Rate limiting in Labstack Echo can be bypassed by header spoofing in the default configuration: when echo.New() is used without setting Echo#IPExtractor, Context.RealIP() returns the first, client-supplied value of X-Forwarded-For (or X-Real-IP) with no proxy-origin validation, and the default middleware.RateLimiter identifier extractor keys its buckets directly on that value. An unauthenticated remote attacker who rotates the header on each request obtains a fresh bucket every time, so endpoints protected by the stock rate limiter - login, password reset, 2FA, API routes - are effectively unthrottled, and any other control that derives per-client identity from ctx.RealIP() (access logging, geo-blocking, audit trails) is undermined the same way. Exploitation requires a target built on echo/v5 before 5.1.0 or echo/v4 from 4.0.0 through 4.16.2 that leaves IPExtractor nil and relies on RealIP()-based throttling; a public proof-of-concept accompanies the advisory, but active exploitation has not been confirmed, and the assessed impact is limited to integrity of the throttling decision (CVSS 5.3), not code execution or data disclosure.
Client IP spoofing in Labstack Echo's reverse-proxy middleware lets remote, unauthenticated attackers dictate the X-Real-IP value that upstream services behind the proxy receive, so upstream IP allowlists, geo-restrictions, rate limits and audit logs can be steered toward an attacker-chosen address. The flaw affects Echo v4 (4.0.0 through 4.16.2, still unpatched) and v5 before 5.4.0, and only manifests when Proxy() or ProxyWithConfig() is used with Echo#IPExtractor left unset and at least one upstream actually trusts X-Real-IP for a security decision. Exploitation is not confirmed in the wild (not in CISA KEV), although the vendor advisory publishes a proof of concept showing the header passing through unchanged; the net effect is forged client identity only, with no code execution, data disclosure or denial of service in Echo itself, and the 'RCE' tag carried by some feeds is not supported by the advisory or the assessed vector.
CSRF protection in Labstack Echo can be skipped entirely when the MethodOverride middleware rewrites a POST to a safe method (GET, HEAD, OPTIONS or TRACE) before the CSRF middleware runs, letting the original state-changing POST handler execute without token validation or a Sec-Fetch-Site check. Affected are echo v4 before 4.16.0 and echo v5 before 5.4.0, but only in a specific non-default setup: MethodOverride registered with e.Use() ahead of CSRF and configured with a browser-settable getter such as MethodFromForm('_method') or MethodFromQuery, plus an authenticated victim lured to an attacker page (CVSS 3.1 5.3, AV:N/AC:H/PR:N/UI:R, C:N/I:H/A:N). The default X-HTTP-Method-Override header getter is not reachable from a cross-site form, and applications using e.Pre() as documented or placing CSRF first are unaffected; there is no CISA KEV entry and the advisory supplies a public proof-of-concept reproducer rather than confirmed exploitation in the wild.
n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 leak the SeaTable Trigger node's API token into error execution data, because failed poll requests persist raw request headers - including the Authorization header carrying the credential's API token. An authenticated n8n user who can view a workflow's executions but is denied permission to read its credentials can recover that token and use it directly against the connected SeaTable base. Exploitation requires a prior poll failure to have been recorded and a SeaTable poll trigger to be in use, so only deployments matching those conditions are exposed; no public exploit code has been identified at time of analysis and the CVE is not in CISA KEV, with the vendor advisory published as GHSA-crfj-5wv6-8v86.
Credential secrets - Git passwords or tokens, MongoDB database passwords, and Google access tokens - are written into stored execution error data by n8n's Git, MongoDB Atlas Vector Store, and Google Cloud Storage nodes whenever an operation in one of those nodes fails. Any authenticated user who can view a workflow's executions but is not authorized to read the underlying credential can then recover the secret from that execution record, escalating from a low-privilege workflow viewer into access to the external Git, MongoDB Atlas, or Google Cloud systems. Fixed in n8n 1.123.85, 2.43.5, and 2.44.1; no public exploit code and no CISA KEV listing were identified at time of analysis, and the priority signal places remediation in the current month rather than as an emergency.
