Information Disclosure
Monthly
Jeg Kit for Elementor exposes sensitive site configuration data to any authenticated WordPress user with Contributor-level access or above through an unguarded inline JavaScript object injected on the post editor page. The `enqueue_scripts()` method outputs a `JkitDashboardOption` object containing installed plugin names, versions, file paths, active statuses, WordPress and PHP versions, site URLs, server capabilities, and - critically - potentially a Mailchimp API key stored in `jkit_user_data`. No public exploit or CISA KEV listing exists at time of analysis, but the low authentication barrier (Contributor) and the API credential exposure risk elevate real-world impact above the Medium CVSS score alone suggests.
User enumeration and profile disclosure in WPGraphQL 2.x through 2.14.1 completely undermines the plugin's own anti-enumeration design via a deprecated GraphQL field that was never removed. An unauthenticated attacker can invoke the `sendPasswordResetEmail` mutation and include the deprecated `user` sub-field: a null response indicates the email or username does not exist, while a populated User object confirms existence and additionally leaks databaseId, full name, slug, bio, and profile URI for author-class users. A detailed proof-of-concept GraphQL mutation is published in advisory GHSA-jhh7-832h-f8hv, and no rate limiting exists at the WPGraphQL layer. No active exploitation has been confirmed by CISA KEV, though the barrier to exploitation is trivially low.
sigstore-go versions up to and including 1.2.0 accept Sigstore bundles signed with expired long-lived public keys because the verifier omits the timestamp-validity check when using `ExpiringKey`-wrapped verifiers. An attacker who obtains expired signing key material can produce bundles that pass verification despite the key's configured expiry window, undermining supply chain integrity guarantees enforced by key rotation policies. This affects only the self-managed long-lived key workflow - standard Sigstore deployments using Fulcio certificate authorities are explicitly unaffected. No public exploit identified at time of analysis.
Contao CMS's crawler leaks HTTP authentication credentials to external hosts due to an option-name mismatch in its credential-scrubbing logic, affecting versions 4.13.40-5.3.46 and 5.7.0-RC1-5.7.6. The cleaner is coded to remove the non-existent keys `basic_auth` and `bearer_auth` rather than Symfony HttpClient's actual `auth_basic` and `auth_bearer` options, so credentials configured in `contao.crawl.default_http_client_options` are silently passed through to external domains. An attacker who can place an external link on any page crawled by Contao's broken-link checker can receive those credentials on an attacker-controlled server. No public exploit or CISA KEV listing exists at time of analysis.
Cleartext storage of sensitive information in Johnson Controls XAAP Application on Android (versions before 1.53) exposes sensitive data to retrieval by attackers who already have access to a jailbroken or otherwise compromised device. The flaw stems from insufficient data-at-rest protection (CWE-312), meaning credentials, tokens, or configuration data are stored without encryption in the app's local storage. No public exploit code exists and this vulnerability is not listed in CISA KEV; real-world risk is constrained by the requirement for prior device compromise.
HTTP request smuggling in cPanel and WP Squared (by WebPros) enables leakage of credentials from other users sharing the same hosting infrastructure. The CVSS 4.0 vector confirms network-reachable exploitation with no authentication required but with passive user interaction and attack-specific prerequisites; critically, the subsequent-system impact is rated High for both confidentiality and integrity (SC:H/SI:H), indicating that successful exploitation crosses trust boundaries to affect other users or backend components beyond the attacker's own session. No public exploit code has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog, but the scope-change impact makes it a meaningful risk in shared hosting environments where cPanel serves multiple tenants.
Improper error handling in HCL iControl 4.3.0 and 4.4.0 exposes sensitive information through verbose error messages triggered by common fault conditions - out of memory events, null pointer exceptions, database unavailability, network timeouts, and system call failures. CWE-209 classifies this as generation of error messages containing sensitive information, meaning stack traces, internal paths, configuration data, or environment details may be disclosed to a network-accessible observer who can trigger or observe these fault states. CVSS scores this at 3.7 (Low), reflecting high attack complexity and limited confidentiality impact; no public exploit identified at time of analysis.
HCL iControl versions 4.3.0 and 4.4.0 expose authentication-related sensitive data through browser autocomplete functionality on login forms, classified under CWE-522 (Insufficiently Protected Credentials). Valid usernames, email addresses used for login, and account identifiers can be surfaced by the browser's autocomplete engine to subsequent users on shared workstations or kiosk environments. No active exploitation has been identified at time of analysis, and the CVSS score of 3.7 accurately reflects a low-severity, opportunistic information disclosure issue rather than a remotely exploitable critical flaw.
HCL iControl versions 4.3.0 and 4.4.0 expose internal configuration files to local access due to improper web server or application hardening, classified under CWE-497 (Exposure of Sensitive System Information). Local actors without any privileges can read configuration data that should be restricted, potentially revealing sensitive system details usable for follow-on attacks. No public exploit or active exploitation has been identified at time of analysis, and the CVSS score of 4.0 (Medium) reflects the limited local attack surface.
Verbose API error responses in HCL iControl 4.3.0 and 4.4.0 leak internal endpoint names, request parameters, error codes, and authentication status directly to unauthenticated network clients. The CVSS vector (AV:N/AC:H/PR:N/UI:N) confirms network-accessible, unauthenticated exposure but with high attack complexity - specific error-triggering conditions must be crafted. No public exploit exists and this is not in CISA KEV; however, the disclosed metadata constitutes meaningful reconnaissance leverage that can lower the cost of subsequent targeted attacks against the platform.
HCL iControl versions 4.3.0 and 4.4.0 publicly expose internal configuration files due to inadequate web server or application hardening, mapping to CWE-15 (External Control of System or Configuration Setting). The misconfiguration allows attackers to retrieve sensitive configuration data that may contain credentials, internal paths, service endpoints, or other operational details usable for further lateral movement or privilege escalation. No active exploitation has been confirmed in CISA KEV, and no public exploit code has been identified at the time of analysis.
Sensitive data exposure in the WP Maps WordPress plugin (versions through 4.9.6) allows authenticated low-privilege users to retrieve embedded sensitive information - likely including API keys such as Google Maps API credentials - from data returned by the plugin. Exploitation requires a valid WordPress account with minimal permissions (CVSS PR:L), making it accessible to any registered user on an affected site. No public exploit code or active exploitation has been identified at time of analysis, but the network-accessible attack vector lowers the bar for opportunistic discovery.
Unauthenticated remote manipulation of user state is possible in StylemixThemes MasterStudy LMS WordPress plugin through version 3.7.39, due to insufficient verification of data authenticity (CWE-345). The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms that no authentication or user interaction is required, allowing any network-accessible attacker to tamper with LMS user state - such as enrollment records, course progress, or quiz scores. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity makes this straightforward to abuse against unpatched installations.
Denial of service in Apache HttpComponents Client (versions 5.0-alpha1 through 5.6.2) arises when the classic/blocking I/O HttpClient fails to release the underlying connection back to the pool after receiving a response carrying an invalid or unsupported Content-Encoding header. An attacker who controls or can influence the server a client talks to can repeatedly return such headers to leak connections until the pool is exhausted, halting further outbound HTTP requests from the affected Java application. The async I/O HttpClient is explicitly unaffected; there is no public exploit identified at time of analysis and no CVSS or EPSS data was supplied.
Redirect URI policy bypass in Keycloak's secure-client-uris executor enables interception of OAuth authorization codes over unencrypted HTTP connections. The flaw exists because the executor performs only a prefix-string comparison on the redirect URI rather than properly parsing and validating the host component, allowing a specially crafted domain name to satisfy the HTTPS enforcement check while pointing to an attacker-controlled HTTP endpoint. Affected deployments include Red Hat Build of Keycloak, Red Hat Single Sign-On 7, and related Red Hat middleware products. No public exploit code or CISA KEV listing has been identified at time of analysis.
SAML HTTP-Redirect binding in Keycloak allows network-based attackers to inject malicious parameters into authentication requests targeting clients configured with wildcard redirect URLs. When a victim user completes authentication, Keycloak appends its legitimate SAML response to the attacker-controlled URL parameters, which can cause susceptible service providers to process the attacker's data instead of the real login assertion - potentially resulting in the victim being logged into the wrong account. No public exploit is identified at time of analysis, and the CVSS score of 3.4 (Low) reflects the high attack complexity and limited integrity-only impact.
User email enumeration in the JS Help Desk WordPress plugin (versions before 3.1.4) allows any Contributor-level site user to harvest the email addresses of all registered WordPress users. Two design flaws compound: the plugin unconditionally grants a support-agent capability to the built-in Contributor role at activation time, and the user-listing handler omits any capability check entirely, making the Contributor elevation the effective attack precondition. A public proof-of-concept is documented by WPScan; however, EPSS places exploitation probability at 0.14% (4th percentile), indicating no public exploit is currently being run at scale. No CISA KEV listing is present.
JS Help Desk WordPress plugin before 3.1.4 exposes all support ticket content to any authenticated WordPress user due to missing authorization and ownership checks in its search handler. Any account at Subscriber level or above can enumerate and read the subject and full message body of every other user's support ticket by interacting with the plugin's nonce-gated AJAX endpoint, bypassing the intended per-user data isolation. A publicly available proof-of-concept exploit exists per WPScan; EPSS is low at 0.14% (4th percentile), suggesting opportunistic rather than widespread automated exploitation, but the low authentication bar makes this a meaningful data exposure risk on multi-user WordPress sites.
Unauthenticated download of exported member and payment PII is possible in the Paid Membership Subscriptions WordPress plugin before 3.0.7 due to export files being written to a predictable, unprotected path within the publicly accessible uploads directory. Any site running an affected version where an administrator has recently triggered an export is at risk of exposing member personally identifiable information and payment records to any network-accessible attacker. A publicly available proof-of-concept exploit exists per WPScan, and while the CVSS base score is low (3.7), the data sensitivity of the exposed artifact elevates real-world impact beyond what the score alone suggests.
HTTP security header spoofing in CodeIgniter4 prior to 4.7.4 allows remote unauthenticated attackers to trick the framework into treating plain HTTP requests as HTTPS by injecting forged X-Forwarded-Proto or Front-End-Https headers. The root cause is that IncomingRequest::isSecure() unconditionally trusted these headers from any source rather than restricting trust to configured trusted proxies, undermining isSecure(), force_https(), and forceGlobalSecureRequests enforcement logic. No public exploit or CISA KEV listing exists; real-world impact is conditioned on deployment topology and CVSS AC:H reflects this complexity.
Out-of-bounds read in mz-automation/lib60870 allows unauthenticated remote attackers to leak one byte of heap memory and potentially crash the parsing process by sending a crafted IEC 60870-5-104 I-frame. The vulnerability triggers when a declared ASDU object count exceeds the actual data present in the message buffer, causing `InformationObject_ParseObjectAddress` to read one byte beyond the allocated heap region. Disclosed via CISA ICS Advisory ICSA-26-211-11 with no public exploit identified at time of analysis.
Out-of-bounds heap read in mz-automation's lib60870 library exposes ICS/SCADA systems to unauthenticated remote exploitation via a crafted IEC 60870-5-104 I-frame. An attacker sending a C_TS_NA_1 ASDU with an inflated object count triggers `TestCommand_getFromBuffer` to read one byte past the end of a heap-allocated buffer, producing partial heap memory disclosure and potential availability disruption. CISA ICS-CERT has published advisory ICSA-26-211-11; no active exploitation is confirmed and no public exploit code has been identified at time of analysis.
