Argument injection through proxy settings, plus an unchecked checksum-update path in the privileged service, in Securepoint SSL VPN Client v2 on Windows let a non-privileged local user steer OpenVPN operations that execute with NT AUTHORITY\SYSTEM privileges, producing high integrity and availability impact (VC:N/VI:H/VA:H). The proxy-settings vector is the more accessible one: it requires only the ability to set the client's proxy options and needs neither communication with the privileged service nor modification of the protected OpenVPN configuration. Exploitation requires a pre-existing local session on the affected Windows host (AV:L, PR:L, UI:N), so this is a post-foothold local privilege escalation rather than a remote entry point; no public exploit code or confirmed active exploitation is identified in the available data, and the vendor-reported advisory is the reference of record.
Crashing the Linux kernel is possible through a NULL pointer dereference in AMD's amdgpu GPU driver, giving local users a denial-of-service primitive on affected systems. The CVSS 4.0 vector shows local access (AV:L), no privileges (PR:N), no user interaction, and high availability impact only; confidentiality and integrity are unaffected. No public exploit or CISA KEV designation was identified in the supplied intelligence, and the priority is this_month rather than emergency.
Integer overflow in the DDS RGB888 loader of the AMD Compressonator SDK can be reached when a user opens a crafted DDS file, producing an undersized heap allocation and an out-of-bounds read that may crash the process or disclose limited heap memory. The issue is local and requires user interaction; the supplied intelligence records no CISA KEV entry and no public exploit identified at time of analysis, with AMD advisory AMD-SB-6032 as the vendor reference.
Unauthenticated information disclosure in CTFd's /api/v1/teams list endpoint exposes non-public team custom registration fields - emails, phone numbers, student IDs - to anyone who paginates GET requests, but only on instances configured for team mode with public visibility enabled and teams that have populated hidden custom fields. Impact is confidentiality-only and limited (CVSS 4.0 6.9; independently assessed as CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, Medium), with no integrity or availability effect. There is no CISA KEV listing and no confirmed public exploit code at time of analysis, though harvesting is trivially automatable through pagination once the preconditions hold. A vendor patch exists in CTFd 3.8.7.
Remote attackers can forge Strava webhook events against Dreeve before 5.8.0 and cause permanent deletion of imported Strava activities and their streams. The StravaWebhookRequestHandler::handleEvent path does not verify the signature, verify-token, or owner_id, so a crafted DELETE event carrying a known public Strava activity id is accepted when the instance has imported that activity and its webhook endpoint is reachable. The assessed impact is limited to integrity and availability of imported activity data, with no confidentiality exposure or code execution, and no public exploit was identified at the time of analysis; this is a genuine but moderate-priority issue rather than an emergency.
Path traversal in Koodo Reader 2.4.6 and earlier lets an authenticated user of the optional self-hosted HTTP server read arbitrary files outside the upload directory. The attacker uploads a crafted books.db whose 'cover' value contains ../ sequences and then requests /opds/cover/{key}, causing the server to serve a file readable by the Koodo Reader process; the same unsafe path construction affected the OPDS download handler. Exploitation requires the non-default OPDS/self-hosted mode to be deployed and reachable plus privileges sufficient to upload a database (PR:H), so impact is read-only disclosure of files the server process can already access. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor fix is contained in commit cbc79a1.
svg-sanitizer 1.1.0 can fail individual PHP 8 requests when an application passes attacker-controlled SVG input that ends inside an unclosed tag, with a lone '<' being the smallest trigger; the resulting uncaught ValueError escapes catch (Exception) handlers and aborts the request. The impact is availability-only and bounded to the affected request, and the vendor fixes it in 1.1.1. A public PoC reference exists; it is not verified as working exploit code, and no confirmed active exploitation is reported in the supplied data.
HTTP response splitting in Wasmtime's wasi-http p3 implementation lets an executing WebAssembly guest set an unvalidated content-length header when it splices an existing body into a new response, creating inconsistent HTTP framing that can enable response splitting or injection against downstream consumers. Wasmtime releases 46.0.0 through 48.0.6 and 49.0.0 through 49.0.3 are affected; vendor patches are available in 48.0.7 and 49.0.4. Exploitation requires a host that embeds Wasmtime and runs untrusted guests through the experimental wasi-http p3 API, and the assessed impact is limited to HTTP message integrity with no direct confidentiality or availability loss; no public exploit identified at time of analysis.
