Stack-based buffer overflow in ImageMagick's bzip2 image decoding path can crash the process or corrupt stack memory when a crafted bzip2-compressed image is parsed by versions before 6.9.13-58 and 7.x before 7.1.2-33. The assessed impact is high integrity and availability loss with no confidentiality impact; the assessed CVSS 3.1 vector is network-reachable and unauthenticated (PR:N), while the supplied CVSS 4.0 vector reflects a low-privilege context (PR:L), so actual authentication depends on the hosting application that accepts and processes the image. No public exploit was identified at time of analysis, and the issue is labeled for remediation this week.
Out-of-vocabulary stop_token_ids in vLLM 0.20.1 through 0.28.x allow a client able to submit generation requests to terminate the inference engine, causing denial of service for every other user sharing that server; on the V2 runner the same unchecked index can instead write outside the logits buffer and corrupt adjacent logits or other GPU state. The flaw is an input-validation gap: SamplingParams accepted any integer for stop_token_ids and those values became column indices into the model's logits tensor, so the OpenAI chat and completion paths, the legacy generate endpoint, and batch inputs are all affected. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VA:H) puts this at 7.1 with availability-only impact, and the PR:L metric is the main limiting factor, meaning the attacker needs the privileged capability to submit requests rather than being fully anonymous; no public exploit code or active exploitation has been identified at time of analysis, and priority is this-week remediation rather than emergency response.
Memory exhaustion in vLLM's multimodal chat audio path lets an authenticated API user submit a small compressed audio payload to /v1/chat/completions that decodes into very large PCM data, driving up server memory and degrading or halting availability. Deployments in the >= 0.19.0, < 0.24.0 range that accept audio content parts are affected; the fix in 0.24.0 extends the existing decoded-duration guard to AudioMediaIO, which currently calls load_audio(..., sr=None) with no max_duration_s bound. Exploitation requires a valid API key by default (PR:L) and an audio-capable deployment; no public exploit code was identified at time of analysis, and the issue is a sibling of the already-published speech-to-text decompression-bomb advisory.
Settings overwrite in the InstaWP Connect WordPress plugin before 0.1.4.2 lets an authenticated low-privileged user who has been explicitly granted access to the plugin's sync feature change plugin settings, including the setting that controls which roles may use that feature. The settings-update action verifies a nonce but performs no capability check (CWE-862), so the attacker must already hold such an account and supply a valid nonce; the role grant is not enabled by default. This is a low-priority issue (CVSS 3.1, EPSS 0.17%, decision: monitor); a public PoC reference exists but is not verified as working exploit code, and there is no CISA KEV confirmation.
Path traversal in rclone's local backend (versions through 1.75.1) allows an attacker who can plant a directory named '...rclonelink' inside a source tree to redirect directory metadata operations one level above the destination the operator selected. The flaw only triggers when a sync targets a local destination with both --links/-l and --metadata enabled, and it is metadata-only: content writes remain blocked by the earlier os.Root hardening, and ownership changes require rclone to run as root, while non-root runs are limited to rewriting timestamps and extended attributes of the destination's parent directory. Exploitation status at time of analysis: no public exploit code confirmed by intelligence sources, although the upstream advisory documents a working reproduction; the vendor has released rclone 1.75.2 as the fix, and priority is routine (patch within the current cycle).
Firecrawl before 2.11.586 is affected by a server-side request forgery protection bypass in its Playwright service proxy, where an attacker who controls authoritative DNS for a submitted scrape target can rebind the hostname so the pre-connection validation sees a public address and the later proxy connection reaches a private or link-local address, exposing cloud metadata and internal services. Exploitation requires attacker-controlled DNS, a low or zero TTL, and winning the timing window between the validation lookup and the connection, and applies to the default blocking path unless ALLOW_LOCAL_WEBHOOKS is enabled. This is a genuine but second-tier priority: no public exploit was identified at time of analysis, and the vendor-released fix is Firecrawl 2.11.586.
