RuoYi-Vue-Plus through 6.0.0 mishandles data-scope enforcement in SysUserServiceImpl.selectUserListByDept, letting an authenticated user whose role is department-restricted read user records belonging to other departments by calling GET /system/user/list/dept/{deptId} with an arbitrary department id. Exposed fields are limited to user metadata such as username, nickname, account status, last login IP and time, and remarks - a read-only confidentiality impact scored 5.3 (Medium) under CVSS 4.0 and CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N by the independent assessment; exploitation requires a valid account holding the system:user:list permission. A public technical write-up describing the bypass is referenced, but working exploit code is not confirmed, the flaw is not in CISA KEV, and the vendor has published an upstream fix commit.
Cross-site data disclosure in Open Web Analytics before 1.14.1 lets an authenticated user holding the view_reports capability on one site read another site's clickstream visit history, transaction and order records, and Domstream session recordings on the same installation. The reports REST controller and the Domstream player keyed lookups on the caller-supplied session_id, transactionId/order_id or recording guid without also constraining the query to the siteId the capability was checked against, so a user authorized for site A can pair their own siteId with a victim site's record identifier and receive that site's IP addresses, user agents and order data. No public exploit has been identified at time of analysis and there is no KEV listing; exploitation requires a valid account, a multi-site deployment, and knowledge of a target record identifier, so single-site instances are not exposed.
Blossom through 1.17.1 fails to verify picture ownership on its picture delete, /picture/del/batch and /picture/star endpoints, so an authenticated user with non-readonly privileges can pass arbitrary picture ids belonging to other accounts and permanently delete their images and stored files or flip their star status. The flaw is a classic IDOR (CWE-639) rated 5.3 by the reporter and re-scored as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L in independent assessment: exploitation needs a valid non-readonly login plus a multi-user instance holding other users' pictures, and impact is bounded to integrity and availability of picture records - no data disclosure. There is no CISA KEV confirmation of active exploitation; a public technical writeup reference exists but is not verified as working exploit code, and the priority label places remediation within this month rather than as an emergency.
Privilege escalation in AxonHub through 1.0.0-beta11 lets an authenticated project user who holds the write_api_keys scope mint a service_account API key carrying system-level scopes such as read_channels, then call the /admin/graphql endpoint to read every channel's configuration, including base URLs and model lists. Exploitation requires an authenticated principal with that project-level scope (CVSS PR:L) and no user interaction; the assessed vector rates confidentiality impact as low with no integrity or availability effect, and broader exposure depends on which system-level scopes the attacker chooses to mint because the pre-patch code did not restrict them. A public technical writeup of the scope-grant flaw exists but is not verified as working exploit code, and the vendor has published an upstream fix (PR #2741 / commit e5c904ef); there is no CISA KEV entry and the issue is triaged as this_month rather than an emergency.
Cross-user information disclosure in Miaomiaowu before 0.9.3 allows any authenticated user to read other users' proxy-provider configurations by iterating the global auto-increment external_subscription_id value supplied to /api/user/proxy-provider-configs. Exposed fields include override scripts, filter rules, custom request headers and health-check URLs, so leaked headers may carry upstream credentials. The flaw requires a valid low-privileged account (PR:L) and only matters on multi-user deployments where accounts share an instance; a public write-up describing the enumeration approach exists, though it is not confirmed as working exploit code, and no CISA KEV entry or EPSS signal was supplied, keeping this at a moderate, prioritize-this-month severity rather than an emergency.
Authenticated members of a UNIT3D torrent tracker running version 9.2.0 or earlier can download the private playlists of other users by walking sequential playlist IDs at the /playlist-zips/{playlist} endpoint, receiving a zip of every torrent in the targeted collection. The controller action performs no ownership or privacy check, so any ordinary registered account can map private collection membership that the UI is meant to hide, with no user interaction and no integrity or availability impact. Exploitation requires a valid low-privileged account (PR:L); a public technical writeup of the issue exists, and while it is not verified as working exploit code, the attack itself needs only ID enumeration. No CISA KEV entry or confirmed in-the-wild activity was provided, and the vendor has published an upstream fix.
