Information Disclosure
Monthly
Microsoft Graph exposes sensitive information to authenticated network attackers through an information disclosure flaw classified under CWE-200. Any attacker holding a valid low-privilege credential can query the Microsoft Graph API over the network to retrieve data they should not have access to, without requiring additional user interaction or elevated rights. No active exploitation is confirmed (not in CISA KEV), and Microsoft has released an official fix; however, the high confidentiality impact and low attack complexity make this a meaningful risk for any organization relying on Microsoft 365 services.
Unauthenticated network asset discovery exposure in Pronetiqs IntraVUE (formerly Panduit IntraVUE) versions 3.2.1a14 and prior allows remote unauthenticated attackers to enumerate sensitive system and network asset information via the application interface. In industrial control system (ICS) and OT environments where IntraVUE is typically deployed, the disclosed asset inventory - including device types, IP addresses, and network topology - provides adversaries with reconnaissance data directly applicable to follow-on ICS-targeted attacks. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Arbitrary constructor injection in React Router's SSR hydration deserializer (deserializeErrors()) affects npm/react-router versions 6.4.0 through 7.17.x when used in Framework Mode or Data Mode with manual SSR/hydration. When application code permits attacker-supplied input to overwrite the __type or __subType fields embedded in server-side serialized error objects, the client-side hydration process can be manipulated into instantiating arbitrary constructors available on the global window object, triggering unintended outbound network requests from the victim's browser. No public exploit code or CISA KEV listing exists at time of analysis; a vendor-released patch is available in version 7.18.0.
Credential extraction in OpenStack Ironic Python Agent (IPA) allows a tenant with bootc deploy_interface access to steal operator-level OCI registry pull secrets by exploiting a Linux PID namespace escape. Affected deployments running IPA >=10.2.0 <10.2.3, >=11.0.0 <11.2.1, or >=11.3.0 <11.5.1 are at risk when the bootc deploy_interface is enabled and operator-side registry credentials are configured. The attack violates the tenant-to-operator trust boundary by reading host authentication material through /proc/1/root inside a privileged container, with no public exploit identified at time of analysis.
HTTP request smuggling in SwiftNIO HTTP/2 allows unauthenticated remote attackers to inject headers or split responses via crafted HTTP/2 HEADERS frames that pass control characters through the HTTP/2-to-HTTP/1.1 codec. The vulnerability, caused by missing CR/LF/NUL/SP validation in regular header values and pseudo-headers, can be exploited when outbound validation is disabled or headers are forwarded without rechecking. Fixed in version 1.45.0; no public exploit identified at time of analysis and EPSS score is 0.14% (low).
Out-of-bounds heap read in gdk-pixbuf's ICO parser exposes heap memory content through rendered image output, affecting Red Hat Enterprise Linux 6 through 10. When processing a crafted ICO file whose pixel indices exceed the defined palette size, the library reads beyond the palette array boundary - heap bytes are treated as palette entries and rendered as RGB pixel values in the output image, enabling an attacker to extract heap content by analyzing the rendered result. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but server-side image processing pipelines that return rendered output to untrusted callers represent a realistic exposure path.
Authorization bypass in Overseerr's push subscription API (versions through 1.35.0) allows any authenticated user to enumerate, read, and delete the push subscriptions of arbitrary other users by supplying a target userId in path parameters - no elevated privileges required. The missing ownership check bypasses the filteredFields filter applied to normal user data access, exposing sensitive PII including email addresses and plexId values. A publicly available proof-of-concept exists; no CISA KEV listing at time of analysis.
Privilege abuse in Tridium Niagara Framework and Niagara Enterprise Security allows an authenticated high-privileged user on an adjacent network to improperly access confidential data and perform limited unauthorized modifications beyond their sanctioned scope. Affected platforms span Windows, Linux, and QNX, and versions prior to 4.14.6 and 4.15.5 are vulnerable. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Hook mutation pollution in DOMPurify <= 3.4.5 allows persistent bypass of HTML sanitization defaults when application-installed hooks mutate data.allowedTags or data.allowedAttributes. Because these hook fields are direct references to the library's live DEFAULT_ALLOWED_TAGS and DEFAULT_ALLOWED_ATTR sets rather than copies, any write inside a uponSanitizeElement or uponSanitizeAttribute hook permanently widens the global allow-lists for the entire lifetime of the DOMPurify instance - meaning all subsequent sanitize() calls under default config will pass through attacker-controlled HTML using the poisoned tag or attribute name. No public exploit has been identified at time of analysis, and this vulnerability is not listed in CISA KEV; real-world risk is gated on the presence of the specific hook mutation pattern in the target application.
Trusted Types policy state contamination in DOMPurify 3.0.0-3.4.8 allows a previously supplied TRUSTED_TYPES_POLICY to survive a clearConfig() call, poisoning subsequent sanitize() calls that request RETURN_TRUSTED_TYPE output. Any application that reuses a single DOMPurify instance across trust boundaries - where one integration sets a permissive or attacker-influenced TRUSTED_TYPES_POLICY and a later caller invokes clearConfig() expecting a clean slate - will receive a TrustedHTML object signed by the old policy, potentially enabling script execution at a Trusted Types sink. A public proof-of-concept is attached to the GHSA advisory; exploitation is not confirmed in CISA KEV.
JetBrains GoLand before version 2026.2 writes sensitive configuration values to log files by default, exposing credentials and secrets to anyone with read access to IDE log output. The CWE-532 flaw affects Go developers whose project configurations contain API keys, VCS credentials, or cloud tokens - values the IDE silently captures in plaintext log entries during normal use. No active exploitation has been confirmed (not in CISA KEV) and no public proof-of-concept exists; the low CVSS score of 3.5 reflects the limited impact and the requirement for low privilege and user interaction.
Sensitive system information disclosure in the MultiVendorX WooCommerce Product Stock Alert WordPress plugin (versions through 3.0.6) allows low-privileged authenticated users to retrieve embedded sensitive data via a network-accessible endpoint. The CVSS vector (AV:N/AC:L/PR:L/UI:N/C:H) confirms that any authenticated WordPress user - such as a registered shop customer - can exploit this with low complexity and no user interaction, yielding high confidentiality impact. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low-complexity, network-accessible nature of the flaw lowers the bar for abuse significantly.
Sensitive data exposure in the TinyMCE Templates WordPress plugin (versions <= 4.8.1) allows authenticated users holding the Contributor role to access information beyond their authorization boundary. The flaw is classified under CWE-497, indicating that system or application internals are being surfaced to an unauthorized control sphere - in this case, low-privileged WordPress users. No active exploitation or public proof-of-concept has been identified at time of analysis, and the CVSS score of 4.3 (Medium) reflects the limited scope: confidentiality-only impact with no integrity or availability consequences.
Unauthenticated sensitive data exposure in WP Social Ninja WordPress plugin versions 4.3.0 and earlier allows remote attackers to access sensitive information without any credentials or user interaction. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivial network-level exploitation with no barriers to access, though impact is bounded to low-severity confidentiality loss. No public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV.
Sensitive data exposure in Ultimate Store Kit Elementor Addons (by BDThemes) versions up to and including 3.0.5 permits unauthenticated remote access to restricted system or application data. The vulnerability is reachable over the network with no credentials, no user interaction, and no special configuration, placing every WordPress installation running the affected plugin version at risk of information leakage. No public exploit code or CISA KEV listing has been identified at time of analysis, and EPSS data was not provided, but the zero-barrier entry point (AV:N/AC:L/PR:N/UI:N) means opportunistic scanning is a realistic threat.
Unauthenticated sensitive data exposure in the Complianz WordPress plugin (versions up to and including 7.5.0) allows any remote, unauthenticated attacker to retrieve sensitive information from affected WordPress installations. Classified as CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere), the flaw is particularly notable because Complianz handles GDPR and cookie consent compliance data - meaning exposed information may carry regulatory implications beyond what the CVSS score alone conveys. No public exploit has been identified at time of analysis, and the vulnerability has not been listed in CISA KEV.
Unauthenticated sensitive data exposure in the Create by Mediavine WordPress plugin (versions <= 2.5.3) allows any remote, unauthenticated user to access information that should be restricted. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this is exploitable over the network with no authentication, no user interaction, and low attack complexity, placing all public-facing WordPress sites running an affected version at risk. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, but the low barrier to exploitation makes patching a timely priority.
Unauthenticated sensitive data exposure in the Ninja Tables WordPress plugin (versions ≤ 5.2.10) allows remote unauthenticated attackers to retrieve sensitive information without any credentials or user interaction. The flaw, classified under CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere), is accessible over the network with low complexity, making it trivially exploitable against any WordPress site running an affected version of the plugin. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, and the CVSS score of 5.3 (Medium) reflects limited confidentiality impact with no integrity or availability consequences.
Sensitive data exposure in Polylang WordPress plugin (versions <= 3.8.5) allows authenticated Contributors to access information beyond their authorization scope. The vulnerability, classified under CWE-497, enables low-privileged authenticated users - specifically those holding the WordPress Contributor role - to read sensitive data they should not be permitted to view. No active exploitation has been confirmed (not listed in CISA KEV) and no public exploit code has been identified at time of analysis.