Missing attempt throttling in the SMS code verification logic of ruoyi-vue-pro (through version 2026.09) allows unauthenticated remote attackers to repeatedly submit verification-code guesses for a known phone number, with the only real impact being low confidentiality exposure if a guess lands inside the code's validity window. Attack complexity is rated high and exploitability 'difficult', and the CVSS 4.0 base score is 2.9 (LOW) with a vuln.today decision label of 'monitor'; a public PoC reference exists but is not verified as working exploit code, no CISA KEV entry applies, and the vendor did not respond to the disclosure so no fixed release is confirmed.
Path traversal in Leon's built-in '/download model' command lets an attacker who supplies a crafted model URL write attacker-controlled content to arbitrary filesystem paths writable by the Leon process, escaping the intended LLM models directory. All Leon builds prior to commit 50df142 are affected (CPE cpe:2.3:a:leon-ai:leon:*), and exploitation depends on the operator being tricked into running '/download model' with a URL whose final segment percent-encodes '../' or '..\' separators - the assessed vector is AV:N/AC:L/PR:N/UI:R with integrity-only impact (I:H, C:N/A:N), so no attacker authentication is needed but no write occurs without that operator action. No CISA KEV listing or EPSS signal was present in the supplied intelligence; the upstream fix includes regression tests that exercise the encoded-traversal payloads, but no verified public exploit code was identified. This is a genuine but moderate-priority integrity flaw, not a drop-everything emergency, and a maintainer fix exists in commit 50df142 (PR #594).
Memory exhaustion denial of service in ImageMagick 6.x before 6.9.13-58 and 7.x before 7.1.2-33 occurs when various decoders process images containing crafted XMP profiles and leak memory on each pass. Remote, unauthenticated attackers can repeatedly supply such images to upload, thumbnail, or conversion pipelines to gradually exhaust memory, although a single request has only limited availability impact. Vendor patches are available in 6.9.13-58 and 7.1.2-33, and no public exploit was identified at time of analysis.
Memory exhaustion in ImageMagick's XML parsing code lets remote, unauthenticated attackers degrade availability by feeding crafted, deeply nested XML-bearing input (for example SVG/MSVG or other XML-based formats the library parses) until an allocation cleanup path fails to release memory at the parser's nesting-depth limit. ImageMagick 6.x before 6.9.13-58 and 7.x before 7.1.2-33 are affected; the CVSS 4.0 score of 6.9 reflects low availability-only impact, since each malicious request leaks only a bounded amount and sustained or repeated requests are needed to exhaust memory. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; vendor-released fixes exist in 7.1.2-33 and 6.9.13-58.
Unauthenticated memory exhaustion in 'rclone serve s3' (streaming multipart implementation shipped in 1.75.0 through 1.75.1) lets a network client defeat the configured multipart reorder-memory cap by holding two concurrent current-part PUT requests that each declare a 5e18-byte body, wrapping the signed int64 accounting counter negative so later out-of-order parts bypass the buffer check and are retained in RAM. Only availability is affected - the reporter demonstrated a bounded 1 MiB-limit run admitting six 8 MiB out-of-order parts and roughly 50 MiB of RSS growth, with no confidentiality or integrity impact shown. Exploitation requires the documented anonymous deployment (no --auth-key or --auth-proxy) with a reachable listener, and the attacker must actually transmit the body bytes; a public PoC reproducer accompanies the advisory, and no confirmed active exploitation (CISA KEV) or EPSS signal is present in the supplied data, so this is a genuine but bounded availability risk rather than a top-tier emergency.
Rclone's `serve webdav` command from 1.64.0 through 1.75.1 grants unauthenticated namespace enumeration because both HTTP auth middlewares in `lib/http` short-circuit every OPTIONS request, not just genuine CORS preflights. A remote attacker with no credentials and no user interaction can send OPTIONS to any path and read the returned `Allow` header, whose value differs for an existing file, an existing collection and a missing path, revealing the existence and type of arbitrarily named files and directories. The exposure is metadata-only - no file contents, listings or writes are reachable - and the flaw does not affect `serve http`, `serve restic` or `rcd`; a vendor patch is available in 1.75.2 and the advisory includes public proof-of-concept reproduction steps verified by the reporter, while no confirmed active exploitation has been recorded (not in CISA KEV).
