Information Disclosure
Monthly
Sensitive information disclosure in Combodo iTop prior to version 3.2.3 leaks raw exception messages to authenticated users through the application's AJAX rendering layer. In ajax.render.php, caught exceptions were echoed back to the browser via $e->GetMessage() (HTML-escaped to prevent XSS, but not content-filtered), potentially exposing internal file paths, database schema details, stack context, or configuration fragments. No public exploit has been identified at time of analysis, and the low CVSS score of 3.5 reflects limited practical impact; however, the disclosed internals can meaningfully assist further reconnaissance.
Unauthenticated information disclosure in CrossWatch prior to v0.9.21 allows any network-accessible attacker to enumerate active session metadata via GET /api/app-auth/status, including originating IP addresses, User-Agent strings, internal session IDs, and creation/expiry timestamps. All CrossWatch deployments running versions before 0.9.21 with a network-accessible API are affected. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, though exploitation requires only a standard HTTP client with no credentials.
Symlink-following vulnerability in Runtipi 4.10.0 and earlier enables authenticated administrators to write arbitrary content to any filesystem path accessible by the Runtipi process. An attacker with admin credentials plants a symlink inside a crafted backup archive targeting an arbitrary path, restores the archive via the backup API, and then invokes the user-config write endpoint - causing FilesystemService.writeTextFile() to follow the planted link and write attacker-controlled content outside the intended directory boundary. No public exploit is identified at time of analysis; vendor-released patch v4.10.1 is available and the fix is confirmed by GitHub advisory GHSA-wcrf-g9p9-2wg7.
Integer overflow in GNU Emacs PBM/PPM/PGM image loader (all versions before 31.0.91) enables heap memory disclosure when a user opens a crafted image file. Signed integer multiplication of image height, width, and channel count wraps to a negative value for sufficiently large inputs, bypassing the allocated-buffer bounds check and allowing the pixel reader to over-read heap contents, which are then rendered on-screen as color values. No active exploitation has been confirmed (not in CISA KEV), and no public exploit code has been identified at time of analysis; however, the VulnCheck-reported CVSS 4.0 score of 6.9 reflects high confidentiality and availability impact under local conditions with user interaction.
Version disclosure in Combodo iTop's login page exposes the complete application version string in the HTML title attribute of the logo element to unauthenticated remote users. All iTop releases prior to 3.2.3 are affected; the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no authentication or user interaction against any network-accessible login page. No active exploitation has been confirmed (not in CISA KEV) and no public POC has been identified; this vulnerability primarily enables reconnaissance that can be chained into version-targeted follow-on attacks.
Hidden volume creation in VeraCrypt 1.26.6 through 1.26.28 leaves forensically detectable plaintext markers inside file-hosted hidden volume containers, directly undermining plausible deniability guarantees. The FormatNoFs and FormatFat functions apply a quick-format optimization that writes zeroed sectors at predictable 128 MiB intervals via WriteFile, bypassing the EncryptDataUnits path that would fill the area with indistinguishable ciphertext; a forensic examiner with access to the container can identify these anomalous plaintext artifacts and infer hidden volume presence. Encryption strength and hidden-volume contents are not compromised - impact is confined to deniability failure. No public exploit has been identified and this vulnerability is not listed in CISA KEV.
Key derivation in VeraCrypt's non-default wolfCrypt backend silently substituted HKDF for PBKDF2-HMAC in SHA-256 and SHA-512 volume-header derivation, discarding the configured iteration count entirely - meaning any PIM or iteration tuning applied by users of affected builds provided zero additional brute-force resistance. Any attacker who obtains a volume file produced by a WOLFCRYPT=1 source build can attempt password recovery at HKDF speeds rather than PBKDF2-iterated cost, dramatically reducing the work factor. Official precompiled VeraCrypt binaries and standard distribution packages are entirely unaffected; no public exploit has been identified and this vulnerability is not listed in CISA KEV.
Cleartext credential exposure in Johnson Controls Simplex Incident Manager / Autocall Fire Administrator (all versions before 2.01.05) allows a local low-privilege attacker who meets specific preconditions to retrieve sensitive data stored unencrypted in application memory (CWE-316). The CVSS 4.0 vector's subsequent-system confidentiality impact (SC:H) is especially notable given this platform interfaces with fire alarm controllers and building safety networks, meaning extracted credentials could be leveraged against downstream safety-critical infrastructure. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Token exfiltration in Infracost prior to 0.10.45 allows an attacker who controls scanned Terraform source to redirect a configured Terraform Cloud or registry credential to an arbitrary attacker-controlled host. The vulnerable code path in internal/hcl/remote_variables_loader.go derived the destination hostname from untrusted Terraform cloud/backend block attributes without validating it against the operator-configured trusted host. CI pipelines using pull_request_target or same-repository pull request workflows that expose a TFC token to Infracost scans are affected; standard fork pull_request workflows without secrets are explicitly not vulnerable. No public exploit code has been identified at time of analysis, and this CVE is not listed in CISA KEV.
Information disclosure in the Brushfire video content streaming platform (online.brushfire.com) exposes internal database path strings within HTTP responses to unauthenticated remote users, allowing enumeration of other users' data. The root cause is CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere), where backend infrastructure details are insufficiently abstracted from client-facing responses. The vendor applied a server-side fix in February 2026; no active exploitation has been confirmed and no public proof-of-concept has been identified.
Out-of-bounds read in iccDEV (all versions prior to 2.3.2.1) crashes the ICC profile parser via a size_t integer underflow in CIccEmbedIO::Read8() when processing embedded ICC v5 profiles. Unauthenticated remote attackers can trigger the denial-of-service condition by delivering a maliciously crafted ICC profile that requires user interaction to parse (e.g., opening a file in an application backed by this library). No public exploit code and no CISA KEV listing exist at time of analysis; vendor-released patch version 2.3.2.1 is available.
Vault token disclosure in the N-able PassPortal browser extension (versions before 3.49.6) stems from missing origin validation on postMessage events, classified under CWE-1385. A malicious web page can send a crafted postMessage to the extension listener, causing it to disclose HashiCorp Vault tokens to an untrusted origin - enabling authentication abuse against any Vault instance the user's session is authorized to access. No public exploit code has been identified at time of analysis, but the network-accessible, unauthenticated attack path (UI:A in CVSS 4.0) and high confidentiality impact make this a meaningful credential theft risk for MSP environments.
Spring AI 2.0.0's Semantic Cache feature leaks cached LLM responses across unrelated system prompt contexts due to insufficient isolation in the context hashing mechanism. Applications using semantic caching across multiple tenants or security domains - where different system prompts define distinct access boundaries - are at risk of cross-context information disclosure and response tampering. Exploitation requires authenticated access and high attack complexity (AC:H, PR:L); no public exploit code and no CISA KEV listing exist at time of analysis.
Stored shortcode injection in the ProfilePress WordPress plugin before 4.17.1 allows unauthenticated attackers to persist shortcodes in two unfiltered profile fields, which WordPress then executes when any visitor loads the public profile page. The impact is limited to information disclosure - exposing a targeted user's email address, login date, and registration date - but the attack requires no elevated privileges and no special configuration beyond default plugin deployment. A publicly available exploit exists per WPScan's disclosure; patch version 4.17.1 is confirmed available from the vendor.
Username denylist bypass in Limit Login Attempts Security (Limit Login Attempts Reloaded) before version 3.3.5 allows a WordPress user who has been explicitly blocked by an administrator to successfully authenticate by varying the case of their username or by supplying the account's associated email address instead. This is a logic flaw in the plugin's denylist enforcement, entirely defeating the access control that a site administrator intended to impose on specific accounts. A publicly available proof-of-concept is documented in the WPScan advisory; the low CVSS score of 3.7 with AC:H reflects that successful exploitation requires the attacker to already hold valid credentials for the denylisted account.
Webhook authentication bypass in the Charitable WordPress donation plugin (versions before 1.8.12) allows unauthenticated remote attackers to forge Square payment webhook notifications, causing the plugin to record donations as successfully paid without any actual financial transaction occurring. The vulnerability exists in all default configurations where Square is the configured payment gateway, requiring no credentials or user interaction to exploit. A publicly available proof-of-concept exists per WPScan reporting, though this vulnerability has not been listed in CISA's Known Exploited Vulnerabilities catalog at time of analysis.
Payment gateway merchant account verification is entirely absent in the myCred WordPress plugin before version 3.2.5, enabling unauthenticated remote attackers to fraudulently inflate their in-site credit balances by routing payments to a gateway account they control instead of the site operator's. An attacker needs only to complete a payment of the expected amount through a supported gateway and trigger the resulting notification to the vulnerable site - no knowledge of or access to the site's merchant credentials is required. A publicly available exploit exists per WPScan reporting (EUVD-2026-63909), and a vendor-released patch in version 3.2.5 is confirmed available.
Improper authorization in Dolibarr's user account management component (htdocs/user/card.php) through version 23.0.4 permits authenticated non-admin users to delete administrator accounts by supplying an arbitrary user ID to the Account Handler. The commit diff confirms the root cause: the deletion code path executed without verifying whether the target account held admin privileges or whether the requesting user was an administrator. A public exploit exists (CVSS 4.0 supplemental E:P); no active exploitation has been confirmed via CISA KEV.
STIX document import in misp-stix through version 2026.7.8 allows an unauthenticated attacker who can supply a crafted STIX bundle to inject arbitrary MISP attribute metadata - including distribution level, sharing_group_id, and classification tags - into the importing MISP instance. The import pipeline trusted attacker-controlled STIX fields (tool labels for STIX2, document title for STIX1) to decide whether content originated from MISP itself, and then passed the complete x_misp_attributes dictionary without field filtering directly into attribute creation. No public exploit has been identified at time of analysis; patch commits are available upstream from the MISP project.
Improper output encoding in Apache CloudStack's management UI exposes administrators to cross-site scripting (XSS) when using the Lock User functionality across versions 4.20.0.0-4.20.3.0 and 4.21.0.0-4.22.1.0. A low-privilege user can embed a malicious script payload in a user-controlled field; when an administrator invokes the Lock User workflow, the CloudStack UI renders the payload without proper HTML or JavaScript escaping, executing it in the admin's browser session. No public exploit or CISA KEV listing has been identified at time of analysis, but the potential for admin session hijacking makes this a meaningful risk in multi-tenant environments.
Sensitive information exposure in Apache CloudStack's Webhook module allows unauthorized actors to view data they should not have access to during webhook delivery listing and deletion operations. Affected deployments span versions 4.20.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0, covering two active release trains. No public exploit or active exploitation has been identified at time of analysis; vendor-released patches are available.
CRLF injection in @fastify/busboy's multipart part-header parser allows unauthenticated remote attackers to embed bare carriage return or line feed characters into parsed Content-Disposition filenames and field names, which are then handed to applications as if they were clean values. All versions through 3.2.1 are affected; the fix is in 3.2.2. When applications forward these tainted values to CR/LF-sensitive sinks - HTTP response headers, log systems, or filesystem paths - attackers can achieve log forging, HTTP header injection, or filesystem filename pollution. No public exploit or CISA KEV listing has been identified at time of analysis.
Unauthorized post data disclosure in the Duplicate Post WordPress plugin before 1.5.6 allows authenticated users holding a delegated role to read content, metadata, and passwords for posts they should not have access to - including other users' private and draft posts. The CVSS vector (PR:H/C:L) reflects a constrained impact limited to information disclosure within authenticated contexts, making this a meaningful risk in multi-user editorial WordPress environments but not in single-author deployments. A publicly available proof-of-concept exists per WPScan's advisory; no active exploitation has been confirmed via CISA KEV.
