Local privilege escalation in the MediaTek audio front-end (afe) driver affects more than 40 MediaTek chipsets, including MT6739, MT6768, MT6893, MT8195 and MT6983. The defect is a use-after-free that can corrupt memory and, for an attacker who already holds System privilege and has local access to the afe interface, can lead to high confidentiality, integrity and availability impact without user interaction. The vendor fix is identified by patch ID ALPS11434319; no public exploit identified at time of analysis, and CISA SSVC records exploitation as none.
Local privilege escalation in MediaTek's adsp (audio DSP) driver arises from a use-after-free that a local process already holding Android System privilege can use to extend its control over the device. Affected are devices built on a broad set of MediaTek chipsets, including MT6991, MT6989, MT6897, MT8195, MT8188, MT8186, MT6878 and others enumerated by EUVD, tracked under MediaTek patch ID ALPS11431474 and issue MSV-9926. No user interaction is required and attack complexity is low, but the PR:H precondition is decisive: without pre-existing System-level access there is no exploitation path, so no public exploit code has been identified at time of analysis, CISA SSVC records exploitation as none with automatable set to no, and the vendor-bulletin fix is scheduled into this month's remediation window.
Local privilege escalation in MediaTek's adsp (audio DSP) component allows an attacker who already holds System privilege to trigger a use-after-free and corrupt memory, escalating to code execution at a higher privilege level on a specific set of MediaTek chipsets (including MT6991, MT6989, MT8196, MT8195, MT8188, MT6897 and others). MediaTek tracks the fix as patch ALPS11431474 / issue MSV-9927, published in its November 2026 product security bulletin; no user interaction is required, and no public exploit code or confirmed active exploitation has been identified at time of analysis. The high-privilege precondition caps severity at CVSS 6.7 and makes realistic abuse a post-foothold escalation link rather than an initial access vector.
Moderate-severity local privilege escalation in MediaTek's afe (audio front-end) component can be triggered by an attacker who already holds System privilege on an affected MediaTek chipset, using a use-after-free to crash the system or gain higher-privilege code execution. The flaw affects a broad set of MediaTek chipsets, including MT6768, MT6789, MT6893, MT8188, MT6991 and many others, and requires local access with no user interaction. No public exploit has been identified at time of analysis; SSVC records no known exploitation and no automatable path.
Local privilege escalation in MediaTek's 'afe' (audio front-end) component allows an attacker who already holds System privilege to trigger an out-of-bounds write via a missing bounds check, gaining higher-integrity code execution on the device. The flaw (CWE-787, CVSS 6.7) is not remotely reachable - the vector is AV:L with PR:H and UI:N - and affects a broad set of MediaTek chipsets used in Android devices, including MT6765, MT6789, MT6893, MT6983, MT8188 and MT8195, with a vendor patch identified as ALPS11431394. No public exploit has been identified at time of analysis and CISA SSVC records no known exploitation; the practical exposure is confined to devices where an attacker has already escalated to System level, making this a post-compromise escalation step rather than an entry point.
Permission control flaws in the Huawei HarmonyOS and EMUI autofill service module allow a local attacker - in practice a malicious or compromised app installed on the device - to reach autofill data that the app's permissions should not permit, resulting in disclosure of confidential information. Exploitation is local (AV:L) and requires the victim to perform an action such as invoking autofill (UI:R); it cannot be triggered remotely. The vendor scores this 6.6, and no public exploit code or confirmed active exploitation was identified at time of analysis; the exact app-permission precondition that enables the bypass is not described in the available sources.
Authenticated SQL injection in ZTE Elasticnet RNIA R18 NGI allows a logged-in attacker to read sensitive database information, with a CVSS 3.1 score of 6.5 reflecting high confidentiality impact but no integrity or availability impact. Exploitation requires valid credentials (PR:L), which aligns with the vendor's internal threat-level classification and limits exposure to users who can already authenticate to the application. There is no CISA KEV confirmation and no public exploit identified at time of analysis; the priority label is this_month.
Denial of service in the Huawei HarmonyOS DSoftBus distributed soft-bus module allows an attacker on the same adjacent network to degrade or exhaust availability of affected devices without authentication or user interaction. The CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 6.5) confines impact to availability, with no confidentiality or integrity effect, and the network-adjacency prerequisite is the primary factor limiting exposure - internet-scale exploitation is not possible. No public exploit code or CISA KEV entry was identified at time of analysis, and the vendor-reported issue is tracked at a this_month priority rather than an emergency.
