An open redirect in the Go web framework Echo lets an attacker craft a link on a trusted domain that sends victims to an arbitrary external site when the AddTrailingSlash or RemoveTrailingSlash middleware is configured with a redirect status set. The framework's sanitizeURI guard inspects only the first two bytes of the redirect target, so a literal TAB byte (delivered as %09) placed before the separator pair, for example /%09/attacker.example/x/, slips past the check and is written unmodified into the Location header, where browsers strip the TAB and resolve the value as an absolute URL on the attacker's host. All users of echo/v4 below 4.16.0 and echo/v5 below 5.4.0 are affected only if those middlewares are registered with a non-zero RedirectCode; a public PoC reference exists and the mechanism was confirmed end to end in a headless browser, but there is no CISA KEV entry and no EPSS data in the supplied sources. This is a medium-severity issue (CVSS 6.1, CWE-601) whose exploitability depends on user interaction: the victim has to click and follow the crafted link.
Reflected cross-site scripting in the Labstack Echo Go web framework's Context.JSONP, Context.JSONPBlob and internal jsonPBlob helper, which write the caller-supplied callback string into an application/javascript response verbatim, with no validation, escaping or allow-listing. Echo v5 releases up to and including v5.1.0 (including current master at the time of reporting) and v4 releases below v4.16.0 are affected, but only applications that actually call the JSONP helpers and pass attacker-influenceable data (query string, form field, header or path parameter) as the callback are exploitable; the official JSONP cookbook pattern is sufficient to reach that state, while applications that never use JSONP are unaffected. Exploitation is unauthenticated from the attacker's side (CVSS PR:N) but requires victim interaction (UI:R): the attacker must lure a user to a crafted URL, after which arbitrary JavaScript runs in the target origin and can hijack sessions, steal cookies or deface pages, and because the payload is delivered as application/javascript it is not neutralised by ordinary script-src CSP rules. The vendor advisory includes a minimal one-request reproduction; no CISA KEV entry or confirmed public exploit tooling was identified at time of analysis, and the priority signal places remediation within this month. Fixed in Echo v5.4.0 and v4.16.0.
Reflected cross-site scripting (CWE-79) affects WSO2's authentication endpoint, which echoes unsanitized request data into error messages; per the vendor advisory, default configurations of WSO2 API Manager, WSO2 API Control Plane, and WSO2 Identity Server are impacted. An unauthenticated remote attacker must convince a victim to follow a crafted link (UI:R), after which injected script runs in the WSO2 origin and can redirect the user, alter the page interface, or read script-accessible information. Because session-related cookies carry the httpOnly flag, the vendor explicitly notes that session hijacking and cookie theft are not possible, keeping this at medium severity (CVSS 6.1); no public exploit or active exploitation is identified at time of analysis.
Server-side request forgery guard bypass in WeKnora: the isRestrictedIP()/ipclass address classifier treats NAT64-encoded IPv6 addresses (64:ff9b::/96) and deprecated IPv4-compatible ::a.b.c.d forms as ordinary public addresses, so a restricted embedded IPv4 such as 169.254.169.254 or an RFC1918 host slips past the filter. Exploitation requires an authenticated low-privilege account (PR:L) able to reach the web_fetch tool or URL-based knowledge import, and a network path from the server to the embedded target (AT:P); impact is confidentiality-only, with internal service or cloud metadata exposure but no integrity or availability effect. All versions from 0.2.11 through before 0.8.2 are affected and fixed in v0.8.2; no public exploit was identified at time of analysis, the issue carries a medium CVSS 4.0 base score of 6.0, and no CISA KEV entry exists.
Unauthenticated local file inclusion in the Bit Flows WordPress plugin through 1.31.0 lets a remote caller make the ImageHelper imageToBase64 node include and execute attacker-chosen server-side .php files, exposing file contents and enabling PHP code execution when an uploadable .php file is reachable. The bar is high: an administrator must already have published a webhook-triggered flow that pipes a webhook body field into the ImageHelper node, and that webhook must still be running with no bearer secret and no IP allowlist - an explicitly supported, documented setup, which is why this is scored AC:H and assessed as a qualified medium-severity issue rather than an emergency. No public exploit has been identified at time of analysis and there is no CISA KEV listing; the vulnerability is rated for this-month handling.