Authorization bypass in n8n Chat Hub lets authenticated accounts with the global:chatUser role register tool types that the product intends to restrict, then run those tools through chat to execute sandboxed code, access permitted files, and use instance workflows, Data Tables, and agents. The flaw affects n8n before 1.123.85, before 2.43.5, and before 2.44.1 and is rated medium severity (CVSS 4.0 5.3); exploitation requires the chat-user role and an instance where Chat Hub is enabled or in use. No public exploit was identified at time of analysis, and the vendor has released fixed versions.
Identity spoofing in Labstack Echo v5 (5.0.0 through 5.4.0) allows remote attackers to forge the client address returned by Context.RealIP when an application configures the ExtractIPFromRealIPHeader extractor with default trust options: the extractor validates the client-supplied X-Real-IP value against trusted ranges rather than validating the actual network peer, so a loopback or private address in that header is accepted from an untrusted sender. Only deployments that both run Echo v5 between 5.0.0 and 5.4.0 and explicitly use this non-default extractor for IP allowlists, IP-based rate limiting, audit logging or forwarding headers are exposed, and the attacker must reach Echo directly or through a proxy that passes the header through unchanged; the default direct extractor and Echo v4 are unaffected. The consequence is a spoofed client identity rather than code execution or data disclosure, no public exploit code has been identified at time of analysis, and the issue is fixed in v5.4.1.
Quadratic CPU consumption in OpenTelemetry Java's W3C tracestate parsing lets remote attackers stall request and event-loop threads by sending crafted trace headers. The vulnerable code is in W3CTraceContextPropagator.extract(), which splits the tracestate header with a regex that backtracks severely on long runs of spaces or tabs that are not followed by a comma; applications on opentelemetry-api 1.66.0 or earlier with W3C trace-context extraction of incoming requests enabled (the common propagation default) are affected. No authentication or user interaction is required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, 5.3), but ingress header-size limits, proxy configuration and threading cap the per-request cost, so practical impact is degraded availability driven by repeated requests rather than a single-shot outage. The parser was rewritten in 1.67.0; no public exploit code was identified at time of analysis.
Prototype pollution in Highcharts Dashboards 1.0.0 through 4.2.1 lets an attacker who controls dashboard configuration supply a DataTable id of __proto__ or constructor and, with an enabled stateful sync such as highlight or extremes, create an enumerable property on Object.prototype whose name suffix is influenced by the sync group option. The injected property is normally inert but can break sync bookkeeping, cause exceptions that stop features like extremes synchronization, and affect any page code that reads or enumerates it; exploitation requires untrusted data to reach the Dashboards dataPool and sync configuration and no user interaction beyond loading the board. The issue is fixed in 4.2.2; no confirmed active exploitation or CISA KEV entry is reported, and the advisory's public live demo and testing reference is not verified as working exploit code.
An out-of-bounds write in the TCP proxy/optimization data plane of Juniper Networks Session Smart Router allows network attackers to corrupt forwarded packet data and potentially crash the data plane by sending a transit TCP packet with a crafted TCP option length. The supplied CVSS vector is network-reachable, low-complexity and unauthenticated (PR:N), but exploitation depends on the SSR actually proxying or optimizing the attacker's TCP traffic; the available sources do not state whether that feature is enabled by default. No public exploit identified at time of analysis, and the supplied data does not report CISA KEV status.
Out-of-bounds read in the HttpParser component of Juniper Session Smart Router and Session Smart Conductor allows a remote, unauthenticated attacker to send a crafted HTTP request that degrades availability, assessed as a moderate-severity denial-of-service issue (CVSS 5.3, A:L only) rather than a high-priority emergency. The CVSS vector indicates no privileges or user interaction are required, but impact is confined to availability - no code execution or data exposure is assessed. No public exploit was identified at time of analysis, and the available data does not describe the precise parser trigger.
CSV formula injection in the iCagenda Joomla extension (versions 3.5.0 through 4.0.16) allows an authenticated, low-privileged user to plant spreadsheet-formula payloads in event registration fields that are later written unescaped into the registrations CSV export. The attack chain only completes when an administrator exports the registrations and then opens that file in a spreadsheet application and dismisses the formula/DDE/external-content warning, so the impact lands on the operator's workstation rather than on the Joomla site itself, which the assessment rates as showing no confidentiality, integrity, or availability impact. Scored 5.3 with a CVSS 4.0 vector (PR:L, scope-changed low impacts) and a CVSS 3.1 assessment of AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, this is a medium-severity, lower-priority issue rather than an emergency; no public exploit was identified at time of analysis and there is no CISA KEV listing.
