Data masked by PostgreSQL Anonymizer can be disclosed in cleartext when a masking rule is implemented through a sub-query: the outer result set is anonymized, but rows returned by the nested query are not, so a database account mapped to a masked role can read values the rule was meant to hide. Only deployments that use dynamic/role-based masking with at least one sub-query-based masking rule are exposed; the attacker must already hold an authenticated PostgreSQL account mapped to a masked role (PR:L), and the impact is confidentiality-only, with no integrity or availability effect. The issue is fixed in PostgreSQL Anonymizer 3.3.0 and later; no public exploit code has been identified at time of analysis, and this is a moderate-severity issue suitable for the monthly patch cycle rather than an emergency response.
PostgreSQL Anonymizer fails to invalidate query plans that were prepared before a masking rule was added or before the session's role was changed, so an already-connected session can keep returning unmasked data until that session ends. Exposure requires an authenticated database session (PR:L per the assessed vector) holding a prepared plan that predates the masking configuration change; fresh sessions and newly prepared plans are masked correctly, which limits this to a defense-in-depth data-exposure issue rather than an external threat. The vendor-resolved issue is fixed in PostgreSQL Anonymizer 3.3.0 and later; no public exploit was identified at time of analysis and there is no KEV entry.
Out-of-bounds write in Zephyr's Ethernet L2 layer (subsys/net/l2/ethernet/ethernet.c) lets a remotely sent packet that the device forwards from a non-Ethernet interface to Ethernet corrupt memory preceding the packet buffer, causing crashes, packet corruption or heap inconsistency (CWE-787, CVSS 6.5, availability-weighted). Affected releases are Zephyr 4.1.0 through 4.4.2 built with CONFIG_NET_L2_ETHERNET_RESERVE_HEADER (default-y on nRF54L and NXP Wi-Fi zero-copy TX configurations) plus a forwarding or tunnelling path such as CONFIG_NET_IPV4_FORWARDING/CONFIG_NET_IPV6_FORWARDING from 802.15.4/OpenThread or PPP to Ethernet/Wi-Fi, IPv6 multicast forwarding, or the IPIP tunnel - plain Ethernet-to-Ethernet forwarding is not affected. The write only materialises in production builds compiled without CONFIG_ASSERT and without CONFIG_NET_BUF_HARDENING; the attacker controls neither the bytes written nor the offset, and no public exploit has been identified at time of analysis (not in CISA KEV).
Denial of service in Grafana OSS and Grafana Enterprise lets an authenticated user holding only the Viewer role crash the server by submitting a crafted server-side math expression that recurses without a depth limit (CWE-674). Per the assessed CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, 6.5), the attacker must be logged in but needs no special UI interaction, and the impact is availability only - no confidentiality or integrity effect. A transient crash is reachable with Viewer privileges alone, while making the outage survive restarts additionally requires the elevated permission to provision alert rules; EUVD lists affected branches spanning the 7.4.0 line through 13.2.x for both OSS and Enterprise editions. No public exploit code or CISA KEV entry was identified at time of analysis, and the priority signal is this_month rather than act_now.
An authenticated user with standard Notification Centre access in Xibo CMS before 4.4.3 can download notification attachments belonging to any other notification, including administrator-created ones, by iterating sequential notification IDs against the /notification/export/{id} endpoint. The flaw is a missing object-level authorization check (CWE-862): the export route validates that a user is logged in but does not verify that the requested notification belongs to, or is visible to, that user. No public exploit code or active exploitation has been identified at time of analysis, and the vendor considers upgrading to 4.4.3 the complete remediation, with privilege revocation as the interim workaround.
Missing object-level authorization on the dataset CSV export endpoint in Xibo CMS 4.4.2 and earlier lets a privileged authenticated user export the contents of any dataset - including those created by administrators - by iterating over sequential dataset IDs. Reaching the endpoint (GET /dataset/export/csv/{id}) requires a CMS account holding the non-default privilege that allows edits, including deletion, to all created DataSets independently of Layouts, which the vendor states is not granted to non-administrators as standard; the result is read-only disclosure of data with no integrity or availability impact. The flaw is fixed in 4.4.3, and no public exploit code was identified at time of analysis, with the assessed severity moderated by the near-administrative privilege gate and the confidentiality-only impact.