GraphQL Tools' legacy WebSocket executor (@graphql-tools/executor-legacy-ws, versions through 1.1.35) discloses subscription payloads across callers: buildWSLegacyExecutor keeps a single WebSocket in closure state and reassigns its only websocket.onmessage handler on every subscribe(), and the LEGACY_WS.DATA branch forwards data.payload to the newest observer without comparing data.id to the operation id it created - so an authorized caller who starts an overlapping subscription through the same shared executor receives another user's authorized subscription data while the earlier caller's stream is silenced. The issue is conditional rather than broadly exploitable: it requires one executor instance reused across mutually untrusted callers, overlapping subscriptions on an already-OPEN socket, and per-user differences in subscription results (reflected in the assessed CVSS 3.1 vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:L); applications that build a fresh executor per operation, such as the in-repo UrlLoader wrapper, are not affected. No CISA KEV entry or other active-exploitation signal is present in the available data, and the vendor advisory documents a reproduction harness verified against the published 1.1.33 package, which is a public PoC reference rather than confirmed working exploit code; the vendor has released 1.1.36 as the fix.
Grafana's Generic OAuth, Google, and GitLab sign-in integrations can write users' OAuth/OIDC access, refresh, and ID tokens to server logs unredacted, letting anyone with read access to those logs or to the log store they are shipped to recover the tokens. The leak is conditional: it occurs when an access or ID token is not a valid JWT, when the ID token is missing at debug log level, or when the ID token is not a string, and the value of any recovered token is bounded by the scopes granted to the configured OAuth client. Grafana OSS and Grafana Enterprise are affected (CVSS 6.0, AV:L/PR:H), and exploitation requires standing privileged access to the logs; no public exploit is identified at time of analysis.
Path traversal in the Echo Go web framework's middleware.Static (all versions prior to 4.15.3 on the v4 branch and prior to 5.2.0 on the v5 branch) allows unauthenticated remote attackers to have Go's already-decoded Request.URL.Path unescaped a second time, so double-encoded separators such as %252F or %2e%2e%2f are reconstructed into traversal sequences before filesystem resolution. Successful exploitation is configuration-dependent: the Static middleware must be registered globally and a file intended to be protected must sit under that Static root behind a separate guarded route, which is why the issue is rated high complexity with confidentiality-only impact; the maintainer could not reproduce reads outside the configured root, bounding impact to in-root files reachable past the route guard. Fixes are released in v4.15.3 and v5.2.0, and no public exploit code or active exploitation has been identified at the time of analysis.
Encoded dot-dot path segments let unauthenticated remote attackers read files that Echo applications intended to protect with route-level middleware, because the static file handlers normalize the path after route matching and serve the file through a public static mount - for example /public/%2E%2E/admin/secret.txt returns a file under a guarded /admin/* route. The flaw is an incomplete fix for CVE-2026-55677 and affects Echo v4 before 4.16.0 and v5 before 5.4.0, but only applications that mount a static filesystem overlapping files guarded solely by middleware are exposed; the primary vector works against the default router configuration while a second, lower-severity vector requires UseEscapedPathForMatching=true. No CISA KEV entry or EPSS score was supplied with the intelligence, and the upstream advisory publishes reproduction tests, so a public PoC reference exists; it is not verified as working exploit code.
Cleartext exposure of agent-host environment variables in Strands Agents Tools (pip package strands-agents-tools, versions 0.1.0 through 0.8.5) lets an attacker who can place instructions in content the agent ingests - a web page, a file, or earlier tool output - drive the loaded 'environment' tool to dump every environment variable without masking. The masking flag shipped inside the tool's model-facing input schema and the list/get actions ran with no operator consent prompt, so a crafted prompt requesting action="list" with masked=false returns AWS access keys, model-provider API keys, source-control tokens, and database connection strings, which the model can then relay through another loaded tool. The vendor rates this CVSS 5.9 (our assessment: CVSS:3.1 5.9, AV:N/AC:H/PR:N/UI:R/C:H/I:N/A:N) with a this_month priority; no public exploit code and no CISA KEV entry were identified at time of analysis, and real impact depends on whether the environment tool is loaded and long-lived secrets are actually present in the agent process environment.
Spoofed forwarded-scheme headers let remote clients defeat Echo's HTTPS enforcement: Context.Scheme() in LabStack Echo before 4.16.0 and 5.4.0 reads X-Forwarded-Proto, X-Forwarded-Protocol, X-Forwarded-Ssl and X-Url-Scheme from any request without validating the source, so an unauthenticated attacker (CVSS PR:N) who reaches an HTTP listener directly can send 'X-Forwarded-Proto: https' and skip HTTPSRedirect entirely, or, behind a TLS-terminating proxy that passes client headers through, send 'X-Forwarded-Proto: http' to suppress the Strict-Transport-Security header while the browser still receives the response over HTTPS. The attack requires victim interaction (UI:R) and a man-in-the-middle position or a header-passing proxy to convert the downgrade into real data exposure, which is why it rates 5.9 rather than critical, and risk drops sharply where a trusted proxy overwrites these headers and direct backend access is blocked. Fixes ship in v4.16.0 and v5.4.0; proof-of-concept curl and Go test snippets are published in the advisory, though no CISA KEV entry exists and the issue is triaged as this-month rather than emergency.
