Monthly
Privilege escalation in Frauscher FDS 102 (versions 2.11.0 through 2.13.3) allows a low-privileged authenticated attacker to create new user accounts with arbitrary role values - including the application's highest privilege level - by submitting a crafted request to the PHP endpoint /api/user/add.php. The user creation API fails to enforce authorization on the role parameter (CWE-863: Incorrect Authorization), permitting authenticated non-admins to self-elevate or plant backdoor admin accounts. No public exploit code or CISA KEV listing has been identified at time of analysis, but the CVSS 4.0 vector indicates high subsequent-system impact (SC:H/SI:H/SA:H), consistent with this being an OT/industrial railway platform where administrative access can affect connected field devices.
Insufficient authorization on GutenKit REST API endpoints allows any WordPress user with Contributor-level access or above to read mailing-list audience metadata from marketing accounts connected to the site. Affected installations running GutenKit versions prior to 2.5.0 with an integrated email marketing platform (e.g., Mailchimp) are exposed to unauthorized data disclosure. A public proof-of-concept is available via WPScan, though SSVC confirms no active exploitation at time of analysis.
Privilege escalation in Splunk AI Toolkit before 6.0.0 allows any authenticated low-privileged user to operate with system-level permissions by exploiting a session key substitution flaw in the Agent Run History handler. The handler unconditionally replaces the caller's session key with a system authentication token before executing searches, completely bypassing Splunk's role-based access controls that gate elevated operations behind 'admin' or 'power' roles. This grants unauthorized read access to all indexed data, cross-user search job enumeration and deletion, and write-level system integrity impact - no public exploit has been identified at time of analysis, but the low exploitation complexity and clear mechanism description make this a high-priority patching target for Splunk enterprise deployments.
Splunk SOAR versions below 8.6.0 expose tenant names and identifiers to authenticated users whose roles restrict them to a subset of tenants, due to a REST API authorization enforcement gap. In multi-tenant deployments, a low-privileged user can enumerate out-of-scope tenant metadata - names and identifiers - without triggering any access control check. No active exploitation or public exploit code has been identified; the CVSS score of 4.3 (Medium) reflects limited confidentiality impact with no integrity or availability consequence.
Splunk Enterprise contains a stored SPL injection flaw in the Table Editor that allows a lower-privileged 'power' role user to plant risky Search Processing Language commands inside a shared dataset, which then execute silently under an 'admin' user's elevated permissions when that admin opens the dataset's Initial Data step. Affected versions span four release lines: below 10.4.2, 10.2.6, 10.0.9, and 9.4.14. A successful attack exposes all data accessible to the admin and allows modification of Splunk lookup files. No public exploit has been identified at time of analysis, and CISA KEV does not list this vulnerability as actively exploited.
Splunk Enterprise's Table Editor dataset feature permits a 'power' role user to inject attacker-controlled Search Processing Language (SPL) into a shared dataset, which silently executes with admin-level permissions when an administrator opens the dataset. Affected deployments span four version branches: 9.4 prior to 9.4.14, 10.0 prior to 10.0.9, 10.2 prior to 10.2.6, and 10.4 prior to 10.4.2. Because the Table Editor omits SPL safeguards for risky commands during the initial data preparation phase (CWE-863), a successfully phished admin can unwittingly expose all search-head-accessible data and allow limited data modification. No public exploit is identified at time of analysis, and the vulnerability does not appear in CISA's KEV catalog.
Cross-community post featuring abuse in Lemmy allows authenticated community moderators to manipulate post visibility across unrelated communities via crafted federated ActivityPub activities. Affected versions span 0.19.0 through 0.19.18 (stable) and all alpha builds prior to 1.0.0-alpha.20. A moderator legitimate in one community can send crafted CollectionAdd or CollectionRemove activities targeting posts in communities they have no authority over, injecting content into or removing it from featured feeds without authorization. No public exploit has been identified and the issue is absent from CISA KEV; vendor-released patches are available in 0.19.19 and 1.0.0-alpha.20.
Privilege escalation to administrative API access in Etherpad 2.1.0 through 3.0.x lets any authenticated non-admin OAuth user invoke instance-wide admin functions. The flaw is a broken authorization check in the /api/2/* handler that treats the mere presence of the admin claim as sufficient, ignoring that OAuth2Provider issues admin: false for non-admin users. Rated CVSS 9.9 with a scope change; no public exploit identified at time of analysis, but the fix is straightforward to reverse-engineer from the public patch.
IBM Power Systems Firmware across three firmware branches exposes a privilege escalation path across the BMC/FSP-to-host boundary, allowing an attacker already holding service account or root credentials on the Flexible Service Processor to read and disrupt host processor state, cascading impact to all logical partitions (LPARs) hosted on the managed system. The scope change confirmed in the CVSS vector (S:C) distinguishes this from a typical local privilege issue: exploitation crosses the management-plane isolation barrier and can affect production workloads running on every partition. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Improper authorization in Akaunting 3.1.21's BulkActions dispatcher allows authenticated low-privilege users to perform bulk operations beyond their intended access scope, potentially exposing or modifying financial records belonging to other users or organizational entities within the platform. Discovered and reported by Fluid Attacks, the flaw resides in a shared dispatcher component used across multiple modules of this open-source web-based accounting application. No public exploit has been identified at time of analysis, and a vendor-released patch is available in version 3.2.1.