Missing authorization checks in the Redux Framework WordPress plugin, versions through 4.5.16, allow a remote attacker holding a valid low-privileged account on the target site to lift sensitive data embedded in the framework's cache. The flaw is rated CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), so confidentiality is fully impacted while integrity and availability are untouched, and exploitation requires the attacker to already be authenticated (PR:L), with no user interaction. No public exploit code has been identified at time of analysis, and the vendor/Patchstack advisory does not yet specify a fixed version in the supplied data; priority is tracked as this_month rather than immediate action.
Stored cross-site scripting in the WP Discussion Board WordPress plugin, affecting versions through 2.6.0, allows an authenticated low-privilege user to persist script content that executes in the browser of any victim who later views it (CVSS 6.5, CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L). The attacker must hold at least a low-privileged account able to submit content the plugin stores, and impact requires a separate victim to load that content; the payload remains server-side and re-triggers for each viewer until the stored data is cleaned or the plugin is fixed. Reported by Patchstack and rated 'this_month' priority rather than an urgent label, this issue has no public exploit identified at time of analysis and no CISA KEV listing.
Waline through 1.40.3 with the MongoDB storage adapter allows unauthenticated remote attackers to bypass the email/identifier factor of the login endpoint POST /api/token by submitting a non-string email such as {"$ne": null}, which the adapter silently drops and turns into a match-all query so the submitted password is checked against the first-registered user, normally the administrator. This is a partial authentication bypass, not a zero-knowledge one: it enables user enumeration and credential-stuffing amplification against the administrator account without revealing passwords, but successful login still requires a valid password for that first user. Fixed in Waline 1.41.1; a public proof-of-concept request is documented in the vendor advisory.
HCL BigFix AEX discloses sensitive technical detail - stack traces, system information and internal file paths - through improperly handled errors and exceptional conditions, handing low-privilege authenticated users reconnaissance material that can support follow-on attacks. The assessed vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) makes valid, if limited, credentials the primary limiting factor: this is not a pre-authentication or drive-by issue, and there is no integrity or availability impact. No public exploit has been identified at time of analysis and the CVE is not in CISA KEV; independent assessment rates this a moderate-severity information-disclosure issue rather than a top-tier emergency.
Path traversal in HAVELSAN Liman MYS before 2.3.5-1132 allows an authenticated low-privilege user to read files outside the intended directory over the network, with high confidentiality impact and no integrity or availability impact. The CVSS 3.1 score is 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), and versions at or above 2.3.5-1132 are not affected. No CISA KEV active-exploitation signal or public exploit code was provided at time of analysis, and EPSS data was not supplied; the issue was reported by TR-CERT.
Missing authorization in Dell PowerProtect Data Domain allows a low-privileged remote account holder to reach functionality or data they should not be permitted to access, resulting in high-confidentiality unauthorized access without integrity or availability impact. The flaw affects Feature Release 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, and LTS2026 8.6.1.0 through 8.6.1.20; exploitation requires valid low-level credentials on the appliance (PR:L), and no user interaction or unusual access complexity is involved. No public exploit code or active exploitation has been identified at time of analysis, and the vendor has published a security advisory covering this and other issues.
An authentication bypass by spoofing (CWE-290) exists in Dell PowerProtect Data Domain Management Center, affecting Feature Release 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, and LTS2026 8.6.1.0 through 8.6.1.20. An attacker who already holds valid low-privilege remote access to the management console (PR:L, AV:N) can exploit the flaw without user interaction to degrade integrity and availability, with a scope change (S:C) but no confidentiality impact; the outcome described is denial of service. No public exploit code or confirmed active exploitation is identified in the available data, and the moderate CVSS score of 6.4 with a 'this_month' priority places it as a limited, non-urgent risk rather than an emergency.