Unauthenticated information disclosure in Dokan WooCommerce Multivendor Marketplace plugin (versions before 5.0.14) allows any remote actor to retrieve per-vendor commission configuration from an unprotected store REST endpoint without credentials. The exposed data includes commission type and, where category-based commissions are configured, per-category and default commission rates - leaking potentially sensitive business financial details for every vendor on the marketplace. A publicly available proof-of-concept exists; however, active exploitation has not been confirmed via CISA KEV.
Kernel heap corruption and GPU memory leaks in Imagination Technologies Graphics DDK expose systems to local denial-of-service from non-privileged users. A double-free defect in the GPU memory free paths - triggered via user-initiated GPU system calls - can corrupt kernel heap state or cause memory leaks, with potential availability impact at the kernel level. No active exploitation is confirmed (EPSS 0.15%, no CISA KEV listing), but a vendor patch is available and a ChromeOS stable channel advisory confirms real-world distribution reach.
Private thread content disclosure in Rocket.Chat exposes all private thread parents and their full reply content to any low-privilege authenticated user on instances running versions prior to 8.8.0 across multiple maintained release branches. By substituting a MongoDB operator object (e.g., {"$gt": ""}) for the expected string room-id or thread message-id in the Meteor DDP methods getThreadsList and getThreadMessages, an attacker with any valid account can cause downstream MongoDB queries to fan out across all rooms while the authorization check resolves only to a room the attacker legitimately accesses. No public exploit has been identified at time of analysis, but the technique is straightforward for any developer familiar with DDP WebSocket debugging, and the fix pattern is visible in the public GitHub pull request.
Unexpected application termination in Apple macOS arises when processing a maliciously crafted file, triggering an out-of-bounds read (CWE-125) that crashes the handling application. Affected versions span all three active macOS release trains: Sonoma prior to 14.8.5, Sequoia prior to 15.7.5, and Tahoe prior to 26.4. No public exploit code has been identified and EPSS sits at the 5th percentile (0.15%), indicating low real-world exploitation probability; vendor-released patches are available for all three tracks.
Kernel memory disclosure in IBM AIX 7.2 and 7.3, and IBM PowerVM VIOS 4.1 allows a local attacker with standard user privileges to read sensitive out-of-bounds kernel memory via an unspecified vulnerability. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms exploitation requires only a local shell account with no elevated rights, making it viable for any authenticated local user or a compromised service account. No public exploit code has been identified at time of analysis, and IBM has released a patch via the vendor advisory.
IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 expose sensitive information over the network, enabling remote unauthenticated attackers to intercept in-flight messages and forge replies. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no credentials or user interaction, making any network-adjacent attacker a potential threat. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog; IBM has released a patch.
Windows Remote Help versions 5.0.0.0 through below 5.2.1040.0 exposes an uncontrolled search path element (CWE-427) that enables an authorized local attacker with standard user privileges to deny service against the Remote Help application. The flaw stems from the application resolving executable dependencies or resources through a controllable or insufficiently constrained search path, allowing a low-privilege local user to interfere with path resolution and crash the process. No public exploit code or active exploitation has been identified at time of analysis; Microsoft has released a remediation in version 5.2.1040.0.
Out-of-bounds read in Capstone's SuperH (SH) architecture disassembler crashes the host process when fed crafted SH2A or SH4A bytecode. Versions 6.0.0-Alpha9 and earlier are affected when the library handle is configured with CS_ARCH_SH plus CS_MODE_SH2A or CS_MODE_SH4A and CS_MODE_SHFPU; the disassembler derives an idx value from a raw 16-bit instruction and dereferences a mode-specific decode[] function-pointer table without a bounds check. The demonstrated impact is limited to process termination - no code execution or information disclosure was shown - and a vendor-released patch is available in 6.0.0-Alpha10.
Cross-site WebSocket hijacking in Mailpit 1.29.0-1.30.5 exposes live email metadata to any website the developer visits, due to a percent-encoding bypass in the origin-check middleware. The origin guard inspects the raw `RequestURI` for an `/api/` prefix, but Go's `ServeMux` routes on the percent-decoded path - so a request to `/%61pi/events` skips the guard and reaches the `/api/events` WebSocket handler, whose upgrader unconditionally accepts every origin. An attacker-controlled page can receive a live stream of message IDs, headers, subjects, and body snippets from a default, unauthenticated Mailpit instance; a working proof of concept is documented in GHSA-8r62-w5wh-fc5m, though no CISA KEV listing exists at time of analysis.
Webhook signature bypass in the appwrite/templates github-issue-bot (≤ 1.1.2) allows any unauthenticated network caller to invoke the bot's comment-posting functionality without a valid GitHub HMAC signature. An inverted boolean condition in verifyWebhook causes requests lacking the X-Hub-Signature-256 header to short-circuit to success, so the body is processed as if it were a legitimate GitHub event. With attacker-controlled repository, issue, and author fields passed directly to postComment, the deployment's GITHUB_TOKEN is used to post arbitrary comments on any accessible GitHub repository and issue. No public exploit code is identified at time of analysis.
Unsalted MD5 password hashing in Ech0's `MD5Encrypt` function (`internal/util/crypto/crypto.go`) stores credentials in a format trivially crackable via rainbow tables or GPU-accelerated brute force. Versions 5.4.0 and 5.4.1 are confirmed affected; the migration comment in the fix explicitly labels the stored values as 'historical bare MD5' (历史裸 MD5), confirming no per-user salt was applied. Ech0 5.4.2 resolves this by backfilling existing hashes to a dedicated `user_local_auth` table and enabling lazy bcrypt upgrade on next login. No public exploit exists and no active exploitation has been confirmed.
Binary HTTP parser in Netty's `netty-incubator-codec-bhttp` (all versions through 0.0.22.Final) crashes with an unchecked `ArrayIndexOutOfBoundsException` when processing a 15-byte crafted payload, enabling remote unauthenticated denial of service. The parser accumulates attacker-controlled varint field lengths - read correctly as `long` - into `int` offset counters; a value of 2^31 silently wraps the accumulator negative via Java's compound-assignment narrowing, bypassing the readable-bytes guard and reaching unchecked buffer index arithmetic. Publicly available exploit code exists per the GitHub advisory GHSA-pgrf-4654-3gq8; no active exploitation is confirmed in CISA KEV.
Unauthorized page content disclosure in Wagtail's internal Pages admin API allows any authenticated Wagtail admin user to read draft and live page fields - including title, slug, seo_title, search_description, and all custom fields declared in api_fields - for pages outside their permitted access scope. The root cause is CWE-280: the get_base_queryset method on PagesAdminAPIViewSet does not scope its queryset through the page permission policy, bypassing page-level access controls entirely. Patched releases (7.0.9, 7.3.4, 7.4.3, 8.0rc2) are available, and no public exploit or active exploitation has been identified at time of analysis.
Unauthenticated arbitrary JSON file read in the npm package next-video (versions ≤ 2.8.0) exposes cryptographic server secrets to any remote attacker who can reach the /api/video route. The /api/video request handler accepts a url query parameter and, for any value not beginning with https://, constructs a local filesystem path by appending .json and serving the file contents directly with no authentication, no path canonicalization, and no directory traversal guard. Applications following the documented one-liner setup are at risk of exposing the Next.js Server Actions AES encryption key, Preview/Draft Mode signing and encryption keys, internal build manifests, and Mux-specific asset metadata. No public exploit code or CISA KEV listing has been identified at time of analysis.
User enumeration via observable response discrepancy in Frappe's personal data download (GDPR) endpoint allows unauthenticated remote attackers to determine whether any email address corresponds to a registered account. The PersonalDataDownloadRequest handler in frappe/website/doctype/personal_data_download_request/personal_data_download_request.py returned the user_name field and persisted the document to the database only for known users, producing structurally distinct responses that an attacker could compare to systematically harvest registered email addresses. No public exploit has been identified at time of analysis; vendor-released patches exist at versions 15.115.0 and 16.27.0.
HTTP chunked trailer smuggling in libevent before 2.1.13 and 2.2.2-alpha allows unauthenticated remote attackers to inject security-sensitive header fields - such as Authorization or X-Forwarded-For - via chunked transfer encoding trailers that libevent merges directly into its request header store. In deployments fronted by a reverse proxy, the proxy evaluates the original headers while libevent processes the attacker-supplied trailers as authoritative input headers, enabling authorization bypass, proxy-header spoofing, and cache poisoning. No public exploit has been identified at time of analysis; vendor-released patches exist in both stable and alpha release branches.
Cache isolation failure in django CMS allows unauthenticated network attackers to both read other users' header-personalized page content and poison the page cache with attacker-chosen content. Affected installations must have CMS_PAGE_CACHE enabled and at least one plugin implementing get_vary_cache_on() - when those conditions hold, the page cache key is computed without the plugin-declared header values, so the first cached variant is served to all subsequent visitors regardless of their headers. No public exploit exists and CISA KEV has not listed this vulnerability, but the attack is mechanically straightforward in affected configurations.
Catalyst::Plugin::Static::Simple through 0.38 unconditionally marks all static file responses as publicly cacheable via Cache-Control: public, including responses to requests bearing an Authorization header. This means shared HTTP proxies may cache authenticated responses and serve them to subsequent unauthenticated requestors. The documented mitigation of setting expires to 0 is silently ignored, leaving operators with no effective means to restrict caching behavior until the patch is applied. No public exploit or CISA KEV entry exists; EPSS is 0.18% (8th percentile), indicating low opportunistic exploitation probability.
Cross-cluster MITM attacks are enabled in Red Hat Advanced Cluster Management for Kubernetes 2.x via the lighthouse service discovery component, which fails to validate IP addresses advertised in EndpointSlice objects. An attacker controlling a compromised spoke cluster can inject arbitrary IP addresses into EndpointSlices, causing lighthouse DNS resolution across all connected clusters to redirect legitimate cross-cluster service traffic to attacker-controlled endpoints. The CVSS Scope:Changed metric confirms that impact propagates beyond the compromised spoke cluster to the hub and peer clusters, enabling unauthorized interception and manipulation of inter-cluster communications. No public exploit code or CISA KEV listing has been identified at time of analysis.
Cross-cluster traffic redirection in Submariner (as shipped with Red Hat Advanced Cluster Management for Kubernetes 2) allows a malicious or compromised member cluster to hijack traffic from peer clusters by advertising a specially crafted network endpoint. Because Submariner does not validate the subnets a spoke cluster declares, an attacker-controlled cluster can claim arbitrary CIDR ranges and cause peer clusters to route all matching traffic through the attacker's tunnel, enabling information disclosure and denial of connectivity. Rated CVSS 9.9 with a changed scope, this affects the multicluster networking layer, though there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Multipart body parsing in Cesanta Mongoose before 7.22 can be manipulated by a remote unauthenticated attacker to truncate headers, filenames, or boundary values through injection of a lone carriage return or line feed. The logic error in mg_http_next_multipart() causes CRLF-scanning loops to terminate prematurely on any single CR or LF character rather than requiring the full two-byte CRLF sequence, enabling content-type spoofing that can cause downstream application logic to accept dangerous or disallowed content. No CISA KEV listing or public proof-of-concept has been identified at time of analysis; the fix is confirmed in release 7.22.