Broken authentication in Easy Digital Downloads WordPress plugin (versions ≤ 3.6.7) by Sandhills Development LLC allows unauthenticated remote attackers to bypass authentication controls via an alternate path or channel (CWE-288), producing limited integrity and availability impact. The attack requires no credentials or user interaction over the network, earning a CVSS 6.5 Medium score - though Patchstack's 'Information Disclosure' tag introduces a potential confidentiality dimension not reflected in the base CVSS C:N designation, suggesting real impact may be slightly higher than the score implies. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Sensitive data exposure in PeproDev Ultimate Invoice (WordPress plugin, versions ≤ 2.2.6) allows unauthenticated remote attackers to access confidential invoice data - including likely customer PII and financial records - without authentication, contingent on some user interaction (CVSS UI:R). The root cause (CWE-201) is the inclusion of sensitive information in plugin-generated output or endpoint responses that lack proper access control. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
TTL capping bypass in PowerDNS Recursor enables ghost domain NS record injection when a slow authoritative server response arrives after the cached NS entry has already expired. Specifically, the proactive background refresh mechanism fails to cap TTLs on NS record responses when no live cache entry exists at response time, allowing attacker-controlled TTL values to persist uncapped in the recursor's cache. No active exploitation has been identified (no CISA KEV listing), no public exploit code exists, and the CVSS score of 3.7 reflects the constrained, timing-dependent nature of this attack.
Unrestricted SSH port forwarding on Ricoh printers and Multifunction Printers (MFPs) allows network-accessible devices to be used as pivot points into the local area network. When SSH is enabled on an affected device, any party able to establish an SSH connection can forward TCP traffic to arbitrary hosts and ports on the internal LAN, effectively bypassing network segmentation. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, but the network scope change (S:C in CVSS) reflects that impact extends beyond the printer itself to other internal hosts.
Format string vulnerability in GNU nano's multi-buffer error message handling allows a local low-privileged attacker to cause stack information disclosure, denial of service via crash, or potentially achieve arbitrary memory writes. The flaw (CWE-134) is triggered when a user opens multiple files at startup, one of which carries a specially crafted name containing printf format specifiers and another triggers an ALERT-level error - causing nano to misinterpret the filename as a format string. Reported by Red Hat and scoped to RHEL 6 through 10 and OpenShift Container Platform 4, no public exploit or CISA KEV listing exists at time of analysis.
Improper input validation in facil.io's WebSocket Frame Parser (versions up to 0.7.4) allows remote unauthenticated attackers to send crafted WebSocket frames that trigger a flaw in the `websocket_on_protocol_error` function, yielding limited confidentiality, integrity, and availability impact. A proof-of-concept exploit has been publicly published, lowering the technical barrier for exploitation. The project maintainer was notified via GitHub issue but has not responded, leaving the vulnerability unpatched at time of analysis.
Cache confusion in Next.js App Router's server-side fetch patch leaks confidential POST response bodies across unrelated requests targeting the same URL. Applications on Next.js 13.0.0 through 15.5.20 or 16.0.0 through 16.2.10 that call `fetch(new Request(init), aDifferentInit)` server-side are at risk of cross-user data exposure - one user's POST response (potentially containing session tokens, PII, or financial data) may be returned to a different user's request. No public exploit has been identified at time of analysis, and Pages Router deployments are explicitly unaffected.
Cache key collision in Next.js server-side fetch exposes confidential POST response bodies to unintended callers when request bodies contain non-UTF-8 byte sequences. Specifically, the incremental cache's key-generation routine decoded raw body bytes through a TextDecoder, causing distinct byte sequences - such as UTF-16 encodings - to collapse to the same replacement-character string (U+FFFD) and therefore the same cache key. A request whose body coincidentally produces a colliding cache key will receive a cached response intended for a different body, leaking whatever confidential data the upstream service returned. No public exploit has been identified at time of analysis; vendor-released patches are available in v15.5.21 and v16.2.11.
CPU exhaustion in the Next.js Image Optimization API allows unauthenticated remote attackers to deny service against the `/_next/image` endpoint by serving malicious image content - particularly crafted SVGs - from domains permitted by `config.images.remotePatterns`. Affected self-hosted deployments on Next.js 15.5.0-15.5.20 and 16.0.0-16.2.10 using the default image loader invoke Sharp's expensive `.metadata()` call on attacker-influenced buffers, exhausting server CPU. Vendor-released patches are available in versions 15.5.21 and 16.2.11; no public exploit or CISA KEV listing is identified at time of analysis.
Server Action endpoint IDs in Next.js App Router applications are exposed to unauthenticated users through publicly served client-side static JavaScript chunks, effectively bypassing page-level authentication gates on those endpoints. Applications running Next.js 13.0.0 through 15.5.20 or 16.0.0 through 16.2.10 with App Router and Server Actions (`use server`) or `use cache` directives are affected. Standalone exploitation provides an enumeration primitive rather than direct data access, but the disclosed IDs can amplify secondary weaknesses - particularly when Server Actions perform sensitive operations without re-authenticating callers within the action boundary itself. No public exploit code has been identified and no CISA KEV listing exists at time of analysis.
Filesystem existence oracle in Dompdf allows attackers who can supply arbitrary HTML content for PDF rendering to enumerate files and directories on the backend server. By embedding a data-URI encoded SVG containing an `<image>` element with a `file://` URI reference, an attacker exploits differential rendering behavior - files and directories that exist cause a different visual output than paths that do not exist - creating a binary oracle for filesystem probing. A publicly available proof-of-concept is included in the GitHub Security Advisory GHSA-j8qw-6jw8-r297; no KEV listing or confirmed active exploitation has been reported at time of analysis.
HTTP/2-to-HTTP/1.x protocol translation in Netty's `netty-codec-http2` enables request routing bypass and HTTP request smuggling via duplicate `Host` header injection. When a client sends a HEADERS frame containing both the `:authority` pseudo-header and a literal `host` header, `Http2StreamFrameToHttpObjectCodec` and `InboundHttp2ToHttpAdapter` independently translate each into `Host` headers, producing an `HttpRequest` with two attacker-controlled, differing values. Downstream HTTP/1.1 components that prioritize the second header can be manipulated into routing requests to unintended targets. No public exploit has been identified and this CVE is not in the CISA KEV catalog, but patches are vendor-released for both affected release trains.
WebSocket protocol upgrade in Netty's V07/V08 handshakers completes without enforcing RFC 6455-mandatory `Connection: Upgrade` and `Upgrade: websocket` headers, enabling an attacker to silently switch protocols in a way that upstream reverse proxies and load balancers do not recognize as an Upgrade request. This desynchronization between proxy and backend creates a classic HTTP request smuggling vector (CWE-444) that can be exploited to poison shared connections, bypass proxy-enforced access controls, or hijack other users' HTTP sessions. Affected versions are `io.netty:netty-codec-http` prior to 4.1.136.Final and 4.2.0.Final through 4.2.15.Final; no public exploit code or CISA KEV listing has been identified at time of analysis.
File existence oracle in Dompdf allows remote unauthenticated attackers to enumerate sensitive server-side files by exploiting a behavioral discrepancy in CSS @font-face processing. Crafted HTML containing thousands of @font-face declarations referencing local paths via the file:// protocol causes PHP memory exhaustion only when the target file exists, producing a detectable crash signal versus a clean render for non-existent files. Publicly available exploit code exists (detailed in the GHSA advisory); no KEV listing at time of analysis, but exploitation requires only a public HTTP endpoint that passes unsanitized HTML to Dompdf. A vendor-released patch (v3.1.6) is available.
Dompdf's chroot validation logic in versions before 3.1.6 can be bypassed by an attacker who controls HTML content rendered into a PDF, allowing files outside the configured chroot directories to be read and embedded in the output. The root cause is a flawed `strpos()` prefix check in `validateLocalUri()` that fails to enforce directory boundaries after `realpath()` strips trailing slashes, enabling sibling directories like `/var/www-admin` to satisfy a chroot configured as `/var/www`. A publicly available proof-of-concept exploit is included in the GitHub Security Advisory GHSA-wvh6-f5jh-8gw4; no active exploitation is recorded in CISA KEV, and upgrading to v3.1.6 fully resolves the issue.
Denial of service against the MongoDB mongod process is achievable by any authenticated user holding standard read/write privileges by submitting a crafted aggregation command that exploits insufficient input validation in the bundled libmongocrypt library. An integer overflow (CWE-190) in libmongocrypt allows attacker-controlled payload values to produce an excessively large memory allocation request, causing the operating system to terminate the mongod process under an out-of-memory condition. No public exploit has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Polkit privilege escalation in PortProtonQt 0.1.12 through 1.3.0 allows any local unprivileged user to modify system NetworkManager connections and mount or unmount arbitrary block devices without authorization. The vulnerable Polkit rule (ru.linux_gaming.PortProtonQt.rules) identifies trusted callers by inspecting process command lines via 'ps', a method trivially defeated by command-line spoofing or PID recycling races. A shell script reproducer confirmed by SUSE researchers achieves exploitation reliably and consistently. No public exploit is independently published but a working reproducer exists; no CISA KEV listing at time of analysis.