Stored cross-site scripting in s2Member versions up to and including 261011 allows authenticated users with contributor-level privileges or higher to inject script-bearing content through the date_format shortcode attribute, which then runs in the browser of any user who views the affected page. The payload survives WordPress wp_kses_post() sanitization because it contains backslash-escaped sequences rather than literal angle brackets, and PHP date() turns those sequences into HTML tag characters at render time. No public exploit was identified at time of analysis; the CVSS 3.1 score is 6.4, and this is a moderate-priority issue rather than a drop-everything emergency.
Stored cross-site scripting in the UiChemy WordPress plugin through 5.3.0 allows an authenticated contributor-level user to plant a javascript: URL in a builder slot link setting, which executes when a higher-privileged reviewer clicks the crafted link. The issue stems from insufficient input sanitization and output escaping in the plugin's composer widget code. Severity is moderate (CVSS 6.4); exploitation requires a contributor account and a privileged user's click, and no public exploit was identified at time of analysis - this is a moderate, not emergency, priority.
Stored cross-site scripting in the Awesome Support WordPress helpdesk plugin, in all versions up to and including 6.4.1, allows an authenticated user holding custom-level access or above to persist arbitrary script through the 'wpas_files' parameter; the injected payload then executes in the browser of any user who subsequently loads the affected ticket page. Exploitation is gated on the 'Enable drag-n-drop uploader for ticket form' setting, which is disabled by default, so standard installations are not exposed. Severity is medium (CVSS 6.4, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) and no public exploit identified at time of analysis; the changeset-linked fix in plugin trunk is the most specific patch evidence available.
Stored cross-site scripting in the If-So Dynamic Content - Elementor & All Page Builders Personalization plugin for WordPress (all versions up to and including 1.10.2) allows authenticated users with contributor-level access or above to inject arbitrary script into a page through the 'conversion' shortcode attribute, which then executes in the browser of any user who later views that page. The flaw is a sanitization and output-escaping failure in the plugin's extended shortcodes handler, rated CVSS 6.4 with a scope change because the injected script runs in the security context of other users rather than the attacker. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; the assessed risk is moderate and not emergency-grade, with the contributor-or-above prerequisite and the need for a victim to open the affected page as the main limiting factors.
Stored cross-site scripting in the Cozy Blocks - Website Builder & Business Growth Toolkit plugin for WordPress (slug cozy-addons) up to and including version 2.2.27 lets an authenticated user with contributor-level access or above persist arbitrary script through the productRating.iconColor setting, which is rendered into the product tab without sufficient sanitization or output escaping and executes for anyone who later views the affected page. Exploitation is gated by two non-default, feature-dependent prerequisites: the plugin's productRating option must be enabled and the associated WooCommerce product must carry a non-zero rating, so the vulnerable code in blocks/product-tab/render.php is only reached in that configuration and a WooCommerce dependency is implied. No public exploit code was identified at time of analysis, and the references include a plugin Trac changeset (3752142) alongside the 2.2.27 source that the advisory points to; a released patched version is not independently confirmed in the provided data.
Stored cross-site scripting in the Travelly - Tour & Travel Booking Manager for WooCommerce WordPress plugin (Tour Booking Manager) through version 2.3.6 lets an authenticated attacker with contributor-level access or above inject arbitrary script into pages via the 'width', 'height' and 'zoom' attributes of the [ttbm-hotel-map] shortcode. The ttbm_hotel_map_shortcode() function concatenates raw attribute values into double-quoted attributes of an <iframe> tag, so payloads are persisted and execute when a user views the affected page. Scored CVSS 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), the flaw requires a contributor-or-higher account, which limits exposure on single-admin sites and those without open registration; no public exploit or active exploitation is reported, and the plugin repository shows an upstream code change (changeset 3757674) that has not been mapped to a confirmed patched release.