ArcadeDB versions 21.12.1 through 26.10.1 allow an authenticated user who holds only the readRecord privilege to overwrite the database's shared GraphQL schema through the read-only /api/v1/query/{database} endpoint, so later GraphQL queries issued by other users - including administrators - return the attacker-chosen result. The root cause is a missing authorization check (CWE-862): a GraphQL type definition carrying a crafted @sql directive was not treated as a schema change, even though the same user is correctly refused a CREATE DOCUMENT TYPE with 403 for lacking updateSchema. The vendor fixed this in 26.10.2; there is no CISA KEV listing or exploitation reporting, and because directive statements execute with the querying user's own privileges there is no data write and no privilege escalation - only manipulation of what other users see. A public proof-of-concept walkthrough is included in the vendor advisory; it is a documented reproduction, not verified working exploit code.
Unauthenticated file upload in ARKETEAM Protectel modules PROTECTELMAJ (before 6.5.19) and BDF (before 6.4.67) lets any user write arbitrary files into a temporary folder and overwrite existing ones. The security consequence does not fire on upload: embedded JavaScript is executed only when an authenticated user later downloads the attacker-overwritten file, so a second victim must retrieve it for impact to materialise; per the vendor CVSS 4.0 vector (AV:A/PR:N) the upload path sits on an adjacent network segment rather than the open internet. Severity is medium (vendor CVSS 4.0 base 5.3; independently assessed as CVSS 3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), no KEV entry and no public exploit identified at time of analysis, and the vuln.today decision label is 'this_month', making this a scheduled-patch item.
Cross-tenant information disclosure in Plausible Analytics through 3.2.1 allows an authenticated site editor to reassign a traffic-change notification to another site by supplying that site's primary key as site_id, causing the attacker to receive the victim site's traffic alerts and visitor figures. The flaw is a CWE-915 mass-assignment issue in the update_traffic_change_notification handler; exploitation requires an editor-level account on an instance that hosts multiple sites and knowledge or enumeration of the target site_id. The supplied intelligence rates it moderate (CVSS 5.3, 'this_month' priority) with no KEV entry or EPSS score provided, and the referenced research write-up is not confirmed as working exploit code.
Enrolled students on Moodle can call the core_grades_get_gradeitems web service and receive the IDs, names, and categories of grade items that the gradebook hides from them, because the external function performs no capability check before returning the data. Confirmed affected ranges are 4.2.0 through 4.5.15, 5.0.0 through 5.0.11, 5.1.0 through 5.1.8, 5.2.0 through 5.2.4, and 5.3.0, and exploitation requires only a valid account with enrolment in a course that actually contains hidden grade items. Disclosure is limited to hidden item metadata - grade values are not exposed - and there is no CISA KEV listing and no confirmed public exploit code at time of analysis, only a third-party research write-up and the upstream source location; the issue is scored 5.3 and assessed as a moderate-severity information-disclosure problem rather than an emergency.
Non-editing teachers on affected Moodle sites can read grade feedback and identity data (names, email addresses) belonging to groups they are not enrolled in, because the core_grades_get_feedback external web service omits group-membership and enrolment checks and accepts an attacker-supplied userid. Affected branches are Moodle 4.2.0 through 4.5.15, 5.0.0 through 5.0.11, 5.1.0 through 5.1.8, 5.2.0 through 5.2.4 and 5.3.0; the only prerequisite is an authenticated account with at least the non-editing teacher role (CVSS 4.0 vector PR:L) plus reachability of the web service, after which exploitation is a matter of iterating the userid parameter. Confidentiality impact is limited (CVSS 4.0 base 5.3; assessed CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) with no write, code-execution or availability effect; a public research writeup by Abraxas Labs describes the issue, but that reference is not verified as working exploit code and there is no KEV or confirmed in-the-wild exploitation.
Forgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1 lets an authenticated user with a read:user-scoped API token or an active session retrieve other users' SSH, deploy, and principal key titles, fingerprints, and public key material through the GetPublicKey API. The handler omits an ownership check, so sequential numeric key IDs can be enumerated; this is an authenticated IDOR (CWE-639) rated CVSS 5.3 with confidentiality-only impact and no integrity or availability effect. A public research write-up is referenced, but working exploit code is not confirmed in the provided data, and exploitation requires a valid low-privilege account.
Captive portal session takeover in OPNsense core allows an unauthenticated attacker sharing a Layer-2 segment with portal clients to inherit an already authorized victim session by forging gratuitous ARP replies that claim the attacker's own IP address belongs to the victim's MAC. The flaw only matters where captive portal roaming is enabled on the zone and a legitimate authorized session already exists; the demonstrated outcome is unauthorized reuse of that existing session, with traffic and quota attributed to the victim, rather than creation of a session from nothing. Severity is moderate (CVSS 5.3; assessed CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N), there is no CISA KEV listing, but a public vendor advisory and an independent technical write-up with reproduction steps are available, and fixes are published in OPNsense 26.7.3 and 26.4.2p1.
Bitwarden Server deployments running the Entity Framework backend on versions before 2026.10.1 let an authenticated organization member insert vault items into collections that member has no edit rights to, with the injected cipher then syncing to every member of the target collection. The bypass is reached through a single call to POST /api/ciphers/create with a nulled UserId, which the collection-assignment path treats as administrative, and no user interaction is required. Exploitation requires a confirmed organization membership on a self-hosted MySQL/PostgreSQL/SQLite deployment; the impact is confined to data integrity (writing items), not disclosure or deletion. No public exploit code has been confirmed in the available sources, the flaw is not listed in CISA KEV, and vendor patches are available.
ProFTPD before 1.3.9e and 1.3.10rc1 through 1.3.10rc4 contain an authorization bypass in the mod_sftp copy-file extension handler that omits <Limit WRITE> enforcement for new destination files. Authenticated SFTP users (CVSS PR:L) can copy any file they can read into a write-denied directory, creating files where uploads are forbidden; existing files are not overwritten and no code execution is provided. Vendor-released patches are available in 1.3.9e and 1.3.10rc5, and no public exploit code was identified at time of analysis.
Delta UFC500 devices can be brute-forced through their HTTP basic authentication endpoint because the service enforces no retry limit or backoff and ships with a default service password, allowing an attacker positioned on an adjacent network segment to exhaust the keyspace and obtain low-sensitivity information. The CVSS 4.0 base score is 5.3 (medium), and the assessed CVSS 3.1 vector is AV:A/AC:L/PR:N/UI:N with only low confidentiality impact, so integrity and availability are unaffected and an on-segment network position is required. No public exploit code or confirmed active exploitation was identified in the available intelligence, and the priority label is this_month.
Delinea Secret Server before 12.3.1 can accept a FIDO2 authenticator's possession factor without reliably enforcing the PIN or biometric user-verification step, weakening the assurance expected from that second factor for authenticated users. The issue is a moderate-severity CWE-284 improper access-control weakness affecting deployments that use FIDO2 authentication; the assessed vector includes PR:H, so exploitation presupposes a privileged or authenticated context, or access to a registered FIDO2 device, rather than a fully unauthenticated remote bypass. No public exploit was identified at time of analysis, and no CISA KEV confirmation is present.
Address bar spoofing in Maxthon Browser for Android before 7.5.8.103 lets a malicious page render a counterfeit address bar showing a trusted domain while displaying attacker-controlled content, once the victim taps to enter fullscreen. The missing persistent fullscreen notification or trusted-origin indicator turns the browser chrome itself into a phishing surface, so impact is limited to integrity of what the user perceives rather than any direct confidentiality or availability loss. Exploitation depends on the victim visiting the attacker's page and completing a single tap, so it is a social-engineering enabler rather than automated compromise; no public exploit identified at time of analysis, and the vuln.today decision label places remediation in the this_month bucket.