Quadratic CPU consumption in Mistune's inline link parser allows unauthenticated remote attackers to degrade availability by submitting crafted Markdown containing thousands of balanced nested bracket pairs that never resolve into a valid link. Every version prior to 3.3.3 is affected, and exploitation only requires that a downstream application or background job pass attacker-controlled Markdown into the default parser (mistune.create_markdown() or mistune.html()); no plugin, non-default renderer, or user interaction is involved. The impact is availability-only (no confidentiality or integrity loss), but a small input of tens of kilobytes can pin a request handler or worker for seconds, and a public proof-of-concept reproducer included in the vendor advisory was verified against the 3.3.2 release tag. The issue is not listed as actively exploited in CISA KEV, and no EPSS score was supplied with the source data.
Server-side request forgery in AzuraCast through 0.23.8 lets any station user holding the station-scoped WebHooks permission make the AzuraCast server issue outbound HTTP requests to attacker-chosen internal addresses. The flaw is an incomplete fix for GHSA-3jp3-3wqw-jvw4: the Mastodon (instance_url), Telegram (api), GroupMe (api) and RadioReg (webhookurl) connectors were never routed through the UserUrlFilter guard, so a low-privilege user can point them at loopback, private-network or cloud-metadata endpoints and fire the test webhook endpoint (PUT /station/{id}/webhook/{id}/test) for immediate dispatch, with the response captured in the HTTP log. Exploitation is gated by the WebHooks permission rather than being anonymous, and the highest-impact outcomes (metadata credential theft, Docker-internal pivoting) depend on such endpoints being reachable from the host; no public exploit code was identified at time of analysis and the issue is prioritised as a this-month item rather than an emergency.
Alo Suite's password recovery endpoint '/Account/resetPwd' lacks rate and frequency limits, so remote attackers can repeatedly trigger unlimited reset emails to a single account, flooding the user's inbox and consuming application and mail infrastructure resources (CWE-770). The flaw affects Alo Suite installations exposing the password-recovery feature (CPE cpe:2.3:a:am_system:alo_suite), requires no authentication or user interaction (AV:N/AC:L/PR:N/UI:N), and is assessed as a moderate-severity availability issue with limited impact (CVSS:3.1 A:L; no confidentiality or integrity effect). The trigger is straightforward endpoint abuse per the available sources; no public exploit code or active exploitation is confirmed, though the vendor advisory from INCIBE is available.
Unauthenticated information disclosure in AM Systems Alo Suite allows remote attackers to read records belonging to other companies or users by substituting the object identifier in requests to the '/Companies/Edit/{id}' endpoint. The underlying flaw (CWE-639, IDOR) is a missing authorization check on the supplied identifier, so confidentiality impact is limited but the exposure is tenant-crossing: any reachable deployment of the affected product can be queried for data the requester should not see, and its practical value depends on identifiers being enumerable or predictable. Reported severity is moderate (6.9 on CVSS v4.0; assessed 5.3-equivalent vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), the issue is not in CISA KEV and no public exploit identified at time of analysis, and the vuln.today decision label places remediation in the 'this month' window rather than an emergency response.
AxxonSoft AxxonNet ARP Agent before 3.25.0 writes the plaintext password of the LDAP directory-service account into WARNING-level log entries on Windows and Linux hosts where LDAP user synchronization is configured. A local attacker with low privileges and read access to ARP Agent logs or generated support packages can recover that password, resulting in high confidentiality impact but no integrity or availability impact. No public exploit was identified at time of analysis, and the issue is not listed in CISA KEV; the risk is moderate and locally scoped rather than an urgent remote-exploitation priority.
Plaintext storage of the LDAP directory service account password in Axxon One before 3.1.0 allows a local attacker with read access to the SecurityManager shared configuration or configuration backups to recover that credential from main.conf on Windows or Linux. The assessed impact is confidentiality-only (CVSS:3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N; CVSS 4.0 score 6.8), and the flaw is only meaningful where an LDAP service account password is actually stored. No public exploit identified at time of analysis; the vendor lists 3.1.0 as the fixed version and this is a moderate, vendor-reported disclosure issue rather than an emergency.