Stored cross-site scripting in the WordPress plugin If-So Dynamic Content - Elementor & All Page Builders Personalization affects every version through 1.10.2 and lets an authenticated user with contributor-level access or above plant arbitrary script in a post via the extended shortcode's 'url' parameter. The payload does not fire for ordinary visitors: the vulnerable rendering branch is reached only when an administrator previews or opens the crafted post, so the practical target is the admin's browser session. Rated CVSS 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) with a this_month remediation priority; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV.
Stored cross-site scripting in the WordPress plugin Post Snippets - Custom WordPress Code Snippets Customizer affects every version up to and including 4.2.4, letting a contributor-level or higher account plant script that runs in another user's browser. The bypass works because entity-encoded payloads such as <script>...</script> are not decoded by WordPress's wp_kses_post on save, and the plugin's own shortcode filter turns them back into live HTML when the page renders; the description states the snippet shortcodes must be enabled for this path to work. Rated CVSS 3.1 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), and no public exploit code has been identified at time of analysis.
Stored DOM-based cross-site scripting in the Document Embedder WordPress plugin, affecting all versions up to and including 2.4.0, allows authenticated users with contributor-level access or higher to place attacker-controlled script in a post's Document Embedder block JSON. The payload executes when a victim clicks the embedded document's Download button, which routes through the de_track_download AJAX fallback after docId=0 makes can_read_document() return false, so real-world exploitation depends on that victim interaction. No public exploit was identified at time of analysis, and upgrading to 2.4.1 is the remediation.
Stored cross-site scripting in the All-in-One Video Gallery plugin for WordPress (all versions up to and including 4.9.7) lets any authenticated user at Subscriber level or above inject arbitrary web scripts through the custom_fields[embedcode] parameter, which then execute whenever a victim accesses the injected page. The required account is easy to obtain because the plugin unconditionally grants Subscribers the publish_aiovg_videos capability, and the sanitization is bypassed with a single wp.newPost XML-RPC call since save_meta_data() returns early when $_POST['post_type'] is absent. Assessed at 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N); no public exploit code was identified at time of analysis and the issue is not in CISA KEV.
Authenticated stored cross-site scripting in the easy.jobs WordPress plugin (all versions up to and including 2.8.2) lets an attacker with contributor-level access or above inject arbitrary script into the 'icon' attribute of the easyjobs/job-list Gutenberg block, with the payload executing for every visitor who renders the affected page. Sites that restrict content-authoring roles to trusted staff are substantially less exposed, since the attacker must already hold a contributor+ account or be able to register one; sites not using the job-list block are unaffected in practice. No public exploit code was identified at time of analysis and there is no confirmed active exploitation (CISA KEV).
Stored cross-site scripting in the If-So Dynamic Content plugin (Elementor & All Page Builders Personalization) for WordPress, affecting all versions up to and including 1.10.2, lets an attacker who holds contributor-level access or above save malicious script into trigger/condition settings fields, which then executes for any user who views a page rendering that dynamic content. The flaw is insufficient input sanitization and output escaping across the repeater settings parameter and numerous sibling fields (version_uid, freeze-mode, cookie-input, ip-input, compare, utm-value, page-url-compare, group-name, custom). There is no unauthenticated path - exploitation requires an existing account with at least contributor capabilities - which is the main bound on real-world priority; no public exploit code or confirmed active exploitation is identified in the available data (priority label: this_month).
Stored cross-site scripting in the Appointment Booking Calendar WordPress plugin through version 1.4.05 allows authenticated users to inject arbitrary web scripts via the 'vs_text_submitbtn' parameter; the payload is stored and executes when a user accesses the injected page. Subscriber-level exploitation is possible only when an administrator has assigned the attacker as a calendar owner ('conwer') through the plugin’s calendar list screen, a non-default grant the UI allows for any registered user; otherwise the flaw requires editor-level access or above. The CVSS 3.1 score is 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), and no public exploit was identified at time of analysis.