SiYuan 3.8.7 through 3.8.8 on Windows can be induced to copy its workspace secret files - the API token in conf.json and the TLS private key - into the publicly served data/assets/ directory by submitting a GLOBALROOT device-namespace path (\\?\GLOBALROOT\Device\HarddiskVolumeN\...) to POST /api/import/importStdMd. The v3.8.7 fix for the earlier GHSA-6gmc traversal only strips the literal \\?\ and \\.\ prefixes, so the device-namespace spelling survives normalization and matches no IsSensitivePath denylist entry, letting the copy proceed. The vendor advisory documents a verified end-to-end reproduction on Windows 10 22H2, so a public proof-of-concept reference exists (it is not verified as packaged exploit code), while no CISA KEV entry or active-exploitation confirmation is present in the supplied corpus; exploitation is confined to Windows deployments running the kernel in server mode where the attacker can reach the import API, which in the published reproduction required the instance's API token.
n8n Local Gateway versions before 2.41.4 and 2.42.x versions before 2.42.1 can be re-pointed from the instance a user originally paired to an attacker-controlled n8n instance without any confirmation prompt when a crafted n8n-computer-use:// link is opened; previously granted gateway permissions remain in effect for the new pairing. This lets the attacker use the victim's computer through the gateway, subject to the prerequisite that the Local Gateway/Computer Use app be installed, running, and already paired and that the victim actively open the link. No public exploit identified at time of analysis, and the issue is a moderate, user-interaction-dependent risk (priority: this_month).
Unverified ownership of the default Athena query result location in AWS SDK for pandas (awswrangler) before 3.16.1 allows a remote actor to read Athena query results and tamper with the result set returned to the caller by pre-creating (squatting) the S3 bucket that awswrangler falls back to when no explicit result location is configured. Only deployments that use the Athena module with the default result location - no explicit s3_output and no workgroup result configuration enforced - and whose default result bucket in that account and region is not already owned by them are exposed; the victim must also actively execute a query through the SDK, and the bucket must be unclaimed in that specific account/region combination. This is a moderate-severity, condition-dependent information-disclosure and tampering flaw rather than an emergency; no public exploit was identified at time of analysis and there is no CISA KEV confirmation of active exploitation, and a vendor fix is available in 3.16.1.
Improper token validation in Acronis Cyber Protect 17 on Linux and Windows (builds before 42587) lets remote attackers potentially disclose sensitive information without authenticating. The CVSS vector (AV:N/AC:H/PR:N/UI:N, confidentiality-only) marks it as a moderate, mid-priority issue rather than a top-of-queue emergency, and the exploit path is not straightforward because of the high attack complexity. No public exploit code has been identified at the time of analysis, and the vendor identifies updating to build 42587 or later as the only complete fix.
Server-side request forgery in the Customer Engagement System WordPress plugin before 2.0.2 lets unauthenticated remote attackers make the WordPress server open outbound connections to arbitrary internal hosts and ports through the plugin's MailChimp interest-group lookup, which neither restricts access nor validates the supplied API key (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N, 5.8). Because the response body is not returned, the exposure is blind: an attacker can only infer which internal hosts and ports are reachable from response timing, so practical value depends on what networks the web server can route to. There is no public exploit identified at time of analysis, EPSS is 0.15% (4th percentile), and the issue is not in CISA KEV; the vendor has released a fixed version, and remediation is prioritized for this month.
Symlink-following in the Python filelock package's StrictSoftFileLock and AsyncStrictSoftFileLock (versions 3.30.0 through 4.2.0) allows a second local account that can rename the `<path>.filelock` coordination directory to redirect the lock user's `claims` directory creation, claim publication and cleanup into any directory that user can write. The attacker lands the swap between the `lstat` check and the following `mkdir` by looping `renameat2(RENAME_EXCHANGE)`, and wins after roughly 1 to 31 runs of a repeatedly-acquired lock; the payoff is directory and claim-file creation with the lock user's privileges, limited file-name disclosure from a private directory through the `claims` property, and - when the link targets another strict lock's `.filelock` directory - stranded claims that deny that lock to every process until an operator force-breaks each one. The impact is local-only, POSIX/Linux-demonstrated, requires a high-complexity race window in a directory the attacker can rename, and yields no code execution; a reproducer accompanies the upstream advisory, and vendor-released patch 4.2.1 closes the issue.