Acronis Cyber Protect 17 builds prior to 42587 on Linux and Windows store or transmit credentials with insufficient protection (CWE-522), allowing an attacker who already holds a low-privilege authenticated account to obtain those credentials over the network. The vendor rates the attack as high complexity, and the available advisory does not describe the specific conditions that must be met to trigger the disclosure; integrity and availability are unaffected, but confidentiality impact is high. No public exploit code or PoC reference is identified in the available sources, and the issue is not confirmed as actively exploited (no CISA KEV listing); EPSS data was not provided, and the priority decision is this_month. Risk is moderated by the need for valid authenticated access, the high attack complexity and the availability of a fixed build.
An unauthenticated path traversal flaw (CWE-22) in Dell PowerProtect Data Domain affects Feature Release 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40 and LTS2026 8.6.1.0 through 8.6.1.20, allowing a remote attacker to read files outside the intended restricted directory. Per the supplied CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication or user interaction is required, but the impact is limited to low-level confidentiality only - read access with no integrity or availability effect. No public exploit code or confirmed active exploitation is identified in the available data, and the priority decision is 'this_month' rather than immediate action.
NexoPOS through 6.3.0 allows an authenticated cashier holding the default nexopos.use.registers permission to act on register sessions opened by a different cashier, because CashRegistersService never compares the register's used_by value with the requesting user. By posting closing, cash-in, or cash-out actions to /api/cash-registers/{action}/{register}, such a user can force-close another cashier's open session or alter its recorded balance, affecting integrity and availability of register data. The flaw requires a valid low-privileged cashier account and a target session owned by someone else; no public exploit code was identified at time of analysis, and the vendor fix (PR #2673) enforces register ownership.
Arbitrary DOM property injection in the a2ui Lit renderer (versions up to and including 0.12.0) allows an attacker who can influence the component tree consumed by Root.renderComponentTree to set properties the receiving custom element never intended to expose - including DOM sinks such as innerHTML, srcdoc, href, formaction and inline event handlers - which can execute script in the page that renders the surface. The rendering path only fires when custom elements are enabled on the a2ui-root (the reproduction in PR 3107 sets enableCustomElements = true), and a victim must view the attacker-influenced surface, so the issue is limited to the viewing page with low confidentiality, integrity and availability impact. No public exploit code was identified at time of analysis and the fix PR 3107 is still awaiting acceptance, so no released patched version is confirmed; priority is this-month rather than urgent.
n8n workflow automation instances before 1.123.85, 2.43.5, and 2.44.1 let a member-level user use credentials they are not authorized to access and have the decrypted values delivered to a destination of their choosing. The bypass works because n8n's pre-execution credential check only inspects credential slots it deems active based on stored parameters, where defaults are omitted, while execution restores those defaults and invokes the node with the credential anyway. Exploitation requires an authenticated member account on a shared or multi-user instance that holds credentials the member should not reach (PR:L, AC:H); the vendor has released fixed versions and no public exploit code has been identified at time of analysis. The vendor rates it CVSS 4.0 base 5.1 and our own assessment lands at moderate severity, placing priority below critical but above negligible.
Credential disclosure in n8n allows an authenticated user with editor rights on a shared workflow to bypass the save-time credential guard and cause the workflow project's credentials to be resolved and returned in decrypted form. The flaw affects the npm package n8n before 1.123.85, before 2.43.5, and before 2.44.1, and is rated moderate severity (CVSS 4.0 score 5.1; assessed CVSS 3.1 vector AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N). Exploitation is not anonymous: it requires shared-workflow editor access and the ability to serve sub-workflow content that the n8n process can fetch from a URL or local file; no public exploit was identified at time of analysis, and the available assessment characterizes this as an insider-oriented authorization weakness rather than a mass-exploitation emergency.
Per-user credential theft in n8n (npm package, versions before 2.41.5 and 2.42.x before 2.42.2) lets a project editor repoint a colleague's workflow settings.errorWorkflow at an error workflow they control, then inherit the colleague's identity when that workflow fails and resolve the colleague's per-user dynamic credential secrets. Exploitation is authenticated (CVSS 4.0 PR:L) and conditional: the attacker must already hold an editor role in a shared team project, dynamic credentials must be in use, and the victim's workflow must actually fail so the error workflow runs with the inherited execution context. Rated Medium (CVSS 4.0 base 5.1, independently assessed as CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N) and classified 'this_month' on the vuln.today priority scale; no public exploit was identified at the time of analysis and there is no CISA KEV entry.