Type confusion in the Lean 4 proof assistant kernel allows a malicious metaprogram to produce a proof of False carrying no axioms, from which any proposition can be derived, completely breaking kernel soundness. The vulnerability arises from two related defects in src/kernel/inductive.cpp: projection expressions do not verify that the named structure matches the projected value's type, and environment::add_inductive fails to type-check the parametric arguments of nested inductive applications after they are replaced by auxiliary types, letting those arguments escape kernel verification entirely - exploitable through the normal maximum-kernel-checking addDecl path without sorry, unsafeCast, or unsafe annotations. Publicly available exploit code exists at multiple repositories; this CVE is not listed in CISA KEV.
Cross-host redirect cookie leakage in Hurl ≤ 8.0.1 exposes session credentials to attacker-controlled redirect destinations when scripts use the dedicated [Cookies] section. Hurl's HTTP client correctly strips raw Cookie headers and Authorization credentials on host changes, but the separate RequestSpec.cookies pathway - populated by the [Cookies] section of .hurl files - bypasses this stripping logic, forwarding scoped cookies to the redirected host. No public exploit code is identified and this vulnerability is not in CISA KEV; the CVSS 4.0 score of 6.9 reflects high confidentiality impact gated by the requirement that a user actively runs the affected script.
Out-of-bounds read in the prh_l2_decode_packet function of Sony XAV-9500ES car head unit firmware 3.02.0.0 exposes device memory contents to network-adjacent attackers over Bluetooth. Exploitation requires a malicious Bluetooth device to be paired with the target unit, after which crafted L2CAP packets trigger a read past the end of an allocated buffer, leaking sensitive memory. While the standalone impact is information disclosure, ZDI notes this vulnerability can be chained with additional flaws to achieve arbitrary code execution on the device; no public exploit identified at time of analysis.
Sandbox escape in Nix versions before 2.35.0 allows a malicious build derivation - executed under the experimental `recursive-nix` feature - to create or truncate empty files outside the build sandbox using the nix-daemon's permissions by exploiting a TOCTOU race in the LocalStore path-restore logic. The race window exists between path resolution and the `open()` call with `O_TRUNC` in `writeFile`, which previously lacked `O_NOFOLLOW` enforcement, letting an attacker substitute a symlink mid-flight to redirect the write. No public exploit has been identified and the vulnerability is not listed in CISA KEV; the official fix is confirmed in Nix 2.35.0.
Remote code execution in EMQX's plugin installation API allows an attacker who has obtained a compromised dashboard administrator credential or plugin-install-capable API key to upload and execute arbitrary Erlang code with full EMQX process privileges. Prior to versions 5.8.11, 5.9.3, 5.10.4, 6.0.3, 6.1.2, and 6.2.1, installation grants issued via `emqx ctl plugins allow` had no expiration and no cryptographic binding to specific package bytes, meaning a stale permit could be reused with attacker-controlled .tar.gz content submitted to POST /api/v5/plugins/install. No public exploit has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Injection in PentestGPT's Web-Page Crawling component (versions up to 1.0.0) allows remote attackers to manipulate the Traceback argument during crawling operations, producing limited confidentiality, integrity, and availability impact against the vulnerable instance. The CVSS 4.0 score of 2.3 reflects a genuinely low-severity finding - high attack complexity and required passive user interaction constrain real-world exploitation to difficult, targeted scenarios. A public proof-of-concept exists, but the upstream maintainer closed the associated GitHub issue as 'not planned', leaving the flaw unpatched with no remediation in sight.
STARTTLS response injection in aiosmtplib prior to version 5.1.2 allows an active network attacker to desynchronize SMTP command-response pairs by staging plaintext bytes that survive the TLS transport upgrade into the encrypted session. The root cause is that SMTPProtocol.start_tls in protocol.py fails to flush its internal _buffer before calling loop.start_tls, so any attacker-injected SMTP response lines appended after the legitimate 220 reply are subsequently parsed as if they arrived inside the TLS tunnel. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the CVSS AC:H rating confirms exploitation requires an active man-in-the-middle network position.
Predictable account activation tokens in ATutor 2.2.4 allow unauthenticated remote attackers to activate unconfirmed user accounts without access to the victim's email inbox. The account confirmation workflow generates tokens from insufficiently random values tied to user registration data (CWE-340), making the token space enumerable or guessable by an attacker who can observe registration patterns. No vendor patch exists or will be released - the product has reached end-of-life - and no public exploit code or CISA KEV listing has been identified at time of analysis.
Missing or insecure Cross-Origin Resource Sharing (CORS) headers in HCL IntelliOps Event Management (IEM) expose the application to unauthorized cross-origin browser interactions. The CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N vector indicates that a highly privileged IEM user must be socially engineered into visiting a malicious page while authenticated, allowing an attacker's script to read IEM responses or issue limited requests on the victim's behalf. No active exploitation has been confirmed and no public exploit code has been identified at time of analysis.
Privilege escalation in HCL IntelliOps Event Management (IEM) allows an authenticated, high-privileged attacker to access resources beyond their original authorization boundary, achieving confidentiality impact against protected data. The vulnerability is classified as CWE-272 (Least Privilege Violation) with a Changed scope in CVSS, indicating the attacker can reach resources outside their normal privilege domain within the application. No public exploit code or active exploitation has been identified at time of analysis; the EPSS signal was not provided.
Race condition (CWE-362) in HCL IntelliOps Event Management (IEM) exposes a timing window that a remote, unauthenticated attacker can exploit to modify shared resources, producing high integrity impact. The CVSS 3.1 score of 5.9 reflects the offsetting effect of high attack complexity (AC:H), which limits opportunistic exploitation to adversaries capable of precise timing control. No active exploitation has been confirmed by CISA KEV, and no public exploit code is known at time of analysis.
Insufficient audit logging in HCL IntelliOps Event Management (IEM) allows an authenticated low-privilege network user to perform workflow actions that are not captured in security logs, breaking observability for incident response teams. All versions of IEM are affected per the wildcard CPE, and the CVSS Scope:Changed metric indicates the logging gap propagates impact to downstream audit platforms or SIEMs that depend on IEM event data. No public exploit code exists and CISA has not listed this in the KEV catalog; the primary risk is forensic and compliance-oriented rather than direct system compromise.
Insufficient audit logging in HCL IntelliOps Event Management (IEM) allows authenticated network users to probe privilege boundaries and conduct reconnaissance without generating detectable log entries. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms any low-privileged authenticated user can exploit this over the network with no complexity barrier. No public exploit code or active exploitation has been identified; this is a vendor-self-reported issue with no EPSS data or KEV listing.
Local File Inclusion (LFI) in the WP Cafe Pro WordPress plugin before version 3.0.15 allows an authenticated WordPress Author to include arbitrary files from the server's filesystem via unsanitized input passed to PHP file inclusion functions. The vulnerability is classified under CWE-98 and requires a high-privilege WordPress account (Author role), limiting opportunistic exploitation but enabling significant damage - including credential theft and potential remote code execution - if a trusted but malicious or compromised Author account is present. Patchstack reported this flaw and confirmed remediation in version 3.0.15. No public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated Local File Inclusion (LFI) in the Shuffle WordPress theme by Edge Themes affects all versions up to and including 1.8, allowing a remote attacker without any credentials to force the PHP application to include arbitrary local files from the server. Successful exploitation can expose sensitive files such as wp-config.php (containing database credentials) and, under certain server configurations, escalate to remote code execution via log poisoning or similar chaining techniques. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS 8.1 score and CWE-98 classification indicate a high-severity, high-impact path.
Sandbox escape in n8n's JavaScript Code node allows authenticated workflow authors to break out of the Node.js VM sandbox by polluting an unfrozen Function.prototype, ultimately recovering a reference to the host process's globalThis object. Affected are n8n deployments running versions prior to 1.123.69, 2.33.4, and 2.34.1 where users hold workflow creation and execution permissions. Full exploitation also requires that specific Node.js modules are present on the allowlist of the deployment's import configuration, raising practical complexity but making impact highly deployment-dependent. No public exploit code or CISA KEV listing has been identified at time of analysis.
Integer truncation in libsoup's SoupServer Range-header comparator silently drops byte ranges from HTTP 206 Partial Content responses when the target resource exceeds approximately 2 GB. The sort_ranges() function in soup-message-headers.c narrows a 64-bit offset subtraction to a 32-bit int return value, inverting the comparator sign whenever offsets differ by more than INT_MAX, causing incorrect range sorting and silent omission of content. No public exploit code or CISA KEV listing has been identified at time of analysis; exploitation requires network access to a SoupServer instance serving files larger than ~2 GB.
User enumeration in the Frauscher FDS 102 railway diagnostic system allows low-privileged remote attackers to retrieve the complete list of configured accounts and identify which hold elevated privileges via the unprotected PHP endpoint /api/user/fetch-all.php. The CPE confirms all tracked versions of the FDS 102 are affected, and the CVSS 4.0 vector (PR:L) indicates exploitation requires an existing low-privilege credential but no user interaction. No public exploit code and no active exploitation have been identified at time of analysis; this is reported by CERTVDE under advisory VDE-2026-078.
OS command injection in vsDesk's Task Scheduler component enables authenticated administrators to execute arbitrary operating system commands on the underlying server due to insufficient input filtering. Affecting at least vsDesk 11.06.02, the flaw - discovered and reported by Kaspersky - can be leveraged to disrupt web server operations, exfiltrate sensitive data, or achieve full server compromise. No public exploit code or CISA KEV listing has been identified at time of analysis; exploitation requires high-privilege authenticated access, which meaningfully constrains opportunistic attack scenarios.
File enumeration in vsDesk service desk software allows remote authenticated attackers to predict and retrieve uploaded files by brute-forcing timestamp-derived filenames within a narrow time window. Affected instances running versions prior to 14.0101 expose any uploaded document to unauthorized access by any logged-in user, enabling secondary attacks through sensitive file exfiltration. No public exploit code has been identified at the time of analysis, and no CISA KEV listing exists.
Revoked root certificates embedded in multiple Seiko Epson printers and scanners expose device communications to interception via man-in-the-middle attacks. Affected products continue to trust certificates that have been revoked, violating the chain-of-trust model defined by CWE-296, and allowing a suitably positioned attacker to decrypt or read transmitted data. No active exploitation has been confirmed (no CISA KEV listing), and the high attack complexity required for network positioning limits real-world exposure, but confidentiality of printer/scanner communications - potentially including scanned document content - is at risk.
Direct HTTP access to an exposed SQL database backup file in code-projects Login Registration System 1.0 allows unauthenticated remote attackers to download the raw database dump at /loginsystem/database/login_registration_system.sql, disclosing user credentials, schema details, and any sensitive data stored in the application database. This is a CWE-552 file exposure defect - the backup artifact is stored within the web-accessible document root with no access controls. No exploitation beyond a standard HTTP GET request is required. A public proof-of-concept exploit exists; no KEV listing at time of analysis.
Unauthenticated information disclosure in The Library Corporation LS2 Admin (versions 5.7 through 5.8.0) exposes sensitive administrative export endpoints - including location configuration data - to any remote attacker without credentials. The root cause is CWE-306 (Missing Authentication for Critical Function), confirmed by a CVSS vector of AV:N/AC:L/PR:N/UI:N and the 'Authentication Bypass' tag. A GitHub gist reference may document the technique publicly, though confirmed active exploitation is absent from CISA KEV and EPSS sits at a low 0.17% (6th percentile).