HTTP header injection in the Juniper Networks Session Smart Router and Session Smart Conductor web server lets remote attackers place attacker-controlled content into HTTP headers via unsanitized request body parameters. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) the flaw is reachable over the network against an exposed web server with no authentication and no user interaction, but impact is limited to integrity (I:L) with no confidentiality or availability effect, and the scope-changed metric indicates the effect is assessed as extending to a downstream consumer of the injected headers. No public exploit code or active exploitation is indicated in the supplied intelligence, and the practical risk depends on whether the router or conductor management web interface is reachable from untrusted networks; the specific parameters or characters that trigger the injection are not described in the available sources.
PostgreSQL Anonymizer releases prior to 3.3.0 leak unmasked data when a masked database role reads a parent table over a partitioned or inheritance hierarchy, even though the same role querying the child partitions directly gets properly masked results. Affected installations are specifically those that followed the project's documentation guidance to place masking rules on partitions and inheritance tables; non-partitioned masking configurations and 3.3.0+ installations are unaffected. The attacker must already hold an authenticated masked role (PR:L in the assessed vector, which also drops the CVE record's UI:R), and no public exploit code has been identified at time of analysis; priority is tracked as this_month rather than an immediate emergency.
PostgreSQL Anonymizer before 3.3.0 can disclose the anonymization salt and shift values to an authenticated database user who is not a member of pg_read_all_settings, because values configured at the database or role level remain readable in the pg_db_role_setting and pg_roles catalogs even though PostgreSQL restricts them through SHOW. The exposure is conditional: the attacker must already hold valid database credentials, and the salt or shift must have been set with ALTER DATABASE or ALTER ROLE, the method the extension documentation recommends. The issue is rated CVSS 5.7 (medium), with a this_month priority label; no public exploit identified at time of analysis, and the supplied data does not indicate CISA KEV listing. Dalibo resolved it in PostgreSQL Anonymizer 3.3.0.
Local users holding only low-privileged accounts on a Windows host can crash the entire machine by triggering a race condition in the TCP connect path of OpenVPN's ovpn-dco-win Data Channel Offload kernel driver (versions 0.6.5 through 2.8.13). Impact is availability-only - a system-wide crash - with no effect on confidentiality or integrity, and exploitation requires an existing local account plus winning a timing window, so it is probabilistic rather than deterministic. No public exploit code and no confirmed active exploitation were identified at time of analysis; this is assessed as a moderate-severity, low-real-world-priority issue that should be handled in the normal monthly patch cycle.
Cross-site scripting in Acronis Cyber Protect 17 before build 42587 allows a high-privileged user on the web management interface to submit improperly validated input that a second user must interact with before script executes. The issue is rated CVSS 5.7 with the supplied CVSS:3.0 vector AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N, but the independent assessment treats real-world risk as medium and lower-priority because of the high privilege requirement, required victim interaction, and single-component scope; the trigger mechanism is not described in available sources. No public exploit was identified at time of analysis, and the vendor fix is build 42587 for Linux and Windows.
CherryTree through 1.7.2 will embed local files chosen by an attacker into a saved note document through a path traversal flaw in XML-based document formats (.ctd, .ctz, .ctx). An attacker supplies a crafted document containing an embedded-file node whose 'filename' attribute is an absolute path or a ~/ path with no inline data; when the victim opens it and then saves, CherryTree reads that path under the victim's account and writes the contents into the document. Impact is confidentiality-only, limited to files the victim can read, and pays off only if the saved document later returns to the attacker. No confirmed actively exploited status (not in CISA KEV) and no verified working exploit code is referenced at time of analysis - the linked GitHub issue is a public defect report - and the moderate 5.6 CVSS:4.0 score aligns with the assessed CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N rating.
Local users with low privileges on Juniper Networks Session Smart Router and Session Smart Conductor can force arbitrary filesystem unmounts or a denial-of-service condition in the ember service by creating directories with specially crafted names and then triggering a service restart. The flaw is an output-neutralization (injection) weakness rated CVSS 5.5 with impact confined to availability (C:N/I:N/A:H); the vector requires local access and low privileges (AV:L/PR:L) and no user interaction. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor-priority label places remediation within this month rather than as an emergency.