Denial of service in the MediaTek ccci subsystem affects the enumerated chipsets (MT6880, MT6890, MT6813, MT6986, MT6982, MT6980D, MT2735 and MT2737, with MT6990 and MT6988 also listed by EUVD) when a user is induced to process crafted input; a missing bounds check allows an out-of-bounds write, but the assessed impact is availability only, with no confidentiality or integrity loss and no code execution per the vendor. The issue is medium severity (CVSS 6.5, AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H), requires user interaction, and is not reported as actively exploited; no public exploit identified at time of analysis, and SSVC records exploitation as none and automatable as no.
Elevation of privilege leading to arbitrary code execution in Dell Alienware Command Center (AWCC) versions prior to 6.14.54.0 arises because the software improperly verifies cryptographic signatures on the components it consumes (CWE-347). The attack path is strictly local: the CVSS vector CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H shows an attacker must already hold high privileges on the host and have local access, so this is not a remote or unauthenticated vector, and high attack complexity further narrows practical exposure. Successful abuse yields high confidentiality, integrity and availability impact through code execution at elevated privilege; no public exploit code or active exploitation was identified at time of analysis, and the moderate 6.4 base score together with the 'this_month' priority reflect a locally scoped, privilege-gated issue rather than an emergency.
Improper certificate validation (CWE-295) in Dell Alienware Command Center before 6.14.54.0 can lead to arbitrary code execution and denial of service, but only for an authenticated, high-privileged attacker (PR:H) with local access to the host. The CVSS 3.1 score is 6.4 (moderate), with high attack complexity (AC:H) reflecting conditions the attacker does not fully control; the specific trigger is not described in the available sources. No public exploit identified at time of analysis, and Dell advisory DSA-2026-429 identifies 6.14.54.0 as the fixed release.
Server-side request forgery in Chainlit's MCP client path lets an unauthenticated remote user slip past path-scoped allowed_urls grants by embedding '..;' segments in the user-supplied MCP URL posted to /mcp, because validate_mcp_url does not reject the semicolon character; on origins that strip semicolon path parameters the request lands on a path outside the operator's grant. Exposure is narrow and opt-in: MCP must be enabled (features.mcp.enabled = true, off by default since v2.7.0), user-provided servers must be enabled with a non-empty allowed_urls allowlist, and the target origin must discard ';' parameters, so reach is confined to paths on hosts the operator already allowlisted, and the SSRF is blind. No public exploit code was identified at time of analysis and no EPSS or KEV signal is present; the priority label is monitor, consistent with a low-to-moderate, conditional issue rather than an urgent one.
Route parameter confusion in Nuxt 4.6.0 through 4.6.1 (and the matching @nuxt/nitro-server releases) allows remote attackers to have the getRouterParam/getRouterParams helpers return a parameter value different from the one h3 actually matched, by sending a path segment containing an encoded question mark (%3F). Impact is conditional: only applications that read the same route param from two different sources - the Nuxt helper for an authorization decision and event.context.params or another h3 helper for resource selection - can be driven to check one resource and act on another, yielding limited confidentiality impact. Exploitation requires high attack complexity and a non-default dual-source coding pattern, no public exploit was identified at time of analysis, and the issue is fixed in nuxt@4.6.2.
A permission-control weakness in the HarmonyOS graphics module lets a locally present attacker read data that should be protected, with high confidentiality impact and no integrity or availability effect. Because the CVSS vector is local-only (AV:L) with no privileges or user interaction required (PR:N/UI:N), the realistic threat is a malicious or compromised app already installed on the device rather than a network-facing attacker. Exploitation status is unconfirmed: no public exploit code is known at time of analysis, CISA KEV does not list this CVE, and it is rated for attention this month rather than immediate action; the exact triggering interface and affected HarmonyOS versions are not described in the available sources.