Stored cross-site scripting in phpMyAdmin through 5.2.3 lets a database user holding the CREATE privilege embed HTML markup in a table name, which DesignerHistory.display() then renders without escaping. The script fires in another user's browser session only when that victim opens the malicious table in Designer query mode and adds a condition on it, so exploitation requires an authenticated attacker (PR:L) plus victim interaction (UI:P). Impact is confined to script execution in the victim's phpMyAdmin session with cross-boundary scope (S:C, C:L/I:L); no public exploit status or CISA KEV listing is recorded for this CVE, and the assigned priority is 'this_month' - moderate urgency rather than emergency.
Stored cross-site scripting in Frappe LMS versions up to and including 2.51.0 lets an authenticated user who holds a course-editing role plant malicious JavaScript in the Course Management meta tag fields, which is then stored and rendered unescaped into the course page (including the meta name/property tags for title, image, description and keywords, the og:/twitter: equivalents, the course title and description headings, and the 'Know More' link). The script executes in the browser of any second user who opens the affected course page, which is why victim interaction is required. Severity is rated Medium - CVSS 4.0 base 5.1 (AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N), with the independent assessment scoring CVSS 3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N; exploitation needs an authenticated editor account plus a victim visiting the page, no public exploit code was identified at time of analysis, and the issue is fixed in 2.52.0.
Login cross-site request forgery in FOSSBilling before 0.8.9 lets a remote, low-privileged attacker silently authenticate a victim's browser into the attacker's own staff account by luring the victim to an auto-submitting HTML form that posts to the guest staff login endpoint (/api/guest/staff/login). The flaw exists because checkGuestClientAuthentication() only allowlisted client_login and client_create, so staff_login was processed without a CSRF token or Origin validation; the attacker must hold valid staff credentials on the target instance and the victim must load the attacker's page, which is why impact is limited to integrity of the victim's session rather than data disclosure. Affected deployments are FOSSBilling 0.1.0 through 0.8.8; the 0.8.9 release requires POST requests carrying a pre-login session token from a same-origin context. No public exploit code has been identified at time of analysis, EPSS and CISA KEV signals are absent, and the assessed risk is moderate rather than an emergency.
Stored cross-site scripting in the note editor of ARKETEAM Protectel PROTECTELMAJ (before 6.5.19) and BDF (before 6.4.67) lets an attacker with note access inject arbitrary HTML and JavaScript that runs when another user opens the note. The issue is medium severity (CVSS 4.0 base 5.1, CWE-79), a vendor patch is available, and there are no amplifying exploitation signals: it is not in CISA KEV, EPSS is not provided, and no public exploit identified at time of analysis. The privilege requirement is ambiguous because the description refers to a low-privileged attacker while the supplied CVSS vector contains PR:N, so authentication requirements are not confirmed from available data.
Improper authorization in the ARKETEAM Protectel modules PROTECTELMAJ (before v6.5.19) and BDF (before v6.4.67) lets a low-privileged authenticated user forge a direct request to a specific administrator-only endpoint and reach functionality that should be reserved for admins. Exploitation requires an existing low-privileged account plus adjacent-network reachability to the Protectel service, and impact is partial (confidentiality, integrity and availability all rated low); no public exploit was identified at time of analysis and the issue is not flagged as actively exploited. The flaw was reported by CERT-PL and is rated CVSS 5.1 (CVSS 4.0: AV:A/AC:L/PR:L/UI:N), with vendor-released fixes available as PROTECTELMAJ v6.5.19 and BDF v6.4.67.
Jellyfin through 12.4 exposes hidden library item identifiers to authenticated low-privilege users through PlaylistsController.GetPlaylist when a public or shared playlist contains items the caller cannot access; the response returns unfiltered ItemId GUIDs, and the CVE description states those IDs can then be used to stream the hidden media. Exploitation requires a restricted or parental-controlled account plus an accessible public/shared playlist containing restricted content, and the assessed impact is low confidentiality only with no integrity or availability effect. A public PoC reference exists per the GHSA/research write-up (not verified here as working exploit code); no CISA KEV active-exploitation flag is present, and the priority label is this_month.