Unauthenticated server-side request forgery in NiubiGEO before 0.3.2 allows remote attackers to make the server fetch loopback, private-network, link-local, or cloud metadata addresses by supplying a crafted domain value to POST /audit-plan; the fetched response is returned in the plan's siteEvidence JSON, making this a full-response read SSRF. No authentication or user interaction is required, but the endpoint must be network-reachable and the audit/site-evidence feature invoked. No public exploit code was identified at time of analysis, and the vendor has released v0.3.2 with public-URL validation and per-redirect address pinning.
Unauthenticated SQL injection in the login handler of mansi-k Restaurant_IMS, a PHP-based restaurant information management system. The login_id and epsw parameters of lsmodal.php reach a database query without proper sanitisation, so a remote attacker who can reach the login modal can inject SQL before authenticating, with low confidentiality, integrity and availability impact per the assessed CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). The project is distributed as a rolling release at commit d7ad49f61ab7cc1ec6eb359ac2b5378bdbde0694, the vendor did not respond to the disclosure, no vendor patch is identified, and no public exploit code was identified at time of analysis; the practical exposure limit is that the codebase is a niche project with a small reachable population.
SQL injection in the SiYuan note-taking kernel's history search handlers (all builds up to and including v3.8.6) lets anyone holding a valid admin API token read the contents of history.db beyond what the history API is meant to expose, including content, titles and paths of previously deleted documents. The flaw is privileged rather than remote-unauthenticated: the actor must already possess the workspace admin token, obtain it from ws/conf/conf.json, complete the login flow, or operate inside a client that holds it, such as a malicious plugin or the MCP history tool. Impact is read-only confidentiality loss against history.db - no integrity or availability effect - and the vendor advisory ships a reproduction that was validated against a source-built v3.8.6 kernel; no confirmed active exploitation (CISA KEV) was reported and the priority label is this_month.
SiYuan's MCP asset tool fails to block dotenv-style secret files, so an attacker who can drive an authenticated MCP client can copy a file such as ~/.env from the server host into the workspace and then read it back over HTTP from /assets/. The flaw is an incomplete fix of GHSA-p23f-cm6q-2qp8: the sensitive-path check is a 17-entry home-dotfile blacklist (.ssh, .aws, .kube, .docker, .gnupg, .git-credentials, credentials*, id_*) that omits .env, .env.local, .env.production, ~/Library, other users' home directories and Windows AppData. Public proof-of-concept reproduction steps exist and were executed against a self-hosted SiYuan 3.8.6 lab; because the MCP server must be exposed and the attacker needs a valid SiYuan API token, the issue is a moderate, not emergency, priority (this_month).
ImageMagick releases before 7.1.2-33 leak a small amount of heap memory when the MAT decoder exits through a specific error path, so an unauthenticated remote attacker who can submit crafted MAT files repeatedly to a long-lived process can slowly accumulate memory and degrade availability. There is no confidentiality or integrity impact - the weakness is an availability-only resource exhaustion issue and each individual file leaks only a small amount of memory. The vendor has released a fix in 7.1.2-33, and no public exploit code was identified at time of analysis.
ImageMagick before 7.1.2-33 contains a policy bypass in its UHDR decoder: width and height checks run after the image is decoded, so a crafted UHDR file with oversized dimensions can consume excessive resources even when ImageMagick policy limits are configured. The flaw is an unauthenticated, no-interaction availability issue (CVSS 6.9 under CVSS:4.0; assessed CVSS:3.1 availability impact is Low) affecting applications that decode attacker-supplied UHDR images; no public exploit was identified at time of analysis. It is a bounded, medium-severity denial of service rather than a code-execution or data-disclosure risk.
Missing object-level ownership checks in the WPVR (WP VR) virtual tour builder plugin for WordPress before 9.0.3 allow authenticated users with contributor-level access or above to modify, reconfigure and publish virtual tours created by other authors. The flaw is an integrity-only issue on multi-author or open-registration sites: it is rated 2.7 by the CVE record and 3.1 in our assessment (both agree there is no confidentiality or availability impact), EPSS is negligible at 0.13% (3rd percentile), there is no CISA KEV listing, and the priority label is monitor. A public PoC reference exists in the WPScan entry, but it is not verified as working exploit code, and the vendor has released a fix in 9.0.3.