Symlink-following vulnerability (CWE-59) in systemd-tmpfiles allows a local, low-privileged user to redirect privileged file write operations to an attacker-controlled path on affected Red Hat Enterprise Linux systems. The flaw resides in the path resolution logic within chase.c, where a safety check incorrectly treats all transitions away from the root user as inherently safe - failing to detect attacker-placed symlinks at tmpfiles.d target path components. Exploitation is constrained by high attack complexity requiring a specific non-default tmpfiles.d configuration, and no public exploit code or CISA KEV listing has been identified at time of analysis.
Dell PowerProtect Data Manager's REST API exposes sensitive information to high-privileged local users in all versions prior to 20.2.0.0. An administrator-level attacker with local access can query the REST API and retrieve sensitive data that should be restricted even at the admin tier - with the CVSS Scope:Changed indicator suggesting the exposed information may include credentials or secrets belonging to systems external to the PPDM instance itself. No public exploit code or active exploitation has been identified at time of analysis; Dell has released version 20.2.0.0 to address this and multiple other vulnerabilities per advisory DSA-2026-287.
Availability loss in ISC BIND 9 DNS server arises when a stored DNS key record containing the PRIVATEDNS algorithm (algorithm number 253) carries a malformed identifier length field that exceeds the actual identifier data. BIND accepts the structurally invalid record without rejecting it at ingestion time, but when it subsequently attempts to render that record to text - during logging, zone display, or similar operations - the inconsistent length triggers a reachable assertion (CWE-617) that causes BIND to abort and exit. No active exploitation has been confirmed (not listed in CISA KEV) and no public exploit code has been identified at time of analysis; however, BIND 9 spans a very wide version range and is critical infrastructure, making patch urgency high despite the medium CVSS score of 6.5.
DNSSEC integrity bypass in ISC BIND 9 enables network-positioned attackers to forge authenticated NXDOMAIN responses by exploiting improper validation of NSEC3 records originating from child zones. Affected are BIND 9 versions across the 9.18, 9.20, and 9.21 branches, as well as the BIND 9 Supported Preview Edition (S-series). Because the CVSS vector carries S:C (scope changed), the integrity impact propagates beyond the resolver itself to any DNS client trusting BIND's DNSSEC-validated answers. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
Unauthenticated file read and deletion in Progress Telerik UI for ASP.NET AJAX (all versions prior to v2026.2.708) is made possible by a hardcoded cryptographic key (CWE-321) embedded in the obsolete RadChart component's ChartImage.axd HTTP handler. Remote attackers without any credentials can exploit this to read or delete image-extension files within the application directory, bypassing standard authentication controls entirely. No public exploit code exists and the vulnerability is not listed in CISA KEV at time of analysis, but the unauthenticated network-accessible attack vector warrants prompt patching for all affected deployments.
Parameter tampering in the DialogHandler component of Progress Telerik UI for ASP.NET AJAX (all versions prior to 2026.2.708) allows unauthenticated remote attackers to manipulate server-side dialog behavior, establishing a foothold for chained exploitation of downstream application components. The CVSS vector specifies High integrity impact with no required privileges (PR:N), making the DialogHandler endpoint a meaningful attack surface in any deployment where it is network-accessible. No public exploit code has been identified at time of analysis and no CISA KEV listing exists, but the vendor's explicit mention of chained exploitation elevates the practical risk beyond the moderate base score of 5.9.
Counter exhaustion in NLnet Labs Unbound 1.20.0 through 1.25.1 enables a remote attacker to degrade DNS resolution service by triggering a missing decrement in the serve-expired discard-timeout code path. The reply-address counter for duplicate in-flight queries is never decremented when the discard-timeout branch fires under a specific non-default misconfiguration, allowing an attacker controlling a slow authoritative zone to drive the counter to its maximum and cause silent query drops for legitimate clients. No public exploit identified at time of analysis; however, the vulnerability is exploitable remotely with no authentication required once the misconfiguration is in place.
Crash-triggering memory corruption in Unbound's DNSCrypt subsystem allows any unauthenticated network client to kill the DNS resolver with a single UDP packet. Affected versions 1.7.0 through 1.25.1, compiled with DNSCrypt support, miscount valid key slots when the dnscrypt-provider-cert list outnumbers dnscrypt-secret-key entries, leaving tail slots filled with libsodium's 0xdb debug pattern; iterating beyond valid bounds then dereferences that garbage. No public exploit has been identified at time of analysis, and no KEV listing exists, but the trigger condition is trivially constructable - one 68-byte UDP datagram.
DNS cache poisoning risk in NLnet Labs Unbound 1.4.22 through 1.25.1 arises because the SO_REUSEPORT load balancing mechanism structurally leaks the secret entropy value - UDP source port randomization - that defends against Kaminsky-style attacks. Each worker thread is assigned a disjoint subset of source ports at startup, so an adjacent-network attacker who can observe Unbound's outgoing UDP queries to authoritative name servers can infer the thread-to-port-subset mapping and substantially reduce the port space to guess during a cache poisoning attempt. Proof-of-concept exploit code exists (CVSS 4.0 E:P); no confirmed active exploitation or CISA KEV listing has been identified.
Cache-clearing denial-of-service in NLnet Labs Unbound through 1.25.1 allows a remote attacker who controls a DNS delegation to indefinitely and repeatedly flush Unbound's message and rrset caches without sending a single spoofed packet. The attack exploits a logic flaw in how the iterator processes in-bailiwick glue records containing the unspecified address 0.0.0.0/::0: on Linux, such queries are routed via loopback and answered by 127.0.0.1, creating an IP mismatch that the unwanted-reply counter tallies until the configured threshold triggers a defensive cache clear - which resets the counter, enabling the loop to continue indefinitely. No public exploit identified at time of analysis; CVSS 3.1 scores this 5.3 (Medium) with Low availability impact and no confidentiality or integrity impact.
DNS response policy poisoning in NLnet Labs Unbound 1.7.0 through 1.25.1 allows an unauthenticated network attacker to become the authoritative XFR source for an auth/rpz zone by spoofing the configured primary hostname's A/AAAA record. The flaw stems from Unbound accepting a BOGUS-validated hostname resolution - one where DNSSEC validation has explicitly failed - as a valid zone transfer endpoint without requiring a valid RRSIG, violating the integrity guarantees DNSSEC is designed to enforce. Successful exploitation enables complete replacement of the resolver's response policy zone, making this a DNS firewall bypass with high real-world consequence for organizations relying on RPZ for threat blocking. No public exploit code has been identified at time of analysis.
DNS response policy rewriting in NLnet Labs Unbound 1.6.2 through 1.25.1 bypasses DNSSEC validation when the respip module is positioned ahead of the validator with response-ip or RPZ-IP redirect rules active. The rewriting handler fails to check upstream DNSSEC security status, allowing a spoofed BOGUS A/AAAA answer whose address falls within an operator-configured redirect subnet to be rewritten and returned to clients with a hardcoded INSECURE security level rather than being rejected as BOGUS. No public exploit code has been identified at time of analysis, but the integrity impact is concrete: clients receive silently misdirected responses that appear to pass through legitimate operator-controlled policy, undermining the core DNSSEC trust guarantee for affected deployments.
Fatal application termination in NLnet Labs Unbound's libunbound library (up to and including 1.25.1) can be triggered remotely when the 'unwanted-reply-threshold' feature is enabled. An attacker controlling or able to spoof responses from an authoritative nameserver can flood the resolver with wrong-transaction-ID UDP datagrams until the threshold is crossed, causing libunbound to invoke 'libworker_alloc_cleanup' - a function absent from the internal allow list - resulting in a fatal exit that crashes the embedding application. Notably, standalone Unbound is unaffected because its counterpart function 'worker_alloc_cleanup' is correctly registered; only applications embedding libunbound are at risk. No public exploit code or CISA KEV listing has been identified at time of analysis.
Ghost domain name cache extension in Unbound DNS resolver 1.16.2 through 1.25.1 allows a network-based adversary who controls a ghost zone to overwrite cached expired parent-side A/AAAA glue records, extending the effective ghost domain window by up to one full cache-max-ttl period beyond expiry. A single crafted A/AAAA client query is sufficient to trigger the overwrite; on resolvers using the non-default harden-referral-path: yes directive, Unbound performs the lookup implicitly with no client query required at all. This is a variant of CVE-2026-40622, which addressed only the NS query path - no public exploit has been identified at time of analysis and no CISA KEV listing exists.
Insecure credential storage in the Ansible Lightspeed VS Code extension exposes Google Gemini API keys to any local actor operating at user privilege level. The extension writes API keys in plaintext to both user configuration files and extension output log channels, making them readable by co-users of the workstation, other OS-level processes, or malware executing under the victim's account. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified; the primary real-world risk is API credential theft leading to unauthorized quota consumption or service abuse.
Credential exposure in n8n workflow automation platform leaks full Google Service Account PEM private keys into the JWT header's kid field, where they are trivially recoverable via Base64 decoding. Affected versions span both the 1.x line (before 1.123.64) and the 2.x line (before 2.29.8 and 2.30.1), but only deployments configured with Google Service Account credentials are at risk. An attacker who captures these JWTs from logs, network traffic, or monitoring systems can extract the raw private key and fully impersonate the service account against any Google Cloud resource it is authorized to access. No public exploit code has been identified at time of analysis, and no confirmed active exploitation is recorded in CISA KEV.
