identified at time of analysis.
ImageMagick before 7.1.2-33 contains a policy bypass in its UHDR decoder: width and height checks run after the image is decoded, so a crafted UHDR file with oversized dimensions can consume excessive resources even when ImageMagick policy limits are configured. The flaw is an unauthenticated, no-interaction availability issue (CVSS 6.9 under CVSS:4.0; assessed CVSS:3.1 availability impact is Low) affecting applications that decode attacker-supplied UHDR images; no public exploit was identified at time of analysis. It is a bounded, medium-severity denial of service rather than a code-execution or data-disclosure risk.
Memory leaks in the JNG encoder of ImageMagick 6.x before 6.9.13-58 and 7.x before 7.1.2-33 let unauthenticated remote attackers exhaust a process's memory by supplying crafted images that are encoded to JNG output, causing limited denial of service; only workflows that actually produce JNG output are exposed. Vendor patches are available in 6.9.13-58 and 7.1.2-33, and no public exploit was identified at time of analysis. Severity is moderate and urgency is low (vuln.today decision: this_month), consistent with availability-only, limited impact.
Null pointer dereference in ImageMagick's DJVU decoder crashes the process when a memory allocation inside the decoder fails and the unchecked NULL result is then used. Affected are 6.x builds before 6.9.13-58 and 7.x builds before 7.1.2-33, meaning any service that decodes attacker-supplied DJVU images with an unpatched build can be knocked over for a denial of service. No public exploit code or in-the-wild exploitation was identified at time of analysis, and the practical severity is tempered by the fact that the crash only materialises under an allocation-failure condition the attacker does not directly control; impact is confined to availability, with no code execution or data exposure.
ImageMagick fails to free memory allocated while parsing crafted MSL (Magick Scripting Language) files, so repeated processing of such files steadily drains process memory until the service is exhausted. Affected builds are 6.x before 6.9.13-58 and 7.x before 7.1.2-33, and the exposure is limited to deployments that actually hand untrusted MSL content to the MSL decoder rather than to generic image uploads. The impact is availability-only (no confidentiality or integrity loss), the CVSS 4.0 vector rates the attack complexity as high and the availability impact as low, and no public exploit has been identified at time of analysis. Fixed releases are published: 7.1.2-33 and 6.9.13-58.
rclone's WebDAV backend (v1.56.0 through v1.75.1, fixed in v1.75.2) forwards operator-configured custom credential headers such as X-Auth-Token or X-Api-Key to a different host whenever the configured WebDAV server answers with a cross-host, non-downgrade HTTP 3xx redirect, disclosing a reusable credential to whoever controls or influences the redirect target. Only custom-named headers set via --webdav-headers are exposed, because Go's net/http strips Authorization, Www-Authenticate, Cookie and Cookie2 across registrable domains; the leak occurs in the default configuration and does not depend on the opt-in auth_redirect option. Exploitation requires an attacker-influenced redirect (open redirect, compromised or malicious endpoint, or on-path position on a cleartext or same-host hop), which is reflected in the assessed high attack complexity; a public PoC reference exists in the form of advisory reproduction steps, which were reviewed against the source trace but not verified as working exploit code, and no confirmed active exploitation was identified at time of analysis. Vendor-released patch: v1.75.2.
Parse Server fails to reject reserved internal field names in client-supplied object writes, so any client with write access to a class can store an object containing an internal field that breaks every subsequent read of that object on MongoDB, disrupting queries for all users of that class until the field is removed from the database. The same gap lets a user clear internal fields on records they may write - notably the account lockout state and password history of their own account - bypassing lockout and password policy enforcement on both MongoDB and PostgreSQL deployments. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has released fixes in 8.6.100 and 9.10.4-alpha.3.
An integrity bypass in the Node.js archiving library adm-zip (through version 0.6.1) allows a crafted ZIP to defeat duplicate-entry validation by registering the same target file under canonically equivalent names such as './hello.txt' and 'hello.txt'. Applications that follow a validate-then-extract pattern - approving an archive by reading an entry with getEntry() or readAsText(), then unpacking it with extractAllTo() - can therefore approve benign content and still write attacker-chosen content to the expected path. This is a medium-severity integrity issue affecting npm consumers of adm-zip at or below 0.6.1; no public exploit code was identified at time of analysis and there is no CISA KEV confirmation of active exploitation, while the vulnerability is inert for applications that extract untrusted archives without relying on a prior content-validation step.
Cross-tenant authorization bypass in rclone's 'serve s3 --auth-proxy' mode lets an authenticated tenant inject parts into, complete, or abort another tenant's in-flight multipart uploads, and read upload and custom object metadata belonging to that tenant. Only deployments that map multiple access keys to separate per-tenant backends through --auth-proxy are affected; tracked as affecting rclone 1.68.0 through 1.75.1, with a vendor fix in v1.75.2. The advisory includes a documented two-tenant reproduction; that PoC reference is not verified as publicly released working exploit code, and there is no confirmation of active exploitation. Impact is bounded - the destination key is fixed by the victim at initiate, no at-rest tenant content is read, and the target upload must still be in flight - so this rates as a medium-severity, this-month-priority issue rather than an emergency.