Cross-site scripting in Dell Wyse Management Suite before 2609.0.0.155 allows a low-privileged authenticated user of the web management interface to inject script into pages that a victim must render, causing script execution in the victim's browser session. The assessed vector requires a valid low-privileged account and user interaction and changes scope, with limited confidentiality and integrity impact and no availability impact, making this a moderate, non-emergency issue rather than an unauthenticated or self-propagating attack. No public exploit was identified at time of analysis, and Dell's remediation is updating to 2609.0.0.155.
Improper certificate validation in HPE Networking Fabric Composer allows an unauthenticated attacker on an adjacent network segment to intercept management-plane traffic and potentially obtain sensitive information. Exploitation requires preconditions outside the attacker's control, reflected as high attack complexity, and no user interaction is needed. No public exploit identified at time of analysis; HPE's advisory is the authoritative source.
CSRF protection bypass in MyTube, a self-hosted video downloader and player, lets an unauthenticated attacker perform state-changing administrator API actions - deleting media, triggering downloads, altering subscriptions - on behalf of a logged-in admin. The root cause is that shouldSkipCsrfProtection() in backend/src/middleware/csrfConfig.ts delegates to isApiKeyRequest(), which grants the CSRF exemption on the mere presence of an 'x-api-key' header or 'Authorization: ApiKey' value rather than on a validated key, so any bogus value skips the double-submit token check while the victim's session cookie authenticates the request. Exploitation is conditional: it requires CORS_ALLOWED_ORIGINS to be configured permissively (broadly or to '*') so the attacker's origin is reachable from the browser, plus an administrator lured to attacker-controlled content (UI:R, AC:H); no KEV entry or confirmed working exploit is recorded, and the public advisory does include a step-by-step PoC description. The issue is fixed in version 1.10.6.
MongoDB Rust Driver can expose client-side-encrypted field values when optional diagnostic tracing and automatic in-use field level encryption are enabled together, because trace records may capture command content before encryption is applied. An authenticated party with local read access to the application's exported trace data could recover fields the application marked for encryption without possessing encryption keys; deployments that do not enable tracing, or that do not combine it with automatic encryption, are not affected. No public exploit was identified at time of analysis.
SQL injection in the End-of-Life SonicWall Global Management System (GMS) 9.5.2 and earlier allows an attacker who already holds high-privilege credentials on the GMS management interface to read or modify data held in the GMS database. The vendor restricts practical exploitation to unspecified 'specific conditions', and the exact vulnerable parameter or feature is not described in the available sources; no public exploit is identified at time of analysis and the issue is not reported as actively exploited. With CVSS 6.8 and a this_month prioritization label, the practical exposure is concentrated in organizations still running the unsupported 9.5.x branch rather than in the general internet-facing population.
Malformed CoAP messages parsed by the Qt CoAP module's QCoapInternalReply::createFromFrame() can crash a CoAP-enabled application or leave it operating on incorrect data, an out-of-bounds read rated 6.7 in CVSS 4.0 (assessed as CVSS 3.1 AV:N/AC:L/PR:N/UI:N/C:N/I:L/A:H). Exploitation requires that the application link Qt CoAP and decode incoming CoAP frames through QCoapInternalReply::createFromFrame(); once such traffic reaches the parser, the CVSS vector PR:N/UI:N indicates no authentication or user interaction is needed. Impact is primarily availability (crash) with low integrity impact and no confidentiality loss claimed; a vendor fix is available, and no public exploit was identified at time of analysis.
Denial of service in Moby BuildKit v0.26.0 through v0.34.1 allows a crafted build definition that resolves metadata for the same Git source reference twice to panic the BuildKit daemon, interrupting builds handled by that daemon. The CVSS 4.0 vector indicates local attack (AV:L), no privileges required (PR:N), and active user interaction (UI:A), with impact limited to availability (VC:N/VI:N/VA:H). The vendor fixed the flaw in v0.34.2; no public exploit was identified at time of analysis, and the vendor notes only very specific builds using Git dependencies are affected.