Denial-of-service in MZ Automation GmbH libiec61850 (all versions before 1.6.2) allows an adjacent unauthenticated attacker to crash the MMS server process by sending a crafted BER-encoded confirmed request PDU containing an extended BER tag over an established MMS session. The missing bounds check in the buffer decoder causes a one-byte heap out-of-bounds read, terminating the MMS service and disrupting IEC 61850-based industrial control communications. No active exploitation is confirmed (not listed in CISA KEV), and no public exploit code has been identified at time of analysis.
Out-of-bounds heap read in MZ Automation GmbH libiec61850 (all versions before 1.6.2) allows an unauthenticated adjacent-network attacker to crash an MMS server by sending a crafted AARQ PDU with a zero or one-byte length value in the calling AP title field during connection establishment. The ACSE parser fails to bounds-check the attacker-controlled length, reading past the end of a heap buffer and causing availability loss - a significant concern in IEC 61850 substation automation environments where device availability underpins grid protection and monitoring. No public exploit has been identified at time of analysis, and no CISA KEV listing exists; a vendor patch (version 1.6.2) is available per CISA ICS advisory ICSA-26-211-10.
Insecure file permissions in ansible-collection-redhat-leapp expose PostgreSQL backup archives to local non-root users on managed RHEL 9 and RHEL 10 nodes. When the `leapp_old_postgresql_data` remediation option is invoked with elevated privileges, the resulting backup archive is written with world-readable or group-readable permissions (CWE-732), allowing any local non-root user on that managed node to extract the full contents of the archived PostgreSQL data. No public exploit has been identified at time of analysis, and exploitation requires local authenticated access to the managed node.
The ansible-collection-redhat-leapp package exposes Ansible controller-side sensitive files to attacker-controlled managed nodes through a manipulated Leapp upgrade report. An attacker who has already obtained privileged write access to a managed node's Leapp report can craft malicious report content that, when an operator executes a specific remediation task, causes the Ansible controller to read and copy its own local files - including private keys and credentials - to the attacker-controlled managed node. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog; however, the CVSS 3.1 score of 6.2 reflects real-world risk limited by the high privilege prerequisite and required operator interaction.
Out-of-bounds heap read in GoAccess prior to version 1.11 allows a remote unauthenticated attacker to read approximately 4 KB beyond a heap allocation and conditionally crash the analyzer by embedding a crafted User-Agent string into any web server access log that GoAccess subsequently processes. The defect resides in the parse_ios() function (src/opesys.c), where an attacker-controlled keyword-to-OS offset value is incorrectly passed as both the source pointer offset and the copy length to memmove(), violating the intended semantics and enabling the out-of-bounds read. No public exploit code has been identified and this vulnerability is not listed in CISA KEV; a vendor-confirmed fix is available in version 1.11.
Out-of-bounds heap read in node-re2 prior to 1.25.2 allows process termination and limited heap memory disclosure when an attacker-influenced lastIndex value is used against a non-ASCII subject string. The flaw arises because lastIndex is validated against the UTF-8 byte length of the input but consumed as a UTF-16 code-unit offset - for any non-ASCII character, the UTF-8 byte count exceeds the UTF-16 unit count, creating a gap where a lastIndex passes the guard yet reads past the allocated buffer. The resulting crash is uncatchable by the Node.js process, making it an effective denial-of-service vector in any server application exposing this code path to external input. No active exploitation confirmed (not in CISA KEV); no public exploit code identified at time of analysis.
Authenticated users with time or cost entry viewing permissions can read private work package subjects and IDs via the OpenProject REST API in versions prior to 17.6.0. The /api/v3/time_entries and /api/v3/cost_entries endpoints expose _links.workPackage.title and _links.workPackage.href through the associated_resource rendering path without enforcing WorkPackage.visible or view_work_packages permission checks. An attacker with only view_time_entries or view_cost_entries can enumerate titles and IDs of work packages they should not have access to, violating project confidentiality controls. No public exploit or CISA KEV listing exists; the fix is available in v17.6.0.
Plugin output logs in IBM UrbanCode Deploy and IBM DevOps Deploy expose sensitive step values to any authenticated user with log access, across a wide range of actively-maintained versions spanning both product lines. The CVSS PR:L vector confirms that a low-privileged authenticated user - such as a developer or operator - who can view deployment logs may read sensitive values such as credentials, API tokens, or configuration secrets that plugin steps emit without redaction. No public exploit code exists and the vulnerability is not listed in CISA KEV, but the risk is practically elevated in CI/CD environments where plugin steps routinely handle high-value secrets.
The /unpack endpoint in Apache Tika's server component (tika-server 4.0.0-alpha-1) fails to enforce the operator-configured enableUnsecureFeatures=false security control, classified as Improper Protection of Alternate Path. This means the /unpack endpoint remains fully operational even when administrators have explicitly disabled unsafe features, bypassing the intended security boundary and allowing archive extraction or untrusted content processing through a restricted interface. No public exploit code has been identified and the vulnerability is confined to a pre-production alpha release, significantly limiting real-world exposure.
Insufficient session expiration in the MikroTik RouterOS API allows authenticated users whose permissions have been reduced to retain their prior, elevated access rights for the duration of the stale session. Specifically, when a user's group membership or permission set is downgraded, or when an inactivity timeout is expected to expire a session, the RouterOS API fails to re-evaluate or invalidate the existing session token - exposing confidential routing, firewall, or credential data the user should no longer reach. No public exploit has been identified and the vulnerability is not listed in the CISA KEV catalog; however, ICS-CERT's publication of ICSA-26-211-01 signals elevated concern for operational technology networks where MikroTik devices are used for segmentation and industrial network management.
Uncontrolled decompression in aiohttp's WebSocket client prior to version 3.14.2 allows a malicious server to exhaust CPU and memory on connecting clients by sending RSV1-flagged compressed frames without having negotiated the permessage-deflate extension. The root cause is a missing constructor argument in `client.py:_ws_connect` that caused `WebSocketReader` to default to `compress=True`, violating RFC 6455 §5.2 which mandates failing the connection on undefined reserved bits. This is client-side exposure only - aiohttp server deployments are not affected. No active exploitation has been identified and no public exploit code exists at time of analysis.
Verbose technical error message disclosure in IBM Verify Identity Access and IBM Security Verify Access (both appliance and container editions) allows unauthenticated remote attackers to harvest internal application details returned directly in the browser. Affected versions span IBM Verify Identity Access 11.0-11.0.2, IBM Security Verify Access 10.0-10.0.9.1, and their respective container variants. No public exploit or CISA KEV listing exists at time of analysis; however, the zero-authentication barrier and the reconnaissance value of exposed technical data elevate this beyond a benign information leak, as harvested details can directly inform more damaging follow-on attacks against an identity management system.
Broken access control in IBM Langflow OSS 1.0.0-1.8.4 exposes private flow files through two distinct endpoint flaws: the image retrieval endpoint enforces no authentication whatsoever, allowing unauthenticated remote attackers to access any user's image files given a valid flow ID and filename; separately, the file download endpoint, while requiring authentication, fails to validate resource ownership, enabling any authenticated user to access files belonging to other tenants via IDOR. Both flaws break tenant isolation in multi-user deployments and result in unauthorized disclosure of sensitive data. No public exploit or CISA KEV listing has been identified at time of analysis; a vendor patch is available.
Cross-buffer memory aliasing in msgpack-ruby prior to 1.8.2 allows same-process code to read or corrupt data belonging to a separate MessagePack::Buffer instance via a use-after-free in the rmem slab allocator. MessagePack::Buffer#clear returns a 4 KiB rmem page to the shared pool but leaves rmem_last, rmem_end, and rmem_owner pointing into the freed page; a subsequent write on the cleared buffer and a concurrent second Buffer allocation can claim the same physical page, creating a memory alias that exposes the second buffer's serialized bytes. A PoC is included in the vendor advisory (GHSA-4mrv-5p47-p938); no public exploit identified at time of analysis beyond that PoC, and the CVE is not in CISA KEV.
Denial of service in Samba's Kerberos KDC password change (kpasswd) service allows authenticated remote attackers to crash the KDC process by submitting specially crafted, malformed ASN.1-encoded password change requests. The server miscalculates the structure size of the incoming request and reads up to six bytes beyond the end of the allocated buffer; when this read strikes unmapped memory, the KDC process terminates rather than simply failing gracefully. No public exploit has been identified and no CISA KEV listing exists, but the disruption of a KDC in an Active Directory or Samba domain environment carries significant operational impact since authentication for the entire domain depends on KDC availability.
foreUP's customer REST API exposes cleartext payment-processor merchant credentials - such as API keys or secrets - directly in response bodies to any authenticated user. All foreUP versions are affected per the wildcard CPE (cpe:2.3:a:foreup:foreup:*). An attacker with any valid authenticated session can harvest these credentials and use them to interact directly with the downstream payment processor, creating potential for financial fraud or account takeover at the payment-processing layer. No public exploit has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Credential exposure in CSL 1010 M2M 3G WiFi Module firmware through 2.2.1.4 stems from a trivially reversible single-byte XOR cipher with a hard-coded static key used to 'protect' the Router.cfg configuration backup file. An attacker with local access to the device can decrypt the backup and recover web administration passwords, telnet credentials, WPA/WPA2 pre-shared keys, PPPoE and 3G/APN credentials, and SIM identifiers (IMSI and IMEI) in plaintext. No public exploit has been identified at time of analysis, KEV listing is absent, and no fixed firmware version has been confirmed.
Unauthenticated exposure of Go pprof debug endpoints in Calico kube-controllers and Goldmane components allows any pod with adjacent network access to retrieve sensitive in-memory data when the shared debug server feature is enabled. Affected products span Calico, Calico Enterprise, and Calico Cloud across all versions per CPE. The vulnerability is opt-in (debug server disabled by default), but carries high confidentiality impact when enabled because heap dumps and goroutine stacks may contain credentials, tokens, or other sensitive runtime state. No public exploit identified at time of analysis and no CISA KEV listing.
Insufficient audit logging in VMware ESX and related Broadcom virtualization platforms allows a malicious administrator to perform certain privileged operations without generating corresponding log entries. Affected products span the VMware ecosystem including Cloud Foundation, vSphere Foundation, ESX, and Telco Cloud Platform. No public exploit code exists and the vulnerability is not listed in CISA KEV, but the insider-threat and post-compromise forensic evasion implications are meaningful for organizations relying on audit logs for compliance and incident response.
DFIR-IRIS web application version 2.4.26 implements logout without server-side session invalidation, leaving session cookies valid indefinitely after a user believes they have signed out. Classified as CWE-613 (Insufficient Session Expiration), this flaw means any attacker who obtains a valid session cookie - through XSS, network interception, shoulder-surfing, or physical device access - retains unauthorized access to the IRIS incident response platform even after the legitimate user logs out. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Credential exposure in Phoenix Contact CHARX SEC EV charging controllers allows a low-privileged local attacker who can read log files to extract plaintext credentials for the built-in 'user-app' account and subsequently authenticate via SSH. Affected are all CHARX SEC-3000, 3050, 3100, and 3150 units running firmware versions 1.0.0 through 1.9.0. Successful exploitation can interrupt active EV charging sessions, constituting a high availability impact in operational charging infrastructure. No public exploit or active exploitation has been identified at time of analysis.
Firmware update handling in Phoenix Contact CHARX SEC EV charging controllers (versions 1.0.0 through 1.8.x) exposes a race condition exploitable by unauthenticated remote attackers via the OCPP backend. By supplying an invalid firmware file, an attacker can cause the file to persist temporarily in accessible device storage during the flawed cleanup window before deletion, resulting in low-impact integrity interference with the firmware management process. No public exploit code and no CISA KEV entry have been identified; a vendor-released patch is confirmed at version 1.9.1.