An out-of-bounds write in MediaTek modem firmware lets a local actor crash or destabilize the modem on devices built on a long list of MediaTek chipsets, including MT6893, MT8768, MT6833, MT6990 and roughly 70 other parts. The defect is classified CWE-787 (incorrect bounds check leading to memory corruption) and is rated CVSS 6.2 with an availability-only impact (C:N/I:N/A:H); per the vector AV:L/PR:N/UI:N applies, so once local access to the device is obtained, no authentication or user interaction is required. Exploitation has not been observed (CISA SSVC exploitation: none, automatable: no) and no public exploit was identified at time of analysis; MediaTek has assigned patch ID MOLY01780439 in its November 2026 product security bulletin.
Out-of-bounds write in the GNSS (satellite positioning) component of MediaTek chipsets allows a local attacker with no additional execution privileges to crash or deny service on affected devices, with availability-only impact (CVSS 6.2, CWE-787). The issue affects chipsets MT6990, MT6890, MT6988, MT6880, MT6986, MT6982, MT6980D, MT2735 and MT2737 and is addressed by MediaTek Patch ID ALPS11309816 per the November 2026 Product Security Bulletin. No public exploit has been identified at time of analysis, and CISA SSVC records exploitation as none; the description states user interaction is needed, which limits unattended or remote abuse.
Reflected cross-site scripting in the CREST framework's HTTP binding shipped in wrensec-commons lets an unauthenticated remote attacker execute arbitrary JavaScript in a victim's browser by luring them to a crafted URL. The HttpUtils.prepareResponse() method copied the _mimeType request parameter straight into the Content-Type response header, so a GET request carrying _mimeType=text/html makes an otherwise inert CREST JSON response be parsed and rendered as HTML, with the injected markup executing under the originating site's origin (CVSS 3.1 base 6.1, scope changed). Only deployments of the json-resource-http module below 22.6.2 or in the 23.0.0-M1 through 23.0.0 range are affected, and exploitation hinges on user interaction - the victim must open the attacker-supplied link; no public exploit code was identified at time of analysis, and patch releases 22.6.2 and 23.0.0 are available.
Path traversal (CWE-22) in Dell OpenManage Enterprise versions prior to 4.8.0 allows an attacker who already holds high-privileged console access and sits on an adjacent network segment to escape the intended restricted directory and reach filesystem locations, driving integrity and availability impact (CVSS 3.1: 6.1, AV:A/AC:L/PR:H/UI:N/C:N/I:H/A:H). The two compounding prerequisites - pre-existing administrative privilege and a position on the same logical network segment, typically the server-management or out-of-band network - are what bound real-world exposure to insiders or an actor who has already compromised the management network, rather than to arbitrary internet attackers. No public exploit has been identified at time of analysis, and the issue is tracked as a scheduled, this-month patch priority rather than an emergency.
Cross-site scripting in Dell OpenManage Enterprise versions prior to 4.8.0 allows an unauthenticated remote attacker to inject script that executes in the browser session of an operator or administrator who loads attacker-supplied content in the web console, potentially tampering with information viewed or acted upon in that session. The attacker needs network reachability to the console but no credentials (PR:N), while successful execution depends on victim interaction (UI:R) and non-trivial trigger conditions (AC:H); the specific page, parameter or feature that reflects the unneutralized input is not described in the available sources. No public exploit has been identified at time of analysis and the issue is not in CISA KEV; our assessment rates it a moderate-priority item (this_month) with scope-changed but low confidentiality and integrity impact and no availability impact, and Dell's advisory names upgrading to 4.8.0 as the remediation.
Dell OpenManage Enterprise versions prior to 4.8.0 contain a path traversal flaw (CWE-22) that lets a high-privileged attacker on an adjacent network segment write to and delete files outside the intended restricted directory, producing a high integrity and availability impact on the appliance (CVSS 6.1, AV:A/AC:L/PR:H/UI:N/C:N/I:H/A:H). Exploitation requires an already-authenticated administrative-level OpenManage Enterprise account and L2-adjacent placement (same management VLAN or broadcast domain), which markedly limits realistic exposure; there is no public exploit identified at time of analysis and the issue is not in CISA KEV. The vendor has published advisory DSA-2026-467 covering the fix in version 4.8.0.