GiveWP before 4.19.0.1 allows authenticated users who hold donor-report (view) access, but not donor-edit access, to add, modify, or delete the stored address of any donor because the address-change handler lacks a capability check. This is a low-severity, low-priority issue despite being network-reachable, with EPSS at 0.13% (percentile 3%); a public PoC reference exists, but it is not verified as working exploit code.
Stored HTML form injection in the Qi Addons For Elementor WordPress plugin before 1.11.2 lets authenticated users with the Contributor role or above place live HTML forms - including password inputs whose form posts to an external host - into post content where WordPress would normally strip such markup. The flaw is a sanitisation-ordering weakness in the plugin's heading widget: HTML entities in the heading text are decoded after WordPress's normal filtering, so encoded markup becomes live at render time. Impact is limited and not self-executing: a victim (administrator or visitor) must view the affected post and choose to type credentials into the injected form, and the independent assessment rates overall risk as LOW real-world priority; there is no CISA KEV entry, EPSS is 0.10% (1st percentile), a public PoC reference exists but is not verified as working exploit code, and the vendor has released 1.11.2 as the fix.
Memory leaks in the JNG encoder of ImageMagick 6.x before 6.9.13-58 and 7.x before 7.1.2-33 let unauthenticated remote attackers exhaust a process's memory by supplying crafted images that are encoded to JNG output, causing limited denial of service; only workflows that actually produce JNG output are exposed. Vendor patches are available in 6.9.13-58 and 7.1.2-33, and no public exploit was identified at time of analysis. Severity is moderate and urgency is low (vuln.today decision: this_month), consistent with availability-only, limited impact.
Null pointer dereference in ImageMagick's DJVU decoder crashes the process when a memory allocation inside the decoder fails and the unchecked NULL result is then used. Affected are 6.x builds before 6.9.13-58 and 7.x builds before 7.1.2-33, meaning any service that decodes attacker-supplied DJVU images with an unpatched build can be knocked over for a denial of service. No public exploit code or in-the-wild exploitation was identified at time of analysis, and the practical severity is tempered by the fact that the crash only materialises under an allocation-failure condition the attacker does not directly control; impact is confined to availability, with no code execution or data exposure.
ImageMagick fails to free memory allocated while parsing crafted MSL (Magick Scripting Language) files, so repeated processing of such files steadily drains process memory until the service is exhausted. Affected builds are 6.x before 6.9.13-58 and 7.x before 7.1.2-33, and the exposure is limited to deployments that actually hand untrusted MSL content to the MSL decoder rather than to generic image uploads. The impact is availability-only (no confidentiality or integrity loss), the CVSS 4.0 vector rates the attack complexity as high and the availability impact as low, and no public exploit has been identified at time of analysis. Fixed releases are published: 7.1.2-33 and 6.9.13-58.
rclone's WebDAV backend (v1.56.0 through v1.75.1, fixed in v1.75.2) forwards operator-configured custom credential headers such as X-Auth-Token or X-Api-Key to a different host whenever the configured WebDAV server answers with a cross-host, non-downgrade HTTP 3xx redirect, disclosing a reusable credential to whoever controls or influences the redirect target. Only custom-named headers set via --webdav-headers are exposed, because Go's net/http strips Authorization, Www-Authenticate, Cookie and Cookie2 across registrable domains; the leak occurs in the default configuration and does not depend on the opt-in auth_redirect option. Exploitation requires an attacker-influenced redirect (open redirect, compromised or malicious endpoint, or on-path position on a cleartext or same-host hop), which is reflected in the assessed high attack complexity; a public PoC reference exists in the form of advisory reproduction steps, which were reviewed against the source trace but not verified as working exploit code, and no confirmed active exploitation was identified at time of analysis. Vendor-released patch: v1.75.2.
Parse Server fails to reject reserved internal field names in client-supplied object writes, so any client with write access to a class can store an object containing an internal field that breaks every subsequent read of that object on MongoDB, disrupting queries for all users of that class until the field is removed from the database. The same gap lets a user clear internal fields on records they may write - notably the account lockout state and password history of their own account - bypassing lockout and password policy enforcement on both MongoDB and PostgreSQL deployments. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has released fixes in 8.6.100 and 9.10.4-alpha.3.
