Missing authorization in the WordPress plugin Event Tickets (Liquid Web / StellarWP) through version 5.30.2 allows an authenticated low-privilege user to reach functionality that should sit behind a higher access-control level, resulting in limited information disclosure (CVSS 4.3, confidentiality-only, no integrity or availability impact). The attacker must already hold a valid account on a site running the affected plugin, and no user interaction is required. Neither CISA KEV listing nor public exploit code was identified at time of analysis, so the practical risk is a real but low-urgency access-control gap rather than an emergency; the Patchstack report is the only public reference supplied and it does not state a fixed version.
Read-only session enforcement bypass in Collabora Online before 24.04.18 and 25.04.11 lets an authenticated viewer-role WOPI user send crafted WebSocket messages that execute document-mutating UNO commands and dialog operations inside the live per-document kit process, despite holding a read-only session. The attacker cannot save the document and the changes are discarded when the kit session ends, so real-world impact is limited to misleading co-viewers in the same live session or having an authorized editor unknowingly persist the edits - matching the 4.3 CVSS (integrity low, no confidentiality or availability impact). No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (not in CISA KEV); the vendor has released fixed versions 24.04.18 and 25.04.11.
Qt3D's assimp scene import plugin contains an out-of-bounds write (CWE-787) that corrupts memory when a crafted 3D scene/model file is imported, giving Integrity and Availability impact while leaving Confidentiality unaffected. The attack is local (AV:L), low complexity, requires no privileges, and depends on the victim actively opening a malicious asset (UI:A), so exposure is limited to applications that build and invoke the Qt3D assimp import path. A vendor patch is available via the Qt3D Gerrit change referenced in the Qt advisory; no public exploit code or CISA KEV entry is associated with this CVE at time of analysis, and the issue is rated moderate and non-urgent with a this_month remediation priority.
Stack exhaustion in the Ickle query parser shipped in Infinispan and its Red Hat product builds lets an authenticated user who holds the BULK_READ permission submit a cache query with deeply nested predicates, driving recursive parsing until the Java thread stack is exhausted and an uncaught StackOverflowError is thrown. Impact is limited to availability (CVSS 4.3, A:L) - there is no data exposure or modification - and the attacker must already possess a valid account plus the specific BULK_READ grant. A public PoC reference exists in the form of the Red Hat Bugzilla record; no public exploit code has been confirmed and no EPSS score was supplied, and the vuln.today decision label places this in the this_month queue rather than an emergency response.
Dell OpenManage Enterprise versions before 4.8.0 leave credentials insufficiently protected, enabling a remote attacker who already holds a low-privileged console account to obtain limited confidential information. The issue is network-reachable, requires authentication (PR:L), needs no user interaction, and has no integrity or availability impact. Dell has released an update, the priority is this_month, and no public exploit was identified in the provided intelligence at time of analysis.
NULL pointer dereference in the Qt Core QCborValue-to-JSON conversion crashes applications that route attacker-influenced CBOR input through that specific conversion path, giving a local attacker who can supply crafted data a denial-of-service effect (application termination, no confidentiality or integrity impact). It is rated CVSS 4.0 4.3 locally and an assessed CVSS 3.1 5.5 locally, reflecting that the victim must process the crafted CBOR via a vulnerable Qt application rather than the attacker triggering it directly. The vulnerability is not listed as confirmed actively exploited (CISA KEV) and no public exploit was identified at time of analysis; the vendor has published a fix in the qtbase code review.
Authenticated users who already hold resource-management permissions can update UMA resources they do not own in Keycloak's authorization services when remote resource management is enabled, letting them alter other users' resource names, URIs and scopes. The flaw is an IDOR-style authorization bypass (CWE-639) rated CVSS 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), so integrity impact is limited and no confidentiality or availability impact is assessed. There is no public exploit identified at time of analysis, no confirmed active exploitation (CISA KEV), and the issue is only reachable when the non-default remote resource management feature is turned on and the attacker is an authenticated user with the relevant permissions.
Two-factor authentication bypass in the Drupal contrib module Authenticator Login Plus (2FA) affects sites running versions 0.0.0 through 1.0.1 where the module is enabled and 2FA is relied upon as a control. An authenticated attacker with low-level privileges-consistent with already holding valid first-factor credentials-can use an alternate path or channel to bypass the second factor over the network without user interaction, though high attack complexity means conditions outside the attacker's control must be met. Impact is limited to low confidentiality and integrity; no public exploit has been identified at time of analysis and EPSS is 0.19% (9th percentile).
Silent file overwrite and delete-and-replace in the croc receiver's working directory is possible when a remote sender names a transferred file with a 'croc-stdin-' prefix, bypassing the interactive overwrite confirmation; croc versions before 11.5.2 are affected. An attacker who can get a victim to accept a transfer (user interaction required) can truncate, overwrite, or delete-and-substitute an existing file of that exact name, or plant an in-directory symlink, with no 'Overwrite?' prompt, because the receive loop treats the prefix as proof of an internal text artifact instead of checking whether the transfer is actually a text transfer. Impact is bounded: only pre-existing names inside the 'croc-stdin-' namespace that the sender can predict are reachable, there is no read primitive, symlink targets stay confined to the receive directory, and dotfiles cannot be named this way; the assessed severity is low (CVSS 4.2, AC:H/UI:R, I:L/A:L), no CISA KEV entry or confirmed public exploit tooling was identified, and the issue is rated 'this_month' priority rather than an emergency.
Administrators of WordPress sites running the WP Visitor Statistics (Real Time Traffic) plugin in versions before 8.8 can reach a parameter that the plugin passes into a SQL statement without sanitizing or escaping, allowing SQL injection by high-privilege users. The vulnerability is scored CVSS 4.1 with PR:H, so only authenticated administrators or equivalent high-privilege accounts can trigger it; an unauthenticated outsider cannot reach the injectable path. No public exploit code is identified at time of analysis, EPSS is 0.16% (5th percentile), SSVC reports Exploitation: none and Automatable: no, and the vendor has released a fix in version 8.8.
AdminNeo versions before 5.5.1 contain a patch bypass in the SQLite SQL-import handler that restores a remote code execution primitive originally described in CVE-2021-43008. An authenticated user with an active SQLite connection uploads a SQL file whose ATTACH statement is preceded by roughly 350,000 SQLite line comments (`--`), driving the `~^$space*+ATTACH\b~i` guard regex past PHP's pcre.backtrack_limit so that preg_match() returns false; the pre-5.5.1 code treats that false as a non-match, and the ATTACH query reaches Connection::get()->multiQuery(), letting the attacker write a .php file that executes when retrieved over HTTP. The assessed CVSS:3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, so the attacker must be authenticated; no CISA KEV listing, no EPSS score, and no confirmed public exploit code were present in the supplied data. Fixing it is a one-line change: AdminNeo 5.5.1 makes the check `preg_match(...) !== 0`, so a false return no longer passes the filter.
Apache Pinot 0.7.0 through 1.5.1 authorize only the table named in a query's FROM clause in the single-stage query engine, so an authenticated user who is authorized for at least one table can supply a different dimension table as the string-literal argument of the lookup() transform and read its columns - and, by passing primary key values directly, arbitrary rows of it - even where per-principal row-level security filters are configured on that table. The behavior only matters when broker access control is enabled, since without it there is no authorization check to escape, and the multi-stage query engine is explicitly not affected, which limits exposure to read-only dimension-table data rather than write access or non-dimension tables. The vendor rates the issue moderate; no CISA KEV entry, EPSS score, SSVC decision or public exploit code appears in the supplied data, and no public exploit was identified at time of analysis.