Warracker releases up to and including 1.0.3 mishandle authorization in their Paperless-ngx integration, letting any signed-in non-administrative user who owns at least one warranty link another user's private Paperless document to their own warranty and then download it, because the presence of a document ID on a warranty is treated as proof of ownership. Exploitation requires the optional Paperless-ngx integration to be enabled with a shared API token that can read the target document, and affects confidentiality only (private receipts, invoices and similar records) with no integrity or availability impact assessed. The vendor has fixed the flaw in 1.0.4; a public proof-of-concept walkthrough exists in the GHSA advisory, but it was validated against synthetic records and a mocked Paperless-ngx API rather than a live deployment, so it is not verified as working exploit code, and the issue is rated for this-month remediation rather than emergency action.
A stack-based buffer overflow in psqlODBC, the PostgreSQL ODBC driver, affects all releases before 18.00.0006 when updatable cursors are used - and they are enabled by default. The driver copies the server-supplied ctid (and oid, for tables with OIDs) value into a fixed 32-byte stack buffer using the server-declared length without validating it against the buffer size, so a value of 32 bytes or more overwrites adjacent stack memory; builds compiled with _FORTIFY_SOURCE abort instead. Reaching the flaw needs a specific attacker position: either a PostgreSQL server the client does not trust under its current SSL/TLS settings (malicious or man-in-the-middle server) or a database user able to create a view with its own column named ctid that the application then reads through an updatable cursor; the assessed vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) rates this medium severity with availability-only impact, and no public exploit or active exploitation has been reported.
Stack buffer over-write in psqlODBC before 18.00.0006 can corrupt an application process that forwards attacker-influenced SQL text to the driver. A schema or table identifier longer than the 128-byte stack buffer can cause up to two bytes past the buffer (a double quote and NUL) via a parsed statement's table name or the last INSERT target during SELECT @@IDENTITY rewriting, and a malicious or compromised PostgreSQL server can add a one-byte over-write through an overlong column name in that rewrite. CVSS 3.1 scores this 5.9 (AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H), exploitation requires the application to expose untrusted identifiers, the supplied priority label is this_month for normal-cycle patching, and the supplied data shows no CISA KEV confirmation or public exploit reference; no public exploit identified at time of analysis.
Client-side crash and limited out-of-bounds read affect psqlODBC before 18.00.0006 when the driver connects to a PostgreSQL server that is not trusted under its current SSL settings and the server returns malformed counts or lengths. The flaws are in SQLBulkOperations, SQLStatistics, and bytea octal decoding, and exploitation requires the user or application to initiate the connection to an attacker-controlled or spoofed server. No public exploit was identified at time of analysis, and the vendor has released psqlODBC 18.00.0006 as the fixed version.
Denial of service in Fastify 5.8.0 through 5.12.7 can terminate the Node.js process when a server uses a nonzero handlerTimeout and a streaming route stays open past that timeout. An unauthenticated remote client can trigger the crash with a single request to an affected streaming endpoint, interrupting other in-flight requests; the default handlerTimeout of 0 is not affected, and no public exploit code was identified at time of analysis. This is a moderate, conditional availability issue because the vulnerable configuration is not the default, and it is fixed in Fastify 5.12.8.
Denial of service in @fastify/multipart 5.3.0 through 10.1.6 allows an unauthenticated remote client to hang upload requests when an application handler performs asynchronous work before consuming a file stream. Malformed multipart bodies that end inside a file part without a closing boundary cause the plugin to destroy the in-progress stream without an error, leaving delayed consumers such as pipeline() or toBuffer() waiting indefinitely and keeping connections open; repeated requests can exhaust server resources. This is availability-only and conditional on the delayed-consumer pattern, with no public exploit identified at time of analysis and a vendor fix in 10.1.7.
@fastify/http-proxy 11.6.0 through 11.6.2 lets an unauthenticated remote attacker reach upstream resources outside the intended proxy prefix by sending a path that hides its backslash dot-segments behind percent-encoding (for example /pub/%5C..%5Csecret), which the plugin's destination validator lets through and the upstream, if it decodes %5C and treats backslash as a path separator, resolves to a sibling location. Impact is confidentiality only (C:H, I:N, A:N) and highly conditional, which is why CVSS 3.1 scores it 5.9 with AC:H: the escape only happens against an upstream whose path handling treats a decoded backslash as a separator, the advisory's canonical case being a Windows host serving static files, and the flaw is moot wherever prefix/rewritePrefix is not relied on as a confidentiality boundary. There is no public exploit identified at time of analysis and no KEV listing, and the vendor-released fix is version 11.6.3; the CNA is the OpenJS Foundation and priority is this_month rather than emergency response.