Stored cross-site scripting in the Postie WordPress plugin through 1.9.87 allows unauthenticated attackers to inject arbitrary script into pages generated from processed email, with execution occurring when a victim later loads the affected page. The vulnerable path combines the unauthenticated, capability-free ?postie=get-mail endpoint with an email-body URL autolink routine that stores an unescaped href after WordPress kses output filters are removed during mail processing. Exploitation requires Postie to be configured to retrieve and process incoming email and requires the crafted message to reach the monitored mailbox; no public exploit identified at time of analysis.
Stored cross-site scripting in the CMB2 WordPress plugin affects every version up to and including 2.13.4 and lets unauthenticated visitors plant arbitrary script through a wysiwyg field that sits inside a repeatable group. Exposure is narrow: the flaw only manifests when a site integrator deliberately renders CMB2's documented front-end form helper with a grouped wysiwyg field on a publicly accessible page that accepts unauthenticated submissions, and a victim must then view the injected page for the script to fire - standard admin metabox usage and non-group wysiwyg fields are unaffected. The CVSS 5.4 score (AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N) reflects that non-default integrator configuration, so real-world risk is materially lower than the network/unauthenticated vector suggests; no public exploit code or active exploitation was identified at time of analysis, and the upstream project has committed a fix.
An out-of-bounds write exists in Samsung's open-source escargot JavaScript engine, where the code-cache serializer under-allocates its output buffer by one boolean-sized flag per entry, so a flag array is written past the end of the allocation during cache serialization. The condition is reached while the engine parses attacker-controlled JavaScript that uses chained tagged template literals, and per the assessed vector (CVSS 5.4, AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) a user or host application must actually execute the script; impact is capped at a bounded overwrite with no confidentiality effect and low integrity/availability effect. Exposure is confined to applications that embed escargot with the code-cache feature active; no public exploit is identified at time of analysis, and the vulnerability is scheduled for this-month remediation priority. An upstream fix is present in pull request #1750, which corrects the buffer sizing and adds a regression test for chained tagged templates.
Domoticz 2026.2 and earlier lacks a role check on the udevices JSON command handler, allowing an authenticated user with SWITCHER rights to invoke operator-installed Lua parser scripts with attacker-controlled input via GET /json.htm?type=command¶m=udevices. The secondary missing '..' guard in CLuaHandler::executeLuaScript broadens reachable existing Lua files, but execution is limited to valid pre-installed scripts and all file-write/upload paths remain ADMIN-gated, so this is not arbitrary code execution. The issue is rated CVSS 5.4 and fixed in 2026.3; no public exploit identified at time of analysis.
Missing object-level authorization on the `GET /layout/status/{id}` endpoint in Xibo CMS 4.4.2 and earlier lets any authenticated CMS user - regardless of role, and even without view rights on the target - read the status and metadata of arbitrary layouts by supplying their IDs. The endpoint is a classic IDOR / broken access-control case (CWE-862): the route had neither a per-object `checkViewable` check nor the `layout.view`/`template.view` feature-authorization middleware, both of which were added in 4.4.3. Exploitation requires a valid account (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N per independent assessment), so risk is concentrated in deployments that over-provision accounts or admit untrusted users; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV, making this a moderate, authorization-only information-disclosure flaw rather than an urgent remote compromise.
Broken access control in the WordPress plugin My Auctions Allegro (free edition), versions through 4.0.3, allows a logged-in low-privilege user such as a subscriber to invoke plugin functionality that should be restricted to higher roles, yielding limited data exposure and limited unauthorized modification. The flaw is a missing authorization check (CWE-862) rated CVSS 5.4 with vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, so anonymous visitors cannot exploit it, but any account on the site can serve as the starting point. No public exploit code or active exploitation has been reported, and the specific endpoint or feature that exposes the unprotected function is not described in the available sources.
Stored cross-site scripting in the DefterAsist Financial Advisor Platform (all versions through 2026-10-27) allows an authenticated user with low privileges to persist a script payload that later executes in another user's browser when the affected page is rendered. Rated CVSS 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), the flaw requires both a valid low-privileged account to plant the content and a separate victim to interact with the page, and its impact is confined to the victim's browser session with low confidentiality and integrity effects and no availability impact. Reported by Turkey's national CERT (TR-CERT) and tracked as EUVD-2026-111826; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the priority label is this_month.