Pcapng file parser crash in Wireshark 4.6.0-4.6.7 and 4.4.0-4.4.18 enables denial of service via a locally-opened malformed capture file. Rooted in CWE-125 (Out-of-Bounds Read), the parser reads beyond an allocated buffer boundary when processing certain pcapng structures, causing application termination. No public exploit identified at time of analysis and not listed in CISA KEV; real-world risk is constrained by the local attack vector and required user interaction.
Wireshark's Kerberos protocol dissector in versions 4.4.0-4.4.18 and 4.6.0-4.6.7 contains an out-of-bounds read (CWE-125) that crashes the application when parsing a maliciously crafted packet capture file, causing denial of service. Exploitation requires a local user to actively open the crafted file, making this a user-interaction-dependent, local-vector attack with no confidentiality or integrity impact. No public exploit code or active exploitation has been identified at time of analysis.
Denial of service in Wireshark's Bluetooth Hands-Free Profile (HFP) protocol dissector affects versions 4.6.0-4.6.7 and 4.4.0-4.4.18, causing application crashes via malformed HFP traffic or crafted capture files. The CWE-125 out-of-bounds read root cause is confirmed by NVD; CVSS impact is confined to availability (A:H, C:N, I:N), though tags include 'Information Disclosure' - a discrepancy unresolved from available data. No public exploit code identified and this is not listed in CISA KEV, keeping real-world risk moderate and largely limited to active Wireshark users handling Bluetooth traffic.
Denial of service via crash affects the Bluetooth Attribute Protocol (ATT) dissector in Wireshark 4.4.0-4.4.17 and 4.6.0-4.6.7, caused by an out-of-bounds read (CWE-125) when processing malformed ATT packets. Exploitation requires user interaction - specifically opening a crafted packet capture file or capturing live malicious Bluetooth traffic - and carries no code execution potential. Fixed releases 4.4.18 and 4.6.8 are available from the Wireshark Foundation; no public exploit code or CISA KEV listing has been identified at time of analysis.
Partial API key exposure in Splunk On-Call (VictorOps) app versions below 1.0.43 allows any authenticated Splunk user - regardless of role - to read a partially masked VictorOps API key from the App Key Value Store (KV Store). The app fails to fully mask the API key prior to persisting it in a KV Store collection that is readable by low-privileged users who do not hold the 'admin' or 'power' Splunk roles, violating the principle of least-privilege for credential storage. No public exploit code has been identified and this vulnerability is not listed in CISA KEV; the CVSS score of 4.3 aligns with the limited, partial credential exposure.
Unauthenticated ReDoS in Splunk Connect for Kafka below version 2.2.7 allows a network-accessible attacker to permanently block a Kafka Connect worker thread by submitting a pathological regular expression via the Kafka Connect REST API, which - when triggered by attacker-supplied or coincident matching event data during timestamp extraction - causes the regex engine to backtrack catastrophically without bound. The practical result is complete stoppage of event delivery for the targeted connector, constituting a targeted denial-of-service against Splunk data ingestion pipelines. No public exploit code or CISA KEV listing exists at time of analysis; the CVSS AC:H rating reflects the two-condition prerequisite, moderating the net risk score to 5.9 Medium despite the unauthenticated network vector.
Unauthenticated model content injection in Splunk AI Toolkit below 6.0.0 allows an authenticated attacker with model upload privileges to overwrite another user's in-progress model upload by racing concurrent requests to the same model name, causing the resulting model lookup entry to reference attacker-controlled content. The root cause is the toolkit's failure to bind uploaded file content to the specific request that creates the corresponding model lookup entry, enabling a TOCTOU-style substitution. No public exploit code or CISA KEV listing has been identified; the vendor (Splunk) has released a patch in version 6.0.0.
Unauthenticated exposure of the OpenAPI specification in Cisco Talos Intelligence for Enterprise Security Cloud (versions below 1.0.3) allows any network-accessible user to retrieve the add-on's full REST API documentation via Splunk Web static file paths. The disclosed specification reveals API endpoint structure and the authentication model, enabling reconnaissance that could facilitate targeted follow-on attacks. No active exploitation or public exploit code has been identified at time of analysis.
Cleartext exposure of Zoom meeting passwords in the Splunk SOAR interface affects all deployments running the Zoom app for Splunk SOAR below version 3.2.2. Any authenticated SOAR user holding a role with permission to run actions can invoke the create meeting, update meeting, or update user settings actions and observe meeting passwords and personal meeting ID (PMI) passwords in plaintext within the SOAR UI. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Cleartext credential exposure in Venafi app for Splunk SOAR versions below 2.1.4 allows any authenticated user with action-run permissions to read keystore and private-key passwords directly from the Splunk SOAR user interface. The root cause is that the app's `keystore_password` and `password` parameters in the 'get certificate' action are not flagged as password-type fields, bypassing the SOAR platform's native masking mechanism. No public exploit code identified at time of analysis, and there is no CISA KEV listing; however, the exposed credentials could enable downstream PKI compromise if observed by a malicious insider.
Cleartext exposure of archive passwords in Splunk Attack Analyzer Connector for Splunk SOAR (versions below 2.2.1) allows authenticated users with action-running permissions to view sensitive archive_password values unmasked in the SOAR user interface. The connector's detonate file and detonate url actions fail to mark the archive_password parameter as a password type, causing the SOAR framework to render it in plaintext during and after action execution. No active exploitation has been identified - the CVE carries no CISA KEV listing and no known public exploit code - but insider or compromised-account exposure is straightforward for any SOAR user with the relevant role.
Information disclosure in the RSA SecurID Authentication Manager app for Splunk SOAR (versions below 1.0.5) exposes RSA token serial numbers in cleartext to any authenticated user with action-run permissions. The app's 'enable token' and 'revoke token' actions fail to mark the token_serial parameter as a password field, causing it to render unmasked in the Splunk SOAR user interface. No public exploit has been identified at time of analysis, and exploitation is constrained by the requirement for an existing Splunk SOAR account with action-execution privileges.
Cleartext exposure of archive passwords in Splunk SOAR's Phantom app (versions below 3.8.5) allows authenticated users with action-running permissions to read sensitive credentials directly from the platform's user interface. The deflate item action fails to mark its password parameter as a sensitive field, causing the archive password to be rendered in plaintext in the SOAR UI to any user who invokes the action. Splunk has released a patch in version 3.8.5 per advisory SVD-2026-0806; no public exploit code or CISA KEV listing has been identified at time of analysis.
Cleartext exposure of temporary Active Directory passwords in the MS Graph for Active Directory app for Splunk SOAR (versions below 1.5.2) allows authenticated users with action-run permissions to capture credentials generated during password reset operations, as the temp_password parameter is rendered in plaintext in the SOAR interface rather than being masked. The flaw stems from the app failing to declare the affected parameter as a password type, causing the Splunk SOAR UI to treat it as generic text output. No active exploitation has been confirmed and no public POC is reported; risk is bounded by the requirement for an authenticated internal SOAR account with specific action-run role permissions.
Cleartext exposure of document passwords in the CrowdStrike OAuth API app for Splunk SOAR (versions below 5.1.3) allows any authenticated user with action-running permissions to read sensitive document_password values directly from the Splunk SOAR user interface. The root cause is the app's failure to mark the document_password parameter as a password type in both the detonate file and detonate url actions, meaning the platform's built-in masking mechanism is never invoked. Vendor patch version 5.1.3 has been released and confirmed via Splunk advisory SVD-2026-0806; no public exploit code or active exploitation has been identified at time of analysis.
Information disclosure in the Cisco Webex App for Splunk SOAR (versions below 2.2.1) exposes Webex meeting passwords in cleartext within the SOAR platform interface. Authenticated users holding roles with action-execution permissions who invoke the 'schedule meeting' action can read the plaintext meeting password directly from the UI, because the app's action manifest fails to designate the password parameter as a masked field. No active exploitation has been identified (not in CISA KEV) and no public exploit code is known; real-world impact is bounded by the requirement for existing SOAR action permissions.
Cleartext exposure of a sensitive sample password in the Cisco Secure Malware Analytics App for Splunk SOAR (versions below 2.4.5) allows authenticated users with action-run permissions to read the sample_password parameter value directly from the Splunk SOAR user interface. The root cause is the app's failure to mark the sample_password field as a password type in the detonate file action, meaning the platform never applies its standard masking behavior to that parameter. No public exploit code or active exploitation has been identified; vendor patch is available at version 2.4.5.
Cleartext exposure of temporary passwords in the Azure AD Graph app for Splunk SOAR (versions below 2.5.3) allows authenticated action-runners to read Azure AD reset credentials directly from the SOAR interface. The app's reset password action fails to classify the temp_password parameter as a sensitive field, so Splunk SOAR renders it unmasked in the UI rather than applying its standard password-masking behavior. Vendor patch 2.5.3 is available per Splunk advisory SVD-2026-0806; no public exploit code and no CISA KEV listing identified at time of analysis.
Credential exposure in the AWS IAM App for Splunk SOAR (all versions below 2.1.9) enables any authenticated user holding a role with action-execution permission to view AWS credentials in cleartext directly within the Splunk SOAR user interface. The root cause is the app's failure to designate the credentials action parameter as a password type field (CWE-312), causing the SOAR platform to render it unmasked rather than redacted. No active exploitation (CISA KEV) or public exploit code has been identified; however, because the exposed material consists of AWS access credentials rather than generic application data, the downstream business risk - potential cloud account compromise - substantially exceeds what the CVSS 4.3 Medium score conveys.
Credential exposure in the AD LDAP app for Splunk SOAR (versions below 2.3.8) allows any authenticated user holding an action-execution role to trigger a full connector process environment dump to a persistent plaintext debug log file, disclosing sensitive credentials such as LDAP bind secrets or service account tokens. The CVSS scope-changed vector (S:C) reflects that the exposed credentials extend impact beyond the SOAR platform itself to the underlying Active Directory environment. No public exploit code exists and this vulnerability is not listed in CISA KEV at time of analysis; however, patch version 2.3.8 is available and should be applied promptly given the potential for AD credential theft.
Sensitive Active Directory response data exposure in the AD LDAP App for Splunk SOAR (versions below 2.3.8) allows authenticated users holding action-execution permissions to cause AD directory data to be written to a persistent debug log file. The flaw is rooted in CWE-532 (insertion of sensitive information into log files) and is reachable over the network by any low-privileged SOAR user with the appropriate role. No public exploit code or active exploitation has been identified; Splunk has released a patch at version 2.3.8.
LDAP injection in the AD LDAP app for Splunk SOAR (versions below 2.3.8) allows authenticated low-privileged users to manipulate Active Directory queries, exposing account enumeration, sensitive attribute disclosure, and unintended modification of AD objects. Exploitation requires only a role with 'run actions' permission within Splunk SOAR - no elevated SOAR admin rights needed. Splunk has released a patch (version 2.3.8); no public exploit code or CISA KEV listing has been identified at time of analysis.
The Nmap Scanner connector for Splunk SOAR (versions prior to 3.0.15) permits privileged users to bypass Safe Mode playbook restrictions by exploiting a manifest miscategorization that marks the scan network action as read-only despite its accepting NSE script parameters capable of write operations and command execution on target systems. Users holding roles that allow editing, creating, or running playbooks can leverage this gap to run arbitrary Nmap Scripting Engine scripts against networked targets through SOAR automation - a meaningful privilege escalation given SOAR platforms typically have broad network reach. No public exploit has been identified at time of analysis, and a vendor patch is available via Splunk advisory SVD-2026-0806.