Credential exposure in n8n's LLM sub-node allows authenticated users to read plaintext API keys and secrets persisted in workflow execution records. Versions before 1.123.64 fail to mask custom HTTP header values - such as Authorization or X-API-Key headers - when those headers are used in LLM node configurations, causing secrets to be written in cleartext to execution data stored in the database. While exploitation requires a low-privilege authenticated session, the downstream impact is high because recovered credentials can be used to access external APIs and services configured in those workflows. No public exploit code or KEV listing has been identified at time of analysis.
Unauthenticated remote information disclosure in Hikvision DS-2CD and DS-2DE series IP cameras exposes partial device memory contents to network-accessible attackers without any credentials. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no authentication and no user interaction against default configurations, making the attack surface broad given the cameras' typical internet or LAN exposure. While confidentiality impact is rated Low (partial memory only), leaked memory may contain sensitive fragments such as session tokens or configuration data, and no public exploit or CISA KEV listing is confirmed at time of analysis.
Off-by-one heap out-of-bounds read in the BlueZ SBC (Sub-Band Coding) frame decoder allows a Bluetooth-adjacent unauthenticated attacker to leak a single byte of heap memory by streaming a crafted audio payload. Red Hat Enterprise Linux 7 through 10 are confirmed affected via the bundled sbc library. No public exploit code exists and this vulnerability is not listed in CISA KEV, making active exploitation unlikely; the impact is constrained to minor information disclosure of a single heap byte.
Cross-space information disclosure in Kibana 9.4.0 through 9.4.3 allows authenticated users to access data from Kibana Spaces they are not authorized to view. The flaw (CWE-862, Missing Authorization) arises because user-supplied input can reference cross-space resources without adequate space-level authorization checks, enabling privilege boundary bypass within a multi-tenant Kibana deployment. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Kibana's multi-tenancy Spaces model can be bypassed through an Insecure Direct Object Reference (IDOR) vulnerability, allowing authenticated users to read scheduled query results belonging to Spaces they are not authorized to access. Affected versions span Kibana 9.4.0 through 9.4.3, with the fix delivered in 9.4.4. The CVSS vector (PR:L, C:L) confirms the impact is limited to low-privilege authenticated access resulting in partial confidentiality loss - no integrity or availability impact is involved. No public exploit code exists and no CISA KEV listing has been identified at time of analysis.
Unauthorized access to workflow execution outputs in Kibana 9.3.0-9.3.7 and 9.4.0-9.4.3 allows an authenticated low-privileged user to read sensitive data returned by workflow steps - including results from connected data sources they are not authorized to query - by directly calling the workflow output endpoint without the authorization the documented API requires. The flaw is classified as Missing Authorization (CWE-862) via Privilege Abuse (CAPEC-122), with impact limited to confidentiality within the user's accessible Kibana space. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog; Elastic has released patched versions 9.3.8 and 9.4.4.
Cross-origin information disclosure in Google Chrome prior to 150.0.7871.182 allows a remote attacker who has already compromised the renderer process to leak sensitive data from other origins via a crafted HTML page. The vulnerability arises from an uninitialized use in the Skia graphics library. Exploitation is unlikely given high complexity and the prerequisite of a separate renderer compromise; no active exploitation or public exploit has been identified at the time of analysis.
Spoofing of the Omnibox (URL bar) in Google Chrome versions prior to 150.0.7871.182 allows a remote attacker to mislead users via a crafted HTML page, exploiting insufficient input validation in the browser's Extensions handling. This Medium-severity vulnerability (CVSS 5.4) has no evidence of active exploitation or publicly available exploit code, and its exploitation requires user interaction to visit a malicious page.
Unauthorized critical data disclosure in Oracle HRMS (US) versions 12.2.3 through 12.2.15 exposes complete read access to all HRMS-accessible data via network HTTP, with a confirmed scope change that can impact additional Oracle E-Business Suite modules beyond HRMS itself. The CVSS vector (PR:H, S:C, C:H) indicates a high-privileged authenticated attacker operating over the network with low complexity can breach data boundaries across co-deployed EBS components. An 'Authentication Bypass' tag in the intelligence feed creates analytical tension with the PR:H prerequisite and warrants vendor clarification; no public exploit code has been identified at time of analysis, and Oracle disclosed this issue via the July 2026 Critical Patch Update.
Oracle HRMS (US) Internal Operations component exposes complete HR dataset read access to any low-privileged authenticated attacker over HTTP. Versions 12.2.6 through 12.2.15 of Oracle E-Business Suite are confirmed affected, enabling an attacker holding even a basic EBS user account to bypass authorization controls and access all data visible to the HRMS application. No public exploit or CISA KEV listing exists at time of analysis, but the low attack complexity (AC:L) means exploitation is straightforward once initial credentials are obtained, making insider threat and credential-compromise scenarios the primary risk vector.
Oracle Quality within Oracle E-Business Suite versions 12.2.3 through 12.2.15 exposes partial confidentiality, integrity, and availability compromise through its Quality Workbench HTML system component. A low-privileged authenticated attacker with HTTP network access can perform unauthorized read, write, and denial-of-service operations against Quality module data. No public exploit code or active exploitation has been identified at time of analysis; this vulnerability was disclosed by Oracle via the July 2026 Critical Patch Update.
Oracle HRMS (US) US Payroll - General component in Oracle E-Business Suite versions 12.2.3 through 12.2.15 exposes payroll data and service availability to low-privileged authenticated network attackers over HTTP. Successful exploitation yields partial unauthorized read of payroll records, unauthorized insert, update, or delete of accessible payroll data, and partial denial of service - impacts that are especially sensitive given the nature of US payroll information. Disclosed as part of Oracle's July 2026 Critical Patch Update, no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Confidential data exposure in Oracle Contracts Integration (Oracle E-Business Suite) versions 12.2.3 through 12.2.15 enables a low-privileged authenticated attacker with HTTP network access to bypass internal authorization controls in the Internal Operations component, gaining unauthorized access to critical or all accessible contract data. The CVSS confidentiality impact is rated High despite the moderate overall score of 5.3, reflecting complete in-scope data exposure when exploitation succeeds. No public exploit code or active exploitation has been identified at time of analysis; the high attack complexity (AC:H) constrains real-world opportunistic risk.
Unauthorized data disclosure in Oracle Self-Service Human Resources (E-Business Suite), Manager Self-Service component, affects versions 12.2.3 through 12.2.15. A low-privileged authenticated attacker with HTTP network access can exploit an authorization bypass to gain complete read access to all data within the Self-Service HR module - including sensitive employee and managerial records. No public exploit has been identified at time of analysis, and the vulnerability is not currently listed in the CISA KEV catalog, but the low attack complexity and broad data exposure make patching via the July 2026 CPU a priority for organizations running Oracle EBS.
Partial data compromise and denial of service in Oracle HRMS (UK) versions 12.2.3 through 12.2.15 allows low-privileged, network-authenticated attackers to perform unauthorized read, write, and partial disruption of HR data via HTTP. The vulnerability resides in the Internal Operations component of Oracle E-Business Suite and is characterized by Oracle as 'easily exploitable,' lowering the practical barrier for authenticated insiders or compromised accounts. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Oracle EDI Gateway versions 12.2.3 through 12.2.15, a component of Oracle E-Business Suite, exposes an information disclosure vulnerability allowing low-privileged network-authenticated attackers to read a subset of EDI transaction data without proper authorization. Tagged as an authentication bypass, the flaw is exploitable over HTTP with low attack complexity and no user interaction required, suggesting an access-control deficiency that permits privilege escalation within the application layer rather than a full bypass of authentication. No public exploit code and no active exploitation have been identified at time of analysis; Oracle addressed this in the July 2026 Critical Patch Update.
Oracle EDI Gateway versions 12.2.3 through 12.2.15 exposes an information disclosure vulnerability via HTTP that enables low-privileged authenticated network attackers to read a subset of EDI transaction data without proper authorization. The vulnerability is tagged 'Authentication Bypass' in threat intelligence sources, yet the CVSS vector assigns PR:L, suggesting the bypass operates within an authenticated session - likely circumventing object-level authorization controls rather than bypassing session authentication entirely. No public exploit code or CISA KEV listing has been identified at time of analysis, keeping real-world urgency moderate despite the vendor's characterization of the flaw as 'easily exploitable.'
Limited unauthorized data read in Oracle EDI Gateway (E-Business Suite versions 12.2.3-12.2.15) requires a high-privileged attacker with local logon access to the underlying infrastructure, combined with difficult exploitation conditions, to access a subset of EDI data without authorization. The confidentiality impact is narrow and no integrity or availability impact is present. No public exploit code or active exploitation has been identified at time of analysis; Oracle disclosed this via the July 2026 Critical Patch Update.
Unauthorized data disclosure in Oracle U.S. Federal Financials (Oracle E-Business Suite, Internal Operations component) allows a low-privileged, network-authenticated attacker to read a subset of sensitive financial data via HTTP. Versions 12.2.3 through 12.2.15 are confirmed affected. No public exploit code or CISA KEV listing has been identified at time of analysis, and the CVSS score of 4.3 reflects a moderate-severity information disclosure with no integrity or availability impact.
