Monthly
Missing authorization checks in Apache Answer through 2.0.2 let an authenticated user perform mutations on non-public content they are not permitted to access, producing limited confidentiality and integrity impact on the affected instance rather than account or host takeover. Assessed severity is moderate (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) and the flaw requires a valid account, making instances that allow open or self-service registration the most exposed. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (CISA KEV); upgrading to Apache Answer 2.0.3 is the fix.
Unauthenticated access to NeuVector's manager /network/graph API exposes cached network topology data in all versions through 5.4.9, allowing any network-reachable attacker to retrieve sensitive container environment details without credentials. The missing authentication on this endpoint (CWE-202) means the container security platform itself becomes a reconnaissance source, potentially revealing Kubernetes service relationships, container names, and network flow data to adversaries. No public exploit code or active exploitation (KEV) has been identified at time of analysis, but the unauthenticated network vector significantly lowers the bar for exploitation.
Unauthenticated access to Apache SkyWalking 9.7.0 to 10.3.0 allows remote attackers to retrieve sensitive MySQL/PostgreSQL configuration details through the /debugging/config/dump endpoint. No active exploitation or public exploit code is known, though the attack is trivial and automatable. The low EPSS score (0.02%) indicates minimal real-world exploitation likelihood.
PostgreSQL Anonymizer before 3.3.0 can leave statistics derived from original, pre-masking data visible in pg_stats after static masking has been applied, until an ANALYZE operation or autovacuum refreshes the table statistics. An authenticated PostgreSQL user with access to pg_stats for the affected relation could read common values, histograms, or range bounds that reveal information about the original data; the exposure is limited to metadata rather than row contents and is time-bounded because routine statistics maintenance clears it. No public exploit identified at time of analysis, and the issue is rated CVSS 4.3 with a fix in 3.3.0.
PostgreSQL Anonymizer before 3.3.0 leaves table optimizer statistics fully readable to any role holding SELECT, so a masked role can recover a limited statistical sample of the very values the mask is supposed to hide. Exploitation requires an authenticated principal that has been assigned a masked database role with SELECT on the target table, and yields only histogram bounds and most-common-value entries rather than full rows, which keeps this at low severity (CVSS 3.5, assessed 3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). No public exploit has been identified at time of analysis and the issue is not in CISA KEV; the fix ships in PostgreSQL Anonymizer 3.3.0.
Information disclosure in TP-Link Deco BE63 v2.0 lets an attacker who already holds administrative privileges on the device, and can reach it from an adjacent LAN or Wi-Fi segment, query the cloud-client daemon and recover the linked TP-Link ID account password in plaintext. That credential could then be used to access the associated TP-Link cloud account and perform actions as the affected user. The vendor has released a firmware update, and no public exploit was identified at time of analysis; the independent assessment rates this as a constrained medium-severity risk because exploitation requires admin access and adjacent-network positioning.
Improper authorization in the similar-question search of Apache Answer through 2.0.2 allows an authenticated user to retrieve metadata belonging to non-public questions they are not entitled to see. The issue is remotely reachable, low complexity, and requires only a valid account plus use of the similar-question search feature, matching the assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, so impact is confined to information disclosure of question metadata with no effect on integrity or availability. No public exploit code has been identified at time of analysis and there is no confirmation of active exploitation (not in CISA KEV); the vendor-stated fix is Apache Answer 2.0.3.
Unauthenticated information disclosure in Apache Answer through 2.0.2 allows remote attackers to read comments tied to non-public (restricted) content by browsing public user profiles, which are rendered without re-checking the visibility of the parent content. The issue is network-reachable, requires no authentication or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), and is bounded to comment disclosure - no content bodies, credentials, or write capability are exposed, and instances hosting only public Q&A material have little to leak. No public exploit code has been identified at time of analysis and there is no indication of active exploitation; users should upgrade to version 2.0.3, which fixes the issue.
Improper input validation in the Backstage Scaffolder backend (@backstage/plugin-scaffolder-backend) before version 4.1.0 allows an authenticated user with permission to create and read scaffolder tasks to influence how the task list endpoint orders results, enabling inference of confidential task data such as secrets. Exploitation is not straightforward: the assessed vector is CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N (5.3 Medium), and the advisory requires four stacked preconditions - the target task's secrets must still be retained (not purged), the attacker must be able to see the target task, the attacker must already know the structure of the secret being inferred, and the attack depends on many repeated list requests - so the practical outcome is partial inference rather than guaranteed full secret disclosure. There is no public exploit identified at time of analysis, and no KEV listing; the issue is fixed in @backstage/plugin-scaffolder-backend 4.1.0 (Backstage release v1.54.6).
Information disclosure in the MediaWiki PageTriage extension (versions 1.43, 1.45, and 1.46) allows an authenticated, low-privileged user to elicit restricted data through the extension's data-query interface. Exploitation requires a specific precondition (AT:P) and passive user interaction (UI:P), and the impact is limited to low confidentiality loss with no effect on integrity or availability; no public exploit identified at time of analysis. The Wikimedia Foundation has published an upstream fix via Gerrit, and this is a low-priority issue that does not warrant urgent action.