Password reset token hijacking in Veeam Service Provider Console 9.2 and earlier enables unauthenticated remote attackers to take over any portal user account by manipulating the returnUrl parameter in the Forgot Password workflow. An attacker who knows a target's email address initiates a password reset on their behalf, supplying an attacker-controlled domain via the unvalidated returnUrl parameter; the platform then generates a reset email whose link routes through the attacker's infrastructure, transmitting the one-time reset code upon the victim clicking it. Account takeover is achieved without requiring any credentials or prior access to the platform. No public exploit has been identified at time of analysis, and CISA KEV status is not confirmed; however, the technique is straightforward and the report originated from HackerOne, suggesting the attack vector is well-understood by researchers.
Unauthenticated deletion of all custom icon font packs is possible in Ultimate Addons for WPBakery Page Builder WordPress plugin before version 3.21.4. The plugin's icon font deletion endpoint performs no WordPress capability check and no nonce verification, meaning any unauthenticated HTTP request can permanently erase every custom-uploaded icon font pack on an affected site in a single request. A publicly available proof-of-concept exists and SSVC assesses the attack as automatable, though EPSS remains very low at 0.15% (5th percentile), indicating no significant observed exploitation at scale; the vulnerability is absent from CISA KEV.
Authenticated information disclosure in the LifterLMS WordPress plugin before 10.0.10 exposes internal post type titles - including coupon codes - to any subscriber-level user. The root cause is a missing capability check in a select2 query AJAX handler that only verifies login status, not whether the user holds an appropriate WordPress capability. A publicly available proof-of-concept exists (via WPScan), though EPSS sits at just 0.16% (5th percentile), indicating low broad exploitation likelihood; no active exploitation is confirmed by CISA KEV.
Unauthorized customer PII exposure in MotoPress Hotel Booking WordPress plugin before 6.0.4 allows any authenticated subscriber-level user to retrieve full personal details - name, email, phone number, and address - belonging to any customer booking in the system. The flaw stems from a missing capability check in an AJAX action handler, meaning the plugin never verifies whether the requesting user is authorized to view the target booking before returning its data. A publicly available exploit exists per WPScan, though EPSS at 0.16% (5th percentile) and absence from CISA KEV suggest exploitation remains opportunistic rather than widespread.
Easy Appointments WordPress plugin through version 3.12.26 exposes an appointment-listing REST endpoint to any authenticated user by gating it on a capability held by every WordPress user - including subscribers, the lowest authenticated role. Any user with a basic account can query this endpoint to enumerate all site bookings, extracting customer names, appointment schedules, and booking statuses belonging to other clients. A publicly available exploit is documented by WPScan; however, EPSS sits at 0.16% (5th percentile) and the vulnerability is not in CISA KEV, indicating limited observed mass exploitation at time of analysis.
Easy Appointments WordPress plugin through version 3.12.26 exposes all stored customer personal information to any authenticated contributor-level user due to missing per-request capability and nonce validation on a customer-listing handler. Any user holding a contributor role - a low-privilege WordPress role normally limited to drafting posts - can invoke the unprotected endpoint and enumerate the full customer dataset. A publicly available proof-of-concept exists per WPScan, though EPSS places exploitation probability at 0.16% (5th percentile) and the flaw has not been listed in CISA KEV, suggesting limited observed exploitation.
Spring Tools language server exposes proxy Basic-auth credentials in cleartext log files, affecting Spring Tools for Eclipse 5.2.0 and earlier and Spring Tools for VSCode/Cursor/Theia 2.2.0 and earlier. When no explicit http.proxy workspace setting is configured, the language server reads the HTTP_PROXY/HTTPS_PROXY (and lowercase variants) environment variables and writes their raw values-including embedded credentials in the form http://user:pass@proxy:8080-to its log at INFO level without redaction. Because language server logs are often shared in bug reports or are readable by other local users and processes, this results in proxy credential disclosure. No public exploit has been identified at time of analysis, and CISA KEV listing is absent.
Remote unauthenticated denial of service and memory disclosure in the Performance Co-Pilot (PCP) pmproxy service affects Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4. An out-of-bounds read (CWE-125) in the pmLogLoadInDom() function can be triggered by a specially crafted network request, causing the pmproxy process to crash and potentially leaking sensitive data from process memory. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Price manipulation in the Persian Elementor WordPress plugin (all versions up to and including 2.8.1) allows unauthenticated remote attackers to submit arbitrary payment amounts to the ZarinPal payment gateway by tampering with the client-supplied 'amount' POST parameter, bypassing the price configured in the Elementor widget. The root cause is the absence of server-side reconciliation between the submitted payment figure and the widget's defined price - whatever the client sends is forwarded directly to ZarinPal. No public exploit code has been identified and the CVE is not listed in the CISA KEV catalog, though exploitation requires zero authentication and only trivial HTTP parameter manipulation.
Side-channel information leakage in Google Chrome's Media component (versions prior to 151.0.7922.72) enables a remote attacker to leak cross-origin data by directing a victim to a crafted HTML page, bypassing same-origin policy protections through measurable side effects of media processing. Affected desktop users on all platforms running any Chrome release before 151.0.7922.72 are exposed to limited confidentiality loss. EPSS is 0.16% (6th percentile), SSVC exploitation status is none, and no public exploit has been identified at time of analysis - all signals converge on low real-world risk.
UI spoofing in the Google Chrome Updater component on Windows (prior to 151.0.7922.72) enables a local attacker to present a falsified interface to users by placing a malicious file in a location the Updater processes. Chromium's own team rates this 'Low' severity, consistent with the 4.0 CVSS score, EPSS of 0.10% (1st percentile), and SSVC exploitation status of 'none'. No public exploit exists at time of analysis, and a vendor-confirmed patch is available in Chrome 151.0.7922.72.
UI spoofing in Google Chrome for iOS prior to 151.0.7922.72 enables a remote attacker to deceive users into believing they are interacting with a legitimate browser interface by serving a crafted HTML page. The root cause is insufficient policy enforcement (CWE-346, origin validation error), allowing the attacker to manipulate rendered UI elements. No public exploit code exists and no active exploitation has been confirmed; EPSS stands at 0.16% (6th percentile) and CISA SSVC classifies exploitation as none, placing this firmly in a patch-and-monitor priority tier rather than an emergency response.
UI spoofing in Google Chrome for iOS prior to version 151.0.7922.72 enables a remote unauthenticated attacker to misrepresent critical interface elements - such as the address bar or origin indicators - through a specially crafted HTML page. Classified as CWE-451 (UI Misrepresentation of Critical Information), the impact is limited to integrity: no code execution or data exfiltration is possible directly, but users can be deceived into trusting a malicious page as legitimate. No public exploit code exists, EPSS sits at 0.16% (6th percentile), and Chromium internally rated this as Low severity - consistent with a constrained, social-engineering-dependent attack surface.
Chrome for iOS prior to 151.0.7922.72 exposes potentially sensitive process memory contents to an attacker with physical access to the device through an inappropriate implementation flaw. The vulnerability is classified CWE-200 (Information Disclosure) and is iOS-platform-specific, not affecting Chrome on other operating systems. No public exploit code exists and CISA SSVC confirms no active exploitation, placing this firmly in the low-urgency tier despite requiring prompt patching for high-assurance mobile environments.
UI spoofing in Google Chrome's Passwords subsystem (versions prior to 151.0.7922.72) enables remote attackers to manipulate password-related UI elements through malicious network traffic, potentially deceiving users into submitting credentials to unintended destinations. Exploitation requires active user interaction (UI:R per CVSS), and real-world risk is constrained by an EPSS of 0.15% (5th percentile) and SSVC confirmation of no known exploitation and a non-automatable attack path. No public exploit identified at time of analysis; vendor patch is available in Chrome 151.0.7922.72.
UI spoofing in Google Chrome's Passwords component (versions prior to 151.0.7922.72) allows a remote unauthenticated attacker to manipulate how credential-related UI elements are displayed by delivering maliciously crafted network traffic to a browsing user. The root cause is insufficient input validation (CWE-20) in the Passwords subsystem, which fails to sanitize externally sourced data before rendering it in the browser interface. No public exploit code has been identified and CISA has not listed this in KEV; EPSS of 0.15% (5th percentile) confirms low automated exploitation probability, consistent with the SSVC rating of exploitation: none.
UI spoofing in Google Chrome's Settings component (versions prior to 151.0.7922.72) enables remote attackers to misrepresent critical interface elements to victims via malicious network traffic, requiring user interaction to trigger. EPSS at 0.15% (5th percentile) and CISA SSVC exploitation rating of none align with the Chromium team's own Low severity classification, making this a low-urgency issue despite its network-accessible attack vector. Google has released a patch in stable channel version 151.0.7922.72; no public exploits are identified at time of analysis.
UI spoofing in Google Chrome for Android (prior to 151.0.7922.72) enables remote unauthenticated attackers to present misleading interface elements to users through a crafted HTML page. The flaw stems from an inappropriate implementation in Chrome's input handling on Android, classified under CWE-451 (UI Misrepresentation of Critical Information), meaning the browser fails to correctly represent critical UI state to the user. No public exploit code exists and CISA has not listed this in KEV; EPSS is extremely low at 0.16% (6th percentile), consistent with Chromium's own Low severity classification.
UI spoofing via Google Lens in Google Chrome prior to 151.0.7922.72 is achievable by a remote attacker who has already compromised the renderer process, using a crafted HTML page to misrepresent interface elements to the victim. The attack requires a chained exploitation scenario: renderer compromise as a prerequisite, followed by abuse of an inappropriate implementation in the Lens component (CWE-451) to manipulate what the user perceives in the browser UI. No active exploitation is confirmed - CISA KEV does not list this CVE, SSVC assessment shows exploitation status of none, and EPSS sits at 0.16% (6th percentile), indicating very low real-world exploitation probability at time of analysis.
Information disclosure in Google Chrome's WebXR subsystem prior to version 151.0.7922.72 allows unauthenticated remote attackers to read potentially sensitive process memory contents by luring a victim to a crafted HTML page. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) indicates a network-accessible, low-complexity path to high confidentiality impact, though Chromium's internal severity rating of Low and an EPSS of 0.16% (6th percentile) reflect limited real-world exploitation risk. No public exploit code exists and CISA SSVC rates exploitation as none, making this a watch-and-patch item rather than an emergency response trigger.
UI spoofing in Google Chrome on iOS prior to 151.0.7922.72 enables a remote attacker to deceive users about page identity or browser security state by serving a crafted HTML page. The flaw is iOS-specific, exploiting an inappropriate implementation in the Chrome for iOS rendering layer rather than the broader Chromium engine, and requires only that the victim navigate to an attacker-controlled page. No public exploit has been identified and EPSS stands at 0.19% (9th percentile), consistent with Chromium's own 'Low' internal severity classification; this is a real but low-urgency integrity issue.
Process memory disclosure in Google Chrome's WebGL implementation allows a remote attacker to read potentially sensitive data from the browser's memory by luring a user to a specially crafted HTML page. Affected versions are all Chrome releases prior to 151.0.7922.72 across desktop platforms. No public exploit code has been identified and EPSS sits at 0.16% (6th percentile), indicating low real-world exploitation probability despite the High confidentiality rating in the CVSS vector.
Cross-origin data leakage in Google Chrome for Android (prior to 151.0.7922.72) stems from insufficient policy enforcement in the USB component, exploitable only after the attacker has already compromised the renderer process. Exploitation requires luring a victim to a crafted HTML page in a pre-compromised renderer context, making this a secondary-stage vulnerability in a chained attack rather than a standalone threat. EPSS sits at 0.19% (9th percentile), SSVC records no exploitation activity, and the vulnerability is not listed in CISA KEV - consistent with its low severity rating and demanding prerequisite.