Arbitrary file deletion in the SureDash WordPress plugin through version 1.12.3 allows an authenticated low-privilege user, such as a Subscriber, to delete files on the hosting server via a path traversal flaw (CWE-22). The impact is limited to integrity and availability (CVSS 5.0; assessed vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L), with the main barrier being the need for a valid account, a barrier that open subscriber registration can effectively remove. No CISA KEV entry and no public exploit were identified at time of analysis; this is a moderate, this-month priority rather than an emergency.
SecureDrop Server 2.5.0 through 2.15.x allows an attacker who already holds the secret Journalist Interface onion address, journalist authentication, and a live API session token to replay that API token against the web UI until its natural expiry of at most eight hours. The root cause is a mutable session-key prefix in the Flask SessionInterface that persists across requests, corrupting the Redis namespace separation introduced in 2.5.0; the same corruption can stop logout from deleting the correct Redis session, though normal expiry still applies. Impact is bounded to encrypted submissions and journalist-side actions on source submissions - no plaintext disclosure and no availability effect - and no public exploit has been identified at time of analysis.
Arbitrary file deletion in the JS Help Desk WordPress plugin through 5.0.1 allows authenticated administrator-level users to remove arbitrary server files through a two-step path-traversal sequence in the setSupportCustomImage() code path. The attacker first saves a traversal-crafted value in the support_custom_img configuration field and then triggers deletion by uploading a new support custom image; deleting a critical file such as wp-config.php can lead to remote code execution. The independent assessment places this as a moderate, non-urgent priority, with no CISA KEV entry and no public exploit identified at time of analysis.
Authentication bypass in the Drupal contributed module Authenticator Login Plus (2FA), affecting versions 0.0.0 through 1.0.1, lets remote unauthenticated attackers defeat the module's second-factor enforcement by reaching an alternate path or channel (CWE-288). Only Drupal sites that have this specific contributed module installed and enabled at a vulnerable version are exposed; the second factor must actually be relied upon for the bypass to have meaningful impact. Impact is partial (confidentiality and integrity low, availability none) and the CVSS vector rates attack complexity High, so a condition outside the attacker's control must hold for a successful bypass; EPSS is low at 0.19% (9th percentile) and no public exploit has been identified at time of analysis, though the vendor's 'this_month' priority means it should be scheduled rather than deferred indefinitely.
Emissary's navigation-link filter in NavAction.java can be bypassed, so a crafted nav entry can still drive users to an attacker-controlled host (open redirect) or make the Emissary server request internal resources such as the cloud instance metadata endpoint (SSRF). The problem is an incomplete fix: the added pattern `^(https?:/)?/.*` accepts protocol-relative strings like `//evil.com/...`, `//169.254.169.254/latest/meta-data/`, and single-slash scheme forms such as `http:/evil.com`, while blocking `javascript:`, `ftp:` and `data:` URIs. Scored CVSS 4.8 (Medium) with a vector requiring high privileges (PR:H) and victim interaction (UI:R), the issue is not in CISA KEV and no confirmed working exploit is known, although the advisory publishes a PoC script demonstrating the regex bypass; package metadata lists the fixed release as 8.51.0.
Reflected cross-site scripting in the WordPress plugin WP User Frontend affects every release before 4.3.14: an unescaped, user-supplied value is reflected into an HTML attribute inside a publicly reachable AJAX response, so a crafted link can execute script in the browser of a logged-out visitor who follows it. Because the vulnerable AJAX action is gated by a nonce that only validates for logged-out requests, the practical target set is anonymous site visitors - authenticated users, including administrators, are not the intended victims and the flaw cannot be leveraged that way to reach admin-context execution. Severity is moderate (CVSS 4.7, AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N) and EPSS is low at 0.16% (5th percentile); no public exploit was identified at time of analysis and there is no KEV listing, so this is a genuine but moderate-priority issue rather than a top-tier emergency. The vendor fix is version 4.3.14.