Oracle Proposals (component of Oracle E-Business Suite versions 12.2.3 through 12.2.15) is exploitable by low-privileged authenticated remote attackers over HTTP, enabling unauthorized read access to a subset of data, unauthorized data manipulation (insert, update, delete), and partial denial of service against the Proposals component. Oracle disclosed this vulnerability in its July 2026 Critical Patch Update (CPU). No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Unauthorized payroll data exposure in Oracle E-Business Suite's HRMS (Australia) Payroll component allows a low-privileged, network-authenticated attacker to access all HR and payroll data accessible to the application. Affecting versions 12.2.3 through 12.2.15, Oracle classifies this as 'easily exploitable' in the July 2026 Critical Patch Update, requiring only low user privileges over HTTP with no user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis, though the confidentiality impact against sensitive payroll records elevates practical priority for affected Australian EBS deployments.
Unauthorized data disclosure in Oracle Learning Management (E-Business Suite) versions 12.2.3 through 12.2.15 allows a low-privileged, network-authenticated attacker to access critical or complete LMS data via the Import and Export component over HTTP. Tagged as an Authentication Bypass, the flaw enables privilege escalation beyond the attacker's granted access level, resulting in full confidentiality compromise of all Learning Management accessible data. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and network vector make this straightforward to exploit once credentials are obtained.
Oracle Payroll within Oracle E-Business Suite (EBS) versions 12.2.3 through 12.2.15 is exploitable by low-privileged authenticated network attackers via HTTP, enabling unauthorized read, write, and partial denial-of-service against payroll data. Oracle's own advisory classifies this as 'easily exploitable,' indicating low attack complexity for any valid EBS user with HTTP reachability. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, placing this as a moderate real-world priority requiring prompt patching for exposed EBS deployments.
Partial confidentiality exposure in Oracle HRMS (UK)'s UK Payroll component allows a network-adjacent, high-privileged attacker to read a limited subset of HRMS data under difficult exploitation conditions. Affecting E-Business Suite versions 12.2.3 through 12.2.15, this low-severity (CVSS 2.2) vulnerability is tagged as an authentication bypass, suggesting an authorization control weakness within an already-authenticated session rather than a full unauthenticated bypass - consistent with the PR:H and AC:H vector. No public exploit code exists and it is not listed in the CISA KEV catalog, placing real-world risk at the lower end of the spectrum.
Oracle HRMS (US) Internal Operations component in E-Business Suite versions 12.2.3 through 12.2.15 exposes a network-accessible flaw that allows a low-privileged authenticated attacker to read a subset of HRMS data and cause partial denial of service via HTTP under high-complexity conditions. Disclosed by Oracle via the July 2026 Critical Patch Update (CPU), the vulnerability carries a CVSS 3.1 score of 4.2 (Medium), with no public exploit and no active exploitation confirmed at time of analysis. The high attack complexity (AC:H) materially constrains real-world exploitability despite the network-accessible attack vector.
Unauthorized data exfiltration in Oracle HRMS (UK), a component of Oracle E-Business Suite, exposes complete HR records to low-privileged network attackers via a scope-changing vulnerability in the Internal Operations component. Versions 12.2.8 through 12.2.15 are affected, and successful exploitation can breach data beyond the immediate HRMS (UK) boundary, impacting additional E-Business Suite products. Tagged as an authentication bypass by EUVD intelligence, the attack requires HTTP network access and low privilege credentials but no user interaction, though high attack complexity (AC:H) limits opportunistic exploitation. No public exploit is identified at time of analysis, and the issue is not listed in CISA KEV.
Unauthorized data disclosure in Oracle Order Management's Product Diagnostic Tools component (E-Business Suite 12.2.3-12.2.15) allows a low-privileged network attacker to read all data accessible to the application over HTTP with no user interaction required. The 'Authentication Bypass' tag suggests the diagnostic interface fails to enforce proper authorization boundaries, enabling a minimally privileged account to exceed its intended data access scope. No public exploit has been identified at time of analysis, but the low attack complexity and ERP-grade data sensitivity - order records, customer PII, financial data - elevate business impact well beyond the moderate CVSS 6.5 score.
Unauthorized read access to a subset of student records data is possible in Oracle PeopleSoft Enterprise CS Student Records 9.2.38 via the Research Tracking component over HTTP. An unauthenticated network attacker exploiting an authentication bypass condition (tagged explicitly by the reporter) can retrieve confidential academic data without credentials, though the high attack complexity constrains opportunistic mass exploitation. No public exploit code or active exploitation has been identified; however, even partial disclosure of student records carries regulatory significance under FERPA regardless of the low CVSS score of 3.7.
Authentication bypass in Oracle PeopleSoft Enterprise CS Campus Community 9.2.38 (Security component) enables an unauthenticated attacker positioned on the adjacent physical network segment to access critical application data and manipulate select records. The exploit is rated difficult due to adjacent-network positioning requirements and high attack complexity, yielding a moderate CVSS 5.9 score despite the high confidentiality impact. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, limiting immediate mass-exploitation risk.
Unauthorized access to critical data is achievable against MySQL Connector/J versions 9.7.0 and 9.7.1 via a network-accessible authentication bypass flaw requiring human interaction. Oracle classifies this as easily exploitable, meaning a network-positioned unauthenticated attacker can intercept or otherwise obtain complete access to all data flowing through the affected connector when a legitimate application initiates a database connection. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Unauthorized data read in MySQL Server and MySQL Cluster's Performance Schema component exposes a subset of accessible data to highly privileged, network-connected attackers. Affected releases span MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1, disclosed as part of Oracle's July 2026 Critical Patch Update. No public exploit code and no CISA KEV listing are identified at time of analysis; the CVSS 2.7 score reflects the limited scope and elevated privilege bar.
Unauthorized data disclosure in Oracle Production Scheduling (E-Business Suite versions 12.2.3 through 12.2.15) allows a low-privileged network attacker to gain complete read access to all data within the application via a difficult-to-exploit flaw in the User Interface component. Tagged as an authentication bypass, the vulnerability suggests improper access control enforcement in the UI layer that permits privilege escalation beyond the attacker's normally granted permissions, enabling full confidentiality compromise of Production Scheduling data. No public exploit code or active exploitation has been identified; Oracle addressed this in the Critical Patch Update for July 2026.
Unauthorized read access to Oracle Time and Labor data is achievable by unauthenticated remote attackers targeting the Internal Operations component via HTTP, affecting E-Business Suite versions 12.2.3 through 12.2.15. Tagged as an Authentication Bypass, the flaw allows network-based attackers to circumvent access controls without credentials, though the high attack complexity (AC:H) constrains reliable exploitation. Impact is confined to partial confidentiality loss - no integrity or availability impact - and no public exploit or active exploitation (CISA KEV) has been identified at time of analysis.
Partial confidentiality exposure in Oracle HRMS (Ireland), a component of Oracle E-Business Suite versions 12.2.3 through 12.2.15, permits a network-based high-privileged attacker to read a limited subset of HRMS data via HTTP under high-complexity conditions. The impact is confined solely to confidentiality with no integrity or availability consequence, and the CVSS 3.1 base score of 2.2 reflects how constrained exploitation is in practice. No public exploit code has been identified and this vulnerability does not appear in the CISA KEV catalog. Notably, the intelligence tag 'Authentication Bypass' conflicts with the PR:H vector - this discrepancy warrants verification against the Oracle July 2026 CPU advisory.
Unauthorized read access in Oracle Project Contracts (E-Business Suite component: Internal Operations) can be achieved by a low-privileged network attacker under high-complexity exploit conditions, exposing a subset of Project Contracts data. Affected versions span 12.2.3 through 12.2.15, as confirmed by Oracle Security Alerts via the July 2026 Critical Patch Update. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, keeping real-world risk low despite the network-accessible attack surface and the notable 'Authentication Bypass' tag applied by ENISA EUVD.
Partial unauthorized read access in Oracle Public Sector Financials (E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged authenticated attacker over HTTP to read a limited subset of data they are not authorized to access. Despite the 'Authentication Bypass' tag in intelligence sources, the CVSS vector confirms authentication is required (PR:L), suggesting this is a partial authorization bypass or privilege boundary failure rather than a full authentication bypass. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Unauthorized read access to a subset of procurement data is achievable in Oracle iSupplier Portal versions 12.2.3 through 12.2.15 via the Internal Operations component over HTTP, requiring a low-privileged account and difficult attack conditions. The intelligence tags classify this as an Authentication Bypass, creating tension with the official CVSS PR:L metric - if bypass is possible, the real-world requirement may be lower than the vector implies. No public exploit or active exploitation has been identified at time of analysis; this vulnerability is addressed in Oracle's July 2026 Critical Patch Update.
Unauthorized read access to Oracle iSupplier Portal (E-Business Suite versions 12.2.3-12.2.15) is possible for unauthenticated network attackers targeting the Internal Operations component over HTTP. The Authentication Bypass tag indicates the root cause involves inadequate access controls on internal HTTP endpoints, though exploitation is constrained by high attack complexity (AC:H), meaning specific conditions must be met. Impact is confined to partial confidentiality loss - no integrity or availability impact - with no public exploit code or active exploitation confirmed at time of analysis.