An out-of-bounds read in the peripheral module of Huawei HarmonyOS lets an attacker who can already execute code locally on the device read past the end of an allocated buffer, exposing limited adjacent memory contents. The assessed impact is confidentiality-only (low), with no integrity or availability effect; the vector is local (AV:L) with no privileges (PR:N) and no user interaction (UI:N) required once an application is running on the device, so the local-access precondition is the main barrier. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, which is consistent with the 'this_month' prioritization rather than an emergency response.
Use-after-free in the Huawei HarmonyOS location service module can be triggered by an unauthenticated local attacker able to run code on the device, with no user interaction required. Successful exploitation may corrupt memory and affect availability, with low confidentiality, integrity and availability impact per the assessed CVSS vector. No public exploit code or confirmed active exploitation was identified at time of analysis, and the available signals place it at moderate severity with this-month remediation priority.
A race condition (CWE-362) in the Huawei HarmonyOS location service module lets a local, low-privileged user or app disrupt the service, with the assessed impact limited to availability rather than confidentiality or integrity. The flaw is only reachable with local access to the device (AV:L) and depends on winning a timing window (assessed AC:H), so it is not remotely exploitable and successful triggering requires persistence or repeated attempts. No public exploit code has been identified and the issue is not in CISA KEV; Huawei has published October 2026 consumer, wearable and laptop security bulletins that should be consulted for fixed builds, although specific affected and fixed HarmonyOS versions are not enumerated in the available data.
Improper authorization in the custom URL scheme handler of Dell Alienware Command Center (versions up to and including 6.14.20.0) allows a remote, unauthenticated attacker to abuse the registered handler to reach command execution, launch phishing content, and carry out remote execution - but only if the victim actively opens a crafted link. Dell rates the issue CVSS 5.8 (AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L): no credentials are needed, yet mandatory user interaction and additional conditions beyond a single request sharply constrain practical exploitation. No public exploit code was identified at time of analysis and the issue is not in CISA KEV; the vendor's priority guidance places remediation in the this-month window rather than immediate action.
This is a moderate, not emergency, priority: an out-of-bounds read in libaec through 1.1.7 (m_se_decode() in src/decode.c) lets a crafted CCSDS 121.0 / SZIP stream crash the decoder and potentially leak adjacent memory into decoded samples. The flaw is only reachable when an application built on libaec decodes attacker-supplied data that selects Second Extension coding and whose first fundamental sequence is longer than 2^31 zero bits, which wraps a signed index negative and defeats the bounds check; the vector is local with the victim feeding untrusted input to the decoder (UI:P / AT:P), and no authentication to the library is involved (PR:N). An upstream fix exists in PR #66, but a tagged patched release is not independently confirmed; there is no CISA KEV entry and no public exploit code confirmed at time of analysis, though a public technical writeup of the signedness issue is referenced.
Information disclosure in WSO2 Identity Server's Keystore REST API lets remote attackers learn the server-side file paths of certificate files by sending a request whose content-type header the component fails to validate. The affected code spans the Keystore REST API commons and v1 modules, and the same component ships in WSO2 Identity Server, Identity Server as Key Manager and Open Banking IAM. The exposure is limited to path strings rather than certificate contents, private keys or credentials, and no public exploit has been identified at time of analysis; the vendor rated it 5.8 with Scope:Changed, while the independent assessment treats scope as unchanged and scores confidentiality-only, low impact.
Path traversal (CWE-22) in Dell OpenManage Enterprise versions prior to 4.8.0 allows a low-privileged attacker positioned on an adjacent network to supply a crafted pathname and reach files outside the intended restricted directory, resulting in high-confidentiality information exposure with no integrity or availability impact. The vendor advisory DSA-2026-467 rates the issue CVSS 5.7 (AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), reflecting that exploitation requires both adjacency to the console and a valid low-privilege account rather than open-internet reachability. No public exploit code was identified at time of analysis, and the vulnerability is not confirmed as actively exploited (no CISA KEV listing); priority is assessed as this_month rather than emergency.