Stored cross-site scripting in the Cozy Blocks WordPress plugin (cozy-addons) through version 2.2.27 lets an authenticated attacker with contributor-level privileges or above inject arbitrary web scripts through the icon.view, icon.layout, and icon.gap attributes of the featured-product-tabs block. Because the wp_kses_post filter applied on save does not neutralize a quote-only attribute-breakout payload containing no '<' character, the block comment and its decoded JSON attributes survive intact and execute when any user later views the injected page. The CVSS 3.1 vector scores this 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), and the primary limiting factor is the contributor+ account requirement rather than network reachability; the trigger is a passive page view by a victim, and no public exploit code or active exploitation is identified at time of analysis.
Stored cross-site scripting in the Hustle email marketing and popup plugin for WordPress (all versions up to and including 7.8.14.3) allows an authenticated user to inject arbitrary script through the 'content[title]' parameter of a Hustle module, which is persisted and later rendered without adequate sanitization or output escaping. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N, 6.4) reflects authenticated network access with a scope change, but the practical precondition is significant: an administrator must first grant the plugin's non-default 'Create and Update Modules' capability (hustle_create / hustle_edit_module) to the attacker's role via Settings → Permissions, so standard installations without delegated roles are not exploitable by non-admins. No public exploit code and no confirmed active exploitation were identified at time of analysis; impact depends on another user, potentially an administrator, subsequently viewing the injected module content.
Stored cross-site scripting in the Mang Board WordPress plugin through 2.4.5 lets authenticated users with contributor-level access or higher inject scripts through a shortcode's align attribute, which then execute for any viewer of the affected page, including an administrator previewing a pending post. The payload avoids angle brackets so wp_kses_post leaves the shortcode intact on save; the CVSS 3.1 score is 6.4, and no public exploit code has been identified at the time of analysis.
Stored cross-site scripting in the VikRentCar Car Rental Management System plugin for WordPress (all versions through 1.4.10) allows an authenticated attacker holding contributor-level access or higher to plant arbitrary script in the plugin's 'className' widget parameter, which then runs in the browser of any user who loads the injected page. The payload survives save-time sanitization because the injection lands in an HTML-attribute context where a raw double-quote is enough to break out, and the block-comment JSON encoding of that quote is decoded back to a literal character by do_blocks() at render time, so wp_kses_post() does not neutralize it. Rated CVSS 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) and tracked as EUVD-2026-111596; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the priority signal places it in the this_month remediation queue rather than an emergency.
Stored cross-site scripting in the Waitlist WooCommerce (Back in stock notifier) plugin for WordPress, affecting all versions up to and including 2.9.1, lets an authenticated user with contributor-level access or above place the plugin's shortcode with a crafted 'type' attribute into a post or page and have arbitrary script execute in the browser of anyone who views that page. The wp_kses_post filter applied on contributor post save does not stop the payload because shortcode attribute values contain no HTML markup and pass through kses unchanged, with the script only materializing when the shortcode is expanded at render time. Rated 6.4 (Medium) with the CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N; no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, with the vuln.today priority label placing it at 'this_month' rather than emergency.
Stored cross-site scripting in the All-in-One Video Gallery WordPress plugin through version 4.9.7 allows authenticated users with contributor-level access or higher to inject arbitrary web scripts via the 'more_link' parameter, which are stored and later execute in the browser of any user who views the affected page. The issue is rated CVSS 6.4 with changed scope and limited confidentiality and integrity impact; the supplied intelligence labels it a measured, this-month priority rather than an urgent one. No public exploit code and no CISA KEV entry are identified at time of analysis, and exploitation is constrained by the contributor-privilege prerequisite and the need for a separate victim to access the injected page.
Stored cross-site scripting in the Ultimate Member WordPress plugin through 2.14.0 lets authenticated users with subscriber-level access or higher save malicious script in the 'user_url' Website URL profile field, which executes when a visitor clicks that link on the attacker's public profile; the required click is described as trivially met because the redirect-confirmation onclick handler is enabled by default on new installations. The issue is rated CVSS 6.4 (medium) and is fixed in 2.14.1; no public exploit code was identified in the supplied intelligence at time of analysis.