Cross-tenant record disclosure in AshPostgres 0.38.0 through 2.15.1 lets an authenticated tenant user load destination records that are only related to a source record through another tenant's join rows, when a many_to_many or through relationship is loaded with a lateral join. The exposure is bounded: it requires the join resource (or a resource along the through path) to use Ash's :attribute multitenancy strategy and to actually hold rows for several tenants, plus a load path that triggers a lateral join via a per-record limit, offset or sort on the relationship; schema- or context-based multitenancy and non-lateral loads are not affected. No public exploit code was identified at time of analysis, the issue is not in CISA KEV, and the vendor-released fix is AshPostgres 2.15.2.
AshPostgres versions 2.6.22 through 2.15.1 can disclose another tenant's row to an authenticated caller when an upsert is skipped and the action was invoked with return_skipped_upsert?: true. The vulnerable read-back in do_bulk_create/3 and upsert/4 re-fetched the existing row by upsert identity without applying the resource's attribute multitenancy (strategy :attribute), so an identity collision across tenants could return the wrong tenant's field values; the exposure is read-only disclosure of the matched row, with no write or availability impact. Exploitation requires the non-default combination documented in the advisory - attribute multitenancy, an upsert action with return_skipped_upsert?: true, an upsert that is actually skipped, and caller-supplied identity values that another tenant also uses - and no public exploit code or CISA KEV entry was identified at time of analysis; vendor-released patch: 2.15.2.
An incorrect authorization flaw in the Elixir Ash framework (versions 3.24.0 up to but not including 3.37.1) lets an authenticated client read destination records that are unrelated to the source record when a `through` relationship is loaded for a single record with a caller-controlled `limit: 1` and optional `offset`. The vulnerable path in `lateral_join?/4` skips the filter that ties the destination back to the source, so a client paging a field such as `teachers(limit: 1, offset: n)` through AshGraphql can walk through destination records that the destination's policies only permit when reached via that relationship. Exploitation requires an authenticated session and a deployment that exposes such a `through` relationship to caller-controlled paging while relying on `accessing_from` in destination read policies; no public exploit was identified at time of analysis, and the vendor has released a fix in 3.37.1.
Rclone's Backblaze B2 backend sends the live account Authorization token and any configured SSE-C encryption key headers to a custom download host when --b2-download-url is set, and it follows redirects with Go's default policy that inspects host but not scheme. A same-host HTTPS-to-HTTP downgrade from that download host replays the full-capability B2 bearer token in cleartext to an on-path observer, while a cross-host redirect forwards the X-Bz-Server-Side-Encryption-Customer-* headers - and therefore the customer key - to an unrelated host. Only deployments using the non-default custom download host are reachable, and the redirect behaviour is controlled by the CDN/proxy rather than the attacker; the vendor fixed the issue in v1.75.2 and a proof-of-concept procedure is described in the public advisory, though it is not verified as working exploit code and no active exploitation is reported.
SiYuan kernel on Windows 3.5.4 through 3.8.6 lets authenticated API callers bypass the IsSensitivePath denylist by prefixing localPath with the NT extended-length prefix \\?\, causing the workspace conf directory to be copied into data/assets and then served to unauthenticated clients over GET /assets/. The exposed files include conf.json with the API token and accessAuthCode plus key.pem, ca.key, and cert.pem; the GHSA includes a reproducible PoC with captured runtime confirmation, and the package range is >= 3.5.4, <= 3.8.6, fixed in v3.8.7. The independent assessment scores CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N; vuln.today labels it this_week, and no CISA KEV entry or EPSS score appears in the supplied data.
LiveQuery subscription isolation fails in Parse Server (versions 9.0.0 up to 9.10.5-alpha.4 and 8.x through 8.6.102), allowing an authenticated client to receive LiveQuery events that belong to another user - including _Session events carrying session tokens that can be used to impersonate the victim. The flaw only manifests when an application uses a $or operator in its subscription query and depends on constraints placed next to that $or for isolation, such as the server-added owner filter on _Session or a constraint injected by a beforeSubscribe trigger, and it additionally requires a second client to be concurrently subscribed so the two subscriptions get grouped by the flawed hash. This is a conditional, configuration-dependent information disclosure rather than a universal authentication bypass: ACLs, class-level permissions and protected fields are still enforced per client, so only isolation that lives purely in query constraints is lost. No public exploit code has been identified and the issue is not in CISA KEV; the vendor has released fixes and the overall priority is to schedule patching this month.