Domain spoofing in Google Chrome on Android (all versions prior to 151.0.7922.72) results from a race condition in the PictureInPicture component, enabling a remote attacker to misrepresent the origin domain shown to a user when they interact with a crafted HTML page. The integrity impact is limited to the browser UI trust indicator - no code execution or data exfiltration occurs directly - but successful spoofing can be chained with credential phishing against a falsely trusted domain. No active exploitation has been confirmed (not listed in CISA KEV), and the EPSS score of 0.16% at the 6th percentile reflects very low exploitation probability, consistent with Chromium's own 'Low' severity classification.
UI spoofing in Google Chrome's Extensions subsystem (all versions prior to 151.0.7922.72) allows an attacker who tricks a user into installing a crafted malicious extension to misrepresent critical security indicators within the browser interface. The flaw stems from incorrect security UI rendering in the Extensions component (CWE-451), enabling deceptive presentation of extension trust signals or permissions. No public exploit has been identified at time of analysis and EPSS is 0.10% (1st percentile), aligning with Chromium's own internal 'Low' severity rating; however, the ubiquitous deployment footprint of Chrome elevates the aggregate exposure.
Cross-origin data leakage in Google Chrome's Passwords component (versions prior to 151.0.7922.72) exposes password-related data to attackers who have already compromised the renderer process and can deliver a crafted HTML page. The flaw stems from an inappropriate implementation that fails to enforce proper origin validation within the Passwords subsystem, making it a second-stage element in a chained attack rather than a standalone threat. No public exploit has been identified, EPSS is 0.16% (6th percentile), SSVC records no known exploitation, and Chromium internally rates this Low severity - consistent with the high prerequisite bar of prior renderer compromise.
Uninitialized memory use in Skia, Chrome's 2D graphics rendering engine, exposes process memory contents to remote attackers on Windows via crafted HTML pages in Google Chrome versions prior to 151.0.7922.72. The flaw is strictly an information disclosure issue (CWE-457), with no integrity or availability impact, affecting only the Windows platform per the vulnerability description. No public exploit code has been identified, EPSS places exploitation probability at 0.19% (9th percentile), and SSVC classifies exploitation as none with partial technical impact - collectively suggesting limited real-world risk despite the CVSS C:H rating.
Cross-origin data leakage in Google Chrome on Android prior to 151.0.7922.72 enables a local attacker to read data from a different origin by directing a victim user to a crafted HTML page. The flaw stems from an inappropriate browser implementation (CWE-346 Origin Validation Error), undermining the Same-Origin Policy's isolation guarantees on the Android platform. No public exploit code exists and no active exploitation has been observed; SSVC assessment confirms exploitation status as none, making this a low-urgency but noteworthy information-disclosure defect.
UI spoofing in Google Chrome's Global Media Controls component prior to version 151.0.7922.72 enables remote attackers to misrepresent interface elements when a victim visits a crafted HTML page. The flaw is rooted in CWE-451 (misrepresentation of critical UI information), allowing attacker-controlled content to manipulate what the media controls overlay displays. No public exploit code exists and no active exploitation has been identified; EPSS at 0.17% (7th percentile) and SSVC exploitation status of 'none' both corroborate this as a low-urgency, routine-patching-priority finding.
Cross-origin data leakage in Google Chrome's Blink rendering engine (versions prior to 151.0.7922.72) exposes data protected by the Same-Origin Policy to remote attackers who can lure a victim to a crafted HTML page. The flaw, classified as CWE-346 (Origin Validation Error), allows Blink to improperly handle origin boundaries, enabling a malicious page to read cross-origin resource data. No public exploit has been identified and EPSS sits at 0.17% (7th percentile), consistent with SSVC's 'Exploitation: none' designation and absence from CISA KEV.
Cross-origin data leakage in Google Chrome on Android (prior to 151.0.7922.72) results from an inappropriate UI implementation that allows a remote attacker to extract data from a different web origin when a user is socially engineered into performing specific UI gestures on a crafted HTML page. Rated CVSS 3.1 (Low) with EPSS at 0.17% (7th percentile) and SSVC exploitation status of 'none,' this vulnerability presents minimal immediate operational risk. No public exploit code exists and the issue is not listed in CISA KEV; a vendor-released patch is available in the stable channel update.
Side-channel memory leakage in Chrome's WebCodecs API prior to version 151.0.7922.72 enables a remote, unauthenticated attacker to extract potentially sensitive data from the browser's process memory by luring a victim to a crafted HTML page. The vulnerability stems from improper protection of physical side-channels (CWE-1300) within the WebCodecs media processing subsystem. No active exploitation has been identified - SSVC rates exploitation as none and EPSS places this in the 7th percentile - but the high confidentiality impact score reflects that successful exploitation could expose in-memory session data or other sensitive content.
Cross-origin data leakage in Google Chrome prior to 151.0.7922.72 is achievable through a CSS policy bypass, enabling remote unauthenticated attackers to exfiltrate data across origin boundaries when a victim visits a crafted HTML page. The root cause is improper origin validation (CWE-346) in Chrome's CSS subsystem, allowing CSS mechanisms to circumvent same-origin policy enforcement and read restricted cross-origin content. No public exploit code exists and no active exploitation has been identified; EPSS probability is 0.18% (8th percentile), consistent with the SSVC 'Exploitation: none' assessment and Chrome's own 'Low' severity designation for this issue.
Process memory leakage in Google Chrome's IME (Input Method Editor) implementation on macOS allows remote unauthenticated attackers to obtain potentially sensitive data from Chrome's process memory by luring a user to a specially crafted HTML page. The flaw affects all Chrome for Mac versions prior to 151.0.7922.72, is platform-scoped to macOS only, and carries a CVSS 6.5 (Medium) despite Chromium's own 'Low' severity designation. No public exploit code exists and EPSS sits at 0.17% (7th percentile), indicating very low current exploitation probability.
Information disclosure in the Views UI component of Google Chrome on macOS allows a local attacker to read potentially sensitive data from browser process memory by inducing a user to open a crafted HTML page on versions prior to 151.0.7922.72. The flaw is Mac-platform-specific, categorized by Chromium itself as Low severity, and carries no integrity or availability impact. No public exploit exists and no active exploitation has been identified; EPSS probability sits at 0.11% (2nd percentile) and CISA SSVC classifies exploitation as none.
UI spoofing in Google Chrome for iOS prior to 151.0.7922.72 enables a remote, unauthenticated attacker to misrepresent security-critical interface elements - such as the address bar or origin indicators - by serving a crafted HTML page to a victim. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms the attack is network-delivered and requires no privileges, but does require the user to interact with the malicious page, limiting its reach. No public exploit or active exploitation has been identified; EPSS at 0.17% (7th percentile) and SSVC exploitation status of 'none' collectively indicate low real-world risk at this time.
UI spoofing in Google Chrome's Passwords component allows an attacker occupying a privileged network position (man-in-the-middle) to manipulate password-related interface elements via malicious network traffic. All Chrome releases prior to 151.0.7922.72 on desktop are affected. Exploitation requires both a privileged network position and user interaction, substantially constraining real-world risk; no public exploit code exists and EPSS sits at the 2nd percentile, consistent with no observed exploitation in the wild.
Uninitialized memory access in Google Chrome's WebXR implementation on Android exposes potentially sensitive browser process memory contents to remote attackers who can direct a victim to a crafted HTML page. All Chrome for Android versions prior to 151.0.7922.72 are affected by this information disclosure weakness (CWE-457). No public exploit identified at time of analysis and SSVC confirms no active exploitation, placing this in routine patch-cycle priority despite the high confidentiality impact rating in the CVSS base score.
Information disclosure in Google Chrome's Views UI framework on macOS prior to version 151.0.7922.72 exposes potentially sensitive data from browser process memory to local attackers. The flaw is triggered by an inappropriate implementation in the Views rendering layer, reachable via a specially crafted HTML page. No public exploit code exists and the EPSS score sits at the 2nd percentile, indicating very low observed exploitation probability; Chrome's own severity rating of 'Low' is consistent with the local-only attack vector and read-only confidentiality impact.
UI spoofing in Google Chrome for iOS prior to version 151.0.7922.72 enables remote attackers to deceive users by manipulating security indicators through a crafted HTML page. The vulnerability causes incorrect rendering of Chrome's browser-managed security UI elements - such as origin display or HTTPS trust badges - potentially causing victims to mistake malicious pages for legitimate or secure ones. No active exploitation has been confirmed (not in CISA KEV), EPSS at 0.17% (7th percentile) indicates low near-term exploitation probability, and a vendor-released patch is available in version 151.0.7922.72.
Domain spoofing in Google Chrome on Android (prior to 151.0.7922.72) enables remote unauthenticated attackers to present misleading security UI indicators to users via a crafted HTML page. The flaw stems from CWE-451 - user interface misrepresentation of critical information - where Chrome's Android UI fails to accurately convey the true origin or domain of the page being visited. No public exploit code exists, EPSS sits at 0.17% (7th percentile), and SSVC confirms exploitation status as none, collectively indicating low urgency despite the broad user base.
Cross-origin data leakage in Google Chrome's SVG implementation affects all versions prior to 151.0.7922.72, exploitable by a remote attacker who can convince a user to visit a crafted HTML page. The flaw violates the browser's Same-Origin Policy via improper SVG origin validation (CWE-346), allowing an attacker's page to infer or extract data belonging to cross-origin resources the victim's browser can reach. No active exploitation has been identified - CISA KEV is absent, SSVC exploitation status is 'none', and EPSS sits at a low 0.17% (7th percentile) - placing real-world urgency in the lower-priority tier despite the network attack vector.
Cross-origin data leakage in Google Chrome's network layer prior to version 151.0.7922.72 enables remote attackers to read sensitive cross-origin data by luring a victim to a crafted HTML page. Rooted in an inappropriate network implementation (CWE-346, Origin Validation Error), the flaw breaks the browser's cross-origin boundary enforcement without requiring any attacker authentication. No public exploit has been identified at time of analysis; EPSS places exploitation probability at 0.17% (7th percentile), and SSVC confirms no active exploitation, making this a low-urgency but valid information disclosure risk given Chrome's ubiquitous deployment.
UI spoofing in Google Chrome's Views component (prior to 151.0.7922.72) enables a remote unauthenticated attacker to deceive a victim about browser UI state or page origin by serving a crafted HTML page that triggers CWE-451 misrepresentation of critical interface elements. The CVSS vector (PR:N/UI:R) confirms the attack requires no authentication but does require the victim to visit the attacker-controlled page, limiting automated mass exploitation. No public exploit exists and SSVC rates current exploitation as none, with EPSS at only 0.17% (7th percentile), consistent with a low-severity, user-interaction-dependent flaw.
Cross-origin data leakage in Google Chrome's CORS implementation enables a post-exploitation information disclosure step for attackers who have already compromised the renderer process. All Chrome versions prior to 151.0.7922.72 are affected, with exploitation requiring both a pre-existing renderer compromise and user interaction with a crafted HTML page. No public exploit code exists and no CISA KEV listing; EPSS at 0.17% (7th percentile) and SSVC Exploitation: none confirm this is a low-priority, chained-attack-only vulnerability in practice.
UI spoofing in Google Chrome's Payments component (versions prior to 151.0.7922.72) permits remote attackers to deceive users by rendering fraudulent payment-related interface elements through a specially crafted HTML page. The flaw carries a CVSS score of 4.3 and Chromium's own 'Low' severity rating, consistent with EPSS at 0.17% (7th percentile), signaling negligible real-world exploitation probability. No public exploit code exists and the vulnerability is absent from CISA's KEV catalog; Google has issued a patch in stable channel version 151.0.7922.72.