Credential permission bypass in n8n lets an authenticated member run an inline-JSON-mode Execute Workflow node that references a credential id they are not permitted to use, so the decrypted credential is passed to a node and can be sent to a server the attacker controls. Deployments on the 1.x branch before 1.123.85 and the 2.x branch before 2.43.5 or 2.44.1 are affected; the attacker needs a valid member account, prior knowledge of the target credential id, and a sub-workflow node whose disabled property holds a non-boolean value, which is why the assessed severity is moderate (CVSS 3.1 AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N) rather than urgent. No public exploit code has been identified at time of analysis and there is no CISA KEV entry; the vulnerability.today decision label is this_month.
HTML injection in GFI Kerio Connect Webmail before 10.0.9 Patch 2 allows unauthenticated remote attackers to spoof link destinations or inject arbitrary markup into rendered messages by sending an email whose link text contains quote characters, breaking the auto-formatter out of the href attribute. Exploitation requires the victim to open the crafted message in the Webmail interface, so impact is scoped to the victim's Webmail session rather than server compromise; no public exploit was identified at time of analysis. The issue is moderate priority with a CVSS 4.0 base score of 5.1, and vendor patch 10.0.9 Patch 2 is available.
CSV formula injection in the Ninja Forms plugin for WordPress before 3.15.4 lets unauthenticated attackers plant crafted spreadsheet payloads inside form submissions, which are then evaluated when an administrator exports submissions and opens the file in a spreadsheet application. Requests go through the unauthenticated nf_ajax_submit endpoint to list-type fields (Checkbox List, Multi-Select List, Image List, Country, State), whose NF_Abstracts_List validate() method only enforces required-field presence and never applies the CSV escaping reserved for Textbox and Textarea fields. The vulnerability requires administrator interaction to become dangerous (UI:A) and does not execute on the web server itself; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV, so it is a moderate-severity, interaction-dependent risk rather than an emergency.
Authenticated users with editor-level access or higher on WordPress sites running the Tainacan plugin through version 1.3.0 can read arbitrary files on the web server by planting a directory-traversal path in an importer session and then triggering it through a separate REST request. The tampered 'tmp_file' value is persisted to the database via the importers REST controller and later handed to fopen() and fgetcsv() by the /source_info endpoint, which returns the parsed file contents in the REST response - exposing configuration files, credentials and other sensitive data readable by the PHP process. Severity is moderate (CVSS 4.9, PR:H with C:H/I:N/A:N), the exploit path is gated behind editor-level authentication rather than being anonymous, no public exploit code has been identified at time of analysis, and the flaw is fixed in Tainacan 1.4.0.
A heap-based buffer overflow in Dell PowerProtect Data Domain (Feature Release 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, and LTS2026 8.6.1.0 through 8.6.1.20) lets a remote attacker who already holds high-privileged administrative access corrupt heap memory on the appliance, producing a denial-of-service condition (CVSS 4.9, AV:N/AC:L/PR:H/UI:N/C:N/I:N/A:H). The high-privilege prerequisite is the dominant limiting factor: an unprivileged or purely external attacker cannot reach the flaw, so realistic exposure is confined to compromised, careless, or malicious administrators. No public exploit code was identified at time of analysis, the issue is not listed in CISA KEV, and the overall priority is routine rather than emergency.
Stored cross-site scripting in the Hustle WordPress plugin through 7.8.14.3 allows an authenticated account with the hustle_edit_module capability to place arbitrary script in the content[cta_label] field, which executes when a page renders the affected Hustle module. By default that capability is limited to Administrators, so lower-role exploitation-including from Subscriber-requires a site owner to have delegated hustle_edit_module through the plugin’s Permissions screen. This is a moderate, low-urgency issue, and no public exploit was identified at time of analysis.