Stored cross-site scripting in the Like Button Rating ♥ LikeBtn plugin for WordPress (all versions up to and including 2.6.64) lets unauthenticated remote attackers place arbitrary script in the Client-IP header value, which the plugin stores without sanitization and renders without escaping in its admin-side votes/IP view; the payload runs when an administrator later opens that page. Two stacked prerequisites sharply limit real-world exposure: the site owner must have turned off the plugin's default 'Be GDPR compliant' setting (while enabled, stored IPs are hashed and the payload is neutralized), and the attacker cannot trigger execution themselves because it depends on an administrator visiting the injected page. No public exploit has been identified at time of analysis, and the issue is assessed as this-month priority rather than urgent; the vendor changeset shows a fix in version 2.6.65.
Reflected HTML injection in Collabora Online's cool.html editor page allows an unauthenticated remote attacker to inject markup through the host_session_id query/form parameter, which was substituted without HTML encoding; exploitation requires inducing a victim to load a crafted URL. Script execution and theft of the session authentication token and page contents occur only when an effective Content Security Policy is absent, and coolwsd sends a CSP header by default, so realistic script-execution exploitation requires a reverse proxy that strips or fails to preserve that header. The issue affects coolwsd before 24.04.18 and before 25.04.11 and is fixed in those releases; no CISA KEV entry or public exploit code was identified at time of analysis, and the vendor rates it medium severity (NVD CVSS 3.1 base 4.7).
Dell OpenManage Enterprise deployments running any version prior to 4.8.0 contain an improper resource-locking flaw (CWE-413) that lets an attacker who already holds high privileges on the local host bypass a protection mechanism, with the dominant impact being availability loss and a limited integrity effect. The vulnerability is not remotely reachable and cannot be triggered by an unprivileged user: the CVSS vector requires local access, high privileges, and high attack complexity, which is why it scores only 4.7 despite the availability impact. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; the trigger condition involving the mishandled lock is not described in the available sources, and Dell has published a fixed release in version 4.8.0.
Incorrect authorization in Microsoft Edge (Chromium-based) lets a local user who already holds low-level privileges elevate their effective permissions on the host, affecting limited confidentiality and integrity with no availability impact. Microsoft rates the issue CVSS 4.4 (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) and classifies it as a local privilege escalation via CWE-863 authorization bypass. No public exploit code or active exploitation is confirmed, the exploit maturity is marked Unproven, and a vendor patch is available through the Microsoft Security Update Guide; this is a low-to-moderate priority issue, not an emergency.
WordPress Security Plugin before 2.191 allows a non-Super-Admin administrator, including a multisite subsite administrator, to use the File System Watcher file viewer to read tracked sensitive files such as wp-config.php, disclosing authentication keys, salts and, on a standard install, database credentials. The flaw crosses the privilege boundary between subsite administrators and Super Admins and requires authenticated administrator access (PR:H); impact is confidentiality-only. This is a modest-priority issue (Decision: this_month), with EPSS 0.17% (6th percentile), SSVC exploitation none, and no public exploit identified at time of analysis; upgrading to 2.191 remediates it.
Immich before 3.0.0 leaks the GPS coordinates and asset identifiers of a sharer's archived photos and videos to view-only partner accounts through GET /api/map/markers. A partner who supplies both withPartners=true and isArchived=true causes the map repository to admit Archive-visibility rows for every selected owner, bypassing the non-archived-only boundary that the timeline endpoint and checkPartnerAccess both enforce. Impact is limited to location metadata and asset IDs (image bytes stay protected), and exploitation requires an already-accepted partner relationship; a proof-of-concept (poc.zip) accompanying the advisory was verified against v2.7.5, and the flaw is fixed in v3.0.0.