Jeg Kit for Elementor exposes sensitive site configuration data to any authenticated WordPress user with Contributor-level access or above through an unguarded inline JavaScript object injected on the post editor page. The `enqueue_scripts()` method outputs a `JkitDashboardOption` object containing installed plugin names, versions, file paths, active statuses, WordPress and PHP versions, site URLs, server capabilities, and - critically - potentially a Mailchimp API key stored in `jkit_user_data`. No public exploit or CISA KEV listing exists at time of analysis, but the low authentication barrier (Contributor) and the API credential exposure risk elevate real-world impact above the Medium CVSS score alone suggests.
User enumeration and profile disclosure in WPGraphQL 2.x through 2.14.1 completely undermines the plugin's own anti-enumeration design via a deprecated GraphQL field that was never removed. An unauthenticated attacker can invoke the `sendPasswordResetEmail` mutation and include the deprecated `user` sub-field: a null response indicates the email or username does not exist, while a populated User object confirms existence and additionally leaks databaseId, full name, slug, bio, and profile URI for author-class users. A detailed proof-of-concept GraphQL mutation is published in advisory GHSA-jhh7-832h-f8hv, and no rate limiting exists at the WPGraphQL layer. No active exploitation has been confirmed by CISA KEV, though the barrier to exploitation is trivially low.
sigstore-go versions up to and including 1.2.0 accept Sigstore bundles signed with expired long-lived public keys because the verifier omits the timestamp-validity check when using `ExpiringKey`-wrapped verifiers. An attacker who obtains expired signing key material can produce bundles that pass verification despite the key's configured expiry window, undermining supply chain integrity guarantees enforced by key rotation policies. This affects only the self-managed long-lived key workflow - standard Sigstore deployments using Fulcio certificate authorities are explicitly unaffected. No public exploit identified at time of analysis.
Contao CMS's crawler leaks HTTP authentication credentials to external hosts due to an option-name mismatch in its credential-scrubbing logic, affecting versions 4.13.40-5.3.46 and 5.7.0-RC1-5.7.6. The cleaner is coded to remove the non-existent keys `basic_auth` and `bearer_auth` rather than Symfony HttpClient's actual `auth_basic` and `auth_bearer` options, so credentials configured in `contao.crawl.default_http_client_options` are silently passed through to external domains. An attacker who can place an external link on any page crawled by Contao's broken-link checker can receive those credentials on an attacker-controlled server. No public exploit or CISA KEV listing exists at time of analysis.
Cleartext storage of sensitive information in Johnson Controls XAAP Application on Android (versions before 1.53) exposes sensitive data to retrieval by attackers who already have access to a jailbroken or otherwise compromised device. The flaw stems from insufficient data-at-rest protection (CWE-312), meaning credentials, tokens, or configuration data are stored without encryption in the app's local storage. No public exploit code exists and this vulnerability is not listed in CISA KEV; real-world risk is constrained by the requirement for prior device compromise.
HTTP request smuggling in cPanel and WP Squared (by WebPros) enables leakage of credentials from other users sharing the same hosting infrastructure. The CVSS 4.0 vector confirms network-reachable exploitation with no authentication required but with passive user interaction and attack-specific prerequisites; critically, the subsequent-system impact is rated High for both confidentiality and integrity (SC:H/SI:H), indicating that successful exploitation crosses trust boundaries to affect other users or backend components beyond the attacker's own session. No public exploit code has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog, but the scope-change impact makes it a meaningful risk in shared hosting environments where cPanel serves multiple tenants.
Improper error handling in HCL iControl 4.3.0 and 4.4.0 exposes sensitive information through verbose error messages triggered by common fault conditions - out of memory events, null pointer exceptions, database unavailability, network timeouts, and system call failures. CWE-209 classifies this as generation of error messages containing sensitive information, meaning stack traces, internal paths, configuration data, or environment details may be disclosed to a network-accessible observer who can trigger or observe these fault states. CVSS scores this at 3.7 (Low), reflecting high attack complexity and limited confidentiality impact; no public exploit identified at time of analysis.
HCL iControl versions 4.3.0 and 4.4.0 expose authentication-related sensitive data through browser autocomplete functionality on login forms, classified under CWE-522 (Insufficiently Protected Credentials). Valid usernames, email addresses used for login, and account identifiers can be surfaced by the browser's autocomplete engine to subsequent users on shared workstations or kiosk environments. No active exploitation has been identified at time of analysis, and the CVSS score of 3.7 accurately reflects a low-severity, opportunistic information disclosure issue rather than a remotely exploitable critical flaw.
HCL iControl versions 4.3.0 and 4.4.0 expose internal configuration files to local access due to improper web server or application hardening, classified under CWE-497 (Exposure of Sensitive System Information). Local actors without any privileges can read configuration data that should be restricted, potentially revealing sensitive system details usable for follow-on attacks. No public exploit or active exploitation has been identified at time of analysis, and the CVSS score of 4.0 (Medium) reflects the limited local attack surface.
Verbose API error responses in HCL iControl 4.3.0 and 4.4.0 leak internal endpoint names, request parameters, error codes, and authentication status directly to unauthenticated network clients. The CVSS vector (AV:N/AC:H/PR:N/UI:N) confirms network-accessible, unauthenticated exposure but with high attack complexity - specific error-triggering conditions must be crafted. No public exploit exists and this is not in CISA KEV; however, the disclosed metadata constitutes meaningful reconnaissance leverage that can lower the cost of subsequent targeted attacks against the platform.
HCL iControl versions 4.3.0 and 4.4.0 publicly expose internal configuration files due to inadequate web server or application hardening, mapping to CWE-15 (External Control of System or Configuration Setting). The misconfiguration allows attackers to retrieve sensitive configuration data that may contain credentials, internal paths, service endpoints, or other operational details usable for further lateral movement or privilege escalation. No active exploitation has been confirmed in CISA KEV, and no public exploit code has been identified at the time of analysis.
Sensitive data exposure in the WP Maps WordPress plugin (versions through 4.9.6) allows authenticated low-privilege users to retrieve embedded sensitive information - likely including API keys such as Google Maps API credentials - from data returned by the plugin. Exploitation requires a valid WordPress account with minimal permissions (CVSS PR:L), making it accessible to any registered user on an affected site. No public exploit code or active exploitation has been identified at time of analysis, but the network-accessible attack vector lowers the bar for opportunistic discovery.
Unauthenticated remote manipulation of user state is possible in StylemixThemes MasterStudy LMS WordPress plugin through version 3.7.39, due to insufficient verification of data authenticity (CWE-345). The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms that no authentication or user interaction is required, allowing any network-accessible attacker to tamper with LMS user state - such as enrollment records, course progress, or quiz scores. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity makes this straightforward to abuse against unpatched installations.
Denial of service in Apache HttpComponents Client (versions 5.0-alpha1 through 5.6.2) arises when the classic/blocking I/O HttpClient fails to release the underlying connection back to the pool after receiving a response carrying an invalid or unsupported Content-Encoding header. An attacker who controls or can influence the server a client talks to can repeatedly return such headers to leak connections until the pool is exhausted, halting further outbound HTTP requests from the affected Java application. The async I/O HttpClient is explicitly unaffected; there is no public exploit identified at time of analysis and no CVSS or EPSS data was supplied.
Redirect URI policy bypass in Keycloak's secure-client-uris executor enables interception of OAuth authorization codes over unencrypted HTTP connections. The flaw exists because the executor performs only a prefix-string comparison on the redirect URI rather than properly parsing and validating the host component, allowing a specially crafted domain name to satisfy the HTTPS enforcement check while pointing to an attacker-controlled HTTP endpoint. Affected deployments include Red Hat Build of Keycloak, Red Hat Single Sign-On 7, and related Red Hat middleware products. No public exploit code or CISA KEV listing has been identified at time of analysis.
SAML HTTP-Redirect binding in Keycloak allows network-based attackers to inject malicious parameters into authentication requests targeting clients configured with wildcard redirect URLs. When a victim user completes authentication, Keycloak appends its legitimate SAML response to the attacker-controlled URL parameters, which can cause susceptible service providers to process the attacker's data instead of the real login assertion - potentially resulting in the victim being logged into the wrong account. No public exploit is identified at time of analysis, and the CVSS score of 3.4 (Low) reflects the high attack complexity and limited integrity-only impact.
User email enumeration in the JS Help Desk WordPress plugin (versions before 3.1.4) allows any Contributor-level site user to harvest the email addresses of all registered WordPress users. Two design flaws compound: the plugin unconditionally grants a support-agent capability to the built-in Contributor role at activation time, and the user-listing handler omits any capability check entirely, making the Contributor elevation the effective attack precondition. A public proof-of-concept is documented by WPScan; however, EPSS places exploitation probability at 0.14% (4th percentile), indicating no public exploit is currently being run at scale. No CISA KEV listing is present.
JS Help Desk WordPress plugin before 3.1.4 exposes all support ticket content to any authenticated WordPress user due to missing authorization and ownership checks in its search handler. Any account at Subscriber level or above can enumerate and read the subject and full message body of every other user's support ticket by interacting with the plugin's nonce-gated AJAX endpoint, bypassing the intended per-user data isolation. A publicly available proof-of-concept exploit exists per WPScan; EPSS is low at 0.14% (4th percentile), suggesting opportunistic rather than widespread automated exploitation, but the low authentication bar makes this a meaningful data exposure risk on multi-user WordPress sites.
Unauthenticated download of exported member and payment PII is possible in the Paid Membership Subscriptions WordPress plugin before 3.0.7 due to export files being written to a predictable, unprotected path within the publicly accessible uploads directory. Any site running an affected version where an administrator has recently triggered an export is at risk of exposing member personally identifiable information and payment records to any network-accessible attacker. A publicly available proof-of-concept exploit exists per WPScan, and while the CVSS base score is low (3.7), the data sensitivity of the exposed artifact elevates real-world impact beyond what the score alone suggests.
HTTP security header spoofing in CodeIgniter4 prior to 4.7.4 allows remote unauthenticated attackers to trick the framework into treating plain HTTP requests as HTTPS by injecting forged X-Forwarded-Proto or Front-End-Https headers. The root cause is that IncomingRequest::isSecure() unconditionally trusted these headers from any source rather than restricting trust to configured trusted proxies, undermining isSecure(), force_https(), and forceGlobalSecureRequests enforcement logic. No public exploit or CISA KEV listing exists; real-world impact is conditioned on deployment topology and CVSS AC:H reflects this complexity.
Out-of-bounds read in mz-automation/lib60870 allows unauthenticated remote attackers to leak one byte of heap memory and potentially crash the parsing process by sending a crafted IEC 60870-5-104 I-frame. The vulnerability triggers when a declared ASDU object count exceeds the actual data present in the message buffer, causing `InformationObject_ParseObjectAddress` to read one byte beyond the allocated heap region. Disclosed via CISA ICS Advisory ICSA-26-211-11 with no public exploit identified at time of analysis.
Out-of-bounds heap read in mz-automation's lib60870 library exposes ICS/SCADA systems to unauthenticated remote exploitation via a crafted IEC 60870-5-104 I-frame. An attacker sending a C_TS_NA_1 ASDU with an inflated object count triggers `TestCommand_getFromBuffer` to read one byte past the end of a heap-allocated buffer, producing partial heap memory disclosure and potential availability disruption. CISA ICS-CERT has published advisory ICSA-26-211-11; no active exploitation is confirmed and no public exploit code has been identified at time of analysis.
