2026-11-04
Authenticated users of Quest Foglight for Databases can supply a crafted file path to the FileServlet endpoint and have the application read files using that path without proper validation, exposing sensitive data with the privileges of the Foglight service account (SYSTEM). The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, 6.5) confirms the attack is network-reachable and requires only a low-privileged authenticated session, with no victim interaction, and impact limited to confidentiality. There is no CISA KEV listing and no public exploit identified at time of analysis; the ZDI-26-853 advisory is a coordinated disclosure rather than evidence of exploitation, and the priority label is this_month.
MailEnable's parseObjectResponse method can disclose sensitive information to an authenticated remote attacker because it processes attacker-supplied XML without restricting external entity references (CWE-611). Exploitation requires valid low-privilege credentials (CVSS PR:L) and runs in the context of the MailEnable service account, so readable data is bounded by that account's permissions. This is a moderate-severity confidentiality-only issue; no public exploit was identified at time of analysis, and no CISA KEV listing is indicated in the provided data.
An authenticated low-privilege user can escalate privileges in MLflow Tracking Server because the get_endpoints function grants access to functionality without an authorization check. The flaw is rated CVSS 6.3 (CWE-862) and requires network reachability plus a valid account; no public exploit identified at time of analysis, and no KEV entry is provided.
MailEnable stores mailbox credentials in cleartext, creating an information-disclosure exposure (CWE-312, CVSS 5.9) that remote unauthenticated attackers could leverage only in conjunction with a separate access or disclosure primitive; the flaw alone does not provide initial access, and the CVSS vector marks attack complexity as High. No public exploit was identified at time of analysis, and the provided data does not confirm active exploitation (CISA KEV).
The PHP library spatie/url-signer up to 2.1.3 fails to type-check the `expires` query parameter in AbstractUrlSigner::validate() and BaseUrlSigner::validate() before comparing it against the current time, so malformed values (arrays, empty strings, alphanumeric, decimal, scientific-notation or oversized numeric strings) reach the expiration check without being normalized through FILTER_VALIDATE_INT. Applications that pass attacker-influenced URLs to the signer are affected; unauthenticated remote attackers can supply crafted query strings (PR:N, UI:N). Impact is limited to availability (A:L) with no confidentiality or integrity effect, and processing such input yields a failed validation rather than a bypass; a public PoC reference exists (the upstream commit adds regression tests for these malformed inputs), but it is not verified as working exploit code, and there is no CISA KEV listing. Upgrading to 2.1.4 resolves the issue.
Authenticated privilege escalation in MLflow Tracking Server lets a low-privileged user reach functionality and resources that should be restricted from their account, because the server's BEFORE_REQUEST_HANDLERS configuration grants access without a prior authorization check (CWE-862 Missing Authorization). Exploitation requires a valid authenticated session (CVSS 3.0 base 5.4, AV:N/AC:L/PR:L/UI:N, low confidentiality and integrity impact, no availability impact), so deployments that do not enforce a multi-tier privilege model are largely unaffected. There is no CISA KEV entry and no public exploit identified at time of analysis, and the issue is tracked under ZDI-CAN-32108 / ZDI-26-842 rather than being treated as an emergency.
MLflow Tracking Server discloses sensitive information to any authenticated low-privileged user through its jobs functionality, because the _find_validator code path performs no authorization check before granting access to the underlying functionality (CWE-862, CVSS 5.4). Exploitation requires a valid session on the Tracking Server - the assessed vector confirms PR:L, so remote unauthenticated attackers cannot exploit it - plus network reachability to the server, and the exposure is bounded to confidentiality in the context of the service account. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; the vuln.today priority decision is remediation this month, and the reference ZDI-26-840 carries the vendor disclosure detail.