Authentication bypass in the Customer Email Verification for WooCommerce plugin (all versions up to and including 2.8.2) allows unauthenticated front-end visitors to complete the plugin's email-verification step for an arbitrary address, letting them log in as a newly created verified WooCommerce customer or flip an existing account's customer_email_verified meta to verified. The bypass relies on three weaknesses chained together: the cusomer_email_verify handler performs no capability or nonce check, the secret_code it validates is generated as md5(email . time()), and the verify_otp_nonce needed to trigger token issuance is disclosed to every visitor through wp_localize_script. Severity is constrained rather than urgent: CVSS 3.1 base 4.8 (AC:H) and the trigger only works on sites where the cev_user_log table retains a password column from an older schema, which clean 2.8.2 installs do not have; no CISA KEV entry and no public exploit code were identified at time of analysis, and impact is limited to customer-level accounts rather than administrative takeover.
PostgreSQL Anonymizer before 3.3.0 can return unmasked values when an authenticated low-privilege database user, who should be subject to masking, reads protected data through a view created with the security_invoker option. The masking rules are not applied on that access path, so sensitive column data is exposed despite the role being configured to see only masked output. Exploitation requires an affected deployment with an existing security_invoker view over the protected data; no public exploit identified at time of analysis, and the flaw is resolved in 3.3.0 and later.
An out-of-bounds write in TCP header processing in Juniper Networks Session Smart Router lets unauthenticated remote attackers corrupt TCP payload data and potentially desynchronize sessions by passing a transit TCP packet whose SACK option carries an oversized length field. Only devices that process transit TCP traffic on the attacker's network path are exposed, and the high attack complexity reflects that the malformed-option condition is not straightforwardly triggered. Impact is bounded to integrity and availability effects (I:L/A:L) with no confidentiality loss and no evidence of code execution; no public exploit has been identified at time of analysis, and the issue is tracked as a moderate, this-month priority rather than an emergency.
Denial of service in SAIL 1.0.1 and earlier: the built-in WebP decoder performs a divide-by-zero during loader initialization when a malformed animated WebP file causes WebPDemuxGetI to return a zero WEBP_FF_CANVAS_WIDTH, terminating the process before frame decoding or generic image-skeleton validation runs. Only builds compiled with the built-in WebP codec are affected, and an unauthenticated attacker must get a victim application to decode the crafted file (user interaction), with impact confined to availability - no confidentiality, integrity or code-execution consequence, and no CISA KEV listing. Version 1.0.2 fixes the issue; a public PoC reference exists in the vendor advisory (a generator script that patches ANMF metadata of a bundled sample), though it is not verified as working exploit code.
Open redirect in the Welcart e-Commerce WordPress plugin before 2.12.6 allows unauthenticated attackers to send victims to arbitrary external sites by supplying an unvalidated URL to the plugin's redirect functionality (CVSS 4.7, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N). Every WordPress site running Welcart e-Commerce below 2.12.6 is exposed; the attacker needs no account, but the victim must click a crafted link, so the flaw cannot be triggered silently or at scale against a server directly. No public exploit has been identified at time of analysis and EPSS is 0.17% (6th percentile), so risk is driven by phishing and link-trust abuse rather than mass scanning.
Stored DOM cross-site scripting in AVideo-Encoder (WWBN AVideo) prior to 8.1.0 lets an attacker plant an HTML title in an encoder queue entry that later executes as script in a privileged viewer's browser. The Login::canUpload() capability needed to submit a queue entry can be self-granted by pointing the encoder's login at an attacker-controlled site that returns canUpload=true, so no legitimate encoder credentials are required; the practical limit is that Encoder::getAll restricts non-administrators to their own streamer's rows, so the payload only fires for an administrator viewing the full queue or an operator on the attacker's own streamer. The GitHub security advisory publishes a proof-of-concept walkthrough (attacker login stub plus curl submission) and a public fix commit exists; no active exploitation is confirmed (CISA KEV) and the report carries a this_month priority label, consistent with a genuine but moderate-priority privilege-escalation-via-XSS issue rather than an emergency.
Blind, second-order server-side request forgery in Endatix 0.6.0 and earlier lets unauthenticated attackers plant HTTP/HTTPS URLs inside the file objects of a public form submission, which the server later fetches from its own network position when a staff member with submissions.view downloads that submission's files. The stored JSON is only checked for well-formedness, and SubmissionFileExtractor passes the attacker-supplied content string straight to HttpClient.GetAsync with no scheme, host, or resolved-IP validation, so internal services, loopback, link-local and cloud metadata endpoints (169.254.169.254) become reachable through the Endatix server; the fetched body lands in the staff viewer's ZIP rather than being returned to the attacker, so disclosure is blind or observational. Exploitation is gated on a public and enabled form, a passing reCAPTCHA v3 challenge when configured, and a staff file-download action the attacker cannot trigger directly; a public PoC walkthrough exists in the vendor advisory but is not verified as working exploit code, and there is no confirmed active exploitation (CISA KEV) at time of analysis.