Unauthenticated remote resource exhaustion in Dell PowerProtect Data Domain can degrade appliance availability (CVSS 5.3, availability-only) across Feature Release 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, and LTS2026 8.6.1.0 through 8.6.1.20. The CVSS vector AV:N/AC:L/PR:N/UI:N indicates no authentication, no user interaction, and low complexity, but only availability is impacted (A:L). No public exploit was identified at time of analysis, and the specific service, protocol, port, or trigger is not described in the available sources.
The Advanced Custom Fields: Extended WordPress plugin, in every release up to and including 0.9.2.7, registers multiple AJAX handlers for unauthenticated visitors (wp_ajax_nopriv_*) that perform no current_user_can() capability check, so remote attackers with no account can invoke server-side actions and read data they should not see. The only gate is ACF's acf_verify_ajax() nonce validation, and because guest nonces (acf_nonce) are printed into the source of any frontend page containing an ACF form, an attacker can simply scrape a valid nonce and pass the check, disclosing post titles and internal Flexible Content layout structures. Rated CVSS 5.3 (AV:N/AC:L/PR:N/UI:N, confidentiality-only impact); there is no CISA KEV entry and no public exploit identified at time of analysis, and this is a moderate-severity information-disclosure issue rather than a critical emergency, though sites on 0.9.2.4 through 0.9.2.7 remain exposed because the 0.9.2.4 fix was only partial.
Unauthenticated attackers can disable or re-enable the PayPal Brasil BCDC payment gateway and overwrite its WooCommerce gateway settings in the PayPal Brasil para WooCommerce plugin (vendor odefranca) for WordPress, in all versions up to and including 1.7.8, silently removing PayPal from checkout for every customer on the store. The flaw is a missing-authorization defect (CWE-862): the plugin's BCDC activate and settings handlers never verify that the caller is permitted to perform the action, so the request needs no credentials (PR:N) and no user interaction (UI:N), though impact stays integrity-only (C:N/I:L/A:N, CVSS 5.3) with no data disclosure or code execution. Wordfence reports the issue and a plugin-repository changeset (r3744502) is referenced; no public exploit code has been identified at time of analysis, and the priority is this_month rather than emergency response.
Missing authorization (CWE-639, insecure direct object reference) in nopCommerce before 5.00.0 lets an authenticated vendor manipulate the catalog listings of another vendor: the admin ProductController handlers RelatedProductAddPopup, CrossSellProductAddPopup and AssociatedProductAddPopup accept a caller-supplied model.ProductId without verifying that the referenced parent product belongs to the requesting vendor. By submitting a victim's product id, an attacker with vendor-level credentials can inject their own items into that product's related-products, cross-sell and grouped/associated-product lists, an integrity-only impact rated 5.3 under CVSS 4.0 (AV:N/AC:L/PR:L/UI:N, VC:N/VI:L/VA:N) and CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N on re-assessment. Exposure is limited to installations running in multi-vendor/marketplace mode, because the vulnerable branch only executes when GetCurrentVendorAsync() returns a vendor; single-admin stores are not affected, and no public exploit code or CISA KEV entry is associated with this issue at time of analysis.
Unauthenticated reservation-type tampering in the Court Reservation WordPress plugin, affecting all versions before 1.12.4, lets remote attackers add or delete reservation types in the plugin's configuration because one of its AJAX actions performs no authentication, authorization, or nonce validation. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) confirms the flaw is network-reachable and requires no credentials or user interaction, but limits impact to low integrity tampering with no confidentiality or availability effect, so damage is confined to corrupting booking configuration rather than site compromise. Exploitation status is not confirmed by CISA KEV, EPSS is low at 0.19% (9th percentile), and no public exploit has been identified at time of analysis; the vendor has released a patch (1.12.4) and priority is assessed as moderate and non-urgent, appropriate for routine this-month remediation.
Unauthenticated content disclosure in the Royal Addons for Elementor WordPress plugin before 1.7.1070: an AJAX action returns post content based only on a post's published status, without checking whether the post type itself is publicly viewable, so published entries stored in non-public post types can be read by anyone who can reach the endpoint. Sites in the affected range 1.3.81 through 1.7.1069 are exposed when they keep sensitive records - the cited example being captured contact-form submissions with names, addresses and messages - in such non-public post types; the assessed impact is confidentiality-only (C:L) with no write or availability effect, CVSS 5.3, PR:N/UI:N per the supplied vector. No public exploit code and no confirmed active exploitation were identified at time of analysis, and EPSS is low at 0.16% (6th percentile), so this is a real but non-urgent issue with vendor remediation available.