Denial of service in Huawei HarmonyOS lets an attacker who shares an adjacent network with a target device and holds low-level privileges exhaust resources in the DSoftBus (distributed soft bus) module, degrading availability of the device. Phones, Vision devices and wearables running affected HarmonyOS builds are addressed by three separate Huawei consumer bulletins dated October 2026 (listed under References). Severity is moderate and availability-only (CVSS 5.7, AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, CWE-400); no public exploit identified at time of analysis and no CISA KEV entry, which places this at a this-month remediation priority rather than an emergency.
Incorrect permission assignment on a critical resource in Dell OpenManage Enterprise versions prior to 4.8.0 allows an attacker who already holds low-privilege local access to bypass an intended protection mechanism and read information they should not be able to reach. The flaw is confidentiality-only (no integrity or availability impact) and is scored 5.5; it cannot be triggered remotely or without credentials, since the assessed vector requires local access (AV:L) and low privileges (PR:L). There is no CISA KEV listing and no public exploit code identified at time of analysis, and Dell addresses the issue with the 4.8.0 release described in advisory DSA-2026-467.
Dell OpenManage Enterprise versions prior to 4.8.0 ship with an incorrect permission assignment on a critical resource (CWE-732), allowing a low-privileged local user to bypass a protection mechanism and read data they should not be able to reach. The assessed vector is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N (5.5), so exploitation requires local access to the host plus existing low-privileged credentials, and the result is a confidentiality impact only - no integrity or availability effect and no scope change. No public exploit code and no confirmed active exploitation were identified at time of analysis; this is a moderate-severity, local-access issue that should be patched on a normal cycle rather than treated as an emergency.
Improper permission enforcement in the Bluetooth module of Huawei HarmonyOS and EMUI allows a local attacker to cause a high availability impact after user interaction, rated CVSS 5.5 (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H). The flaw is confined to Huawei's device operating systems and offers no confidentiality or integrity impact; no public exploit identified at time of analysis and no CISA KEV entry. Huawei's October 2026 consumer security bulletins are the reference advisories.
Local information disclosure in Huawei HarmonyOS allows an attacker with code already running under low privileges to reach the WLAN module and expose sensitive data. Exploitation requires local access to the device and low-level privileges (PR:L), with no user interaction; confidentiality impact is high, while integrity and availability are unaffected. No public exploit was identified at time of analysis, and active exploitation is not confirmed (not listed in CISA KEV); Huawei consumer bulletins cover phones, vision products, wearables, and laptops.
Local denial of service in the GNSS (location) component of MediaTek chipsets MT6990, MT6980D, MT2737, MT6982, MT6988, MT6986 and MT6813 stems from a missing bounds check that permits an out-of-bounds write, carrying an assessed CVSS of 5.5 with availability-only impact. Exploitation requires local access to the device plus user interaction (AV:L/UI:R) and yields no additional execution privileges, no code execution and no data exposure; no public exploit has been identified at time of analysis and CISA's SSVC assessment records exploitation as none. MediaTek has released patch ALPS11309305 under issue ID MSV-10730 in its November 2026 product security bulletin.
Missing authentication in the VPN Client List Handler of WAVLINK WN536AX6-A firmware V260507_2.0.0 lets remote attackers manipulate the 'opt' argument in /bin/ioos to disclose VPN client information without credentials. The disclosure states the exploit is now public and references a GitHub write-up, but no CISA KEV entry is indicated; the issue is confidentiality-only and moderate priority because the management service is typically LAN-facing unless remote management is enabled.
psqlODBC before 18.00.0006 on Unix-like systems can expose query text and data to other local users when logging is enabled, because log files are created in /tmp with predictable names and default permissions. A local authenticated attacker can read a victim's logs or pre-place a symbolic link at the predictable path so the driver appends log data to an attacker-chosen file with the victim's privileges. Exploitation requires logging to be explicitly enabled and a separate local account on the same host; no public exploit identified at time of analysis, and the issue is assessed as moderate rather than urgent.
DJ-Classifieds before 3.11.3 exposes seller contact details and draft ad content to any logged-in user through an insecure direct object reference in the duplicate-my-ad feature. An authenticated user of any role can supply another advert's small sequential numeric ID to the new-ad form and receive that ad's full content, including phone number, address, email, and price, even if the ad was never published, blocked, or still pending. No public exploit was identified at time of analysis, and the assessed impact is confidentiality-only with a moderate CVSS score of 5.3.