Inefficient regular expression complexity (ReDoS) in whatstk 0.2.0 through 0.8.x lets anyone who supplies a WhatsApp chat export burn CPU indefinitely in the process that parses it. The library's generate_regex() builds the header pattern by substituting named capture groups into the header format but leaves all other characters unescaped, so an export whose date separator is a regex metacharacter - for example '+' - turns the pattern into a nested-quantifier form such as (?P<day>\d{1,2})+(?P<month>\d{1,2})+(?P<year>\d{2,4}) that backtracks catastrophically on a digit run that cannot complete the header. Header auto-detection is on by default and derives the format from the file's own text, so no caller-supplied hformat is needed; separators of (, ) or \ instead raise re.PatternError, *, | or ? raise TypeError, and ^ or $ raise KeyError, none of which the library catches. The result is a hang or uncaught exception from a file of a few hundred bytes. There is no confirmed active exploitation or CISA KEV listing, and no public working exploit code is documented in the available sources; a public PoC reference appears only as a CNA write-up. whatstk v0.9.0 contains the fix.
An out-of-bounds write in the Zephyr Bluetooth host's GATT client allows a malicious, spoofed or compromised GATT server within radio range to hand a subscribed client more than the 512-octet maximum attribute length defined by the Core Specification, corrupting memory in subscribers that size their receive buffers to that documented limit. Affected releases are Zephyr 3.4.0 through 4.3.1 and 4.4.0 through 4.4.x (fixed in 4.3.2 and 4.5.0), specifically the in-tree LE Audio unicast client and BAP Broadcast Assistant as well as any out-of-tree subscriber that assumes the 512-octet ceiling. Practical exploitation is heavily conditional: the device must already be connected and subscribed to the attacker's handle, and the build must negotiate an ATT MTU above 515 octets, which the shipped defaults (27/69/70/200/265) never reach; the assessed vector (PR:L) reflects that established subscription relationship rather than classic credential authentication, and no public exploit has been identified at time of analysis.
Command injection in the HPE Networking Fabric Composer API lets an authenticated attacker who already holds administrative privileges on the appliance execute commands that escalate to elevated privileges on the underlying operating system. Exploitation is gated by the CVSS vector's high privileges requirement (PR:H) and a high attack complexity rating (AC:H) that reflects vendor language about preconditions outside the attacker's control, so this is a post-authentication, admin-level escalation path rather than an anonymous remote compromise of default deployments. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; the vendor advisory is the authoritative source for fix guidance.
Queue-pointer corruption in libslirp's if_output() lets a guest on a libslirp user-mode network crash the host-side networking process. When burst traffic forces a session to migrate from the fast queue to the batch queue, the code unlinks and reinserts an arbitrary packet via ifm->m_nextpkt instead of the session queue head, leaving the queue pointers inconsistent; the result is an availability-only denial of service (CVSS 6.5, AV:A/AC:L/PR:N/UI:N, C:N/I:N/A:H) with no confidentiality or integrity impact and no demonstrated code execution. Affected deployments are those actually running the slirp/slirp4netns backend - QEMU user networking and rootless Podman/OpenShift container networking among Red Hat Enterprise Linux 8, 9 and 10 and OpenShift Container Platform 4 and 5 - while bridge, tap or passt setups are out of scope. Exploitation requires the attacker to already control a guest attached to that virtual network; no public exploit code has been identified at time of analysis, and this is a medium-severity, availability-only issue rather than a top-priority emergency.
Improper access controls in Tanium Enforce allow a remote attacker with an existing low-privileged authenticated session to modify protected data without user interaction, producing high integrity impact while confidentiality and availability remain unaffected. The issue is tracked as CVE-2026-116661 (CWE-863), affects Tanium Enforce per the supplied CPE, and the specific feature or endpoint abused is not described in the available sources. No public exploit identified at time of analysis and no CISA KEV entry is present; Tanium's advisory is TAN-2026-096.
An improper access control flaw (CWE-862) in Tanium's Enforce module allows a low-privileged authenticated user to read data they should not be authorized to access; the CVSS 3.1 score is 6.5 with C:H and no integrity or availability impact. The CVSS vector carries PR:L, so this is not a pre-authentication bypass despite the 'Authentication Bypass' tag - exploitation requires valid Enforce credentials, and no public exploit code or active exploitation is identified in the available data. Risk is confined to insiders or attackers who already hold a foothold account, making this a moderate-priority item rather than an emergency, with an EPSS-style urgency consistent with the 'this_month' decision label.