Echo's WWWRedirect() and NonWWWRedirect() middlewares build the Location header from Context.Scheme(), which returns the raw value of the X-Forwarded-Proto, X-Forwarded-Protocol or X-Url-Scheme request header without checking it is a web scheme, so an attacker who controls that header can make the redirect point at an arbitrary URI scheme such as javascript, data, file or gopher. Applications built on github.com/labstack/echo/v4 before 4.15.2 or /v5 before 5.1.1 are affected only if they mount one of those two redirect middlewares and run without an edge proxy that overwrites or strips the forwarded-scheme headers; the HTTPSRedirect, HTTPSWWWRedirect and HTTPSNonWWWRedirect variants hardcode https:// and are unaffected. The advisory documents a public proof-of-concept request verified against a live server, and per the CVSS vector (AC:H, UI:R) a victim must also interact with the manipulated redirect for impact, which keeps realistic exposure narrow; KEV status was not provided.
PostgreSQL Anonymizer before 3.3.0 fails to validate the dimensions declared in an image header against the actual image data inside anon.image_blur(), so a tiny file claiming enormous height and width can drive a backend into an oversized allocation. When the image is passed through image_blur() the backend can be OOM-killed, and with memory overcommit enabled on the host this escalates to a cluster-wide crash and recovery cycle. Reachability is constrained: a low-privileged database user (CVSS PR:L per the assessment) can only trigger it if an operator actually runs the masking function over the crafted image (UI:R), and impact is strictly availability (C:N/I:N/A:L) - no confidentiality or integrity exposure. No public exploit code has been identified at time of analysis, and the issue is fixed in release 3.3.0.
Memory exhaustion in PostgreSQL Anonymizer's range-based dummy functions affects every release before 3.3.0: whoever can run SQL that invokes one of these faking functions with an attacker-controlled range size can force an oversized allocation, OOM-kill the backend and, on hosts with memory overcommit enabled, drive cluster-wide crash recovery. The published score is CVSS 4.7 (AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:L) while the independent assessment rates PR:L, UI:N and A:H, so the privilege requirement and availability impact should be treated as disputed rather than settled; priority is 'this_month'. No public exploit code was identified at time of analysis and CISA KEV does not list this issue.
Stored cross-site scripting in the DesignSetGo WordPress plugin through version 2.11.0 allows a contributor-level (or higher) account to stash an arbitrary HTML element name in the free-form 'tagName' attribute of a Section, Row or Grid block delimiter comment, which later becomes live markup. The payload is dormant by design: it only executes if an administrator deactivates the plugin and runs the 'Scan & Convert Blocks' migration, which invokes build_group_block() and carries the stored value into rendered post_content HTML. The attacker cannot trigger execution themselves, so exploitation requires an authenticated contributor plus a specific, non-default administrative action; no public exploit has been identified at time of analysis and the vulnerability has not been confirmed actively exploited (not in CISA KEV).
Stored cross-site scripting in the Product Addons for Woocommerce - Product Options with Custom Fields plugin (all versions up to and including 3.1.8) allows authenticated users with WooCommerce shop manager-level access or above to inject arbitrary script through the 'fields[section][fields][row][col][type]' parameter, which is then rendered without adequate escaping and executes for any user who later views a page containing the injected add-on data. The root cause is insufficient input sanitization combined with missing output escaping (CWE-79) across the plugin's field-handling code. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the assessed risk is low-to-moderate because the PR:H prerequisite limits realistic abuse to trusted insiders, compromised shop-manager accounts, or post-compromise escalation rather than unauthenticated remote attack.
chrome-devtools-mcp versions 1.1.0 through 1.4.0 on Linux can be induced to write tool output outside the MCP roots workspace boundary, giving a local attacker limited arbitrary read/write against files the victim user can write. The bypass works because the caller-supplied path is canonicalized and validated first, then rewritten to the tool's enforced extension (for example report.txt becomes report.png) and written without a second validation, so a pre-planted symlink at the final extension-rewritten path redirects the write outside the root; the trigger requires only local, unprivileged access (CVSS:3.1/AV:L/AC:L/PR:N/UI:R, 4.4 Medium) but depends on an agent being driven to invoke an extension-enforcing sink such as take_screenshot. The upstream GHSA-5hw5-4q87-m6x9 advisory includes four reproduction scripts, including a full MCP stdio PoC against a real Chrome instance; no CISA KEV entry or confirmed in-the-wild exploitation is reported, and the vendor-released fix is version 1.5.0.