An integrity bypass in the Node.js archiving library adm-zip (through version 0.6.1) allows a crafted ZIP to defeat duplicate-entry validation by registering the same target file under canonically equivalent names such as './hello.txt' and 'hello.txt'. Applications that follow a validate-then-extract pattern - approving an archive by reading an entry with getEntry() or readAsText(), then unpacking it with extractAllTo() - can therefore approve benign content and still write attacker-chosen content to the expected path. This is a medium-severity integrity issue affecting npm consumers of adm-zip at or below 0.6.1; no public exploit code was identified at time of analysis and there is no CISA KEV confirmation of active exploitation, while the vulnerability is inert for applications that extract untrusted archives without relying on a prior content-validation step.
A path traversal flaw in the designer-mcp MCP server (versions up to 2.1.0) lets a caller of the get_reference tool read files outside the bundled references directory by supplying a crafted reference name. Because the argument was concatenated directly into a path with a '.md' extension appended, exposure is limited to Markdown files and to low confidentiality impact - no write or availability effect. Exploitation requires the attacker to already hold access as a connected MCP client invoking the tool, and a public issue report (#14) referencing the flaw exists but is not verified working exploit code; there is no confirmation of active exploitation. The project ships rolling releases, so version-based guidance is unavailable and remediation is by commit c8c2951dcbed9b1710a745993f028317f10a3f10.
DOM-based cross-site scripting in Privoce Vocechat up to and including 0.9.121 allows remote attackers to run script in a victim's browser by crafting a link whose `welcome` query parameter is reflected into the widget.html page. Exploitation requires the target to open the malicious URL (CVSS 4.0 UI:P, assessed vector UI:R), and impact is confined to client-side script execution rather than server compromise. VulDB reported the issue with a public PoC document reference that is not verified as working exploit code, no CISA KEV entry applies, the vendor was contacted and did not respond, and no fixed version is listed in the available sources; scoring is 5.3 with a this_month priority.
Unrestricted file upload in TinyFileManager 2.0 through 2.6 allows a user who is already authenticated to the file manager (CVSS PR:L) to store arbitrary files through the Remote URL File Upload Module in tinyfilemanager.php without file-type or extension enforcement, which can escalate to PHP code execution if the storage location is web-served and script-executable. The vendor was contacted about the disclosure and did not respond, so no fixed release has been identified; exploitation requires valid credentials plus a deployment that exposes the remote-URL upload path. A public PoC reference exists (a linked Google Drive artifact); it is not verified as working exploit code, and there is no CISA KEV confirmation of active exploitation - the priority signal is 'this_month' rather than an emergency, consistent with the authentication gate.
Cross-tenant authorization bypass in rclone's 'serve s3 --auth-proxy' mode lets an authenticated tenant inject parts into, complete, or abort another tenant's in-flight multipart uploads, and read upload and custom object metadata belonging to that tenant. Only deployments that map multiple access keys to separate per-tenant backends through --auth-proxy are affected; tracked as affecting rclone 1.68.0 through 1.75.1, with a vendor fix in v1.75.2. The advisory includes a documented two-tenant reproduction; that PoC reference is not verified as publicly released working exploit code, and there is no confirmation of active exploitation. Impact is bounded - the destination key is fixed by the victim at initiate, no at-rest tenant content is read, and the target upload must still be in flight - so this rates as a medium-severity, this-month-priority issue rather than an emergency.
Stored cross-site scripting in CloudClassroom-PHP-Project allows an attacker to submit script content through the fname argument of addnewstudent.php, which is persisted and later rendered without output encoding, executing in the browser of any user who views the affected page. The CVSS 4.0 base score is 5.3 (medium), and the impact is limited to low integrity with no confidentiality or availability effect per the assessed vector. No CISA KEV listing is present and no public working exploit has been confirmed; a public PoC reference exists but is not verified as working exploit code, and the vendor was contacted about the disclosure but did not respond, so no vendor-released patch is identified at time of analysis.
SQL injection in SourceCodester Performance Indicator System 1.0 lets a remote attacker who can authenticate to the admin area manipulate the ID argument of /opils/admin/deleteproduct.php and inject SQL, with low confidentiality, integrity, and availability impact under the assessed vector. This is a medium-severity, lower-priority issue rather than an urgent one: the priority label is this_month, and the supplied data contains no KEV confirmation. A public PoC reference exists at the linked GitHub issue, but it is not verified as working exploit code.