The Payconiq WordPress plugin through version 1.0.4 returns an order's confirmation link/key without checking whether the requester is permitted to view that order, so any unauthenticated remote visitor who can reach the site can obtain the keys of paid orders. For recent guest-checkout orders the same request also exposes the customer's personal details, while older or account-based orders leak only the order key. No CISA KEV entry, no confirmed public exploit code, and an EPSS of 0.16% (6th percentile) indicate limited observed activity at time of analysis, though the flaw is trivially reachable (AV:N/AC:L/PR:N/UI:N) and requires no special configuration.
Unauthenticated information disclosure in the Essential Addons for Elementor WordPress plugin before 6.8.7 allows any remote visitor to read the contents of non-public post types and recover private custom-field values from published posts by supplying arbitrary post_type and meta_query parameters to the plugin's pagination endpoint. The flaw is rated CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N): no authentication, configuration change or user interaction is needed, the pagination endpoint is reachable by default, but the impact is confined to read-only confidentiality loss with no integrity or availability effect. EPSS is low at 0.16% (5th percentile), there is no CISA KEV listing and no public exploit identified at time of analysis, so this is a moderate issue to be scheduled for remediation this month rather than an emergency: a patched release (6.8.7) is available from the vendor.
Unauthenticated attackers can delete WordPress user accounts of roster members on sites running the WP Roster plugin before 2.35, because one of its AJAX actions lacks capability and nonce checks. The issue is rated CVSS 5.3 with integrity-only impact and is exploitable remotely without authentication or user interaction when the plugin is active and roster-member accounts exist. EPSS is 0.15%, no public exploit has been identified at time of analysis, and the vendor patch is version 2.35.
Unauthenticated attackers can add arbitrary subscriber records to a site owner's Mailchimp audience through Royal Addons for Elementor before 1.7.1070 because the plugin's subscribe path lacks an authorization check. The issue affects sites running versions from 1.3.71 up to but not including 1.7.1070 that have the Mailchimp integration configured with a stored credential and a reachable audience; without that integration there is nothing to abuse. No public exploit has been identified at time of analysis, and EPSS is low at 0.15% (4th percentile), so this is a moderate-severity integrity issue rather than a top-tier emergency.
Unauthenticated remote attackers can delete arbitrary tournament-ladder challenge records - and the linked court-booking event when one is scheduled - on WordPress sites running the Court Reservation plugin before 1.12.4, because one of the plugin's challenge-management actions performs neither an authorization check nor a nonce verification (CWE-862). The CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N scores 5.3: no credentials, interaction, or special configuration are needed, but the impact is confined to integrity loss of these specific application records, with no data disclosure or code execution. EPSS is 0.15% (4th percentile), no public exploit has been identified at time of analysis, there is no CISA KEV entry, and vuln.today assigns a this_month priority; a vendor fix is available in 1.12.4.
Unauthenticated email-relay abuse in the Booking Package WordPress plugin before version 1.7.33 lets remote attackers trigger the site's booking verification-code emails to arbitrary recipient addresses, because the plugin neither restricts who can invoke the workflow nor binds the recipient to server-side verification state. The flaw affects any WordPress installation running the plugin with the booking verification-code email workflow reachable, which is the default behaviour of the booking feature; exploitation requires no authentication, no user interaction and no non-default configuration. Impact is confined to email abuse, sender-reputation damage and mail-resource consumption rather than code execution, data access or site modification, and no public exploit has been identified at time of analysis (EPSS 0.15%, 4th percentile, no CISA KEV listing).
Unauthenticated attackers can forge bank-transfer payment notifications to the Casso Flow WordPress plugin (versions before 4.2.0) and flip any pending WooCommerce order to 'paid', regardless of the order's actual payment method. The flaw exists because the token used to authenticate incoming notifications is empty on a default installation, so the verification step effectively accepts forged callbacks; the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, integrity-only) confirms the attack is remote and requires no credentials or user interaction. Impact is limited to order payment status - no data disclosure or outage - and exploitation additionally requires WooCommerce to be active with Casso Flow enabled plus a pending order to target; no public exploit code was identified at time of analysis, the issue is not in CISA KEV, and EPSS is low at 0.15% (4th percentile).
Stores running the UniPAY Payment Gateway For WooCommerce plugin through version 2.3 can have arbitrary orders marked as paid by unauthenticated remote attackers, because the plugin verifies payment-notification signatures against a merchant secret that is empty by default. No credentials or user interaction are required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), and the impact is confined to payment-status integrity rather than data disclosure or site downtime. Exploitation requires the store to be reachable over the network and to have left the secret unset; the issue scores 5.3 with an EPSS of 0.15% (4th percentile), no public exploit code has been identified at time of analysis, and the priority is this_month rather than emergency.