Improper input validation in Tanium Threat Response allows a remote, authenticated low-privilege user to disclose sensitive information, with high confidentiality impact and no integrity or availability effect at low attack complexity and no user interaction (CVSS 3.1: 6.5, AV:N/AC:L/PR:L/UI:N/C:H/I:N/A:N). The vendor advisory does not describe the specific feature, request or input that triggers the flaw, so the only confirmed prerequisite is a valid low-privilege account, which constrains exposure to insiders or attackers who already hold credentials rather than anonymous remote actors. This is a moderate-priority issue rather than an emergency: no public exploit identified at time of analysis and the product is not in CISA KEV.
Tanium Discover contains an improper access-control flaw (CWE-639) that lets an authenticated, low-privileged user reach data outside the scope their account should permit, with impact limited to confidentiality. The vulnerability is network-reachable and requires no user interaction, but an attacker must already hold valid Discover credentials (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base score 6.5); there is no integrity or availability impact and no privilege escalation component. It rates as a moderate-severity authorization issue rather than an emergency, and no public exploit code or confirmed active exploitation was identified at time of analysis. Tanium has addressed the issue and published advisory TAN-2026-087.
Denial of service in Tanium Client allows an attacker on an adjacent network segment to disrupt the endpoint agent through an integer overflow (CWE-190), rated CVSS 6.5 with availability-only impact. No authentication (PR:N) or user interaction (UI:N) is required, but exploitation requires network adjacency (AV:A) - the attacker must reach the client from the same local segment or broadcast domain rather than across the open internet, which is the primary limiting factor. No public exploit code has been identified at time of analysis, no CISA KEV entry is associated with this CVE, and it is classified as a this-month priority rather than an emergency.
An authenticated low-privilege user of the HPE Networking Fabric Composer API can suppress the audit records of their own activity, weakening the integrity of the system's logging and audit trail. The flaw is network-reachable, low-complexity and requires no user interaction, but it is confined to attackers who already hold valid operator-level credentials, such as malicious insiders or intruders who have already compromised an account. It is not listed in CISA KEV and no public exploit or PoC reference was identified, so it is rated moderate priority rather than an emergency.
An authorization bypass in the API of HPE Networking Fabric Composer lets a remote attacker who already holds low-privileged credentials (CVSS PR:L) circumvent security restrictions and modify protected resources, with high integrity impact but no confidentiality or availability impact. Network reachability of the Fabric Composer API from the attacker's position is required, and no user interaction or non-default configuration is indicated. No public exploit code and no confirmed active exploitation were identified at time of analysis; the vulnerability is assessed as a moderate-severity, moderate-priority issue rather than an emergency.
Local low-privileged users on HPE Networking Fabric Composer can bypass authentication in an API and use that access to write arbitrary files onto remote servers that the appliance has been configured to manage. The CVSS 3.1 score is 6.5 (AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N), reflecting an attacker who already holds a local account, needs no user interaction, and achieves high integrity impact that crosses into downstream servers while confidentiality and availability are unaffected. There is no public exploit identified at time of analysis and no confirmed active exploitation; priority is rated this_month - a moderate, not emergency, issue.
Denial of service in HPE Networking VIA: a buffer overflow can be triggered by an authenticated, low-privileged user, allowing the attacker to interrupt normal operation of the affected system. Impact is availability-only (CVSS 6.5, A:H with no confidentiality or integrity effect), and the trigger condition is not described in the available sources. No public exploit code has been identified at time of analysis, and the reference proof-of-concept status is unset; priority is rated this_month rather than immediate action. Note that the published CVSS vector uses AV:N while the description and independent assessment characterize the actor as a local user, so defenders should confirm whether remote authenticated access is sufficient or local access is mandatory.
Sensitive information disclosure in HPE Networking VIA allows an authenticated remote attacker with low privileges to read data that should not be exposed, with high confidentiality impact and no integrity or availability effect (CVSS 6.5, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). The prerequisite is valid authentication, so exploitation is most relevant to insiders or attackers who already hold a foothold; no public exploit has been identified at time of analysis, and the issue is rated moderate priority rather than an emergency. The specific exposed feature and affected versions are not described in the supplied data, so the HPE advisory should be consulted for scope.