Authorization bypass in the Content Egg affiliate importer plugin for WordPress (all versions up to and including 12.0.0) lets an authenticated user with author-level access or above create posts that WordPress records as authored by a different account - typically an administrator - by supplying a preset_id owned by that administrator to the plugin's import routine. When the attacker also holds publish_posts capability for the preset's post type, the resulting administrator-attributed content can be published rather than left as a draft, damaging authorship integrity on the site. The flaw is remote and low-complexity but requires a valid low-privileged account (CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, 4.3); there is no confidentiality or availability impact, no public exploit code or PoC reference was identified at time of analysis, and it is not in CISA KEV. Our assessment rates it a genuine but modest-severity issue best handled as a routine-priority fix.
Forceful browsing in the Drupal contributed module Two Factor Authentication - TFA / Passwordless Login lets an authenticated, low-privileged user reach module resources directly and receive sensitive information that should have been protected by access checks (CWE-201). Rated CVSS 4.3 with confidentiality-only impact, it affects releases before 5.4.1 and 5.5.0 through 5.5.1 on Drupal sites that have the module installed. No public exploit identified at time of analysis, there is no CISA KEV entry, and EPSS is 0.21% (12th percentile); vendor patches are available in 5.4.1 and 5.5.2.
LORIS deployments running the Issue Tracker module expose a missing-authorization flaw in which the backend edit endpoint does not enforce the same edit scope the frontend applies, so an authenticated user can post changes to issue records that lie outside their permitted scope. Affected versions are 16.0.0 through 28.0.1 (fixed in 27.0.4 and 28.0.2), with the flaw reachable by any authenticated account holding some Issue Tracker access (CVSS PR:L). Impact is limited to unauthorized modification of issue data - no confidentiality or availability effect - and no public exploit code was identified at time of analysis. This is a moderate, low-priority access-control weakness (CWE-862, Missing Authorization) rather than a critical threat.
Missing per-post authorization in the Content Egg affiliate product importer plugin for WordPress (versions up to and including 12.0.0) allows an authenticated user with contributor-level access or above to overwrite Content Egg product data and update-timestamp post meta on arbitrary posts, including posts owned by administrators. The ajaxUpdateProducts() handler validates a static 'contentegg_metabox' nonce and the generic edit_posts capability, then trusts the attacker-supplied post_id without ever calling current_user_can('edit_post', $post_id). Impact is limited to integrity (I:L) with no confirmed confidentiality or availability effect, and exploitation is restricted by the authentication prerequisite; no public exploit code was identified at time of analysis and the issue is not known to be actively exploited.
Memory corruption in Google Chrome's CacheStorage subsystem, affecting versions prior to 156.0.8078.79, allows a remote attacker who convinces a victim to render a crafted HTML page to read memory contents; the issue is rated moderate (CVSS 4.3) because exploitation requires user interaction and the confirmed impact is limited to confidentiality. No public exploit has been identified at time of analysis, EPSS is 0.20% (9th percentile), and CISA SSVC records no known exploitation with partial technical impact. Authentication is not required per the CVSS vector (PR:N), but the crafted page must be visited and rendered (UI:R), and no code execution or availability impact is confirmed from this issue alone.
An out-of-bounds read in the FileSystem implementation of Google Chrome versions prior to 156.0.8078.79 lets a remote attacker who convinces a user to open a crafted HTML page read memory that is confined to the renderer sandbox. The exposure is limited to confidentiality inside the sandboxed process; there is no integrity or availability impact and no path to code execution or sandbox escape on its own. EPSS is 0.16% (5th percentile), no public exploit code or active exploitation is confirmed, and CISA SSVC marks exploitation as none with the flaw not assessed as automatable, consistent with a low-priority this_month remediation cadence.
Unbounded resource allocation in the Drupal contrib module Examples for Developers (versions 0.0.0 through 4.0.7) allows a low-privileged authenticated user to cause excessive allocation and degrade service availability, with the CVSS 4.3 vector reflecting availability-only impact. The module is an optional developer-demonstration package that must be installed and enabled, which sharply limits exposure on production sites, and the available intelligence shows no active exploitation and no public exploit identified at time of analysis (EPSS 0.15%, SSVC exploitation none). A vendor patch is available.