Sensitive information disclosure in Combodo iTop prior to version 3.2.3 leaks raw exception messages to authenticated users through the application's AJAX rendering layer. In ajax.render.php, caught exceptions were echoed back to the browser via $e->GetMessage() (HTML-escaped to prevent XSS, but not content-filtered), potentially exposing internal file paths, database schema details, stack context, or configuration fragments. No public exploit has been identified at time of analysis, and the low CVSS score of 3.5 reflects limited practical impact; however, the disclosed internals can meaningfully assist further reconnaissance.
Unauthenticated information disclosure in CrossWatch prior to v0.9.21 allows any network-accessible attacker to enumerate active session metadata via GET /api/app-auth/status, including originating IP addresses, User-Agent strings, internal session IDs, and creation/expiry timestamps. All CrossWatch deployments running versions before 0.9.21 with a network-accessible API are affected. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, though exploitation requires only a standard HTTP client with no credentials.
Symlink-following vulnerability in Runtipi 4.10.0 and earlier enables authenticated administrators to write arbitrary content to any filesystem path accessible by the Runtipi process. An attacker with admin credentials plants a symlink inside a crafted backup archive targeting an arbitrary path, restores the archive via the backup API, and then invokes the user-config write endpoint - causing FilesystemService.writeTextFile() to follow the planted link and write attacker-controlled content outside the intended directory boundary. No public exploit is identified at time of analysis; vendor-released patch v4.10.1 is available and the fix is confirmed by GitHub advisory GHSA-wcrf-g9p9-2wg7.
Integer overflow in GNU Emacs PBM/PPM/PGM image loader (all versions before 31.0.91) enables heap memory disclosure when a user opens a crafted image file. Signed integer multiplication of image height, width, and channel count wraps to a negative value for sufficiently large inputs, bypassing the allocated-buffer bounds check and allowing the pixel reader to over-read heap contents, which are then rendered on-screen as color values. No active exploitation has been confirmed (not in CISA KEV), and no public exploit code has been identified at time of analysis; however, the VulnCheck-reported CVSS 4.0 score of 6.9 reflects high confidentiality and availability impact under local conditions with user interaction.
Version disclosure in Combodo iTop's login page exposes the complete application version string in the HTML title attribute of the logo element to unauthenticated remote users. All iTop releases prior to 3.2.3 are affected; the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no authentication or user interaction against any network-accessible login page. No active exploitation has been confirmed (not in CISA KEV) and no public POC has been identified; this vulnerability primarily enables reconnaissance that can be chained into version-targeted follow-on attacks.
Hidden volume creation in VeraCrypt 1.26.6 through 1.26.28 leaves forensically detectable plaintext markers inside file-hosted hidden volume containers, directly undermining plausible deniability guarantees. The FormatNoFs and FormatFat functions apply a quick-format optimization that writes zeroed sectors at predictable 128 MiB intervals via WriteFile, bypassing the EncryptDataUnits path that would fill the area with indistinguishable ciphertext; a forensic examiner with access to the container can identify these anomalous plaintext artifacts and infer hidden volume presence. Encryption strength and hidden-volume contents are not compromised - impact is confined to deniability failure. No public exploit has been identified and this vulnerability is not listed in CISA KEV.
Key derivation in VeraCrypt's non-default wolfCrypt backend silently substituted HKDF for PBKDF2-HMAC in SHA-256 and SHA-512 volume-header derivation, discarding the configured iteration count entirely - meaning any PIM or iteration tuning applied by users of affected builds provided zero additional brute-force resistance. Any attacker who obtains a volume file produced by a WOLFCRYPT=1 source build can attempt password recovery at HKDF speeds rather than PBKDF2-iterated cost, dramatically reducing the work factor. Official precompiled VeraCrypt binaries and standard distribution packages are entirely unaffected; no public exploit has been identified and this vulnerability is not listed in CISA KEV.
Cleartext credential exposure in Johnson Controls Simplex Incident Manager / Autocall Fire Administrator (all versions before 2.01.05) allows a local low-privilege attacker who meets specific preconditions to retrieve sensitive data stored unencrypted in application memory (CWE-316). The CVSS 4.0 vector's subsequent-system confidentiality impact (SC:H) is especially notable given this platform interfaces with fire alarm controllers and building safety networks, meaning extracted credentials could be leveraged against downstream safety-critical infrastructure. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Token exfiltration in Infracost prior to 0.10.45 allows an attacker who controls scanned Terraform source to redirect a configured Terraform Cloud or registry credential to an arbitrary attacker-controlled host. The vulnerable code path in internal/hcl/remote_variables_loader.go derived the destination hostname from untrusted Terraform cloud/backend block attributes without validating it against the operator-configured trusted host. CI pipelines using pull_request_target or same-repository pull request workflows that expose a TFC token to Infracost scans are affected; standard fork pull_request workflows without secrets are explicitly not vulnerable. No public exploit code has been identified at time of analysis, and this CVE is not listed in CISA KEV.
Information disclosure in the Brushfire video content streaming platform (online.brushfire.com) exposes internal database path strings within HTTP responses to unauthenticated remote users, allowing enumeration of other users' data. The root cause is CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere), where backend infrastructure details are insufficiently abstracted from client-facing responses. The vendor applied a server-side fix in February 2026; no active exploitation has been confirmed and no public proof-of-concept has been identified.
Out-of-bounds read in iccDEV (all versions prior to 2.3.2.1) crashes the ICC profile parser via a size_t integer underflow in CIccEmbedIO::Read8() when processing embedded ICC v5 profiles. Unauthenticated remote attackers can trigger the denial-of-service condition by delivering a maliciously crafted ICC profile that requires user interaction to parse (e.g., opening a file in an application backed by this library). No public exploit code and no CISA KEV listing exist at time of analysis; vendor-released patch version 2.3.2.1 is available.
Vault token disclosure in the N-able PassPortal browser extension (versions before 3.49.6) stems from missing origin validation on postMessage events, classified under CWE-1385. A malicious web page can send a crafted postMessage to the extension listener, causing it to disclose HashiCorp Vault tokens to an untrusted origin - enabling authentication abuse against any Vault instance the user's session is authorized to access. No public exploit code has been identified at time of analysis, but the network-accessible, unauthenticated attack path (UI:A in CVSS 4.0) and high confidentiality impact make this a meaningful credential theft risk for MSP environments.
Spring AI 2.0.0's Semantic Cache feature leaks cached LLM responses across unrelated system prompt contexts due to insufficient isolation in the context hashing mechanism. Applications using semantic caching across multiple tenants or security domains - where different system prompts define distinct access boundaries - are at risk of cross-context information disclosure and response tampering. Exploitation requires authenticated access and high attack complexity (AC:H, PR:L); no public exploit code and no CISA KEV listing exist at time of analysis.
Stored shortcode injection in the ProfilePress WordPress plugin before 4.17.1 allows unauthenticated attackers to persist shortcodes in two unfiltered profile fields, which WordPress then executes when any visitor loads the public profile page. The impact is limited to information disclosure - exposing a targeted user's email address, login date, and registration date - but the attack requires no elevated privileges and no special configuration beyond default plugin deployment. A publicly available exploit exists per WPScan's disclosure; patch version 4.17.1 is confirmed available from the vendor.
Username denylist bypass in Limit Login Attempts Security (Limit Login Attempts Reloaded) before version 3.3.5 allows a WordPress user who has been explicitly blocked by an administrator to successfully authenticate by varying the case of their username or by supplying the account's associated email address instead. This is a logic flaw in the plugin's denylist enforcement, entirely defeating the access control that a site administrator intended to impose on specific accounts. A publicly available proof-of-concept is documented in the WPScan advisory; the low CVSS score of 3.7 with AC:H reflects that successful exploitation requires the attacker to already hold valid credentials for the denylisted account.
Webhook authentication bypass in the Charitable WordPress donation plugin (versions before 1.8.12) allows unauthenticated remote attackers to forge Square payment webhook notifications, causing the plugin to record donations as successfully paid without any actual financial transaction occurring. The vulnerability exists in all default configurations where Square is the configured payment gateway, requiring no credentials or user interaction to exploit. A publicly available proof-of-concept exists per WPScan reporting, though this vulnerability has not been listed in CISA's Known Exploited Vulnerabilities catalog at time of analysis.
Payment gateway merchant account verification is entirely absent in the myCred WordPress plugin before version 3.2.5, enabling unauthenticated remote attackers to fraudulently inflate their in-site credit balances by routing payments to a gateway account they control instead of the site operator's. An attacker needs only to complete a payment of the expected amount through a supported gateway and trigger the resulting notification to the vulnerable site - no knowledge of or access to the site's merchant credentials is required. A publicly available exploit exists per WPScan reporting (EUVD-2026-63909), and a vendor-released patch in version 3.2.5 is confirmed available.
Improper authorization in Dolibarr's user account management component (htdocs/user/card.php) through version 23.0.4 permits authenticated non-admin users to delete administrator accounts by supplying an arbitrary user ID to the Account Handler. The commit diff confirms the root cause: the deletion code path executed without verifying whether the target account held admin privileges or whether the requesting user was an administrator. A public exploit exists (CVSS 4.0 supplemental E:P); no active exploitation has been confirmed via CISA KEV.
STIX document import in misp-stix through version 2026.7.8 allows an unauthenticated attacker who can supply a crafted STIX bundle to inject arbitrary MISP attribute metadata - including distribution level, sharing_group_id, and classification tags - into the importing MISP instance. The import pipeline trusted attacker-controlled STIX fields (tool labels for STIX2, document title for STIX1) to decide whether content originated from MISP itself, and then passed the complete x_misp_attributes dictionary without field filtering directly into attribute creation. No public exploit has been identified at time of analysis; patch commits are available upstream from the MISP project.
Improper output encoding in Apache CloudStack's management UI exposes administrators to cross-site scripting (XSS) when using the Lock User functionality across versions 4.20.0.0-4.20.3.0 and 4.21.0.0-4.22.1.0. A low-privilege user can embed a malicious script payload in a user-controlled field; when an administrator invokes the Lock User workflow, the CloudStack UI renders the payload without proper HTML or JavaScript escaping, executing it in the admin's browser session. No public exploit or CISA KEV listing has been identified at time of analysis, but the potential for admin session hijacking makes this a meaningful risk in multi-tenant environments.
Sensitive information exposure in Apache CloudStack's Webhook module allows unauthorized actors to view data they should not have access to during webhook delivery listing and deletion operations. Affected deployments span versions 4.20.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0, covering two active release trains. No public exploit or active exploitation has been identified at time of analysis; vendor-released patches are available.
CRLF injection in @fastify/busboy's multipart part-header parser allows unauthenticated remote attackers to embed bare carriage return or line feed characters into parsed Content-Disposition filenames and field names, which are then handed to applications as if they were clean values. All versions through 3.2.1 are affected; the fix is in 3.2.2. When applications forward these tainted values to CR/LF-sensitive sinks - HTTP response headers, log systems, or filesystem paths - attackers can achieve log forging, HTTP header injection, or filesystem filename pollution. No public exploit or CISA KEV listing has been identified at time of analysis.
Unauthorized post data disclosure in the Duplicate Post WordPress plugin before 1.5.6 allows authenticated users holding a delegated role to read content, metadata, and passwords for posts they should not have access to - including other users' private and draft posts. The CVSS vector (PR:H/C:L) reflects a constrained impact limited to information disclosure within authenticated contexts, making this a meaningful risk in multi-user editorial WordPress environments but not in single-author deployments. A publicly available proof-of-concept exists per WPScan's advisory; no active exploitation has been confirmed via CISA KEV.