Microsoft Graph exposes sensitive information to authenticated network attackers through an information disclosure flaw classified under CWE-200. Any attacker holding a valid low-privilege credential can query the Microsoft Graph API over the network to retrieve data they should not have access to, without requiring additional user interaction or elevated rights. No active exploitation is confirmed (not in CISA KEV), and Microsoft has released an official fix; however, the high confidentiality impact and low attack complexity make this a meaningful risk for any organization relying on Microsoft 365 services.
Unauthenticated network asset discovery exposure in Pronetiqs IntraVUE (formerly Panduit IntraVUE) versions 3.2.1a14 and prior allows remote unauthenticated attackers to enumerate sensitive system and network asset information via the application interface. In industrial control system (ICS) and OT environments where IntraVUE is typically deployed, the disclosed asset inventory - including device types, IP addresses, and network topology - provides adversaries with reconnaissance data directly applicable to follow-on ICS-targeted attacks. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Arbitrary constructor injection in React Router's SSR hydration deserializer (deserializeErrors()) affects npm/react-router versions 6.4.0 through 7.17.x when used in Framework Mode or Data Mode with manual SSR/hydration. When application code permits attacker-supplied input to overwrite the __type or __subType fields embedded in server-side serialized error objects, the client-side hydration process can be manipulated into instantiating arbitrary constructors available on the global window object, triggering unintended outbound network requests from the victim's browser. No public exploit code or CISA KEV listing exists at time of analysis; a vendor-released patch is available in version 7.18.0.
Credential extraction in OpenStack Ironic Python Agent (IPA) allows a tenant with bootc deploy_interface access to steal operator-level OCI registry pull secrets by exploiting a Linux PID namespace escape. Affected deployments running IPA >=10.2.0 <10.2.3, >=11.0.0 <11.2.1, or >=11.3.0 <11.5.1 are at risk when the bootc deploy_interface is enabled and operator-side registry credentials are configured. The attack violates the tenant-to-operator trust boundary by reading host authentication material through /proc/1/root inside a privileged container, with no public exploit identified at time of analysis.
HTTP request smuggling in SwiftNIO HTTP/2 allows unauthenticated remote attackers to inject headers or split responses via crafted HTTP/2 HEADERS frames that pass control characters through the HTTP/2-to-HTTP/1.1 codec. The vulnerability, caused by missing CR/LF/NUL/SP validation in regular header values and pseudo-headers, can be exploited when outbound validation is disabled or headers are forwarded without rechecking. Fixed in version 1.45.0; no public exploit identified at time of analysis and EPSS score is 0.14% (low).
Out-of-bounds heap read in gdk-pixbuf's ICO parser exposes heap memory content through rendered image output, affecting Red Hat Enterprise Linux 6 through 10. When processing a crafted ICO file whose pixel indices exceed the defined palette size, the library reads beyond the palette array boundary - heap bytes are treated as palette entries and rendered as RGB pixel values in the output image, enabling an attacker to extract heap content by analyzing the rendered result. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but server-side image processing pipelines that return rendered output to untrusted callers represent a realistic exposure path.
Authorization bypass in Overseerr's push subscription API (versions through 1.35.0) allows any authenticated user to enumerate, read, and delete the push subscriptions of arbitrary other users by supplying a target userId in path parameters - no elevated privileges required. The missing ownership check bypasses the filteredFields filter applied to normal user data access, exposing sensitive PII including email addresses and plexId values. A publicly available proof-of-concept exists; no CISA KEV listing at time of analysis.
Privilege abuse in Tridium Niagara Framework and Niagara Enterprise Security allows an authenticated high-privileged user on an adjacent network to improperly access confidential data and perform limited unauthorized modifications beyond their sanctioned scope. Affected platforms span Windows, Linux, and QNX, and versions prior to 4.14.6 and 4.15.5 are vulnerable. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Hook mutation pollution in DOMPurify <= 3.4.5 allows persistent bypass of HTML sanitization defaults when application-installed hooks mutate data.allowedTags or data.allowedAttributes. Because these hook fields are direct references to the library's live DEFAULT_ALLOWED_TAGS and DEFAULT_ALLOWED_ATTR sets rather than copies, any write inside a uponSanitizeElement or uponSanitizeAttribute hook permanently widens the global allow-lists for the entire lifetime of the DOMPurify instance - meaning all subsequent sanitize() calls under default config will pass through attacker-controlled HTML using the poisoned tag or attribute name. No public exploit has been identified at time of analysis, and this vulnerability is not listed in CISA KEV; real-world risk is gated on the presence of the specific hook mutation pattern in the target application.
Trusted Types policy state contamination in DOMPurify 3.0.0-3.4.8 allows a previously supplied TRUSTED_TYPES_POLICY to survive a clearConfig() call, poisoning subsequent sanitize() calls that request RETURN_TRUSTED_TYPE output. Any application that reuses a single DOMPurify instance across trust boundaries - where one integration sets a permissive or attacker-influenced TRUSTED_TYPES_POLICY and a later caller invokes clearConfig() expecting a clean slate - will receive a TrustedHTML object signed by the old policy, potentially enabling script execution at a Trusted Types sink. A public proof-of-concept is attached to the GHSA advisory; exploitation is not confirmed in CISA KEV.
JetBrains GoLand before version 2026.2 writes sensitive configuration values to log files by default, exposing credentials and secrets to anyone with read access to IDE log output. The CWE-532 flaw affects Go developers whose project configurations contain API keys, VCS credentials, or cloud tokens - values the IDE silently captures in plaintext log entries during normal use. No active exploitation has been confirmed (not in CISA KEV) and no public proof-of-concept exists; the low CVSS score of 3.5 reflects the limited impact and the requirement for low privilege and user interaction.
Sensitive system information disclosure in the MultiVendorX WooCommerce Product Stock Alert WordPress plugin (versions through 3.0.6) allows low-privileged authenticated users to retrieve embedded sensitive data via a network-accessible endpoint. The CVSS vector (AV:N/AC:L/PR:L/UI:N/C:H) confirms that any authenticated WordPress user - such as a registered shop customer - can exploit this with low complexity and no user interaction, yielding high confidentiality impact. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low-complexity, network-accessible nature of the flaw lowers the bar for abuse significantly.
Sensitive data exposure in the TinyMCE Templates WordPress plugin (versions <= 4.8.1) allows authenticated users holding the Contributor role to access information beyond their authorization boundary. The flaw is classified under CWE-497, indicating that system or application internals are being surfaced to an unauthorized control sphere - in this case, low-privileged WordPress users. No active exploitation or public proof-of-concept has been identified at time of analysis, and the CVSS score of 4.3 (Medium) reflects the limited scope: confidentiality-only impact with no integrity or availability consequences.
Unauthenticated sensitive data exposure in WP Social Ninja WordPress plugin versions 4.3.0 and earlier allows remote attackers to access sensitive information without any credentials or user interaction. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivial network-level exploitation with no barriers to access, though impact is bounded to low-severity confidentiality loss. No public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV.
Sensitive data exposure in Ultimate Store Kit Elementor Addons (by BDThemes) versions up to and including 3.0.5 permits unauthenticated remote access to restricted system or application data. The vulnerability is reachable over the network with no credentials, no user interaction, and no special configuration, placing every WordPress installation running the affected plugin version at risk of information leakage. No public exploit code or CISA KEV listing has been identified at time of analysis, and EPSS data was not provided, but the zero-barrier entry point (AV:N/AC:L/PR:N/UI:N) means opportunistic scanning is a realistic threat.
Unauthenticated sensitive data exposure in the Complianz WordPress plugin (versions up to and including 7.5.0) allows any remote, unauthenticated attacker to retrieve sensitive information from affected WordPress installations. Classified as CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere), the flaw is particularly notable because Complianz handles GDPR and cookie consent compliance data - meaning exposed information may carry regulatory implications beyond what the CVSS score alone conveys. No public exploit has been identified at time of analysis, and the vulnerability has not been listed in CISA KEV.
Unauthenticated sensitive data exposure in the Create by Mediavine WordPress plugin (versions <= 2.5.3) allows any remote, unauthenticated user to access information that should be restricted. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this is exploitable over the network with no authentication, no user interaction, and low attack complexity, placing all public-facing WordPress sites running an affected version at risk. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, but the low barrier to exploitation makes patching a timely priority.
Unauthenticated sensitive data exposure in the Ninja Tables WordPress plugin (versions ≤ 5.2.10) allows remote unauthenticated attackers to retrieve sensitive information without any credentials or user interaction. The flaw, classified under CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere), is accessible over the network with low complexity, making it trivially exploitable against any WordPress site running an affected version of the plugin. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, and the CVSS score of 5.3 (Medium) reflects limited confidentiality impact with no integrity or availability consequences.
Sensitive data exposure in Polylang WordPress plugin (versions <= 3.8.5) allows authenticated Contributors to access information beyond their authorization scope. The vulnerability, classified under CWE-497, enables low-privileged authenticated users - specifically those holding the WordPress Contributor role - to read sensitive data they should not be permitted to view. No active exploitation has been confirmed (not listed in CISA KEV) and no public exploit code has been identified at time of analysis.