Broken object-level authorization in InvoicePlane's guest quote portal allows an authenticated guest user to approve, reject, or mark-as-viewed quotes that belong to clients they were never assigned, simply by changing sequential quote_id values in the /guest/quotes/approve/{id}, /guest/quotes/reject/{id} and PDF-generation routes. Only Integrity is affected (status changes, viewed flags, and notification e-mails sent via email_quote_status()); confidentiality and availability are untouched, which is why the score lands at 5.3 rather than higher. The vendor shipped fixes in 1.7.2-beta-1 and the subsequent stable 1.7.2, and a step-by-step reproduction is published in the GitHub advisory, but no confirmed working exploit code or active exploitation has been reported.
Improper URL validation in A2UI's Image, Video and Audio player components (versions up to and including 0.10.4) lets an attacker who can influence a component's 'url' value push disallowed schemes - javascript:, vbscript:, file:, blob: and protocol-relative // URLs - into the media element's src attribute, resulting in low-confidentiality resource loading or disclosure for users who view the rendered surface. The issue is remote and requires only passive user interaction (UI:P) once a crafted A2UI message is rendered by the client; data: URLs remain intentionally permitted by the fix. Severity is modest (CVSS 4.0 base 5.3; independently assessed CVSS 3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N), there is no CISA KEV entry, and no public exploit was identified at time of analysis - an upstream fix exists as pull request #3108 but, per the advisory, still awaits acceptance.
StrictSoftFileLock and AsyncStrictSoftFileLock in Python filelock 3.30.0 through 4.2.0 create their <path>.filelock and claims/ coordination directories with a bare mkdir(), so those directories receive 0o777 filtered only by the process umask or by an inheritable default ACL instead of the restrictive mode the caller passed for the lock's files. When that environment leaves another local account a write bit on those non-sticky directories, that account can unlink the holder's 0600 intent and held claim files, and the next contender from the holder's own account (or root) then finds an empty claim directory and enters the critical section while the original holder still reports is_locked == True and later releases cleanly with exit status 0. The exposure is conditional and strictly local: with the common umask 022 and no default ACL the directories land 0755, the kernel denies the unlink, and the second process simply times out; the maintainers measured three enabling configurations (umask 000 under a sticky parent such as /tmp, umask 002 with the attacker in the directory's group, or a default ACL granting group write). Vendor-released patch: 4.2.1; no public exploit identified at time of analysis, and the flaw is scoped to POSIX/Linux permission semantics and to the strict lock classes only (FileLock, SoftFileLock and SoftReadWriteLock are unaffected in the same setting).
Windows permission handling in the Python filelock library (3.10.0 through 4.2.0) silently drops the `mode` argument, so a lock file requested as `mode=0o600` is created with no security descriptor of its own and instead inherits the parent directory's ACL - the same as a lock created with no mode at all; the ReadWriteLock SQLite database, always requested as 0o600, is created the same way. An authenticated local user (CVSS PR:L) on the same Windows host who inherits read or modify access through the directory's inherited entries can open the lock file or database, take the byte-range lock and make the owner's later `acquire()` calls wait or time out, read holder metadata written by an `on_acquired` hook when `preserve_lock_file=True`, and, where modify access is inherited, write to both files. Exposure is limited to the lock file and lock database - mutual exclusion between cooperating processes still holds, Unix is unaffected, and the issue disappears entirely when the lock directory's ACL already excludes other accounts; no CISA KEV entry or confirmed active exploitation exists, though a public reproducer accompanies the advisory, and it is not verified working exploit code (maintainers separately confirmed the behavior on Windows 11 with two local accounts).
In @hono/node-server 1.19.10 through 2.1.2, the serveStatic middleware decodes the request path a second time after Hono has already decoded it for routing, letting remote unauthenticated attackers (CVSS:3.1/AV:N/AC:L/PR:N/UI:N) fetch files under a static prefix whose route middleware - typically an authentication check - never runs, yielding low confidentiality impact confined to the configured static root. Only deployments that mount middleware on a sub-portion of the directory served by serveStatic (for example auth on /static/admin/* while serveStatic covers /static/*) are exposed; applications serving purely public files are unaffected. No public exploit code and no CISA KEV listing were identified at time of analysis, and the vendor-released patch is version 2.1.3, which by default skips routed paths that still contain '%' unless allowPercentInPath:true is explicitly set.