Related Posts for WordPress through version 3.0.0 allows authenticated users holding Contributor-level access or higher to read the titles of non-public posts they are not authorized to see, including drafts, pending, private, future and trashed posts owned by higher-privileged users. The hidden 'rp4wp_link_related' admin page checks the nonce and the ability to edit the parent post but never verifies that the caller may read the attacker-supplied child post ID, so linking an arbitrary post ID to a draft the attacker owns causes that post's title to be echoed back in the editor meta box. Rated CVSS 4.3 (medium, PR:L, C:L only) with no CISA KEV listing and no public exploit identified at time of analysis; impact is confined to title disclosure for authenticated Contributors and above, so real-world risk is modest rather than urgent.
Authorization bypass in the WordPress plugin Enable Media Replace (all versions up to and including 4.2.2) allows an authenticated user holding the Author role or above to rewrite the post_content of published posts that reference a replaced media file - including posts owned by Administrators - with the changes immediately visible to unauthenticated site visitors. The root cause is that the plugin's doReplaceQuery() performs a database-wide search-and-replace across every post containing the old media URL without any per-post capability check, so a single Author-triggered replace request can silently overwrite many posts that WordPress's admin UI and REST API would otherwise forbid that user from editing. Severity is modest (CVSS 4.3, PR:L, integrity-only) because the actor must already hold a valid Author+ account and the rewrite is constrained to substituting the old media URL with the new one; no public exploit code has been identified at time of analysis, and the vendor has released version 4.2.3 which, among other hardening, restricts Author-role users to the standard replace option only.
Billable AI embedding calls can be triggered repeatedly by any authenticated subscriber on WordPress sites running WoowBot 5.0.0 or earlier, draining the administrator's stored OpenAI, Gemini, OpenRouter, or xAI credits. The only prerequisites are a logged-in account and a configured paid provider key; the wp_chatbot nonce is emitted to every authenticated frontend visitor via wp_localize_script and is not a meaningful barrier. Rated CVSS 4.3 (PR:L, integrity-only impact), no public exploit identified at time of analysis, and the vendor fix is in the 5.0.1 release.
Authenticated WordPress users with Contributor-level access or higher can read the title, content, excerpt, taxonomies, and metadata of private, draft, and pending posts on sites running Travelly - Tour & Travel Booking Manager for WooCommerce through 2.3.6. The flaw is a CWE-862 missing authorization check in the plugin's duplicate-post action: a nonce with the static action 'TTBM_Admin.php' is not bound to a specific post, so a Contributor can reuse it against arbitrary post IDs. The assessed CVSS is 4.3 (low severity); no public exploit identified at time of analysis, and exploitation is gated by the Contributor-or-above account requirement, with the highest practical impact on multi-author sites that hold unpublished content from Administrators or Editors.
Missing authorization in the Related Posts for WordPress plugin (barrykooij) through version 3.0.0 lets any authenticated Contributor-level user enumerate the titles and publication dates of every private post site-wide by supplying the 'rp4wp_view' parameter to the plugin's admin link screen. The only gate on that screen verifies edit_posts and edit_post against a parent post the attacker already owns - capabilities every Contributor holds - so nothing prevents the private-post query from returning other authors' data. Disclosure is confined to titles and publication dates rather than post bodies or credentials, exploitation requires a valid low-privilege account, and no public exploit code has been identified at time of analysis; the current priority is this_month rather than emergency action.
Missing authorization in the Clean Login plugin for WordPress through version 1.20.1 allows any authenticated user with Contributor-level access or higher to hijack the plugin's front-end page mapping: the save_post-hooked CleanLogin_Shortcode::get_pages_with_shortcodes() routine runs without a current_user_can() check, so a Contributor who embeds the plugin's shortcodes in a post they authored can have the plugin's cl_login_url, cl_register_url, cl_restore_url, cl_edit_url and cl_change_password_url options (plus their matching ID values) overwritten with the ID and permalink of that attacker-owned post. Impact is limited to integrity of those plugin settings - no confidentiality or availability effect and no code execution - and exploitation is impossible without a valid low-privilege account on a site running the plugin. There is no CISA KEV entry and no public exploit identified at time of analysis; the overall priority is medium-to-low, with the practical risk concentrated on sites that hand Contributor accounts to untrusted users.