Broken authentication in Easy Digital Downloads WordPress plugin (versions ≤ 3.6.7) by Sandhills Development LLC allows unauthenticated remote attackers to bypass authentication controls via an alternate path or channel (CWE-288), producing limited integrity and availability impact. The attack requires no credentials or user interaction over the network, earning a CVSS 6.5 Medium score - though Patchstack's 'Information Disclosure' tag introduces a potential confidentiality dimension not reflected in the base CVSS C:N designation, suggesting real impact may be slightly higher than the score implies. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Sensitive data exposure in PeproDev Ultimate Invoice (WordPress plugin, versions ≤ 2.2.6) allows unauthenticated remote attackers to access confidential invoice data - including likely customer PII and financial records - without authentication, contingent on some user interaction (CVSS UI:R). The root cause (CWE-201) is the inclusion of sensitive information in plugin-generated output or endpoint responses that lack proper access control. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
TTL capping bypass in PowerDNS Recursor enables ghost domain NS record injection when a slow authoritative server response arrives after the cached NS entry has already expired. Specifically, the proactive background refresh mechanism fails to cap TTLs on NS record responses when no live cache entry exists at response time, allowing attacker-controlled TTL values to persist uncapped in the recursor's cache. No active exploitation has been identified (no CISA KEV listing), no public exploit code exists, and the CVSS score of 3.7 reflects the constrained, timing-dependent nature of this attack.
Unrestricted SSH port forwarding on Ricoh printers and Multifunction Printers (MFPs) allows network-accessible devices to be used as pivot points into the local area network. When SSH is enabled on an affected device, any party able to establish an SSH connection can forward TCP traffic to arbitrary hosts and ports on the internal LAN, effectively bypassing network segmentation. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, but the network scope change (S:C in CVSS) reflects that impact extends beyond the printer itself to other internal hosts.
Format string vulnerability in GNU nano's multi-buffer error message handling allows a local low-privileged attacker to cause stack information disclosure, denial of service via crash, or potentially achieve arbitrary memory writes. The flaw (CWE-134) is triggered when a user opens multiple files at startup, one of which carries a specially crafted name containing printf format specifiers and another triggers an ALERT-level error - causing nano to misinterpret the filename as a format string. Reported by Red Hat and scoped to RHEL 6 through 10 and OpenShift Container Platform 4, no public exploit or CISA KEV listing exists at time of analysis.
Improper input validation in facil.io's WebSocket Frame Parser (versions up to 0.7.4) allows remote unauthenticated attackers to send crafted WebSocket frames that trigger a flaw in the `websocket_on_protocol_error` function, yielding limited confidentiality, integrity, and availability impact. A proof-of-concept exploit has been publicly published, lowering the technical barrier for exploitation. The project maintainer was notified via GitHub issue but has not responded, leaving the vulnerability unpatched at time of analysis.
Cache confusion in Next.js App Router's server-side fetch patch leaks confidential POST response bodies across unrelated requests targeting the same URL. Applications on Next.js 13.0.0 through 15.5.20 or 16.0.0 through 16.2.10 that call `fetch(new Request(init), aDifferentInit)` server-side are at risk of cross-user data exposure - one user's POST response (potentially containing session tokens, PII, or financial data) may be returned to a different user's request. No public exploit has been identified at time of analysis, and Pages Router deployments are explicitly unaffected.
Cache key collision in Next.js server-side fetch exposes confidential POST response bodies to unintended callers when request bodies contain non-UTF-8 byte sequences. Specifically, the incremental cache's key-generation routine decoded raw body bytes through a TextDecoder, causing distinct byte sequences - such as UTF-16 encodings - to collapse to the same replacement-character string (U+FFFD) and therefore the same cache key. A request whose body coincidentally produces a colliding cache key will receive a cached response intended for a different body, leaking whatever confidential data the upstream service returned. No public exploit has been identified at time of analysis; vendor-released patches are available in v15.5.21 and v16.2.11.
CPU exhaustion in the Next.js Image Optimization API allows unauthenticated remote attackers to deny service against the `/_next/image` endpoint by serving malicious image content - particularly crafted SVGs - from domains permitted by `config.images.remotePatterns`. Affected self-hosted deployments on Next.js 15.5.0-15.5.20 and 16.0.0-16.2.10 using the default image loader invoke Sharp's expensive `.metadata()` call on attacker-influenced buffers, exhausting server CPU. Vendor-released patches are available in versions 15.5.21 and 16.2.11; no public exploit or CISA KEV listing is identified at time of analysis.
Server Action endpoint IDs in Next.js App Router applications are exposed to unauthenticated users through publicly served client-side static JavaScript chunks, effectively bypassing page-level authentication gates on those endpoints. Applications running Next.js 13.0.0 through 15.5.20 or 16.0.0 through 16.2.10 with App Router and Server Actions (`use server`) or `use cache` directives are affected. Standalone exploitation provides an enumeration primitive rather than direct data access, but the disclosed IDs can amplify secondary weaknesses - particularly when Server Actions perform sensitive operations without re-authenticating callers within the action boundary itself. No public exploit code has been identified and no CISA KEV listing exists at time of analysis.
Filesystem existence oracle in Dompdf allows attackers who can supply arbitrary HTML content for PDF rendering to enumerate files and directories on the backend server. By embedding a data-URI encoded SVG containing an `<image>` element with a `file://` URI reference, an attacker exploits differential rendering behavior - files and directories that exist cause a different visual output than paths that do not exist - creating a binary oracle for filesystem probing. A publicly available proof-of-concept is included in the GitHub Security Advisory GHSA-j8qw-6jw8-r297; no KEV listing or confirmed active exploitation has been reported at time of analysis.
HTTP/2-to-HTTP/1.x protocol translation in Netty's `netty-codec-http2` enables request routing bypass and HTTP request smuggling via duplicate `Host` header injection. When a client sends a HEADERS frame containing both the `:authority` pseudo-header and a literal `host` header, `Http2StreamFrameToHttpObjectCodec` and `InboundHttp2ToHttpAdapter` independently translate each into `Host` headers, producing an `HttpRequest` with two attacker-controlled, differing values. Downstream HTTP/1.1 components that prioritize the second header can be manipulated into routing requests to unintended targets. No public exploit has been identified and this CVE is not in the CISA KEV catalog, but patches are vendor-released for both affected release trains.
WebSocket protocol upgrade in Netty's V07/V08 handshakers completes without enforcing RFC 6455-mandatory `Connection: Upgrade` and `Upgrade: websocket` headers, enabling an attacker to silently switch protocols in a way that upstream reverse proxies and load balancers do not recognize as an Upgrade request. This desynchronization between proxy and backend creates a classic HTTP request smuggling vector (CWE-444) that can be exploited to poison shared connections, bypass proxy-enforced access controls, or hijack other users' HTTP sessions. Affected versions are `io.netty:netty-codec-http` prior to 4.1.136.Final and 4.2.0.Final through 4.2.15.Final; no public exploit code or CISA KEV listing has been identified at time of analysis.
File existence oracle in Dompdf allows remote unauthenticated attackers to enumerate sensitive server-side files by exploiting a behavioral discrepancy in CSS @font-face processing. Crafted HTML containing thousands of @font-face declarations referencing local paths via the file:// protocol causes PHP memory exhaustion only when the target file exists, producing a detectable crash signal versus a clean render for non-existent files. Publicly available exploit code exists (detailed in the GHSA advisory); no KEV listing at time of analysis, but exploitation requires only a public HTTP endpoint that passes unsanitized HTML to Dompdf. A vendor-released patch (v3.1.6) is available.
Dompdf's chroot validation logic in versions before 3.1.6 can be bypassed by an attacker who controls HTML content rendered into a PDF, allowing files outside the configured chroot directories to be read and embedded in the output. The root cause is a flawed `strpos()` prefix check in `validateLocalUri()` that fails to enforce directory boundaries after `realpath()` strips trailing slashes, enabling sibling directories like `/var/www-admin` to satisfy a chroot configured as `/var/www`. A publicly available proof-of-concept exploit is included in the GitHub Security Advisory GHSA-wvh6-f5jh-8gw4; no active exploitation is recorded in CISA KEV, and upgrading to v3.1.6 fully resolves the issue.
Denial of service against the MongoDB mongod process is achievable by any authenticated user holding standard read/write privileges by submitting a crafted aggregation command that exploits insufficient input validation in the bundled libmongocrypt library. An integer overflow (CWE-190) in libmongocrypt allows attacker-controlled payload values to produce an excessively large memory allocation request, causing the operating system to terminate the mongod process under an out-of-memory condition. No public exploit has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Polkit privilege escalation in PortProtonQt 0.1.12 through 1.3.0 allows any local unprivileged user to modify system NetworkManager connections and mount or unmount arbitrary block devices without authorization. The vulnerable Polkit rule (ru.linux_gaming.PortProtonQt.rules) identifies trusted callers by inspecting process command lines via 'ps', a method trivially defeated by command-line spoofing or PID recycling races. A shell script reproducer confirmed by SUSE researchers achieves exploitation reliably and consistently. No public exploit is independently published but a working reproducer exists; no CISA KEV listing at time of analysis.