SmartLinker AI, a contributed Drupal module, ships an incorrect authorization check (CWE-863) that permits forceful browsing: an authenticated user can directly request resources they should not be allowed to reach, resulting in limited information disclosure. Versions 0.0.0 through 1.0.3 are affected, and only sites with the module installed and enabled are exposed; the CVSS score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) confirms credentials are required and that integrity and availability impacts are absent. No public exploit code has been identified at time of analysis, EPSS is 0.14% (4th percentile), and CISA SSVC records exploitation as none with automation as not possible, so this is a low-priority item to schedule for a normal maintenance window rather than an emergency.
Server-side request forgery in the Drupal Freelinking contrib module allows an authenticated user with permission to create or edit content - and only when the Freelinking filter is enabled on an active text format - to make the Drupal site issue attacker-influenced outbound requests, with partial confidentiality impact and no integrity or availability effect. All releases from 0.0.0 through 4.0.3 are in scope, and the vendor has published a security advisory with a fix. Risk signals are consistently low: EPSS 0.14% (4th percentile), SSVC exploitation none and automatable no, and no public exploit identified at time of analysis, so this fits a this_month remediation cadence rather than emergency response.
Missing authorization in the Unlimited Elements For Elementor (Free Widgets, Addons, Templates) WordPress plugin affects every release through 2.0.26, letting a logged-in low-privilege user reach data that the plugin's access control is supposed to keep from them. The flaw is CWE-862 broken access control rated CVSS 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), so impact is limited to confidentiality and requires an authenticated account - the CVSS vector's PR:L means a subscriber-level user on a site with open registration is enough, and anonymous visitors cannot trigger it. As of this analysis there is no CISA KEV listing and no public exploit identified at time of analysis; Patchstack is credited with the disclosure and the vendor advisory does not name a fixed version.
Missing authorization in StellarWP BookIt through version 2.6.0.6 allows an authenticated low-privilege user, such as a self-registered subscriber, to invoke plugin functionality without the required capability check, producing limited integrity impact (CVSS 4.3). It affects WordPress sites running BookIt up to and including 2.6.0.6, requires a valid low-privilege account, and has no confidentiality or availability impact; no CISA KEV entry or public exploit was identified at time of analysis. A fixed version is not explicitly stated in the available sources, so the patched release should be confirmed with Patchstack/StellarWP.
Booktics WordPress plugin through 1.0.31 contains a missing-authorization condition that allows authenticated low-privilege users to read data they should not be able to access. The issue is rated CVSS 4.3 with PR:L and only confidentiality impact, and no public exploit was identified at time of analysis. This is a moderate-severity, low-priority issue rather than an emergency, with exposure concentrated on sites that permit subscriber or customer accounts.
Event Tickets, the WordPress ticketing and event registration plugin maintained by Liquid Web / StellarWP, lacks an authorization check in at least one of its features through version 5.30.2, letting a logged-in low-privilege user perform an action that should require higher permissions and thereby alter site data (integrity impact only). The flaw is remote and low in complexity but requires a valid account, so sites that permit open self-registration or that host many subscriber-level users carry the most exposure; confidentiality and availability are unaffected. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, which keeps this a moderate, this-month priority rather than an emergency.
Authorization bypass in the OpenStation WordPress plugin (slug desktop-mode) through version 1.1.16 lets any authenticated user at subscriber level or above modify other users' placement rows - position, sort order, parent folder and meta - and read serialized metadata such as title, permalink and post status for the entities those placements reference. The attacker must first self-enable OpenStation via the save-openstation AJAX endpoint, which requires only the 'read' capability that every default WordPress role holds, and the chain additionally depends on at least one orphaned placement existing, a state the plugin's own trash cascade produces when it marks a parent folder trashed while leaving child placements' parent_id intact. Rated medium (CVSS 3.1: 4.3, AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) with low confidentiality and integrity impact; no public exploit identified at time of analysis, and the priority signal places it in this_month rather than emergency handling.