The Royal MCP WordPress plugin before 1.5.10 exposes non-public content because one of its search tools performs no object-level or post-type authorization checks, so a low-privileged authenticated user such as a subscriber can retrieve the titles and content of private or otherwise unpublished entries; where the companion Royal MCP plugin is installed and stores personal data, that data is disclosable too. The flaw requires a valid WordPress account of any role (PR:L in the assessed vector) and is read-only - no modification, privilege escalation or denial of service - so severity is bounded at 4.3 with EPSS at 0.15% (percentile 4) and no CISA KEV listing; no public exploit identified at time of analysis. It matters most on sites that allow open or self-service registration, where a subscriber account is trivial to obtain, and is scheduled for routine monthly remediation rather than emergency action.
Path traversal in the LangGraph Python SDK (langgraph-sdk 0.4.0 through 0.4.5, and langgraph 1.2.3 through 1.2.13 via RemoteGraph v3 streaming) lets an attacker who controls a streaming thread_id or assistant_id value redirect the SDK's authenticated GET requests to a different readable path on the same configured LangGraph server, with thread_id also able to inject query parameters such as /store/items?namespace=...&key=... . Exploitation requires the application to pass attacker-controlled text directly as those identifiers; requests are GET-only, so the impact is limited to disclosure of another readable path's response (CVSS 4.3, PR:L - authenticated), and the hosted LangGraph Platform is not exposed. The vendor has released fixed versions langgraph-sdk 0.4.6 and langgraph 1.2.14, and no public exploit code was identified at time of analysis.
PostgreSQL Anonymizer before 3.3.0 can leave statistics derived from original, pre-masking data visible in pg_stats after static masking has been applied, until an ANALYZE operation or autovacuum refreshes the table statistics. An authenticated PostgreSQL user with access to pg_stats for the affected relation could read common values, histograms, or range bounds that reveal information about the original data; the exposure is limited to metadata rather than row contents and is time-bounded because routine statistics maintenance clears it. No public exploit identified at time of analysis, and the issue is rated CVSS 4.3 with a fix in 3.3.0.
PostgreSQL Anonymizer before 3.3.0 can disclose entire column values through the anon.partial() and anon.partial_email() masking functions when the underlying data is short enough that partial masking leaves it effectively unredacted. An authenticated database user with query access to an affected masked column can obtain more of the original value than intended, producing a low confidentiality impact (CVSS 4.3, PR:L). The vendor issue states the weakness is fixed in 3.3.0 and later; no active exploitation or public exploit is identified in the supplied intelligence, and the decision label is this_month.
Juniper Networks Session Smart Router can be induced to perform an out-of-bounds read (CWE-125) in its VRRPv3 handling by a crafted VRRP advertisement sent from the same Layer 2 segment, allowing an L2-adjacent attacker to expose stale memory contents or fault the routing process. Affected deployments are those where VRRP is configured and actively running on the targeted interface; the attack requires adjacency on the local broadcast domain but no authentication and no user interaction (CVSS:3.1/AV:A/AC:L/PR:N/UI:N). The confidentiality and availability impact is limited and the trigger specifics are not described in the available sources; no public exploit has been identified at time of analysis, and the vendor advisory JSA112183 is the authoritative reference.
An authenticated user of Xibo CMS can push arbitrary scheduling criteria to any display group through the POST /displaygroup/criteria/{displayGroupId} endpoint, which performs no ownership or permission check on the target group, so the update is relayed over XMR to player devices that should belong to someone else. The result is altered playback - for example weather-dependent content being shown when the condition it depends on is false - but only on installations where the optional Schedule Criteria feature is actually in use, and impact is limited to the integrity of scheduling data (no disclosure, no code execution, no outage). Xibo CMS versions up to and including 4.4.2 are affected and the issue is fixed in 4.4.3; no public exploit code or active exploitation has been reported, and the vendor rates it low severity (CVSS 4.3, PR:L).