Stored cross-site scripting in Otter Wiki before 2.26.2 lets anyone able to edit a page - including anonymous users under the default configuration - persist HTML and script inside a ```math fenced code block that the renderer emits without escaping, so the payload executes in the browser of every viewer who opens the poisoned page. Successful exploitation requires the victim to view the page (passive user interaction) and grants script execution in the wiki's origin in a scope-changed context, with low confidentiality and integrity impact on the viewer's session rather than on the server. This is a genuine but moderate-priority issue, not an emergency: no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, with a vendor fix released in 2.26.2.
Outline workspaces running versions before 1.12.0 let any authenticated workspace member - including read-only members with no membership in the target collection - publish attacker-supplied documents into private collections, enabling content injection such as phishing links or misleading policy text placed inside trusted confidential spaces. The bypass uses documents.unpublish with detach:true to strip a draft's collection while retaining its parentDocumentId, then documents.update with publish:true and the private collection's UUID; the retained parent link satisfies the authorization check instead of the destination collection's createDocument policy, whereas a detached draft without a parent is correctly rejected with 403. Impact is integrity-only - the injected document appears in listings for legitimate collection members, but the attacker gains no read access to the collection. Severity is medium (CVSS 4.0 base 5.3; independent assessment CVSS 3.1 5.3, C:N/I:L/A:N); the upstream advisory contains a documented proof-of-concept reproduction (a public PoC reference) and there is no CISA KEV entry confirming active exploitation.
Improper authorization in LaraDashboard 1.4.0 through 1.4.8 lets an authenticated user holding only the read-only email_template.view permission send arbitrary HTML email through the MCP send-email tool. Authenticated low-privilege users (or holders of an MCP token minted while that permission was present) can mint a token and POST attacker-chosen sender, recipient, subject and raw HTML body to /mcp/send-email, turning the application's mailer into a phishing or spam relay that abuses the site's sending reputation; the assessed impact is a limited integrity violation, with no confidentiality or availability impact. The vendor fixed the permission check in v1.4.9 (the tool now requires email_template.edit), and the GHSA includes a public proof-of-concept script that has not been independently verified as working exploit code; no confirmed active exploitation (CISA KEV) or public exploit tooling is indicated at time of analysis.
Category-management authorization bypass in Camaleon CMS before 2.9.2 lets an authenticated low-privileged user rename or delete categories belonging to a different post type by pairing their own authorized post_type_id with an arbitrary category ID in update or destroy requests. The flaw is an insecure direct object reference (CWE-639) in Admin::CategoriesController with medium severity impact limited to integrity and availability of category objects; it does not disclose data or enable code execution. Vendor-released patch 2.9.2 is available, and no public exploit code was identified at time of analysis.
MrDoc through 1.1.1 allows any authenticated user to read other users' private document templates by submitting sequential doctemp_id values to the get_doctemp view, whose database lookup lacks an owner constraint. The flaw is a CWE-639 object-level authorization bypass affecting confidentiality only (CVSS 4.0 score 5.3, PR:L); template contents can be read but not modified or deleted. No public exploit code was identified at time of analysis, and an upstream vendor fix commit is available.
Reflected cross-site scripting in the StageIt extension for Joomla (php-web-design.com) affects versions 1.0 through 5.7.5 and 6.0 through 6.3.5, allowing an unauthenticated remote attacker to have script execute in a victim's browser when the victim loads a crafted URL; the issue is rated CVSS 5.3 (moderate). Exploitation requires user interaction (UI:P) and impact is limited to the victim's browser session, and no public exploit or CISA KEV entry is identified at time of analysis; the vuln.today decision label is this_month.
An out-of-bounds read in MediaTek's modem ip_stack can crash the modem and cause denial of service on devices built with affected MediaTek chipsets (including MT6897, MT6989, MT6991 and MT6983) when the victim UE connects to an attacker-controlled rogue base station. Exploitation requires radio proximity and successful over-the-air attachment, but no authentication or user interaction once attached; impact is assessed as availability-only (C:N/I:N/A:H). No public exploit code was identified at time of analysis, and the CVSS 5.3 rating reflects the substantial rogue-base-station precondition.