PHP code injection in DedeCMS up to and including 5.7.118 lets an attacker who already holds backend administrator credentials supply a crafted vtime argument to dede/update_guide.php, which is passed into a require_once call and results in attacker-influenced code being loaded and executed. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) confirms remote reachability with no user interaction, but exploitation is gated on high-privilege authentication, so anonymous remote users cannot reach the flaw directly. A public PoC reference exists in a third-party GitHub repository; it is not verified as working exploit code, and there is no CISA KEV confirmation of active exploitation, with a vuln.today priority of this_month indicating a moderate, authentication-gated risk rather than an emergency.
Cross-tenant record disclosure in AshPostgres 0.38.0 through 2.15.1 lets an authenticated tenant user load destination records that are only related to a source record through another tenant's join rows, when a many_to_many or through relationship is loaded with a lateral join. The exposure is bounded: it requires the join resource (or a resource along the through path) to use Ash's :attribute multitenancy strategy and to actually hold rows for several tenants, plus a load path that triggers a lateral join via a per-record limit, offset or sort on the relationship; schema- or context-based multitenancy and non-lateral loads are not affected. No public exploit code was identified at time of analysis, the issue is not in CISA KEV, and the vendor-released fix is AshPostgres 2.15.2.
AshPostgres versions 2.6.22 through 2.15.1 can disclose another tenant's row to an authenticated caller when an upsert is skipped and the action was invoked with return_skipped_upsert?: true. The vulnerable read-back in do_bulk_create/3 and upsert/4 re-fetched the existing row by upsert identity without applying the resource's attribute multitenancy (strategy :attribute), so an identity collision across tenants could return the wrong tenant's field values; the exposure is read-only disclosure of the matched row, with no write or availability impact. Exploitation requires the non-default combination documented in the advisory - attribute multitenancy, an upsert action with return_skipped_upsert?: true, an upsert that is actually skipped, and caller-supplied identity values that another tenant also uses - and no public exploit code or CISA KEV entry was identified at time of analysis; vendor-released patch: 2.15.2.
An incorrect authorization flaw in the Elixir Ash framework (versions 3.24.0 up to but not including 3.37.1) lets an authenticated client read destination records that are unrelated to the source record when a `through` relationship is loaded for a single record with a caller-controlled `limit: 1` and optional `offset`. The vulnerable path in `lateral_join?/4` skips the filter that ties the destination back to the source, so a client paging a field such as `teachers(limit: 1, offset: n)` through AshGraphql can walk through destination records that the destination's policies only permit when reached via that relationship. Exploitation requires an authenticated session and a deployment that exposes such a `through` relationship to caller-controlled paging while relying on `accessing_from` in destination read policies; no public exploit was identified at time of analysis, and the vendor has released a fix in 3.37.1.
Rclone's Backblaze B2 backend sends the live account Authorization token and any configured SSE-C encryption key headers to a custom download host when --b2-download-url is set, and it follows redirects with Go's default policy that inspects host but not scheme. A same-host HTTPS-to-HTTP downgrade from that download host replays the full-capability B2 bearer token in cleartext to an on-path observer, while a cross-host redirect forwards the X-Bz-Server-Side-Encryption-Customer-* headers - and therefore the customer key - to an unrelated host. Only deployments using the non-default custom download host are reachable, and the redirect behaviour is controlled by the CDN/proxy rather than the attacker; the vendor fixed the issue in v1.75.2 and a proof-of-concept procedure is described in the public advisory, though it is not verified as working exploit code and no active exploitation is reported.
SiYuan kernel on Windows 3.5.4 through 3.8.6 lets authenticated API callers bypass the IsSensitivePath denylist by prefixing localPath with the NT extended-length prefix \\?\, causing the workspace conf directory to be copied into data/assets and then served to unauthenticated clients over GET /assets/. The exposed files include conf.json with the API token and accessAuthCode plus key.pem, ca.key, and cert.pem; the GHSA includes a reproducible PoC with captured runtime confirmation, and the package range is >= 3.5.4, <= 3.8.6, fixed in v3.8.7. The independent assessment scores CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N; vuln.today labels it this_week, and no CISA KEV entry or EPSS score appears in the supplied data.