Stored cross-site scripting in the Avada (Fusion) Builder WordPress plugin (all versions up to and including 3.16.2) allows authenticated users with contributor-level access or higher to inject script payloads into the 'tab_index' and 'empty_notice' shortcode attributes, which then execute in the browser of any user viewing the injected page. The sanitization gap exists because wp_kses_post does not strip the payload on save - the dangerous characters sit inside shortcode attribute text between square brackets, which kses treats as plain text rather than HTML markup, so the stored content survives filtering. The assessed severity is moderate (CVSS 6.4, scope-changed, low confidentiality and integrity impact), no public exploit has been identified at time of analysis, and exploitation is gated by the need for a contributor-or-higher account on a site running an affected builder version.
Clickjacking in the HCL BigFix AEX web interface allows remote attackers to embed the application in a malicious page or iframe and trick a logged-in administrator or operator into performing unintended actions with their own privileges, which can result in unauthorized configuration or account changes. The flaw is a missing or ineffective anti-framing control (CWE-1021); the supplied vendor advisory reference (KB0134281) does not specify which control is absent, and the CPE entry (cpe:2.3:a:hcl_software:bigfix_aex) carries no version boundary, so the affected build range is not enumerated in the available data. Exploitation depends on a victim with an active AEX session being socially engineered into visiting the attacker's page and interacting with the overlaid UI, so it fails against logged-out users and against deployments that already emit X-Frame-Options or a CSP frame-ancestors directive; no public exploit was identified at time of analysis and the issue is not in CISA KEV. Our independent assessment rates this moderate and not urgent (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N), narrower in impact than the vendor's 6.4 score, with the priority label indicating remediation is appropriate within the current monthly cycle rather than as an emergency.
Privilege escalation in the BeyondSEO WordPress plugin through version 1.3.6 allows authenticated users with Contributor-level access or above to create, update and delete site-wide 301/302 redirects, giving them administrator-equivalent control over redirect management and the ability to hijack arbitrary paths such as /checkout or /wp-login. The plugin permanently assigns its rankingcoach_write_* module capabilities to the Contributor role by default, and its REST create/edit/delete callbacks authorize only on that capability, so no administrator rights are needed beyond the Contributor foothold. No public exploit identified at time of analysis and no CISA KEV entry; the issue is a genuine but moderate-priority concern (this_month) rather than an emergency, because the realistic attack surface depends on sites that allow untrusted users to obtain Contributor-level accounts.
HTTP header injection in LibreSSL's ocspcheck utility (through 4.4.0) lets a certificate-borne CR/LF sequence in the AIA OCSP URI path be carried into the POST request line sent to the OCSP responder, allowing injected headers or request splitting. The attacker does not reach the code directly: exploitation requires the victim to run ocspcheck against an attacker-supplied certificate whose AIA URI path contains control characters, which is why the assessed severity is moderate (CVSS 4.0 base 6.3, CVSS 3.1 AV:N/AC:H/PR:N/UI:N with integrity-only impact). No public exploit code and no confirmed active exploitation were identified at time of analysis, and impact is limited to the integrity of HTTP traffic toward the responder host, with no confidentiality or availability effect.
LibreSSL's libcrypto OCSP client (through 4.4.0) writes an unvalidated request path into the HTTP POST request line, so carriage-return and line-feed characters embedded in a certificate's Authority Information Access OCSP URI are passed through into OCSP traffic, allowing header injection or request splitting toward a responder or proxy. Applications are exposed only if they use OCSP_sendreq_new()/OCSP_parse_url(), have OCSP revocation checking enabled, and actually query a URI taken from an attacker-supplied certificate; the resulting impact is integrity-limited with no confidentiality or availability effect. This is a moderate-severity issue rather than an emergency, no public exploit was identified at time of analysis, and the upstream commit d3f7195f rejects URI paths containing control or non-ASCII characters.