Denial-of-service in MZ Automation GmbH libiec61850 (all versions before 1.6.2) allows an adjacent unauthenticated attacker to crash the MMS server process by sending a crafted BER-encoded confirmed request PDU containing an extended BER tag over an established MMS session. The missing bounds check in the buffer decoder causes a one-byte heap out-of-bounds read, terminating the MMS service and disrupting IEC 61850-based industrial control communications. No active exploitation is confirmed (not listed in CISA KEV), and no public exploit code has been identified at time of analysis.
Out-of-bounds heap read in MZ Automation GmbH libiec61850 (all versions before 1.6.2) allows an unauthenticated adjacent-network attacker to crash an MMS server by sending a crafted AARQ PDU with a zero or one-byte length value in the calling AP title field during connection establishment. The ACSE parser fails to bounds-check the attacker-controlled length, reading past the end of a heap buffer and causing availability loss - a significant concern in IEC 61850 substation automation environments where device availability underpins grid protection and monitoring. No public exploit has been identified at time of analysis, and no CISA KEV listing exists; a vendor patch (version 1.6.2) is available per CISA ICS advisory ICSA-26-211-10.
Insecure file permissions in ansible-collection-redhat-leapp expose PostgreSQL backup archives to local non-root users on managed RHEL 9 and RHEL 10 nodes. When the `leapp_old_postgresql_data` remediation option is invoked with elevated privileges, the resulting backup archive is written with world-readable or group-readable permissions (CWE-732), allowing any local non-root user on that managed node to extract the full contents of the archived PostgreSQL data. No public exploit has been identified at time of analysis, and exploitation requires local authenticated access to the managed node.
The ansible-collection-redhat-leapp package exposes Ansible controller-side sensitive files to attacker-controlled managed nodes through a manipulated Leapp upgrade report. An attacker who has already obtained privileged write access to a managed node's Leapp report can craft malicious report content that, when an operator executes a specific remediation task, causes the Ansible controller to read and copy its own local files - including private keys and credentials - to the attacker-controlled managed node. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog; however, the CVSS 3.1 score of 6.2 reflects real-world risk limited by the high privilege prerequisite and required operator interaction.
Out-of-bounds heap read in GoAccess prior to version 1.11 allows a remote unauthenticated attacker to read approximately 4 KB beyond a heap allocation and conditionally crash the analyzer by embedding a crafted User-Agent string into any web server access log that GoAccess subsequently processes. The defect resides in the parse_ios() function (src/opesys.c), where an attacker-controlled keyword-to-OS offset value is incorrectly passed as both the source pointer offset and the copy length to memmove(), violating the intended semantics and enabling the out-of-bounds read. No public exploit code has been identified and this vulnerability is not listed in CISA KEV; a vendor-confirmed fix is available in version 1.11.
Out-of-bounds heap read in node-re2 prior to 1.25.2 allows process termination and limited heap memory disclosure when an attacker-influenced lastIndex value is used against a non-ASCII subject string. The flaw arises because lastIndex is validated against the UTF-8 byte length of the input but consumed as a UTF-16 code-unit offset - for any non-ASCII character, the UTF-8 byte count exceeds the UTF-16 unit count, creating a gap where a lastIndex passes the guard yet reads past the allocated buffer. The resulting crash is uncatchable by the Node.js process, making it an effective denial-of-service vector in any server application exposing this code path to external input. No active exploitation confirmed (not in CISA KEV); no public exploit code identified at time of analysis.
Authenticated users with time or cost entry viewing permissions can read private work package subjects and IDs via the OpenProject REST API in versions prior to 17.6.0. The /api/v3/time_entries and /api/v3/cost_entries endpoints expose _links.workPackage.title and _links.workPackage.href through the associated_resource rendering path without enforcing WorkPackage.visible or view_work_packages permission checks. An attacker with only view_time_entries or view_cost_entries can enumerate titles and IDs of work packages they should not have access to, violating project confidentiality controls. No public exploit or CISA KEV listing exists; the fix is available in v17.6.0.
Plugin output logs in IBM UrbanCode Deploy and IBM DevOps Deploy expose sensitive step values to any authenticated user with log access, across a wide range of actively-maintained versions spanning both product lines. The CVSS PR:L vector confirms that a low-privileged authenticated user - such as a developer or operator - who can view deployment logs may read sensitive values such as credentials, API tokens, or configuration secrets that plugin steps emit without redaction. No public exploit code exists and the vulnerability is not listed in CISA KEV, but the risk is practically elevated in CI/CD environments where plugin steps routinely handle high-value secrets.
The /unpack endpoint in Apache Tika's server component (tika-server 4.0.0-alpha-1) fails to enforce the operator-configured enableUnsecureFeatures=false security control, classified as Improper Protection of Alternate Path. This means the /unpack endpoint remains fully operational even when administrators have explicitly disabled unsafe features, bypassing the intended security boundary and allowing archive extraction or untrusted content processing through a restricted interface. No public exploit code has been identified and the vulnerability is confined to a pre-production alpha release, significantly limiting real-world exposure.
Insufficient session expiration in the MikroTik RouterOS API allows authenticated users whose permissions have been reduced to retain their prior, elevated access rights for the duration of the stale session. Specifically, when a user's group membership or permission set is downgraded, or when an inactivity timeout is expected to expire a session, the RouterOS API fails to re-evaluate or invalidate the existing session token - exposing confidential routing, firewall, or credential data the user should no longer reach. No public exploit has been identified and the vulnerability is not listed in the CISA KEV catalog; however, ICS-CERT's publication of ICSA-26-211-01 signals elevated concern for operational technology networks where MikroTik devices are used for segmentation and industrial network management.
Uncontrolled decompression in aiohttp's WebSocket client prior to version 3.14.2 allows a malicious server to exhaust CPU and memory on connecting clients by sending RSV1-flagged compressed frames without having negotiated the permessage-deflate extension. The root cause is a missing constructor argument in `client.py:_ws_connect` that caused `WebSocketReader` to default to `compress=True`, violating RFC 6455 §5.2 which mandates failing the connection on undefined reserved bits. This is client-side exposure only - aiohttp server deployments are not affected. No active exploitation has been identified and no public exploit code exists at time of analysis.
Verbose technical error message disclosure in IBM Verify Identity Access and IBM Security Verify Access (both appliance and container editions) allows unauthenticated remote attackers to harvest internal application details returned directly in the browser. Affected versions span IBM Verify Identity Access 11.0-11.0.2, IBM Security Verify Access 10.0-10.0.9.1, and their respective container variants. No public exploit or CISA KEV listing exists at time of analysis; however, the zero-authentication barrier and the reconnaissance value of exposed technical data elevate this beyond a benign information leak, as harvested details can directly inform more damaging follow-on attacks against an identity management system.
Broken access control in IBM Langflow OSS 1.0.0-1.8.4 exposes private flow files through two distinct endpoint flaws: the image retrieval endpoint enforces no authentication whatsoever, allowing unauthenticated remote attackers to access any user's image files given a valid flow ID and filename; separately, the file download endpoint, while requiring authentication, fails to validate resource ownership, enabling any authenticated user to access files belonging to other tenants via IDOR. Both flaws break tenant isolation in multi-user deployments and result in unauthorized disclosure of sensitive data. No public exploit or CISA KEV listing has been identified at time of analysis; a vendor patch is available.
Cross-buffer memory aliasing in msgpack-ruby prior to 1.8.2 allows same-process code to read or corrupt data belonging to a separate MessagePack::Buffer instance via a use-after-free in the rmem slab allocator. MessagePack::Buffer#clear returns a 4 KiB rmem page to the shared pool but leaves rmem_last, rmem_end, and rmem_owner pointing into the freed page; a subsequent write on the cleared buffer and a concurrent second Buffer allocation can claim the same physical page, creating a memory alias that exposes the second buffer's serialized bytes. A PoC is included in the vendor advisory (GHSA-4mrv-5p47-p938); no public exploit identified at time of analysis beyond that PoC, and the CVE is not in CISA KEV.
Denial of service in Samba's Kerberos KDC password change (kpasswd) service allows authenticated remote attackers to crash the KDC process by submitting specially crafted, malformed ASN.1-encoded password change requests. The server miscalculates the structure size of the incoming request and reads up to six bytes beyond the end of the allocated buffer; when this read strikes unmapped memory, the KDC process terminates rather than simply failing gracefully. No public exploit has been identified and no CISA KEV listing exists, but the disruption of a KDC in an Active Directory or Samba domain environment carries significant operational impact since authentication for the entire domain depends on KDC availability.
foreUP's customer REST API exposes cleartext payment-processor merchant credentials - such as API keys or secrets - directly in response bodies to any authenticated user. All foreUP versions are affected per the wildcard CPE (cpe:2.3:a:foreup:foreup:*). An attacker with any valid authenticated session can harvest these credentials and use them to interact directly with the downstream payment processor, creating potential for financial fraud or account takeover at the payment-processing layer. No public exploit has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Credential exposure in CSL 1010 M2M 3G WiFi Module firmware through 2.2.1.4 stems from a trivially reversible single-byte XOR cipher with a hard-coded static key used to 'protect' the Router.cfg configuration backup file. An attacker with local access to the device can decrypt the backup and recover web administration passwords, telnet credentials, WPA/WPA2 pre-shared keys, PPPoE and 3G/APN credentials, and SIM identifiers (IMSI and IMEI) in plaintext. No public exploit has been identified at time of analysis, KEV listing is absent, and no fixed firmware version has been confirmed.
Unauthenticated exposure of Go pprof debug endpoints in Calico kube-controllers and Goldmane components allows any pod with adjacent network access to retrieve sensitive in-memory data when the shared debug server feature is enabled. Affected products span Calico, Calico Enterprise, and Calico Cloud across all versions per CPE. The vulnerability is opt-in (debug server disabled by default), but carries high confidentiality impact when enabled because heap dumps and goroutine stacks may contain credentials, tokens, or other sensitive runtime state. No public exploit identified at time of analysis and no CISA KEV listing.
Insufficient audit logging in VMware ESX and related Broadcom virtualization platforms allows a malicious administrator to perform certain privileged operations without generating corresponding log entries. Affected products span the VMware ecosystem including Cloud Foundation, vSphere Foundation, ESX, and Telco Cloud Platform. No public exploit code exists and the vulnerability is not listed in CISA KEV, but the insider-threat and post-compromise forensic evasion implications are meaningful for organizations relying on audit logs for compliance and incident response.
DFIR-IRIS web application version 2.4.26 implements logout without server-side session invalidation, leaving session cookies valid indefinitely after a user believes they have signed out. Classified as CWE-613 (Insufficient Session Expiration), this flaw means any attacker who obtains a valid session cookie - through XSS, network interception, shoulder-surfing, or physical device access - retains unauthorized access to the IRIS incident response platform even after the legitimate user logs out. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Credential exposure in Phoenix Contact CHARX SEC EV charging controllers allows a low-privileged local attacker who can read log files to extract plaintext credentials for the built-in 'user-app' account and subsequently authenticate via SSH. Affected are all CHARX SEC-3000, 3050, 3100, and 3150 units running firmware versions 1.0.0 through 1.9.0. Successful exploitation can interrupt active EV charging sessions, constituting a high availability impact in operational charging infrastructure. No public exploit or active exploitation has been identified at time of analysis.
Firmware update handling in Phoenix Contact CHARX SEC EV charging controllers (versions 1.0.0 through 1.8.x) exposes a race condition exploitable by unauthenticated remote attackers via the OCPP backend. By supplying an invalid firmware file, an attacker can cause the file to persist temporarily in accessible device storage during the flawed cleanup window before deletion, resulting in low-impact integrity interference with the firmware management process. No public exploit code and no CISA KEV entry have been identified; a vendor-released patch is confirmed at version 1.9.1.
