Insufficient session expiration in the CloudClassroom-PHP-Project Global Session Handler (CWE-613) lets a session that should be terminated keep working after logout, so anyone already holding a live session identifier can continue to reach the associated account's data. Because the project ships on a rolling-release basis, no affected or fixed version numbers exist - the CPE is a wildcard covering all deployments - and the vendor did not respond to the disclosure. Impact is deliberately scoped: low confidentiality only (VC:L, no integrity or availability effect), remote but high complexity (AC:H), and a public proof-of-concept reference exists but is not verified as working exploit code; there is no KEV (CISA) entry and no confirmed active exploitation, and the reporter rates practical exploitability as difficult because a valid session token must be obtained first.
Reflected cross-site scripting in the Welcart e-Commerce plugin for WordPress (versions up to and including 2.12.6) lets remote attackers inject script into the payment error page generated by ESCOTT_MAIN::error_page_message through the unsanitized ResponseCd argument. The CVSS 4.0 vector indicates no privileges are required (PR:N) but the victim must interact (UI:P), since a crafted request or link has to be opened for the payload to execute, and impact is limited to low integrity/confidentiality effects within the page context. Version 2.12.7 fixes the issue by escaping the value with esc_html(); a public PoC reference exists but is not verified as working exploit code, there is no CISA KEV listing, and this is assessed as a moderate, genuinely low-urgency issue rather than a high-priority emergency, consistent with a this_month priority label.
Stored cross-site scripting in CloudClassroom-PHP-Project's manageassessment2.php allows remote unauthenticated attackers to supply crafted ExamName or Q1-Q5 values that execute script in a victim's browser when the page is viewed, with the CVSS 4.0 vector requiring user interaction. The issue is low severity (CVSS 2.1) and the supplied priority label is monitor; a public PoC reference exists, but it is not verified as working exploit code, and no KEV confirmation is present in the supplied intelligence.
Cross-site scripting in CloudClassroom-PHP-Project's updatedetailsfromfaculty.php allows remote attackers to manipulate the fname argument and inject script that executes when a victim loads the page where the value is rendered. The referenced advisory describes a stored-XSS condition, and a public PoC reference exists; it is not verified as working exploit code. No CISA KEV confirmation or EPSS score was supplied, and the assessed severity is low, with exploitation requiring user interaction and possible authentication ambiguity at the faculty detail-update endpoint.
Path traversal in deepset-ai FARM through 0.8.0 allows unauthenticated remote attackers to influence the vocab_filename argument of EmbeddingTokenizer.from_pretrained and read files outside the intended vocabulary location, with limited confidentiality impact and no integrity or availability effect; user interaction is required per the assessed vector. Exploitation depends on a host application passing attacker-influenceable input into vocab_filename, and a public PoC reference exists; it is not verified as working exploit code. The vendor did not respond, the project is unmaintained, and no vendor-released patch was identified.
Path traversal in the Knip developer CLI (Webpro-nl, versions up to and including 6.44.0) allows a crafted 'workspaces' value in a project's Knip configuration to escape the intended directory when the autofix writeFile routine in IssueFixer.ts is executed, overwriting or deleting files outside the project tree. The issue is rated 5.3 MEDIUM under CVSS 4.0 (CWE-22); exploitation is not passive, it requires a victim to run the autofix/IssueFixer path against a project whose configuration or repository content is attacker-influenced, making this a developer-workstation and supply-chain exposure rather than a service-facing remote flaw. No confirmed active exploitation (CISA KEV) is recorded, but a public PoC reference exists; it is not verified as working exploit code. The vendor was contacted about the disclosure and did not respond.
MoviePilot through 3.1.2 deserializes untrusted Python pickle data when restoring saved workflow execution context, and the workflow fork endpoint copied an attacker-supplied 'context' field from shared workflow payloads straight into that stored context, so a crafted shared workflow can trigger code execution on the instance that forks or later runs it. Exploitation requires an authenticated account with access to the Workflow feature (CVSS 4.0 PR:H in the supplied vector; the independently assessed 3.1 vector scores PR:L) and depends on the legacy Base64 pickle 'content' format being loaded by WorkflowExecutor.restore_context. A public PoC reference exists; it is not verified as working exploit code, no confirmed active exploitation (CISA KEV) has been reported, and the vendor has fixed the issue in 3.1.3.
Information disclosure in EchoHS GeekezBrowser through 1.8.0 lets any local process that can reach the application's localhost Public API read the /api/status response, because that endpoint served data without an authorization check and with a wildcard CORS origin. The exposure is local rather than remote, the leaked data is low sensitivity, and there is no integrity or availability impact, which keeps this at a low-to-moderate severity (CVSS 4.0 base 4.8). A public PoC reference exists in the project's GitHub issue tracker but is not verified as working exploit code; no CISA KEV listing was supplied, and the vendor has released 1.8.1 with a fix.
Path traversal in the WordEmbedding_LM.load function of deepset-ai FARM through version 0.8.0 lets a local attacker control the embeddings_filename argument - typically by supplying a crafted model package - and read files outside the intended model directory. The flaw is assessed as low severity (CVSS 3.1: AV:L/AC:L/PR:L/UI:R, limited confidentiality impact only), requires local access and a victim to actually load the attacker-influenced input, and affects an end-of-life product the maintainer no longer supports and did not respond about. A public PoC reference has been published, but it is not verified as working exploit code, and no confirmed active exploitation has been reported.