Stored cross-site scripting in the WPVibes AnyWhere Elementor WordPress plugin, affecting all versions through 1.3.0, lets a holder of a low-privileged authenticated WordPress account persist a script payload that later executes in the browser of any user viewing the affected page - potentially including site administrators. The CVSS 3.1 score is 6.5 with a scope change (S:C), reflecting that the injected script runs outside the plugin's own security boundary; the assessed vector is AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, so exploitation needs valid credentials plus victim interaction rather than a fully unauthenticated attack. No public exploit code or CISA KEV entry was identified at time of analysis, and the specific plugin field or parameter that fails to neutralize input is not described in the available sources.
Stored cross-site scripting in the Barn2 Posts Table with Search & Sort WordPress plugin through 1.4.14 lets an authenticated low-privilege user inject persistent script that executes when a victim loads the affected table page. The medium-severity flaw (CVSS 6.5) requires a foothold account and victim interaction, which limits real-world exploitation; no public exploit was identified at time of analysis.
Sensitive information exposure in the WordPress plugin AnyWhere Elementor through version 1.3.0 lets low-privilege authenticated users retrieve embedded sensitive data that should not be sent to the client. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/C:H/I:N/A:N, 6.5) means a logged-in account at low privilege on an affected site can remotely read data on the confidentiality side with no interaction and no integrity or availability impact. No public exploit code or CISA KEV entry is part of the available data, and the trigger mechanism is not described in the available sources; risk is moderate and depends on how readily low-privilege accounts exist or can be obtained on a target site.
Memory exhaustion in Elastic APM Server's OpenTelemetry (OTLP/HTTP) intake lets an attacker who can submit OTLP data drive the server out of memory and terminate it, halting all APM and OpenTelemetry ingestion until the service restarts. The flaw is a resource-allocation-without-limits weakness (CWE-770, CAPEC-231 oversized serialized payloads) rated CVSS 6.5 with availability-only impact (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), so it is a moderate-severity denial of service rather than a confidentiality or integrity risk, and only deployments that expose the OTLP/HTTP endpoint are reachable by this path. No public exploit code identified at time of analysis and no CISA KEV listing; vuln.today priority is this_month, and vendor fixes are published as APM Server 8.19.24, 9.4.9 and 9.5.6 under ESA-2026-236.
Heap exhaustion in Elasticsearch's optional analysis-phonetic plugin allows an authenticated user who can write documents to, or run searches against, an index configured with an affected phonetic encoder to drive a node out of memory until it becomes unresponsive or terminates. The flaw is CWE-770 (allocation of resources without limits or throttling) and is reachable remotely with low complexity and no user interaction (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, 6.5), but only when the non-default plugin is installed and a target index actually uses a vulnerable encoder - prerequisites that substantially narrow the exposed population. Availability is the only impacted property; no public exploit code was identified at time of analysis, and the issue is not on the CISA KEV list, consistent with a this_month remediation priority rather than an emergency response.
A single crafted AMQP packet can crash Elastic Packetbeat by triggering a null pointer dereference in its AMQP protocol parser, producing an unrecovered Go runtime panic that terminates the process and halts network telemetry collection. The flaw is rated CVSS 6.5 (availability-only) and requires no AMQP authentication, but exploitation is constrained to attackers who can inject traffic onto a network segment the sensor actually monitors and only where AMQP protocol analysis is enabled - the CVSS vector is Adjacent (AV:A), so this is not reachable against an internet-exposed service. There is no CISA KEV listing and no public exploit identified at time of analysis; the vendor has published fixed releases (8.19.24, 9.4.9, 9.5.6) under ESA-2026-208, and vuln.today prioritizes it as a this-month item rather than an emergency.
Kibana can disclose the Elasticsearch credentials it uses as a service account to any authenticated user who holds privileges to onboard Observability data, because those credentials are inserted into data sent back to the client during the onboarding flow. The exposure is conditional: it occurs when the Elasticsearch connection credentials are embedded inside the Elasticsearch host URLs in the Kibana configuration, so deployments that keep credentials in separate username/password settings do not appear to expose them through this path. Fixed versions 8.19.24, 9.4.9 and 9.5.6 are published in Elastic security advisory ESA-2026-204; no public exploit has been identified at time of analysis, and the issue is rated moderate with a 'this month' remediation priority rather than an emergency.