Incomplete authorization in ProjectSend's file-version linking lets an authenticated staff user cause a protected original file to be shared with clients who should never see it. A staffer holding upload/edit permission can link a file they control onto another user's intermediate revision, and because linking moves the new file's assignments onto the root of the version chain, the real original becomes visible to the attacker's recipients; a client-scoped staffer can likewise carry an out-of-roster client onto someone else's file. Exploitation is gated by pre-existing state the attacker does not fully control (a multi-level chain where the linked previous item is itself a revision, or an upload already shared with an outside client), no public exploit code is identified at time of analysis and there is no CISA KEV entry, and the vendor has published an upstream fix commit (a6ce4f51cfd05e1c9895f8daed261ef1fdfd194d).
Server-side request forgery in KodCloud KodExplorer through version 4.56 allows an authenticated low-privilege user to make the server issue requests to attacker-chosen destinations by supplying a URL to the Remote Download feature, which passes it to request_url_safe() in app/function/web.function.php. Rated CVSS 5.3 (CVSS 4.0: AV:N/AC:L/AT:N/PR:L/UI:N, low confidentiality/integrity/availability impact), the practical effect is that the KodExplorer host can be used to reach internal-only HTTP services that the attacker cannot reach directly. No public exploit code or confirmed active exploitation is reported, the vendor did not respond to the disclosure, and no vendor-released patch was identified at time of analysis.
Risk signals are moderate but notably conflicting: the published CVSS 4.0 score is 5.3, while the independent CVSS 3.1 assessment is 8.8 because successful exploitation can produce high confidentiality, integrity, and availability impact. Deserialization in SteelRaven7 Ravenfield's RFL/RFLD custom map handler (cacheCoverPoints) allows unauthenticated remote attackers to execute code when a player loads an attacker-supplied custom map, with user interaction required. A vendor patch named 'EA39 Security Patch' is available, a public technical writeup is referenced but working exploit code is not confirmed by the provided data, and KEV status is not indicated; the vuln.today decision label is this_month.
OpenRemote Core deployments before 1.31.0 expose a cross-tenant information disclosure through the gateway tunnel endpoint: any authenticated, non-restricted user in one realm can retrieve active tunnel metadata (target host, target port, gateway ID, expiry/routing data) belonging to a gateway in a different realm. The flaw sits in getGatewayActiveTunnelInfos, which checks only that the caller-supplied realm path segment matches the caller's own realm and then looks up tunnels by the caller-supplied gateway ID without applying the realm predicate that both sibling endpoints use; authentication is required but no role restriction is enforced, so even low-privilege users qualify. Practical exploitation is limited by the need to know a specific 22-character random gateway asset ID in the victim realm, and impact is read-only disclosure of routing metadata rather than data modification; a public PoC reference (a benign script in the vendor advisory) exists but was not verified as working exploit code, and no active exploitation has been reported.
Stored cross-site scripting in YesWiki before 4.7.0 allows anonymous visitors to plant markup in the {{filtertags}} action's attribute parameters, which the action echoes into page HTML without output encoding and which then executes in the browser of every user who views the page. Because the payload travels through the action-attribute parsing path, it is processed before - and instead of - the wakka formatter's allow_raw_html gate, so it still works on installations that have set allow_raw_html=0 to block editor-supplied markup. The default install posture (page ACLs read=* and write=*) lets anyone store the payload anonymously, with a hashcash token as the only friction; execution still requires a victim to open the page (UI:P). The GitHub advisory includes a detailed PoC with a recorded live execution against v4.6.7; no CISA KEV entry or active-exploitation confirmation was provided and no EPSS figure was supplied, and the fix is YesWiki 4.7.0.
Login CSRF in Infinity for Reddit through version 8.3.4 lets an attacker silently log a victim into the attacker's own Reddit account. The exported LoginChromeCustomTabActivity validates the OAuth 'state' parameter against a hardcoded constant in APIUtils.java rather than a per-session random value, so an attacker can authorize the app's client ID on their own Reddit account and deliver an infinity://localhost redirect containing the attacker's authorization code plus the constant state value. A victim who opens that crafted deep link then browses, posts, and reads messages under the attacker's account, which can expose content the victim subsequently submits or manipulate their view of the service. No public exploit code or active exploitation is confirmed in the supplied data; severity is medium (CVSS 4.0 5.3) and exploitation requires the victim to open the crafted link on a device with the vulnerable app installed.
Snipe-IT through 8.6.3 can persist sensitive custom-field values as plaintext in columns the application and UI present as encrypted when an asset is created through the API by a caller who does not hold assets.view.encrypted_custom_fields. The defect is confined to Api\AssetsController::store; the sibling API update path, the non-API web paths and BulkAssetsController all skip the field on gate denial, so an authenticated API user with asset-creation rights (PR:L in the assessed vector) can silently break the encryption-at-rest guarantee for that record, with the plaintext then visible to anyone reading backups, replicas or the database directly. No public exploit code or active exploitation has been reported, and the API transformer still redacts the value to the literal string "ENCRYPTED" for readers lacking the permission, so realized exposure depends on a separate database-layer compromise.