Privilege escalation in Frauscher FDS 102 (versions 2.11.0 through 2.13.3) allows a low-privileged authenticated attacker to create new user accounts with arbitrary role values - including the application's highest privilege level - by submitting a crafted request to the PHP endpoint /api/user/add.php. The user creation API fails to enforce authorization on the role parameter (CWE-863: Incorrect Authorization), permitting authenticated non-admins to self-elevate or plant backdoor admin accounts. No public exploit code or CISA KEV listing has been identified at time of analysis, but the CVSS 4.0 vector indicates high subsequent-system impact (SC:H/SI:H/SA:H), consistent with this being an OT/industrial railway platform where administrative access can affect connected field devices.
Insufficient authorization on GutenKit REST API endpoints allows any WordPress user with Contributor-level access or above to read mailing-list audience metadata from marketing accounts connected to the site. Affected installations running GutenKit versions prior to 2.5.0 with an integrated email marketing platform (e.g., Mailchimp) are exposed to unauthorized data disclosure. A public proof-of-concept is available via WPScan, though SSVC confirms no active exploitation at time of analysis.
Privilege escalation in Splunk AI Toolkit before 6.0.0 allows any authenticated low-privileged user to operate with system-level permissions by exploiting a session key substitution flaw in the Agent Run History handler. The handler unconditionally replaces the caller's session key with a system authentication token before executing searches, completely bypassing Splunk's role-based access controls that gate elevated operations behind 'admin' or 'power' roles. This grants unauthorized read access to all indexed data, cross-user search job enumeration and deletion, and write-level system integrity impact - no public exploit has been identified at time of analysis, but the low exploitation complexity and clear mechanism description make this a high-priority patching target for Splunk enterprise deployments.
Splunk SOAR versions below 8.6.0 expose tenant names and identifiers to authenticated users whose roles restrict them to a subset of tenants, due to a REST API authorization enforcement gap. In multi-tenant deployments, a low-privileged user can enumerate out-of-scope tenant metadata - names and identifiers - without triggering any access control check. No active exploitation or public exploit code has been identified; the CVSS score of 4.3 (Medium) reflects limited confidentiality impact with no integrity or availability consequence.
Splunk Enterprise contains a stored SPL injection flaw in the Table Editor that allows a lower-privileged 'power' role user to plant risky Search Processing Language commands inside a shared dataset, which then execute silently under an 'admin' user's elevated permissions when that admin opens the dataset's Initial Data step. Affected versions span four release lines: below 10.4.2, 10.2.6, 10.0.9, and 9.4.14. A successful attack exposes all data accessible to the admin and allows modification of Splunk lookup files. No public exploit has been identified at time of analysis, and CISA KEV does not list this vulnerability as actively exploited.
Splunk Enterprise's Table Editor dataset feature permits a 'power' role user to inject attacker-controlled Search Processing Language (SPL) into a shared dataset, which silently executes with admin-level permissions when an administrator opens the dataset. Affected deployments span four version branches: 9.4 prior to 9.4.14, 10.0 prior to 10.0.9, 10.2 prior to 10.2.6, and 10.4 prior to 10.4.2. Because the Table Editor omits SPL safeguards for risky commands during the initial data preparation phase (CWE-863), a successfully phished admin can unwittingly expose all search-head-accessible data and allow limited data modification. No public exploit is identified at time of analysis, and the vulnerability does not appear in CISA's KEV catalog.
Cross-community post featuring abuse in Lemmy allows authenticated community moderators to manipulate post visibility across unrelated communities via crafted federated ActivityPub activities. Affected versions span 0.19.0 through 0.19.18 (stable) and all alpha builds prior to 1.0.0-alpha.20. A moderator legitimate in one community can send crafted CollectionAdd or CollectionRemove activities targeting posts in communities they have no authority over, injecting content into or removing it from featured feeds without authorization. No public exploit has been identified and the issue is absent from CISA KEV; vendor-released patches are available in 0.19.19 and 1.0.0-alpha.20.
Privilege escalation to administrative API access in Etherpad 2.1.0 through 3.0.x lets any authenticated non-admin OAuth user invoke instance-wide admin functions. The flaw is a broken authorization check in the /api/2/* handler that treats the mere presence of the admin claim as sufficient, ignoring that OAuth2Provider issues admin: false for non-admin users. Rated CVSS 9.9 with a scope change; no public exploit identified at time of analysis, but the fix is straightforward to reverse-engineer from the public patch.
IBM Power Systems Firmware across three firmware branches exposes a privilege escalation path across the BMC/FSP-to-host boundary, allowing an attacker already holding service account or root credentials on the Flexible Service Processor to read and disrupt host processor state, cascading impact to all logical partitions (LPARs) hosted on the managed system. The scope change confirmed in the CVSS vector (S:C) distinguishes this from a typical local privilege issue: exploitation crosses the management-plane isolation barrier and can affect production workloads running on every partition. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Improper authorization in Akaunting 3.1.21's BulkActions dispatcher allows authenticated low-privilege users to perform bulk operations beyond their intended access scope, potentially exposing or modifying financial records belonging to other users or organizational entities within the platform. Discovered and reported by Fluid Attacks, the flaw resides in a shared dispatcher component used across multiple modules of this open-source web-based accounting application. No public exploit has been identified at time of analysis, and a vendor-released patch is available in version 3.2.1.