LibreSSL's ocspcheck utility (through 4.4.0) can transmit OCSP requests in cleartext when an OCSP responder URL uses the https scheme on a TCP port other than 443: url2host() discards the URL scheme and http_alloc() decides TLS solely on whether the port equals 443. An on-path attacker in a position to read the traffic can then observe the leaked OCSP request metadata - certificate serial numbers, issuer hashes and nonces - but cannot modify it. Exposure requires a non-default configuration (https responder URL on a non-443 port) and a passive network position, so severity is limited to low-confidentiality metadata disclosure; exploit code is not confirmed, and the issue is not listed as actively exploited.
Missing authorization in the POST /send-message endpoint of xianyu-auto-reply-fix through 2.0.7 lets unauthenticated remote attackers send arbitrary Xianyu messages to buyers from another merchant's account by supplying a published default/test API secret plus that account's cookie_id along with chosen chat_id, to_user_id and message values. Exploitation is gated by three conditions: the endpoint must be reachable, the instance must still be running a pre-patch build with the send secret unset or left at one of the published defaults ('xianyu_qq_reply_2024', 'xianyu_api_secret_2024', 'zhinina_test_key'), and the attacker must know a valid account-specific cookie_id, which limits mass exploitation. Impact is confined to message integrity - no data is read and no code is executed - yielding an assessed CVSS 3.1 score of AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N; no public exploit code has been identified at time of analysis, and the vendor has published an upstream fix commit.
Authentication bypass in go-chi chi through 5.4.0 lets an unauthenticated remote request reach an outer public route instead of an authenticated mounted subrouter when middleware.SupressNotFound is enabled, the mounted path suffix collides with an explicit outer public route, and that outer handler trusts the retained tenant mount parameter. The issue is CWE-288 and the fixed release is 5.5.0. The upstream advisory includes a reproduction harness against v5.4.0; no CISA KEV confirmation is provided, and the assessed CVSS 3.1 vector is AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N, reflecting the substantial application-specific prerequisites.
Size-policy bypass in Echo v5's BodyDump middleware: when the middleware's capture cap is set below an outer BodyLimit threshold, an HTTP/1.1 chunked request whose body exceeds the limit is drained with read errors ignored and then replaced by the captured prefix, so the handler processes a truncated body and returns success. Only applications on Echo v5.0.0 through v5.4.0 that combine BodyDump with MaxRequestBytes below BodyLimit are exposed; known-length requests are rejected before BodyDump runs, and the advisory explicitly disclaims general authentication bypass, data modification or denial of service. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor fixed the behaviour in v5.4.1; the assessed severity is medium/low rather than an emergency.
Hard-coded SSH credentials in Alpine iLX-F511 firmware 7.0.000 allow network-adjacent, unauthenticated attackers to log in and execute code as the telechips user; the CVSS 3.0 score is 6.3 with low confidentiality, integrity, and availability impact. Exploitation requires reachability to the device's SSH service from the same or an adjacent network segment, not the open internet, and no public exploit has been identified at time of analysis. The supplied intelligence does not confirm active exploitation.
Acronis Cyber Protect 17 on Linux (builds earlier than 42587) ships binaries that are flagged with the executable-stack attribute, which disables the non-executable-stack (NX) hardening that normally stops injected data from being run as code. The weakness is local and requires an existing low-privileged account on the host (CVSS AV:L/PR:L) with additional non-trivial preconditions (AC:H); on its own it is a mitigation gap rather than a directly exploitable memory-corruption bug, and its real severity depends on whether a separate corruptible flaw exists on the host to chain against. There is no public exploit code and no confirmed active exploitation at time of analysis, and the only complete fix stated by the vendor is upgrading to build 42587 or later per advisory SEC-10003.
Blombooru releases before 1.40.0 expose an administrator-only image proxy at GET /api/booru-import/proxy-image that fetches any caller-supplied URL server-side with only a check that the value starts with 'http', so private, loopback and link-local destinations are reachable through the application. An authenticated administrator (CVSS PR:H) can therefore enumerate internal services, hang the worker with a recursive self-request, or reach a cloud metadata endpoint such as 169.254.169.254 to harvest IAM credentials - so the confidentiality impact lands primarily on the surrounding cloud or network boundary rather than on Blombooru itself, and only on deployments that expose such services. No CISA KEV entry is recorded, though the vendor advisory includes reproduction steps demonstrating a request reaching an internal Redis port and a recursive self-request; this is a this-month patching priority, not an emergency, because the admin-authentication prerequisite keeps the endpoint out of reach of anonymous attackers.