Unauthenticated information disclosure in Dokan WooCommerce Multivendor Marketplace plugin (versions before 5.0.14) allows any remote actor to retrieve per-vendor commission configuration from an unprotected store REST endpoint without credentials. The exposed data includes commission type and, where category-based commissions are configured, per-category and default commission rates - leaking potentially sensitive business financial details for every vendor on the marketplace. A publicly available proof-of-concept exists; however, active exploitation has not been confirmed via CISA KEV.
Kernel heap corruption and GPU memory leaks in Imagination Technologies Graphics DDK expose systems to local denial-of-service from non-privileged users. A double-free defect in the GPU memory free paths - triggered via user-initiated GPU system calls - can corrupt kernel heap state or cause memory leaks, with potential availability impact at the kernel level. No active exploitation is confirmed (EPSS 0.15%, no CISA KEV listing), but a vendor patch is available and a ChromeOS stable channel advisory confirms real-world distribution reach.
Private thread content disclosure in Rocket.Chat exposes all private thread parents and their full reply content to any low-privilege authenticated user on instances running versions prior to 8.8.0 across multiple maintained release branches. By substituting a MongoDB operator object (e.g., {"$gt": ""}) for the expected string room-id or thread message-id in the Meteor DDP methods getThreadsList and getThreadMessages, an attacker with any valid account can cause downstream MongoDB queries to fan out across all rooms while the authorization check resolves only to a room the attacker legitimately accesses. No public exploit has been identified at time of analysis, but the technique is straightforward for any developer familiar with DDP WebSocket debugging, and the fix pattern is visible in the public GitHub pull request.
Unexpected application termination in Apple macOS arises when processing a maliciously crafted file, triggering an out-of-bounds read (CWE-125) that crashes the handling application. Affected versions span all three active macOS release trains: Sonoma prior to 14.8.5, Sequoia prior to 15.7.5, and Tahoe prior to 26.4. No public exploit code has been identified and EPSS sits at the 5th percentile (0.15%), indicating low real-world exploitation probability; vendor-released patches are available for all three tracks.
Kernel memory disclosure in IBM AIX 7.2 and 7.3, and IBM PowerVM VIOS 4.1 allows a local attacker with standard user privileges to read sensitive out-of-bounds kernel memory via an unspecified vulnerability. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms exploitation requires only a local shell account with no elevated rights, making it viable for any authenticated local user or a compromised service account. No public exploit code has been identified at time of analysis, and IBM has released a patch via the vendor advisory.
IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 expose sensitive information over the network, enabling remote unauthenticated attackers to intercept in-flight messages and forge replies. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no credentials or user interaction, making any network-adjacent attacker a potential threat. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog; IBM has released a patch.
Windows Remote Help versions 5.0.0.0 through below 5.2.1040.0 exposes an uncontrolled search path element (CWE-427) that enables an authorized local attacker with standard user privileges to deny service against the Remote Help application. The flaw stems from the application resolving executable dependencies or resources through a controllable or insufficiently constrained search path, allowing a low-privilege local user to interfere with path resolution and crash the process. No public exploit code or active exploitation has been identified at time of analysis; Microsoft has released a remediation in version 5.2.1040.0.
Out-of-bounds read in Capstone's SuperH (SH) architecture disassembler crashes the host process when fed crafted SH2A or SH4A bytecode. Versions 6.0.0-Alpha9 and earlier are affected when the library handle is configured with CS_ARCH_SH plus CS_MODE_SH2A or CS_MODE_SH4A and CS_MODE_SHFPU; the disassembler derives an idx value from a raw 16-bit instruction and dereferences a mode-specific decode[] function-pointer table without a bounds check. The demonstrated impact is limited to process termination - no code execution or information disclosure was shown - and a vendor-released patch is available in 6.0.0-Alpha10.
Cross-site WebSocket hijacking in Mailpit 1.29.0-1.30.5 exposes live email metadata to any website the developer visits, due to a percent-encoding bypass in the origin-check middleware. The origin guard inspects the raw `RequestURI` for an `/api/` prefix, but Go's `ServeMux` routes on the percent-decoded path - so a request to `/%61pi/events` skips the guard and reaches the `/api/events` WebSocket handler, whose upgrader unconditionally accepts every origin. An attacker-controlled page can receive a live stream of message IDs, headers, subjects, and body snippets from a default, unauthenticated Mailpit instance; a working proof of concept is documented in GHSA-8r62-w5wh-fc5m, though no CISA KEV listing exists at time of analysis.
Webhook signature bypass in the appwrite/templates github-issue-bot (≤ 1.1.2) allows any unauthenticated network caller to invoke the bot's comment-posting functionality without a valid GitHub HMAC signature. An inverted boolean condition in verifyWebhook causes requests lacking the X-Hub-Signature-256 header to short-circuit to success, so the body is processed as if it were a legitimate GitHub event. With attacker-controlled repository, issue, and author fields passed directly to postComment, the deployment's GITHUB_TOKEN is used to post arbitrary comments on any accessible GitHub repository and issue. No public exploit code is identified at time of analysis.
Unsalted MD5 password hashing in Ech0's `MD5Encrypt` function (`internal/util/crypto/crypto.go`) stores credentials in a format trivially crackable via rainbow tables or GPU-accelerated brute force. Versions 5.4.0 and 5.4.1 are confirmed affected; the migration comment in the fix explicitly labels the stored values as 'historical bare MD5' (历史裸 MD5), confirming no per-user salt was applied. Ech0 5.4.2 resolves this by backfilling existing hashes to a dedicated `user_local_auth` table and enabling lazy bcrypt upgrade on next login. No public exploit exists and no active exploitation has been confirmed.
Binary HTTP parser in Netty's `netty-incubator-codec-bhttp` (all versions through 0.0.22.Final) crashes with an unchecked `ArrayIndexOutOfBoundsException` when processing a 15-byte crafted payload, enabling remote unauthenticated denial of service. The parser accumulates attacker-controlled varint field lengths - read correctly as `long` - into `int` offset counters; a value of 2^31 silently wraps the accumulator negative via Java's compound-assignment narrowing, bypassing the readable-bytes guard and reaching unchecked buffer index arithmetic. Publicly available exploit code exists per the GitHub advisory GHSA-pgrf-4654-3gq8; no active exploitation is confirmed in CISA KEV.
Unauthorized page content disclosure in Wagtail's internal Pages admin API allows any authenticated Wagtail admin user to read draft and live page fields - including title, slug, seo_title, search_description, and all custom fields declared in api_fields - for pages outside their permitted access scope. The root cause is CWE-280: the get_base_queryset method on PagesAdminAPIViewSet does not scope its queryset through the page permission policy, bypassing page-level access controls entirely. Patched releases (7.0.9, 7.3.4, 7.4.3, 8.0rc2) are available, and no public exploit or active exploitation has been identified at time of analysis.
Unauthenticated arbitrary JSON file read in the npm package next-video (versions ≤ 2.8.0) exposes cryptographic server secrets to any remote attacker who can reach the /api/video route. The /api/video request handler accepts a url query parameter and, for any value not beginning with https://, constructs a local filesystem path by appending .json and serving the file contents directly with no authentication, no path canonicalization, and no directory traversal guard. Applications following the documented one-liner setup are at risk of exposing the Next.js Server Actions AES encryption key, Preview/Draft Mode signing and encryption keys, internal build manifests, and Mux-specific asset metadata. No public exploit code or CISA KEV listing has been identified at time of analysis.
User enumeration via observable response discrepancy in Frappe's personal data download (GDPR) endpoint allows unauthenticated remote attackers to determine whether any email address corresponds to a registered account. The PersonalDataDownloadRequest handler in frappe/website/doctype/personal_data_download_request/personal_data_download_request.py returned the user_name field and persisted the document to the database only for known users, producing structurally distinct responses that an attacker could compare to systematically harvest registered email addresses. No public exploit has been identified at time of analysis; vendor-released patches exist at versions 15.115.0 and 16.27.0.
HTTP chunked trailer smuggling in libevent before 2.1.13 and 2.2.2-alpha allows unauthenticated remote attackers to inject security-sensitive header fields - such as Authorization or X-Forwarded-For - via chunked transfer encoding trailers that libevent merges directly into its request header store. In deployments fronted by a reverse proxy, the proxy evaluates the original headers while libevent processes the attacker-supplied trailers as authoritative input headers, enabling authorization bypass, proxy-header spoofing, and cache poisoning. No public exploit has been identified at time of analysis; vendor-released patches exist in both stable and alpha release branches.
Cache isolation failure in django CMS allows unauthenticated network attackers to both read other users' header-personalized page content and poison the page cache with attacker-chosen content. Affected installations must have CMS_PAGE_CACHE enabled and at least one plugin implementing get_vary_cache_on() - when those conditions hold, the page cache key is computed without the plugin-declared header values, so the first cached variant is served to all subsequent visitors regardless of their headers. No public exploit exists and CISA KEV has not listed this vulnerability, but the attack is mechanically straightforward in affected configurations.
Catalyst::Plugin::Static::Simple through 0.38 unconditionally marks all static file responses as publicly cacheable via Cache-Control: public, including responses to requests bearing an Authorization header. This means shared HTTP proxies may cache authenticated responses and serve them to subsequent unauthenticated requestors. The documented mitigation of setting expires to 0 is silently ignored, leaving operators with no effective means to restrict caching behavior until the patch is applied. No public exploit or CISA KEV entry exists; EPSS is 0.18% (8th percentile), indicating low opportunistic exploitation probability.
Cross-cluster MITM attacks are enabled in Red Hat Advanced Cluster Management for Kubernetes 2.x via the lighthouse service discovery component, which fails to validate IP addresses advertised in EndpointSlice objects. An attacker controlling a compromised spoke cluster can inject arbitrary IP addresses into EndpointSlices, causing lighthouse DNS resolution across all connected clusters to redirect legitimate cross-cluster service traffic to attacker-controlled endpoints. The CVSS Scope:Changed metric confirms that impact propagates beyond the compromised spoke cluster to the hub and peer clusters, enabling unauthorized interception and manipulation of inter-cluster communications. No public exploit code or CISA KEV listing has been identified at time of analysis.
Cross-cluster traffic redirection in Submariner (as shipped with Red Hat Advanced Cluster Management for Kubernetes 2) allows a malicious or compromised member cluster to hijack traffic from peer clusters by advertising a specially crafted network endpoint. Because Submariner does not validate the subnets a spoke cluster declares, an attacker-controlled cluster can claim arbitrary CIDR ranges and cause peer clusters to route all matching traffic through the attacker's tunnel, enabling information disclosure and denial of connectivity. Rated CVSS 9.9 with a changed scope, this affects the multicluster networking layer, though there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Multipart body parsing in Cesanta Mongoose before 7.22 can be manipulated by a remote unauthenticated attacker to truncate headers, filenames, or boundary values through injection of a lone carriage return or line feed. The logic error in mg_http_next_multipart() causes CRLF-scanning loops to terminate prematurely on any single CR or LF character rather than requiring the full two-byte CRLF sequence, enabling content-type spoofing that can cause downstream application logic to accept dangerous or disallowed content. No CISA KEV listing or public proof-of-concept has been identified at time of analysis; the fix is confirmed in release 7.22.