Authentication bypass by spoofing in Dell Alienware Command Center (AWCC) before 6.14.54.0 allows a low-privileged local attacker to tamper with application data, cause denial of service, and spoof application notifications, but only if a legitimate user interacts with the spoofed notifications. The issue is local-only, requires an existing account on the host, and has low integrity and availability impact with no confidentiality impact (CVSS 3.9). No CISA KEV entry was present and no public exploit identified at time of analysis; the vuln.today decision label is monitor.
CORS preflight handling in @fastify/cors 8.2.0 through 11.3.x can terminate the Node.js process when the plugin is registered with the non-default hook: 'onSend' option. On an OPTIONS request carrying Origin and Access-Control-Request-Method, the plugin calls reply.send from inside the onSend hook and re-enters Fastify's send pipeline, so a second write of the response headers throws ERR_HTTP_HEADERS_SENT; with no process-level handler installed, that uncaught exception kills the process. The trigger is a single unauthenticated request (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L, 3.7), but only the non-default onSend configuration with preflight enabled is exposed - the default onRequest hook and deployments with preflight: false are unaffected - so this is a low-priority availability issue rather than an urgent threat, and no public exploit code was identified at time of analysis.
The Optimizer module in Huawei HarmonyOS and EMUI performs an operation without an adequate permission check, letting a local app with limited privileges reach data or functionality that should be restricted to more privileged callers. Huawei's own scoring is modest (CVSS 3.7) and the published vector assumes network reachability with high attack complexity, while the independent assessment places the flaw as local with low privileges and only low confidentiality impact - the two views differ on attack vector and on which impact dimension is affected (availability in the vendor vector, confidentiality in the description), and that discrepancy is unresolved in the supplied data. No public exploit code or CISA KEV entry is associated with this CVE, and the vendor bulletin is the only remediation reference provided.
Huawei HarmonyOS contains a permission-control weakness in its background task management module that, under the assessed CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N, base score 3.6), requires local access with user interaction and produces only limited confidentiality impact that crosses a scope boundary. No public exploit code has been identified at time of analysis, and the aggregated priority signal is monitor. Huawei's October 2026 consumer, Vision and laptop security bulletins should be consulted for the fixed builds.
Client-side request forgery in Dell Alienware Command Center (AWCC) before 6.14.54.0 allows a low-privileged, remote attacker to make the application issue crafted requests on the victim's behalf, with impact scored as limited confidentiality exposure only (CVSS 3.5). Exploitation requires AWCC to be installed so its custom URL scheme handler is registered, a low-privileged context (PR:L), and victim interaction with an attacker-crafted link (UI:R), which substantially constrains real-world abuse. Every available signal rates this as low severity and the priority decision is monitor; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV.
Memory corruption in Qt MQTT's QMqttClient can crash Qt-based client applications when an MQTT 5 connection is established under a particular combination of client and server settings. The flaw is a CWE-787 out-of-bounds write reachable by an unauthenticated remote MQTT peer (CVSS 4.0 PR:N) but gated by a specific attack prerequisite (AT:P) and user interaction (UI:P), with the assessed impact limited to availability (VA:H) rather than data exposure or modification. The issue is rated low severity (CVSS 2.3) with a monitor decision label, affects client-side Qt applications rather than a widely exposed server surface, and has vendor patch code available; no public exploit was identified at time of analysis.
Parse Server before 8.6.109 and 9.0.0 before 9.10.6-alpha.1 can return stored field values in object update responses to a caller that lacks read access, letting a client with update-but-not-read permissions learn atomic-operation results, Cloud Code trigger-set values, and under narrower conditions an entire stored parent field. Exploitation requires an authenticated caller authorized to update the object and a permission mismatch-class-level update allowed while get is denied, or an object ACL granting write but not read-so default configurations that do not grant update without read are not exposed. No public exploit identified at time of analysis, and the issue is low severity with only confidentiality impact.
Authorization bypass in Sanluan PublicCMS 4.x, 5.x and 6.x allows an authenticated low-privilege user to manipulate the refundId argument handled by TradeRefundService.updateAmound and operate on refund records that belong to other accounts. Only deployments that include and actively use the optional publiccms-trade e-commerce/refund module are exposed; core CMS content-serving instances are not affected by this code path. Severity is medium (CVSS 4.0 base 5.3, assessed CVSS 3.1 5.3) and the disclosure states the exploit has been made public, so a public PoC/exploit reference exists, though it is not independently verified as working exploit code. There is no CISA KEV entry, no fixed version is listed in the available evidence, and the vendor did not respond to the report, so no vendor mitigation is stated.
Out-of-bounds read in hivex when parsing registry values with malformed large data block lists can crash applications that process attacker-supplied Windows registry hive files, resulting in denial of service. The assessed vector is local, requires user interaction, and has availability-only impact; no public exploit or CISA KEV entry was identified at time of analysis. This is a low-priority issue consistent with the 'monitor' decision label.
Integer overflow in the legacy Qt5Compat QXmlSimpleReader XML parser can be triggered when an application that still uses this deprecated component parses a crafted XML document, primarily threatening availability through a local, user-interaction-dependent attack path. No public exploit was identified at time of analysis, and vendor patches are available; the overall priority is monitor because exposure is limited to applications that opt into the Qt5 compatibility parser.