LiveQuery subscription isolation fails in Parse Server (versions 9.0.0 up to 9.10.5-alpha.4 and 8.x through 8.6.102), allowing an authenticated client to receive LiveQuery events that belong to another user - including _Session events carrying session tokens that can be used to impersonate the victim. The flaw only manifests when an application uses a $or operator in its subscription query and depends on constraints placed next to that $or for isolation, such as the server-added owner filter on _Session or a constraint injected by a beforeSubscribe trigger, and it additionally requires a second client to be concurrently subscribed so the two subscriptions get grouped by the flawed hash. This is a conditional, configuration-dependent information disclosure rather than a universal authentication bypass: ACLs, class-level permissions and protected fields are still enforced per client, so only isolation that lives purely in query constraints is lost. No public exploit code has been identified and the issue is not in CISA KEV; the vendor has released fixes and the overall priority is to schedule patching this month.
Incomplete authorization in ProjectSend's file-version linking lets an authenticated staff user cause a protected original file to be shared with clients who should never see it. A staffer holding upload/edit permission can link a file they control onto another user's intermediate revision, and because linking moves the new file's assignments onto the root of the version chain, the real original becomes visible to the attacker's recipients; a client-scoped staffer can likewise carry an out-of-roster client onto someone else's file. Exploitation is gated by pre-existing state the attacker does not fully control (a multi-level chain where the linked previous item is itself a revision, or an upload already shared with an outside client), no public exploit code is identified at time of analysis and there is no CISA KEV entry, and the vendor has published an upstream fix commit (a6ce4f51cfd05e1c9895f8daed261ef1fdfd194d).
Loading a malformed mmproj (multimodal projector) file into llama.cpp's Pocket-TTS audio-generation path can drive an out-of-bounds heap write through list_pockettts_state_slots in tools/mtmd/models/pockettts-gen.cpp. The exposure is narrow: it requires local access with low privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) plus the operator actually loading an untrusted projector while using the non-default Pocket-TTS feature, so it is not a remote or default-inference risk. A public PoC reference exists but is not verified as working exploit code, there is no KEV listing, and the reviewed decision label is monitor; vendor build b11796 (commit 0a1ef309) is the documented fix, and on current master and b11871 the same malformed input trips a release-active GGML_ASSERT and aborts instead of corrupting the heap, while the by-construction hardening PR #29360 remains open.
Server-side request forgery in KodCloud KodExplorer through version 4.56 allows an authenticated low-privilege user to make the server issue requests to attacker-chosen destinations by supplying a URL to the Remote Download feature, which passes it to request_url_safe() in app/function/web.function.php. Rated CVSS 5.3 (CVSS 4.0: AV:N/AC:L/AT:N/PR:L/UI:N, low confidentiality/integrity/availability impact), the practical effect is that the KodExplorer host can be used to reach internal-only HTTP services that the attacker cannot reach directly. No public exploit code or confirmed active exploitation is reported, the vendor did not respond to the disclosure, and no vendor-released patch was identified at time of analysis.
Risk signals are moderate but notably conflicting: the published CVSS 4.0 score is 5.3, while the independent CVSS 3.1 assessment is 8.8 because successful exploitation can produce high confidentiality, integrity, and availability impact. Deserialization in SteelRaven7 Ravenfield's RFL/RFLD custom map handler (cacheCoverPoints) allows unauthenticated remote attackers to execute code when a player loads an attacker-supplied custom map, with user interaction required. A vendor patch named 'EA39 Security Patch' is available, a public technical writeup is referenced but working exploit code is not confirmed by the provided data, and KEV status is not indicated; the vuln.today decision label is this_month.