Improper token validation in Acronis Cyber Protect 17 on Linux and Windows (builds before 42587) allows a local attacker to disclose sensitive information, scored CVSS 6.2 with confidentiality-only impact and no authentication or user interaction required per the vector (AV:L/AC:L/PR:N/UI:N). The weakness class (CWE-347, improper verification of cryptographic signatures) combined with the JWT/token tagging indicates the token verification logic can be bypassed, exposing data the token was meant to protect. The flaw is not remotely reachable: an attacker needs local presence on the host, and no public exploit code or CISA KEV entry is identified at time of analysis; Acronis has published advisory SEC-9812 and fixes the issue in build 42587.
Out-of-bounds write in GNU mtools through 4.0.49 occurs in parse_vses in vfat.c when a crafted FAT/VFAT disk image or device contains malformed VFAT long-filename sequence entries. Exploitation requires a local attacker to get the image onto the system and the victim to invoke an mtools utility such as mdir, mcopy, or minfo against it; no authentication is needed, but user interaction is required. CVSS 3.1 score is 6.1 (C:N/I:L/A:H), no public exploit or CISA KEV entry is identified at time of analysis, and the priority is moderate (this_month), not urgent.
Reflected cross-site scripting in the Echo Knowledge Base - Documentation, FAQs, Chat & Smart Search plugin for WordPress (versions up to and including 17.214.0) lets a remote attacker place arbitrary script in a knowledge base article page by supplying an epkb_fe_reload_mode=on request that carries a crafted new_kb_config JSON blob, whose values are merged over the stored KB configuration and concatenated unescaped into a <style> element. Rated CVSS 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) and tracked as CWE-79, the practical ceiling is limited: the payload only executes in the browser of a logged-in user with Editor-level access or above holding the manage_categories capability, or an Administrator, and that user must be tricked into clicking the crafted link (UI:R), so anonymous visitors and ordinary readers cannot be targeted. No public exploit code was identified in the supplied intelligence and there is no CISA KEV entry; the vuln.today decision label is 'this_month' rather than act_now or emergency. Vulnerability details were reported by Wordfence and cross-referenced by ENISA as EUVD-2026-111818.
Reflected cross-site scripting in the Webheadcoder Multi-Step Forms for Contact Form 7 WordPress plugin, affecting all versions up to and including 4.7, lets unauthenticated remote attackers inject arbitrary script through the 'l10n_print_after' parameter, which is written into a page without adequate sanitization or escaping and executes in a victim's browser when a crafted link is visited. The site must have at least one Contact Form 7 form configured with a [multistep] form-tag, since the canonicalization added in 4.7 blocks the attack path on non-multistep forms, and successful exploitation depends on a user being tricked into clicking a link (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, 6.1). No confirmed active exploitation (CISA KEV) or public exploit code was identified at time of analysis; the upstream commit that removes the reserved 'l10n_print_after' key is public, and the plugin Trac shows a 4.7.1 tag.
Reflected cross-site scripting in the AVideo-Encoder login interface (WWBN/AVideo project) affects all versions prior to 8.1.0 and is reachable by unauthenticated remote attackers because the login view renders for any anonymous visitor - the gate in view/index.php only checks Login::canUpload(). By persuading a victim operator to open a crafted login URL, an attacker can execute arbitrary JavaScript in the encoder's origin, read the operator session identifier exposed in inline script, capture credentials typed into the login form, and act as the operator against the encoder and its upstream AVideo platform. The vendor has released 8.1.0, the GitHub advisory includes reproduction payloads for the affected parameters, and no confirmed active exploitation is reported; the CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N (6.1), requiring victim interaction for scope-changed, low-confidentiality/low-integrity impact.