Password reset token hijacking in Veeam Service Provider Console 9.2 and earlier enables unauthenticated remote attackers to take over any portal user account by manipulating the returnUrl parameter in the Forgot Password workflow. An attacker who knows a target's email address initiates a password reset on their behalf, supplying an attacker-controlled domain via the unvalidated returnUrl parameter; the platform then generates a reset email whose link routes through the attacker's infrastructure, transmitting the one-time reset code upon the victim clicking it. Account takeover is achieved without requiring any credentials or prior access to the platform. No public exploit has been identified at time of analysis, and CISA KEV status is not confirmed; however, the technique is straightforward and the report originated from HackerOne, suggesting the attack vector is well-understood by researchers.
Unauthenticated deletion of all custom icon font packs is possible in Ultimate Addons for WPBakery Page Builder WordPress plugin before version 3.21.4. The plugin's icon font deletion endpoint performs no WordPress capability check and no nonce verification, meaning any unauthenticated HTTP request can permanently erase every custom-uploaded icon font pack on an affected site in a single request. A publicly available proof-of-concept exists and SSVC assesses the attack as automatable, though EPSS remains very low at 0.15% (5th percentile), indicating no significant observed exploitation at scale; the vulnerability is absent from CISA KEV.
Authenticated information disclosure in the LifterLMS WordPress plugin before 10.0.10 exposes internal post type titles - including coupon codes - to any subscriber-level user. The root cause is a missing capability check in a select2 query AJAX handler that only verifies login status, not whether the user holds an appropriate WordPress capability. A publicly available proof-of-concept exists (via WPScan), though EPSS sits at just 0.16% (5th percentile), indicating low broad exploitation likelihood; no active exploitation is confirmed by CISA KEV.
Unauthorized customer PII exposure in MotoPress Hotel Booking WordPress plugin before 6.0.4 allows any authenticated subscriber-level user to retrieve full personal details - name, email, phone number, and address - belonging to any customer booking in the system. The flaw stems from a missing capability check in an AJAX action handler, meaning the plugin never verifies whether the requesting user is authorized to view the target booking before returning its data. A publicly available exploit exists per WPScan, though EPSS at 0.16% (5th percentile) and absence from CISA KEV suggest exploitation remains opportunistic rather than widespread.
Easy Appointments WordPress plugin through version 3.12.26 exposes an appointment-listing REST endpoint to any authenticated user by gating it on a capability held by every WordPress user - including subscribers, the lowest authenticated role. Any user with a basic account can query this endpoint to enumerate all site bookings, extracting customer names, appointment schedules, and booking statuses belonging to other clients. A publicly available exploit is documented by WPScan; however, EPSS sits at 0.16% (5th percentile) and the vulnerability is not in CISA KEV, indicating limited observed mass exploitation at time of analysis.
Easy Appointments WordPress plugin through version 3.12.26 exposes all stored customer personal information to any authenticated contributor-level user due to missing per-request capability and nonce validation on a customer-listing handler. Any user holding a contributor role - a low-privilege WordPress role normally limited to drafting posts - can invoke the unprotected endpoint and enumerate the full customer dataset. A publicly available proof-of-concept exists per WPScan, though EPSS places exploitation probability at 0.16% (5th percentile) and the flaw has not been listed in CISA KEV, suggesting limited observed exploitation.
Spring Tools language server exposes proxy Basic-auth credentials in cleartext log files, affecting Spring Tools for Eclipse 5.2.0 and earlier and Spring Tools for VSCode/Cursor/Theia 2.2.0 and earlier. When no explicit http.proxy workspace setting is configured, the language server reads the HTTP_PROXY/HTTPS_PROXY (and lowercase variants) environment variables and writes their raw values-including embedded credentials in the form http://user:pass@proxy:8080-to its log at INFO level without redaction. Because language server logs are often shared in bug reports or are readable by other local users and processes, this results in proxy credential disclosure. No public exploit has been identified at time of analysis, and CISA KEV listing is absent.
Remote unauthenticated denial of service and memory disclosure in the Performance Co-Pilot (PCP) pmproxy service affects Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4. An out-of-bounds read (CWE-125) in the pmLogLoadInDom() function can be triggered by a specially crafted network request, causing the pmproxy process to crash and potentially leaking sensitive data from process memory. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Price manipulation in the Persian Elementor WordPress plugin (all versions up to and including 2.8.1) allows unauthenticated remote attackers to submit arbitrary payment amounts to the ZarinPal payment gateway by tampering with the client-supplied 'amount' POST parameter, bypassing the price configured in the Elementor widget. The root cause is the absence of server-side reconciliation between the submitted payment figure and the widget's defined price - whatever the client sends is forwarded directly to ZarinPal. No public exploit code has been identified and the CVE is not listed in the CISA KEV catalog, though exploitation requires zero authentication and only trivial HTTP parameter manipulation.
Side-channel information leakage in Google Chrome's Media component (versions prior to 151.0.7922.72) enables a remote attacker to leak cross-origin data by directing a victim to a crafted HTML page, bypassing same-origin policy protections through measurable side effects of media processing. Affected desktop users on all platforms running any Chrome release before 151.0.7922.72 are exposed to limited confidentiality loss. EPSS is 0.16% (6th percentile), SSVC exploitation status is none, and no public exploit has been identified at time of analysis - all signals converge on low real-world risk.
UI spoofing in the Google Chrome Updater component on Windows (prior to 151.0.7922.72) enables a local attacker to present a falsified interface to users by placing a malicious file in a location the Updater processes. Chromium's own team rates this 'Low' severity, consistent with the 4.0 CVSS score, EPSS of 0.10% (1st percentile), and SSVC exploitation status of 'none'. No public exploit exists at time of analysis, and a vendor-confirmed patch is available in Chrome 151.0.7922.72.
UI spoofing in Google Chrome for iOS prior to 151.0.7922.72 enables a remote attacker to deceive users into believing they are interacting with a legitimate browser interface by serving a crafted HTML page. The root cause is insufficient policy enforcement (CWE-346, origin validation error), allowing the attacker to manipulate rendered UI elements. No public exploit code exists and no active exploitation has been confirmed; EPSS stands at 0.16% (6th percentile) and CISA SSVC classifies exploitation as none, placing this firmly in a patch-and-monitor priority tier rather than an emergency response.
UI spoofing in Google Chrome for iOS prior to version 151.0.7922.72 enables a remote unauthenticated attacker to misrepresent critical interface elements - such as the address bar or origin indicators - through a specially crafted HTML page. Classified as CWE-451 (UI Misrepresentation of Critical Information), the impact is limited to integrity: no code execution or data exfiltration is possible directly, but users can be deceived into trusting a malicious page as legitimate. No public exploit code exists, EPSS sits at 0.16% (6th percentile), and Chromium internally rated this as Low severity - consistent with a constrained, social-engineering-dependent attack surface.
Chrome for iOS prior to 151.0.7922.72 exposes potentially sensitive process memory contents to an attacker with physical access to the device through an inappropriate implementation flaw. The vulnerability is classified CWE-200 (Information Disclosure) and is iOS-platform-specific, not affecting Chrome on other operating systems. No public exploit code exists and CISA SSVC confirms no active exploitation, placing this firmly in the low-urgency tier despite requiring prompt patching for high-assurance mobile environments.
UI spoofing in Google Chrome's Passwords subsystem (versions prior to 151.0.7922.72) enables remote attackers to manipulate password-related UI elements through malicious network traffic, potentially deceiving users into submitting credentials to unintended destinations. Exploitation requires active user interaction (UI:R per CVSS), and real-world risk is constrained by an EPSS of 0.15% (5th percentile) and SSVC confirmation of no known exploitation and a non-automatable attack path. No public exploit identified at time of analysis; vendor patch is available in Chrome 151.0.7922.72.
UI spoofing in Google Chrome's Passwords component (versions prior to 151.0.7922.72) allows a remote unauthenticated attacker to manipulate how credential-related UI elements are displayed by delivering maliciously crafted network traffic to a browsing user. The root cause is insufficient input validation (CWE-20) in the Passwords subsystem, which fails to sanitize externally sourced data before rendering it in the browser interface. No public exploit code has been identified and CISA has not listed this in KEV; EPSS of 0.15% (5th percentile) confirms low automated exploitation probability, consistent with the SSVC rating of exploitation: none.
UI spoofing in Google Chrome's Settings component (versions prior to 151.0.7922.72) enables remote attackers to misrepresent critical interface elements to victims via malicious network traffic, requiring user interaction to trigger. EPSS at 0.15% (5th percentile) and CISA SSVC exploitation rating of none align with the Chromium team's own Low severity classification, making this a low-urgency issue despite its network-accessible attack vector. Google has released a patch in stable channel version 151.0.7922.72; no public exploits are identified at time of analysis.
UI spoofing in Google Chrome for Android (prior to 151.0.7922.72) enables remote unauthenticated attackers to present misleading interface elements to users through a crafted HTML page. The flaw stems from an inappropriate implementation in Chrome's input handling on Android, classified under CWE-451 (UI Misrepresentation of Critical Information), meaning the browser fails to correctly represent critical UI state to the user. No public exploit code exists and CISA has not listed this in KEV; EPSS is extremely low at 0.16% (6th percentile), consistent with Chromium's own Low severity classification.
UI spoofing via Google Lens in Google Chrome prior to 151.0.7922.72 is achievable by a remote attacker who has already compromised the renderer process, using a crafted HTML page to misrepresent interface elements to the victim. The attack requires a chained exploitation scenario: renderer compromise as a prerequisite, followed by abuse of an inappropriate implementation in the Lens component (CWE-451) to manipulate what the user perceives in the browser UI. No active exploitation is confirmed - CISA KEV does not list this CVE, SSVC assessment shows exploitation status of none, and EPSS sits at 0.16% (6th percentile), indicating very low real-world exploitation probability at time of analysis.
Information disclosure in Google Chrome's WebXR subsystem prior to version 151.0.7922.72 allows unauthenticated remote attackers to read potentially sensitive process memory contents by luring a victim to a crafted HTML page. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) indicates a network-accessible, low-complexity path to high confidentiality impact, though Chromium's internal severity rating of Low and an EPSS of 0.16% (6th percentile) reflect limited real-world exploitation risk. No public exploit code exists and CISA SSVC rates exploitation as none, making this a watch-and-patch item rather than an emergency response trigger.
UI spoofing in Google Chrome on iOS prior to 151.0.7922.72 enables a remote attacker to deceive users about page identity or browser security state by serving a crafted HTML page. The flaw is iOS-specific, exploiting an inappropriate implementation in the Chrome for iOS rendering layer rather than the broader Chromium engine, and requires only that the victim navigate to an attacker-controlled page. No public exploit has been identified and EPSS stands at 0.19% (9th percentile), consistent with Chromium's own 'Low' internal severity classification; this is a real but low-urgency integrity issue.
Process memory disclosure in Google Chrome's WebGL implementation allows a remote attacker to read potentially sensitive data from the browser's memory by luring a user to a specially crafted HTML page. Affected versions are all Chrome releases prior to 151.0.7922.72 across desktop platforms. No public exploit code has been identified and EPSS sits at 0.16% (6th percentile), indicating low real-world exploitation probability despite the High confidentiality rating in the CVSS vector.
Cross-origin data leakage in Google Chrome for Android (prior to 151.0.7922.72) stems from insufficient policy enforcement in the USB component, exploitable only after the attacker has already compromised the renderer process. Exploitation requires luring a victim to a crafted HTML page in a pre-compromised renderer context, making this a secondary-stage vulnerability in a chained attack rather than a standalone threat. EPSS sits at 0.19% (9th percentile), SSVC records no exploitation activity, and the vulnerability is not listed in CISA KEV - consistent with its low severity rating and demanding prerequisite.