OpenRemote Core deployments before 1.31.0 expose a cross-tenant information disclosure through the gateway tunnel endpoint: any authenticated, non-restricted user in one realm can retrieve active tunnel metadata (target host, target port, gateway ID, expiry/routing data) belonging to a gateway in a different realm. The flaw sits in getGatewayActiveTunnelInfos, which checks only that the caller-supplied realm path segment matches the caller's own realm and then looks up tunnels by the caller-supplied gateway ID without applying the realm predicate that both sibling endpoints use; authentication is required but no role restriction is enforced, so even low-privilege users qualify. Practical exploitation is limited by the need to know a specific 22-character random gateway asset ID in the victim realm, and impact is read-only disclosure of routing metadata rather than data modification; a public PoC reference (a benign script in the vendor advisory) exists but was not verified as working exploit code, and no active exploitation has been reported.
Stored cross-site scripting in YesWiki before 4.7.0 allows anonymous visitors to plant markup in the {{filtertags}} action's attribute parameters, which the action echoes into page HTML without output encoding and which then executes in the browser of every user who views the page. Because the payload travels through the action-attribute parsing path, it is processed before - and instead of - the wakka formatter's allow_raw_html gate, so it still works on installations that have set allow_raw_html=0 to block editor-supplied markup. The default install posture (page ACLs read=* and write=*) lets anyone store the payload anonymously, with a hashcash token as the only friction; execution still requires a victim to open the page (UI:P). The GitHub advisory includes a detailed PoC with a recorded live execution against v4.6.7; no CISA KEV entry or active-exploitation confirmation was provided and no EPSS figure was supplied, and the fix is YesWiki 4.7.0.
Login CSRF in Infinity for Reddit through version 8.3.4 lets an attacker silently log a victim into the attacker's own Reddit account. The exported LoginChromeCustomTabActivity validates the OAuth 'state' parameter against a hardcoded constant in APIUtils.java rather than a per-session random value, so an attacker can authorize the app's client ID on their own Reddit account and deliver an infinity://localhost redirect containing the attacker's authorization code plus the constant state value. A victim who opens that crafted deep link then browses, posts, and reads messages under the attacker's account, which can expose content the victim subsequently submits or manipulate their view of the service. No public exploit code or active exploitation is confirmed in the supplied data; severity is medium (CVSS 4.0 5.3) and exploitation requires the victim to open the crafted link on a device with the vulnerable app installed.
Snipe-IT through 8.6.3 can persist sensitive custom-field values as plaintext in columns the application and UI present as encrypted when an asset is created through the API by a caller who does not hold assets.view.encrypted_custom_fields. The defect is confined to Api\AssetsController::store; the sibling API update path, the non-API web paths and BulkAssetsController all skip the field on gate denial, so an authenticated API user with asset-creation rights (PR:L in the assessed vector) can silently break the encryption-at-rest guarantee for that record, with the plaintext then visible to anyone reading backups, replicas or the database directly. No public exploit code or active exploitation has been reported, and the API transformer still redacts the value to the literal string "ENCRYPTED" for readers lacking the permission, so realized exposure depends on a separate database-layer compromise.
Code injection in Alfresco Activiti through 7.21.0-rc.692 lets an authenticated low-privileged user who can route input into JuelScriptEngine.eval execute attacker-supplied JUEL expressions, potentially leading to remote code execution on the server. The vendor was contacted but did not respond, and no public exploit or fixed release has been identified at time of analysis. The supplied CVSS 4.0 base score is 5.3 (medium), while the independent assessment's CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects the higher potential impact if the reachable evaluator permits arbitrary Java invocation; the trigger feature or field that feeds eval is not described in the available sources.
Stored cross-site scripting in YesWiki 4.2.0 through 4.6.7 lets any authenticated user who can post a comment embed raw HTML and JavaScript using the wiki's "".."" raw-HTML syntax, which is saved with only whitespace trimming and later rendered through a Twig raw filter, so the payload executes in the wiki origin for every visitor of that page, including administrators. Shipped defaults (allow_raw_html = true, comments_activated = true) keep the path open, but exploitation additionally requires that comments be enabled on at least one page, because the global default_comment_acl is comments-closed; the vendor confirms the flaw is fixed in 4.7.0, and the GitHub security advisory includes proof-of-concept request steps, while no CISA KEV listing or other evidence of active exploitation was supplied. Scored 5.3 on CVSS 4.0 (PR:L, scope changed, low confidentiality and integrity impact), the realistic outcome is script execution in a higher-privileged viewer's session, plausibly enabling session theft and follow-on wiki actions rather than server compromise.