Missing authorization checks in Apache Answer through 2.0.2 let an authenticated user perform mutations on non-public content they are not permitted to access, producing limited confidentiality and integrity impact on the affected instance rather than account or host takeover. Assessed severity is moderate (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) and the flaw requires a valid account, making instances that allow open or self-service registration the most exposed. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (CISA KEV); upgrading to Apache Answer 2.0.3 is the fix.
Unauthenticated access to NeuVector's manager /network/graph API exposes cached network topology data in all versions through 5.4.9, allowing any network-reachable attacker to retrieve sensitive container environment details without credentials. The missing authentication on this endpoint (CWE-202) means the container security platform itself becomes a reconnaissance source, potentially revealing Kubernetes service relationships, container names, and network flow data to adversaries. No public exploit code or active exploitation (KEV) has been identified at time of analysis, but the unauthenticated network vector significantly lowers the bar for exploitation.
Unauthenticated access to Apache SkyWalking 9.7.0 to 10.3.0 allows remote attackers to retrieve sensitive MySQL/PostgreSQL configuration details through the /debugging/config/dump endpoint. No active exploitation or public exploit code is known, though the attack is trivial and automatable. The low EPSS score (0.02%) indicates minimal real-world exploitation likelihood.
PostgreSQL Anonymizer before 3.3.0 can leave statistics derived from original, pre-masking data visible in pg_stats after static masking has been applied, until an ANALYZE operation or autovacuum refreshes the table statistics. An authenticated PostgreSQL user with access to pg_stats for the affected relation could read common values, histograms, or range bounds that reveal information about the original data; the exposure is limited to metadata rather than row contents and is time-bounded because routine statistics maintenance clears it. No public exploit identified at time of analysis, and the issue is rated CVSS 4.3 with a fix in 3.3.0.
PostgreSQL Anonymizer before 3.3.0 leaves table optimizer statistics fully readable to any role holding SELECT, so a masked role can recover a limited statistical sample of the very values the mask is supposed to hide. Exploitation requires an authenticated principal that has been assigned a masked database role with SELECT on the target table, and yields only histogram bounds and most-common-value entries rather than full rows, which keeps this at low severity (CVSS 3.5, assessed 3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). No public exploit has been identified at time of analysis and the issue is not in CISA KEV; the fix ships in PostgreSQL Anonymizer 3.3.0.
Information disclosure in TP-Link Deco BE63 v2.0 lets an attacker who already holds administrative privileges on the device, and can reach it from an adjacent LAN or Wi-Fi segment, query the cloud-client daemon and recover the linked TP-Link ID account password in plaintext. That credential could then be used to access the associated TP-Link cloud account and perform actions as the affected user. The vendor has released a firmware update, and no public exploit was identified at time of analysis; the independent assessment rates this as a constrained medium-severity risk because exploitation requires admin access and adjacent-network positioning.
Improper authorization in the similar-question search of Apache Answer through 2.0.2 allows an authenticated user to retrieve metadata belonging to non-public questions they are not entitled to see. The issue is remotely reachable, low complexity, and requires only a valid account plus use of the similar-question search feature, matching the assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, so impact is confined to information disclosure of question metadata with no effect on integrity or availability. No public exploit code has been identified at time of analysis and there is no confirmation of active exploitation (not in CISA KEV); the vendor-stated fix is Apache Answer 2.0.3.
Unauthenticated information disclosure in Apache Answer through 2.0.2 allows remote attackers to read comments tied to non-public (restricted) content by browsing public user profiles, which are rendered without re-checking the visibility of the parent content. The issue is network-reachable, requires no authentication or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), and is bounded to comment disclosure - no content bodies, credentials, or write capability are exposed, and instances hosting only public Q&A material have little to leak. No public exploit code has been identified at time of analysis and there is no indication of active exploitation; users should upgrade to version 2.0.3, which fixes the issue.
Improper input validation in the Backstage Scaffolder backend (@backstage/plugin-scaffolder-backend) before version 4.1.0 allows an authenticated user with permission to create and read scaffolder tasks to influence how the task list endpoint orders results, enabling inference of confidential task data such as secrets. Exploitation is not straightforward: the assessed vector is CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N (5.3 Medium), and the advisory requires four stacked preconditions - the target task's secrets must still be retained (not purged), the attacker must be able to see the target task, the attacker must already know the structure of the secret being inferred, and the attack depends on many repeated list requests - so the practical outcome is partial inference rather than guaranteed full secret disclosure. There is no public exploit identified at time of analysis, and no KEV listing; the issue is fixed in @backstage/plugin-scaffolder-backend 4.1.0 (Backstage release v1.54.6).
Information disclosure in the MediaWiki PageTriage extension (versions 1.43, 1.45, and 1.46) allows an authenticated, low-privileged user to elicit restricted data through the extension's data-query interface. Exploitation requires a specific precondition (AT:P) and passive user interaction (UI:P), and the impact is limited to low confidentiality loss with no effect on integrity or availability; no public exploit identified at time of analysis. The Wikimedia Foundation has published an upstream fix via Gerrit, and this is a low-priority issue that does not warrant urgent action.