Type confusion in the Lean 4 proof assistant kernel allows a malicious metaprogram to produce a proof of False carrying no axioms, from which any proposition can be derived, completely breaking kernel soundness. The vulnerability arises from two related defects in src/kernel/inductive.cpp: projection expressions do not verify that the named structure matches the projected value's type, and environment::add_inductive fails to type-check the parametric arguments of nested inductive applications after they are replaced by auxiliary types, letting those arguments escape kernel verification entirely - exploitable through the normal maximum-kernel-checking addDecl path without sorry, unsafeCast, or unsafe annotations. Publicly available exploit code exists at multiple repositories; this CVE is not listed in CISA KEV.
Cross-host redirect cookie leakage in Hurl ≤ 8.0.1 exposes session credentials to attacker-controlled redirect destinations when scripts use the dedicated [Cookies] section. Hurl's HTTP client correctly strips raw Cookie headers and Authorization credentials on host changes, but the separate RequestSpec.cookies pathway - populated by the [Cookies] section of .hurl files - bypasses this stripping logic, forwarding scoped cookies to the redirected host. No public exploit code is identified and this vulnerability is not in CISA KEV; the CVSS 4.0 score of 6.9 reflects high confidentiality impact gated by the requirement that a user actively runs the affected script.
Out-of-bounds read in the prh_l2_decode_packet function of Sony XAV-9500ES car head unit firmware 3.02.0.0 exposes device memory contents to network-adjacent attackers over Bluetooth. Exploitation requires a malicious Bluetooth device to be paired with the target unit, after which crafted L2CAP packets trigger a read past the end of an allocated buffer, leaking sensitive memory. While the standalone impact is information disclosure, ZDI notes this vulnerability can be chained with additional flaws to achieve arbitrary code execution on the device; no public exploit identified at time of analysis.
Sandbox escape in Nix versions before 2.35.0 allows a malicious build derivation - executed under the experimental `recursive-nix` feature - to create or truncate empty files outside the build sandbox using the nix-daemon's permissions by exploiting a TOCTOU race in the LocalStore path-restore logic. The race window exists between path resolution and the `open()` call with `O_TRUNC` in `writeFile`, which previously lacked `O_NOFOLLOW` enforcement, letting an attacker substitute a symlink mid-flight to redirect the write. No public exploit has been identified and the vulnerability is not listed in CISA KEV; the official fix is confirmed in Nix 2.35.0.
Remote code execution in EMQX's plugin installation API allows an attacker who has obtained a compromised dashboard administrator credential or plugin-install-capable API key to upload and execute arbitrary Erlang code with full EMQX process privileges. Prior to versions 5.8.11, 5.9.3, 5.10.4, 6.0.3, 6.1.2, and 6.2.1, installation grants issued via `emqx ctl plugins allow` had no expiration and no cryptographic binding to specific package bytes, meaning a stale permit could be reused with attacker-controlled .tar.gz content submitted to POST /api/v5/plugins/install. No public exploit has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Injection in PentestGPT's Web-Page Crawling component (versions up to 1.0.0) allows remote attackers to manipulate the Traceback argument during crawling operations, producing limited confidentiality, integrity, and availability impact against the vulnerable instance. The CVSS 4.0 score of 2.3 reflects a genuinely low-severity finding - high attack complexity and required passive user interaction constrain real-world exploitation to difficult, targeted scenarios. A public proof-of-concept exists, but the upstream maintainer closed the associated GitHub issue as 'not planned', leaving the flaw unpatched with no remediation in sight.
STARTTLS response injection in aiosmtplib prior to version 5.1.2 allows an active network attacker to desynchronize SMTP command-response pairs by staging plaintext bytes that survive the TLS transport upgrade into the encrypted session. The root cause is that SMTPProtocol.start_tls in protocol.py fails to flush its internal _buffer before calling loop.start_tls, so any attacker-injected SMTP response lines appended after the legitimate 220 reply are subsequently parsed as if they arrived inside the TLS tunnel. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the CVSS AC:H rating confirms exploitation requires an active man-in-the-middle network position.
Predictable account activation tokens in ATutor 2.2.4 allow unauthenticated remote attackers to activate unconfirmed user accounts without access to the victim's email inbox. The account confirmation workflow generates tokens from insufficiently random values tied to user registration data (CWE-340), making the token space enumerable or guessable by an attacker who can observe registration patterns. No vendor patch exists or will be released - the product has reached end-of-life - and no public exploit code or CISA KEV listing has been identified at time of analysis.
Missing or insecure Cross-Origin Resource Sharing (CORS) headers in HCL IntelliOps Event Management (IEM) expose the application to unauthorized cross-origin browser interactions. The CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N vector indicates that a highly privileged IEM user must be socially engineered into visiting a malicious page while authenticated, allowing an attacker's script to read IEM responses or issue limited requests on the victim's behalf. No active exploitation has been confirmed and no public exploit code has been identified at time of analysis.
Privilege escalation in HCL IntelliOps Event Management (IEM) allows an authenticated, high-privileged attacker to access resources beyond their original authorization boundary, achieving confidentiality impact against protected data. The vulnerability is classified as CWE-272 (Least Privilege Violation) with a Changed scope in CVSS, indicating the attacker can reach resources outside their normal privilege domain within the application. No public exploit code or active exploitation has been identified at time of analysis; the EPSS signal was not provided.
Race condition (CWE-362) in HCL IntelliOps Event Management (IEM) exposes a timing window that a remote, unauthenticated attacker can exploit to modify shared resources, producing high integrity impact. The CVSS 3.1 score of 5.9 reflects the offsetting effect of high attack complexity (AC:H), which limits opportunistic exploitation to adversaries capable of precise timing control. No active exploitation has been confirmed by CISA KEV, and no public exploit code is known at time of analysis.
Insufficient audit logging in HCL IntelliOps Event Management (IEM) allows an authenticated low-privilege network user to perform workflow actions that are not captured in security logs, breaking observability for incident response teams. All versions of IEM are affected per the wildcard CPE, and the CVSS Scope:Changed metric indicates the logging gap propagates impact to downstream audit platforms or SIEMs that depend on IEM event data. No public exploit code exists and CISA has not listed this in the KEV catalog; the primary risk is forensic and compliance-oriented rather than direct system compromise.
Insufficient audit logging in HCL IntelliOps Event Management (IEM) allows authenticated network users to probe privilege boundaries and conduct reconnaissance without generating detectable log entries. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms any low-privileged authenticated user can exploit this over the network with no complexity barrier. No public exploit code or active exploitation has been identified; this is a vendor-self-reported issue with no EPSS data or KEV listing.
Local File Inclusion (LFI) in the WP Cafe Pro WordPress plugin before version 3.0.15 allows an authenticated WordPress Author to include arbitrary files from the server's filesystem via unsanitized input passed to PHP file inclusion functions. The vulnerability is classified under CWE-98 and requires a high-privilege WordPress account (Author role), limiting opportunistic exploitation but enabling significant damage - including credential theft and potential remote code execution - if a trusted but malicious or compromised Author account is present. Patchstack reported this flaw and confirmed remediation in version 3.0.15. No public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated Local File Inclusion (LFI) in the Shuffle WordPress theme by Edge Themes affects all versions up to and including 1.8, allowing a remote attacker without any credentials to force the PHP application to include arbitrary local files from the server. Successful exploitation can expose sensitive files such as wp-config.php (containing database credentials) and, under certain server configurations, escalate to remote code execution via log poisoning or similar chaining techniques. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS 8.1 score and CWE-98 classification indicate a high-severity, high-impact path.
Sandbox escape in n8n's JavaScript Code node allows authenticated workflow authors to break out of the Node.js VM sandbox by polluting an unfrozen Function.prototype, ultimately recovering a reference to the host process's globalThis object. Affected are n8n deployments running versions prior to 1.123.69, 2.33.4, and 2.34.1 where users hold workflow creation and execution permissions. Full exploitation also requires that specific Node.js modules are present on the allowlist of the deployment's import configuration, raising practical complexity but making impact highly deployment-dependent. No public exploit code or CISA KEV listing has been identified at time of analysis.
Integer truncation in libsoup's SoupServer Range-header comparator silently drops byte ranges from HTTP 206 Partial Content responses when the target resource exceeds approximately 2 GB. The sort_ranges() function in soup-message-headers.c narrows a 64-bit offset subtraction to a 32-bit int return value, inverting the comparator sign whenever offsets differ by more than INT_MAX, causing incorrect range sorting and silent omission of content. No public exploit code or CISA KEV listing has been identified at time of analysis; exploitation requires network access to a SoupServer instance serving files larger than ~2 GB.
User enumeration in the Frauscher FDS 102 railway diagnostic system allows low-privileged remote attackers to retrieve the complete list of configured accounts and identify which hold elevated privileges via the unprotected PHP endpoint /api/user/fetch-all.php. The CPE confirms all tracked versions of the FDS 102 are affected, and the CVSS 4.0 vector (PR:L) indicates exploitation requires an existing low-privilege credential but no user interaction. No public exploit code and no active exploitation have been identified at time of analysis; this is reported by CERTVDE under advisory VDE-2026-078.
OS command injection in vsDesk's Task Scheduler component enables authenticated administrators to execute arbitrary operating system commands on the underlying server due to insufficient input filtering. Affecting at least vsDesk 11.06.02, the flaw - discovered and reported by Kaspersky - can be leveraged to disrupt web server operations, exfiltrate sensitive data, or achieve full server compromise. No public exploit code or CISA KEV listing has been identified at time of analysis; exploitation requires high-privilege authenticated access, which meaningfully constrains opportunistic attack scenarios.
File enumeration in vsDesk service desk software allows remote authenticated attackers to predict and retrieve uploaded files by brute-forcing timestamp-derived filenames within a narrow time window. Affected instances running versions prior to 14.0101 expose any uploaded document to unauthorized access by any logged-in user, enabling secondary attacks through sensitive file exfiltration. No public exploit code has been identified at the time of analysis, and no CISA KEV listing exists.
Revoked root certificates embedded in multiple Seiko Epson printers and scanners expose device communications to interception via man-in-the-middle attacks. Affected products continue to trust certificates that have been revoked, violating the chain-of-trust model defined by CWE-296, and allowing a suitably positioned attacker to decrypt or read transmitted data. No active exploitation has been confirmed (no CISA KEV listing), and the high attack complexity required for network positioning limits real-world exposure, but confidentiality of printer/scanner communications - potentially including scanned document content - is at risk.
Direct HTTP access to an exposed SQL database backup file in code-projects Login Registration System 1.0 allows unauthenticated remote attackers to download the raw database dump at /loginsystem/database/login_registration_system.sql, disclosing user credentials, schema details, and any sensitive data stored in the application database. This is a CWE-552 file exposure defect - the backup artifact is stored within the web-accessible document root with no access controls. No exploitation beyond a standard HTTP GET request is required. A public proof-of-concept exploit exists; no KEV listing at time of analysis.
Unauthenticated information disclosure in The Library Corporation LS2 Admin (versions 5.7 through 5.8.0) exposes sensitive administrative export endpoints - including location configuration data - to any remote attacker without credentials. The root cause is CWE-306 (Missing Authentication for Critical Function), confirmed by a CVSS vector of AV:N/AC:L/PR:N/UI:N and the 'Authentication Bypass' tag. A GitHub gist reference may document the technique publicly, though confirmed active exploitation is absent from CISA KEV and EPSS sits at a low 0.17% (6th percentile).