Stored cross-site scripting in Cozmoslabs Paid Member Subscriptions through version 3.1.3 allows an authenticated user with low-level privileges to inject script that executes when another user or administrator views the affected page. The plugin does not properly neutralize input during web page generation (CWE-79), and exploitation requires victim interaction with the stored payload, which limits reliability. No public exploit was identified at time of analysis.
A denial-of-service flaw in the GStreamer JPEG 2000 decimator shipped in gst-plugins-bad allows crafted JPEG 2000 media to crash applications that decode it, via integer overflows or division by zero during tile processing. Per the assessed vector (AV:N/AC:L/PR:N/UI:R, C:N/I:N/A:H), the attack is remote but requires the user to open or play the malicious file, and impact is limited to availability - no code execution or data exposure. This is a moderate-severity issue rather than a high-priority emergency; no public exploit is identified in the supplied data, and Red Hat tracks the flaw across Red Hat Enterprise Linux 7, 8, 9 and 10. The only complete fix stated in the sources is updating to GStreamer 1.28.
SQL injection in runZero's search feature lets authenticated low-privileged users retrieve search results belonging to other organizations, breaking tenant-level data isolation. The flaw affects deployments prior to 5.1.261013.1 and has a medium CVSS score of 6.5 with confidentiality-only impact; runZero's hosted-environment logs showed testing but no adversary traffic. No public exploit code or proof-of-concept was identified at time of analysis, and exploitation requires a valid low-privileged account.
GStreamer's gst-plugins-good FLV demuxer can be driven into an assertion failure or process crash by malformed or truncated FLV streams carrying enhanced audio/video tags, producing a denial of service in applications that open or stream the file. The assessed CVSS score is 6.5 with availability-only impact and UI:R, and affected deployments include gst-plugins-good plus Red Hat Enterprise Linux 7, 8, 9, and 10. No CISA KEV entry or public exploit code was identified in the supplied data, and the vuln.today priority label is this_month.
Stored cross-site scripting in the Photo Engine (Media Organizer & Lightroom) WordPress plugin, known in the plugin directory as wplr-sync, affects every version up to and including 6.5.7 and allows an authenticated attacker with only subscriber-level access to plant arbitrary script in the 'hierarchy[].name' field. The subscriber barrier is unusually low here because the plugin's /?wplr-sync-api endpoint authenticates solely on the wplr_auth_token usermeta with no capability check, and that token is exposed in localized script data on every admin page due to a commented-out screen-condition guard, so any registered user can reach the vulnerable write path. The injected script then executes when a victim - potentially an administrator - later views the poisoned page; the issue is rated 6.4 (Medium) on the CVSS 3.1 scale with a scope change, is tracked for remediation this month rather than as an emergency, is fixed in 6.5.8, and no public exploit code has been identified at time of analysis.
Stored cross-site scripting in the SEO Engine - Smart SEO with AI, Schema & Redirection for WordPress plugin (all versions through 0.9.9) lets authenticated users with Contributor-level access or higher store entity-encoded script payloads through the REST API 'title' field; those payloads execute when a victim views the affected page. The issue is scored CVSS 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) and requires a pre-existing content-authoring role, so it is not unauthenticated or self-triggering. No KEV listing or public exploit reference appears in the supplied intelligence, and the referenced changeset compares 0.9.9 with 1.0.0, identifying 1.0.0 as the release to validate for the fix.
Stored cross-site scripting in the News Kit Addons For Elementor WordPress plugin (all versions up to and including 1.4.8) lets an authenticated attacker with subscriber-level access or above plant arbitrary script inside a post's Elementor data, which executes for any user - typically an administrator or site visitor - who later opens the injected page. This is a genuine but mid-tier priority: the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N, 6.4) is not unauthenticated, so practical exposure is concentrated on sites that permit self-registration or otherwise hand out low-privileged accounts, and the stored payload only fires when a second party views the affected page. No public exploit identified at time of analysis, and the issue is not in CISA KEV; the decision label from the priority feed is this_month.
Privilege escalation in the HPE Networking Fabric Composer API allows an authenticated attacker with low privileges to gain elevated privileges when vendor-described preconditions outside the attacker's control are met. The CVSS 3.1 vector is AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L, giving a score of 6.4 and reflecting network-reachable API access, a valid low-privileged account, high attack complexity, and high integrity impact. No public exploit was identified at time of analysis, and the issue is prioritized for this-month remediation rather than emergency response.