Domain spoofing in Google Chrome on Android (all versions prior to 151.0.7922.72) results from a race condition in the PictureInPicture component, enabling a remote attacker to misrepresent the origin domain shown to a user when they interact with a crafted HTML page. The integrity impact is limited to the browser UI trust indicator - no code execution or data exfiltration occurs directly - but successful spoofing can be chained with credential phishing against a falsely trusted domain. No active exploitation has been confirmed (not listed in CISA KEV), and the EPSS score of 0.16% at the 6th percentile reflects very low exploitation probability, consistent with Chromium's own 'Low' severity classification.
UI spoofing in Google Chrome's Extensions subsystem (all versions prior to 151.0.7922.72) allows an attacker who tricks a user into installing a crafted malicious extension to misrepresent critical security indicators within the browser interface. The flaw stems from incorrect security UI rendering in the Extensions component (CWE-451), enabling deceptive presentation of extension trust signals or permissions. No public exploit has been identified at time of analysis and EPSS is 0.10% (1st percentile), aligning with Chromium's own internal 'Low' severity rating; however, the ubiquitous deployment footprint of Chrome elevates the aggregate exposure.
Cross-origin data leakage in Google Chrome's Passwords component (versions prior to 151.0.7922.72) exposes password-related data to attackers who have already compromised the renderer process and can deliver a crafted HTML page. The flaw stems from an inappropriate implementation that fails to enforce proper origin validation within the Passwords subsystem, making it a second-stage element in a chained attack rather than a standalone threat. No public exploit has been identified, EPSS is 0.16% (6th percentile), SSVC records no known exploitation, and Chromium internally rates this Low severity - consistent with the high prerequisite bar of prior renderer compromise.
Uninitialized memory use in Skia, Chrome's 2D graphics rendering engine, exposes process memory contents to remote attackers on Windows via crafted HTML pages in Google Chrome versions prior to 151.0.7922.72. The flaw is strictly an information disclosure issue (CWE-457), with no integrity or availability impact, affecting only the Windows platform per the vulnerability description. No public exploit code has been identified, EPSS places exploitation probability at 0.19% (9th percentile), and SSVC classifies exploitation as none with partial technical impact - collectively suggesting limited real-world risk despite the CVSS C:H rating.
Cross-origin data leakage in Google Chrome on Android prior to 151.0.7922.72 enables a local attacker to read data from a different origin by directing a victim user to a crafted HTML page. The flaw stems from an inappropriate browser implementation (CWE-346 Origin Validation Error), undermining the Same-Origin Policy's isolation guarantees on the Android platform. No public exploit code exists and no active exploitation has been observed; SSVC assessment confirms exploitation status as none, making this a low-urgency but noteworthy information-disclosure defect.
UI spoofing in Google Chrome's Global Media Controls component prior to version 151.0.7922.72 enables remote attackers to misrepresent interface elements when a victim visits a crafted HTML page. The flaw is rooted in CWE-451 (misrepresentation of critical UI information), allowing attacker-controlled content to manipulate what the media controls overlay displays. No public exploit code exists and no active exploitation has been identified; EPSS at 0.17% (7th percentile) and SSVC exploitation status of 'none' both corroborate this as a low-urgency, routine-patching-priority finding.
Cross-origin data leakage in Google Chrome's Blink rendering engine (versions prior to 151.0.7922.72) exposes data protected by the Same-Origin Policy to remote attackers who can lure a victim to a crafted HTML page. The flaw, classified as CWE-346 (Origin Validation Error), allows Blink to improperly handle origin boundaries, enabling a malicious page to read cross-origin resource data. No public exploit has been identified and EPSS sits at 0.17% (7th percentile), consistent with SSVC's 'Exploitation: none' designation and absence from CISA KEV.
Cross-origin data leakage in Google Chrome on Android (prior to 151.0.7922.72) results from an inappropriate UI implementation that allows a remote attacker to extract data from a different web origin when a user is socially engineered into performing specific UI gestures on a crafted HTML page. Rated CVSS 3.1 (Low) with EPSS at 0.17% (7th percentile) and SSVC exploitation status of 'none,' this vulnerability presents minimal immediate operational risk. No public exploit code exists and the issue is not listed in CISA KEV; a vendor-released patch is available in the stable channel update.
Side-channel memory leakage in Chrome's WebCodecs API prior to version 151.0.7922.72 enables a remote, unauthenticated attacker to extract potentially sensitive data from the browser's process memory by luring a victim to a crafted HTML page. The vulnerability stems from improper protection of physical side-channels (CWE-1300) within the WebCodecs media processing subsystem. No active exploitation has been identified - SSVC rates exploitation as none and EPSS places this in the 7th percentile - but the high confidentiality impact score reflects that successful exploitation could expose in-memory session data or other sensitive content.
Cross-origin data leakage in Google Chrome prior to 151.0.7922.72 is achievable through a CSS policy bypass, enabling remote unauthenticated attackers to exfiltrate data across origin boundaries when a victim visits a crafted HTML page. The root cause is improper origin validation (CWE-346) in Chrome's CSS subsystem, allowing CSS mechanisms to circumvent same-origin policy enforcement and read restricted cross-origin content. No public exploit code exists and no active exploitation has been identified; EPSS probability is 0.18% (8th percentile), consistent with the SSVC 'Exploitation: none' assessment and Chrome's own 'Low' severity designation for this issue.
Process memory leakage in Google Chrome's IME (Input Method Editor) implementation on macOS allows remote unauthenticated attackers to obtain potentially sensitive data from Chrome's process memory by luring a user to a specially crafted HTML page. The flaw affects all Chrome for Mac versions prior to 151.0.7922.72, is platform-scoped to macOS only, and carries a CVSS 6.5 (Medium) despite Chromium's own 'Low' severity designation. No public exploit code exists and EPSS sits at 0.17% (7th percentile), indicating very low current exploitation probability.
Information disclosure in the Views UI component of Google Chrome on macOS allows a local attacker to read potentially sensitive data from browser process memory by inducing a user to open a crafted HTML page on versions prior to 151.0.7922.72. The flaw is Mac-platform-specific, categorized by Chromium itself as Low severity, and carries no integrity or availability impact. No public exploit exists and no active exploitation has been identified; EPSS probability sits at 0.11% (2nd percentile) and CISA SSVC classifies exploitation as none.
UI spoofing in Google Chrome for iOS prior to 151.0.7922.72 enables a remote, unauthenticated attacker to misrepresent security-critical interface elements - such as the address bar or origin indicators - by serving a crafted HTML page to a victim. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms the attack is network-delivered and requires no privileges, but does require the user to interact with the malicious page, limiting its reach. No public exploit or active exploitation has been identified; EPSS at 0.17% (7th percentile) and SSVC exploitation status of 'none' collectively indicate low real-world risk at this time.
UI spoofing in Google Chrome's Passwords component allows an attacker occupying a privileged network position (man-in-the-middle) to manipulate password-related interface elements via malicious network traffic. All Chrome releases prior to 151.0.7922.72 on desktop are affected. Exploitation requires both a privileged network position and user interaction, substantially constraining real-world risk; no public exploit code exists and EPSS sits at the 2nd percentile, consistent with no observed exploitation in the wild.
Uninitialized memory access in Google Chrome's WebXR implementation on Android exposes potentially sensitive browser process memory contents to remote attackers who can direct a victim to a crafted HTML page. All Chrome for Android versions prior to 151.0.7922.72 are affected by this information disclosure weakness (CWE-457). No public exploit identified at time of analysis and SSVC confirms no active exploitation, placing this in routine patch-cycle priority despite the high confidentiality impact rating in the CVSS base score.
Information disclosure in Google Chrome's Views UI framework on macOS prior to version 151.0.7922.72 exposes potentially sensitive data from browser process memory to local attackers. The flaw is triggered by an inappropriate implementation in the Views rendering layer, reachable via a specially crafted HTML page. No public exploit code exists and the EPSS score sits at the 2nd percentile, indicating very low observed exploitation probability; Chrome's own severity rating of 'Low' is consistent with the local-only attack vector and read-only confidentiality impact.
UI spoofing in Google Chrome for iOS prior to version 151.0.7922.72 enables remote attackers to deceive users by manipulating security indicators through a crafted HTML page. The vulnerability causes incorrect rendering of Chrome's browser-managed security UI elements - such as origin display or HTTPS trust badges - potentially causing victims to mistake malicious pages for legitimate or secure ones. No active exploitation has been confirmed (not in CISA KEV), EPSS at 0.17% (7th percentile) indicates low near-term exploitation probability, and a vendor-released patch is available in version 151.0.7922.72.
Domain spoofing in Google Chrome on Android (prior to 151.0.7922.72) enables remote unauthenticated attackers to present misleading security UI indicators to users via a crafted HTML page. The flaw stems from CWE-451 - user interface misrepresentation of critical information - where Chrome's Android UI fails to accurately convey the true origin or domain of the page being visited. No public exploit code exists, EPSS sits at 0.17% (7th percentile), and SSVC confirms exploitation status as none, collectively indicating low urgency despite the broad user base.
Cross-origin data leakage in Google Chrome's SVG implementation affects all versions prior to 151.0.7922.72, exploitable by a remote attacker who can convince a user to visit a crafted HTML page. The flaw violates the browser's Same-Origin Policy via improper SVG origin validation (CWE-346), allowing an attacker's page to infer or extract data belonging to cross-origin resources the victim's browser can reach. No active exploitation has been identified - CISA KEV is absent, SSVC exploitation status is 'none', and EPSS sits at a low 0.17% (7th percentile) - placing real-world urgency in the lower-priority tier despite the network attack vector.
Cross-origin data leakage in Google Chrome's network layer prior to version 151.0.7922.72 enables remote attackers to read sensitive cross-origin data by luring a victim to a crafted HTML page. Rooted in an inappropriate network implementation (CWE-346, Origin Validation Error), the flaw breaks the browser's cross-origin boundary enforcement without requiring any attacker authentication. No public exploit has been identified at time of analysis; EPSS places exploitation probability at 0.17% (7th percentile), and SSVC confirms no active exploitation, making this a low-urgency but valid information disclosure risk given Chrome's ubiquitous deployment.
UI spoofing in Google Chrome's Views component (prior to 151.0.7922.72) enables a remote unauthenticated attacker to deceive a victim about browser UI state or page origin by serving a crafted HTML page that triggers CWE-451 misrepresentation of critical interface elements. The CVSS vector (PR:N/UI:R) confirms the attack requires no authentication but does require the victim to visit the attacker-controlled page, limiting automated mass exploitation. No public exploit exists and SSVC rates current exploitation as none, with EPSS at only 0.17% (7th percentile), consistent with a low-severity, user-interaction-dependent flaw.
Cross-origin data leakage in Google Chrome's CORS implementation enables a post-exploitation information disclosure step for attackers who have already compromised the renderer process. All Chrome versions prior to 151.0.7922.72 are affected, with exploitation requiring both a pre-existing renderer compromise and user interaction with a crafted HTML page. No public exploit code exists and no CISA KEV listing; EPSS at 0.17% (7th percentile) and SSVC Exploitation: none confirm this is a low-priority, chained-attack-only vulnerability in practice.
UI spoofing in Google Chrome's Payments component (versions prior to 151.0.7922.72) permits remote attackers to deceive users by rendering fraudulent payment-related interface elements through a specially crafted HTML page. The flaw carries a CVSS score of 4.3 and Chromium's own 'Low' severity rating, consistent with EPSS at 0.17% (7th percentile), signaling negligible real-world exploitation probability. No public exploit code exists and the vulnerability is absent from CISA's KEV catalog; Google has issued a patch in stable channel version 151.0.7922.72.