Pcapng file parser crash in Wireshark 4.6.0-4.6.7 and 4.4.0-4.4.18 enables denial of service via a locally-opened malformed capture file. Rooted in CWE-125 (Out-of-Bounds Read), the parser reads beyond an allocated buffer boundary when processing certain pcapng structures, causing application termination. No public exploit identified at time of analysis and not listed in CISA KEV; real-world risk is constrained by the local attack vector and required user interaction.
Wireshark's Kerberos protocol dissector in versions 4.4.0-4.4.18 and 4.6.0-4.6.7 contains an out-of-bounds read (CWE-125) that crashes the application when parsing a maliciously crafted packet capture file, causing denial of service. Exploitation requires a local user to actively open the crafted file, making this a user-interaction-dependent, local-vector attack with no confidentiality or integrity impact. No public exploit code or active exploitation has been identified at time of analysis.
Denial of service in Wireshark's Bluetooth Hands-Free Profile (HFP) protocol dissector affects versions 4.6.0-4.6.7 and 4.4.0-4.4.18, causing application crashes via malformed HFP traffic or crafted capture files. The CWE-125 out-of-bounds read root cause is confirmed by NVD; CVSS impact is confined to availability (A:H, C:N, I:N), though tags include 'Information Disclosure' - a discrepancy unresolved from available data. No public exploit code identified and this is not listed in CISA KEV, keeping real-world risk moderate and largely limited to active Wireshark users handling Bluetooth traffic.
Denial of service via crash affects the Bluetooth Attribute Protocol (ATT) dissector in Wireshark 4.4.0-4.4.17 and 4.6.0-4.6.7, caused by an out-of-bounds read (CWE-125) when processing malformed ATT packets. Exploitation requires user interaction - specifically opening a crafted packet capture file or capturing live malicious Bluetooth traffic - and carries no code execution potential. Fixed releases 4.4.18 and 4.6.8 are available from the Wireshark Foundation; no public exploit code or CISA KEV listing has been identified at time of analysis.
Partial API key exposure in Splunk On-Call (VictorOps) app versions below 1.0.43 allows any authenticated Splunk user - regardless of role - to read a partially masked VictorOps API key from the App Key Value Store (KV Store). The app fails to fully mask the API key prior to persisting it in a KV Store collection that is readable by low-privileged users who do not hold the 'admin' or 'power' Splunk roles, violating the principle of least-privilege for credential storage. No public exploit code has been identified and this vulnerability is not listed in CISA KEV; the CVSS score of 4.3 aligns with the limited, partial credential exposure.
Unauthenticated ReDoS in Splunk Connect for Kafka below version 2.2.7 allows a network-accessible attacker to permanently block a Kafka Connect worker thread by submitting a pathological regular expression via the Kafka Connect REST API, which - when triggered by attacker-supplied or coincident matching event data during timestamp extraction - causes the regex engine to backtrack catastrophically without bound. The practical result is complete stoppage of event delivery for the targeted connector, constituting a targeted denial-of-service against Splunk data ingestion pipelines. No public exploit code or CISA KEV listing exists at time of analysis; the CVSS AC:H rating reflects the two-condition prerequisite, moderating the net risk score to 5.9 Medium despite the unauthenticated network vector.
Unauthenticated model content injection in Splunk AI Toolkit below 6.0.0 allows an authenticated attacker with model upload privileges to overwrite another user's in-progress model upload by racing concurrent requests to the same model name, causing the resulting model lookup entry to reference attacker-controlled content. The root cause is the toolkit's failure to bind uploaded file content to the specific request that creates the corresponding model lookup entry, enabling a TOCTOU-style substitution. No public exploit code or CISA KEV listing has been identified; the vendor (Splunk) has released a patch in version 6.0.0.
Unauthenticated exposure of the OpenAPI specification in Cisco Talos Intelligence for Enterprise Security Cloud (versions below 1.0.3) allows any network-accessible user to retrieve the add-on's full REST API documentation via Splunk Web static file paths. The disclosed specification reveals API endpoint structure and the authentication model, enabling reconnaissance that could facilitate targeted follow-on attacks. No active exploitation or public exploit code has been identified at time of analysis.
Cleartext exposure of Zoom meeting passwords in the Splunk SOAR interface affects all deployments running the Zoom app for Splunk SOAR below version 3.2.2. Any authenticated SOAR user holding a role with permission to run actions can invoke the create meeting, update meeting, or update user settings actions and observe meeting passwords and personal meeting ID (PMI) passwords in plaintext within the SOAR UI. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Cleartext credential exposure in Venafi app for Splunk SOAR versions below 2.1.4 allows any authenticated user with action-run permissions to read keystore and private-key passwords directly from the Splunk SOAR user interface. The root cause is that the app's `keystore_password` and `password` parameters in the 'get certificate' action are not flagged as password-type fields, bypassing the SOAR platform's native masking mechanism. No public exploit code identified at time of analysis, and there is no CISA KEV listing; however, the exposed credentials could enable downstream PKI compromise if observed by a malicious insider.
Cleartext exposure of archive passwords in Splunk Attack Analyzer Connector for Splunk SOAR (versions below 2.2.1) allows authenticated users with action-running permissions to view sensitive archive_password values unmasked in the SOAR user interface. The connector's detonate file and detonate url actions fail to mark the archive_password parameter as a password type, causing the SOAR framework to render it in plaintext during and after action execution. No active exploitation has been identified - the CVE carries no CISA KEV listing and no known public exploit code - but insider or compromised-account exposure is straightforward for any SOAR user with the relevant role.
Information disclosure in the RSA SecurID Authentication Manager app for Splunk SOAR (versions below 1.0.5) exposes RSA token serial numbers in cleartext to any authenticated user with action-run permissions. The app's 'enable token' and 'revoke token' actions fail to mark the token_serial parameter as a password field, causing it to render unmasked in the Splunk SOAR user interface. No public exploit has been identified at time of analysis, and exploitation is constrained by the requirement for an existing Splunk SOAR account with action-execution privileges.
Cleartext exposure of archive passwords in Splunk SOAR's Phantom app (versions below 3.8.5) allows authenticated users with action-running permissions to read sensitive credentials directly from the platform's user interface. The deflate item action fails to mark its password parameter as a sensitive field, causing the archive password to be rendered in plaintext in the SOAR UI to any user who invokes the action. Splunk has released a patch in version 3.8.5 per advisory SVD-2026-0806; no public exploit code or CISA KEV listing has been identified at time of analysis.
Cleartext exposure of temporary Active Directory passwords in the MS Graph for Active Directory app for Splunk SOAR (versions below 1.5.2) allows authenticated users with action-run permissions to capture credentials generated during password reset operations, as the temp_password parameter is rendered in plaintext in the SOAR interface rather than being masked. The flaw stems from the app failing to declare the affected parameter as a password type, causing the Splunk SOAR UI to treat it as generic text output. No active exploitation has been confirmed and no public POC is reported; risk is bounded by the requirement for an authenticated internal SOAR account with specific action-run role permissions.
Cleartext exposure of document passwords in the CrowdStrike OAuth API app for Splunk SOAR (versions below 5.1.3) allows any authenticated user with action-running permissions to read sensitive document_password values directly from the Splunk SOAR user interface. The root cause is the app's failure to mark the document_password parameter as a password type in both the detonate file and detonate url actions, meaning the platform's built-in masking mechanism is never invoked. Vendor patch version 5.1.3 has been released and confirmed via Splunk advisory SVD-2026-0806; no public exploit code or active exploitation has been identified at time of analysis.
Information disclosure in the Cisco Webex App for Splunk SOAR (versions below 2.2.1) exposes Webex meeting passwords in cleartext within the SOAR platform interface. Authenticated users holding roles with action-execution permissions who invoke the 'schedule meeting' action can read the plaintext meeting password directly from the UI, because the app's action manifest fails to designate the password parameter as a masked field. No active exploitation has been identified (not in CISA KEV) and no public exploit code is known; real-world impact is bounded by the requirement for existing SOAR action permissions.
Cleartext exposure of a sensitive sample password in the Cisco Secure Malware Analytics App for Splunk SOAR (versions below 2.4.5) allows authenticated users with action-run permissions to read the sample_password parameter value directly from the Splunk SOAR user interface. The root cause is the app's failure to mark the sample_password field as a password type in the detonate file action, meaning the platform never applies its standard masking behavior to that parameter. No public exploit code or active exploitation has been identified; vendor patch is available at version 2.4.5.
Cleartext exposure of temporary passwords in the Azure AD Graph app for Splunk SOAR (versions below 2.5.3) allows authenticated action-runners to read Azure AD reset credentials directly from the SOAR interface. The app's reset password action fails to classify the temp_password parameter as a sensitive field, so Splunk SOAR renders it unmasked in the UI rather than applying its standard password-masking behavior. Vendor patch 2.5.3 is available per Splunk advisory SVD-2026-0806; no public exploit code and no CISA KEV listing identified at time of analysis.
Credential exposure in the AWS IAM App for Splunk SOAR (all versions below 2.1.9) enables any authenticated user holding a role with action-execution permission to view AWS credentials in cleartext directly within the Splunk SOAR user interface. The root cause is the app's failure to designate the credentials action parameter as a password type field (CWE-312), causing the SOAR platform to render it unmasked rather than redacted. No active exploitation (CISA KEV) or public exploit code has been identified; however, because the exposed material consists of AWS access credentials rather than generic application data, the downstream business risk - potential cloud account compromise - substantially exceeds what the CVSS 4.3 Medium score conveys.
Credential exposure in the AD LDAP app for Splunk SOAR (versions below 2.3.8) allows any authenticated user holding an action-execution role to trigger a full connector process environment dump to a persistent plaintext debug log file, disclosing sensitive credentials such as LDAP bind secrets or service account tokens. The CVSS scope-changed vector (S:C) reflects that the exposed credentials extend impact beyond the SOAR platform itself to the underlying Active Directory environment. No public exploit code exists and this vulnerability is not listed in CISA KEV at time of analysis; however, patch version 2.3.8 is available and should be applied promptly given the potential for AD credential theft.
Sensitive Active Directory response data exposure in the AD LDAP App for Splunk SOAR (versions below 2.3.8) allows authenticated users holding action-execution permissions to cause AD directory data to be written to a persistent debug log file. The flaw is rooted in CWE-532 (insertion of sensitive information into log files) and is reachable over the network by any low-privileged SOAR user with the appropriate role. No public exploit code or active exploitation has been identified; Splunk has released a patch at version 2.3.8.
LDAP injection in the AD LDAP app for Splunk SOAR (versions below 2.3.8) allows authenticated low-privileged users to manipulate Active Directory queries, exposing account enumeration, sensitive attribute disclosure, and unintended modification of AD objects. Exploitation requires only a role with 'run actions' permission within Splunk SOAR - no elevated SOAR admin rights needed. Splunk has released a patch (version 2.3.8); no public exploit code or CISA KEV listing has been identified at time of analysis.
The Nmap Scanner connector for Splunk SOAR (versions prior to 3.0.15) permits privileged users to bypass Safe Mode playbook restrictions by exploiting a manifest miscategorization that marks the scan network action as read-only despite its accepting NSE script parameters capable of write operations and command execution on target systems. Users holding roles that allow editing, creating, or running playbooks can leverage this gap to run arbitrary Nmap Scripting Engine scripts against networked targets through SOAR automation - a meaningful privilege escalation given SOAR platforms typically have broad network reach. No public exploit has been identified at time of analysis, and a vendor patch is available via Splunk advisory SVD-2026-0806.