Symlink-following vulnerability (CWE-59) in systemd-tmpfiles allows a local, low-privileged user to redirect privileged file write operations to an attacker-controlled path on affected Red Hat Enterprise Linux systems. The flaw resides in the path resolution logic within chase.c, where a safety check incorrectly treats all transitions away from the root user as inherently safe - failing to detect attacker-placed symlinks at tmpfiles.d target path components. Exploitation is constrained by high attack complexity requiring a specific non-default tmpfiles.d configuration, and no public exploit code or CISA KEV listing has been identified at time of analysis.
Dell PowerProtect Data Manager's REST API exposes sensitive information to high-privileged local users in all versions prior to 20.2.0.0. An administrator-level attacker with local access can query the REST API and retrieve sensitive data that should be restricted even at the admin tier - with the CVSS Scope:Changed indicator suggesting the exposed information may include credentials or secrets belonging to systems external to the PPDM instance itself. No public exploit code or active exploitation has been identified at time of analysis; Dell has released version 20.2.0.0 to address this and multiple other vulnerabilities per advisory DSA-2026-287.
Availability loss in ISC BIND 9 DNS server arises when a stored DNS key record containing the PRIVATEDNS algorithm (algorithm number 253) carries a malformed identifier length field that exceeds the actual identifier data. BIND accepts the structurally invalid record without rejecting it at ingestion time, but when it subsequently attempts to render that record to text - during logging, zone display, or similar operations - the inconsistent length triggers a reachable assertion (CWE-617) that causes BIND to abort and exit. No active exploitation has been confirmed (not listed in CISA KEV) and no public exploit code has been identified at time of analysis; however, BIND 9 spans a very wide version range and is critical infrastructure, making patch urgency high despite the medium CVSS score of 6.5.
DNSSEC integrity bypass in ISC BIND 9 enables network-positioned attackers to forge authenticated NXDOMAIN responses by exploiting improper validation of NSEC3 records originating from child zones. Affected are BIND 9 versions across the 9.18, 9.20, and 9.21 branches, as well as the BIND 9 Supported Preview Edition (S-series). Because the CVSS vector carries S:C (scope changed), the integrity impact propagates beyond the resolver itself to any DNS client trusting BIND's DNSSEC-validated answers. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
Unauthenticated file read and deletion in Progress Telerik UI for ASP.NET AJAX (all versions prior to v2026.2.708) is made possible by a hardcoded cryptographic key (CWE-321) embedded in the obsolete RadChart component's ChartImage.axd HTTP handler. Remote attackers without any credentials can exploit this to read or delete image-extension files within the application directory, bypassing standard authentication controls entirely. No public exploit code exists and the vulnerability is not listed in CISA KEV at time of analysis, but the unauthenticated network-accessible attack vector warrants prompt patching for all affected deployments.
Parameter tampering in the DialogHandler component of Progress Telerik UI for ASP.NET AJAX (all versions prior to 2026.2.708) allows unauthenticated remote attackers to manipulate server-side dialog behavior, establishing a foothold for chained exploitation of downstream application components. The CVSS vector specifies High integrity impact with no required privileges (PR:N), making the DialogHandler endpoint a meaningful attack surface in any deployment where it is network-accessible. No public exploit code has been identified at time of analysis and no CISA KEV listing exists, but the vendor's explicit mention of chained exploitation elevates the practical risk beyond the moderate base score of 5.9.
Counter exhaustion in NLnet Labs Unbound 1.20.0 through 1.25.1 enables a remote attacker to degrade DNS resolution service by triggering a missing decrement in the serve-expired discard-timeout code path. The reply-address counter for duplicate in-flight queries is never decremented when the discard-timeout branch fires under a specific non-default misconfiguration, allowing an attacker controlling a slow authoritative zone to drive the counter to its maximum and cause silent query drops for legitimate clients. No public exploit identified at time of analysis; however, the vulnerability is exploitable remotely with no authentication required once the misconfiguration is in place.
Crash-triggering memory corruption in Unbound's DNSCrypt subsystem allows any unauthenticated network client to kill the DNS resolver with a single UDP packet. Affected versions 1.7.0 through 1.25.1, compiled with DNSCrypt support, miscount valid key slots when the dnscrypt-provider-cert list outnumbers dnscrypt-secret-key entries, leaving tail slots filled with libsodium's 0xdb debug pattern; iterating beyond valid bounds then dereferences that garbage. No public exploit has been identified at time of analysis, and no KEV listing exists, but the trigger condition is trivially constructable - one 68-byte UDP datagram.
DNS cache poisoning risk in NLnet Labs Unbound 1.4.22 through 1.25.1 arises because the SO_REUSEPORT load balancing mechanism structurally leaks the secret entropy value - UDP source port randomization - that defends against Kaminsky-style attacks. Each worker thread is assigned a disjoint subset of source ports at startup, so an adjacent-network attacker who can observe Unbound's outgoing UDP queries to authoritative name servers can infer the thread-to-port-subset mapping and substantially reduce the port space to guess during a cache poisoning attempt. Proof-of-concept exploit code exists (CVSS 4.0 E:P); no confirmed active exploitation or CISA KEV listing has been identified.
Cache-clearing denial-of-service in NLnet Labs Unbound through 1.25.1 allows a remote attacker who controls a DNS delegation to indefinitely and repeatedly flush Unbound's message and rrset caches without sending a single spoofed packet. The attack exploits a logic flaw in how the iterator processes in-bailiwick glue records containing the unspecified address 0.0.0.0/::0: on Linux, such queries are routed via loopback and answered by 127.0.0.1, creating an IP mismatch that the unwanted-reply counter tallies until the configured threshold triggers a defensive cache clear - which resets the counter, enabling the loop to continue indefinitely. No public exploit identified at time of analysis; CVSS 3.1 scores this 5.3 (Medium) with Low availability impact and no confidentiality or integrity impact.
DNS response policy poisoning in NLnet Labs Unbound 1.7.0 through 1.25.1 allows an unauthenticated network attacker to become the authoritative XFR source for an auth/rpz zone by spoofing the configured primary hostname's A/AAAA record. The flaw stems from Unbound accepting a BOGUS-validated hostname resolution - one where DNSSEC validation has explicitly failed - as a valid zone transfer endpoint without requiring a valid RRSIG, violating the integrity guarantees DNSSEC is designed to enforce. Successful exploitation enables complete replacement of the resolver's response policy zone, making this a DNS firewall bypass with high real-world consequence for organizations relying on RPZ for threat blocking. No public exploit code has been identified at time of analysis.
DNS response policy rewriting in NLnet Labs Unbound 1.6.2 through 1.25.1 bypasses DNSSEC validation when the respip module is positioned ahead of the validator with response-ip or RPZ-IP redirect rules active. The rewriting handler fails to check upstream DNSSEC security status, allowing a spoofed BOGUS A/AAAA answer whose address falls within an operator-configured redirect subnet to be rewritten and returned to clients with a hardcoded INSECURE security level rather than being rejected as BOGUS. No public exploit code has been identified at time of analysis, but the integrity impact is concrete: clients receive silently misdirected responses that appear to pass through legitimate operator-controlled policy, undermining the core DNSSEC trust guarantee for affected deployments.
Fatal application termination in NLnet Labs Unbound's libunbound library (up to and including 1.25.1) can be triggered remotely when the 'unwanted-reply-threshold' feature is enabled. An attacker controlling or able to spoof responses from an authoritative nameserver can flood the resolver with wrong-transaction-ID UDP datagrams until the threshold is crossed, causing libunbound to invoke 'libworker_alloc_cleanup' - a function absent from the internal allow list - resulting in a fatal exit that crashes the embedding application. Notably, standalone Unbound is unaffected because its counterpart function 'worker_alloc_cleanup' is correctly registered; only applications embedding libunbound are at risk. No public exploit code or CISA KEV listing has been identified at time of analysis.
Ghost domain name cache extension in Unbound DNS resolver 1.16.2 through 1.25.1 allows a network-based adversary who controls a ghost zone to overwrite cached expired parent-side A/AAAA glue records, extending the effective ghost domain window by up to one full cache-max-ttl period beyond expiry. A single crafted A/AAAA client query is sufficient to trigger the overwrite; on resolvers using the non-default harden-referral-path: yes directive, Unbound performs the lookup implicitly with no client query required at all. This is a variant of CVE-2026-40622, which addressed only the NS query path - no public exploit has been identified at time of analysis and no CISA KEV listing exists.
Insecure credential storage in the Ansible Lightspeed VS Code extension exposes Google Gemini API keys to any local actor operating at user privilege level. The extension writes API keys in plaintext to both user configuration files and extension output log channels, making them readable by co-users of the workstation, other OS-level processes, or malware executing under the victim's account. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified; the primary real-world risk is API credential theft leading to unauthorized quota consumption or service abuse.
Credential exposure in n8n workflow automation platform leaks full Google Service Account PEM private keys into the JWT header's kid field, where they are trivially recoverable via Base64 decoding. Affected versions span both the 1.x line (before 1.123.64) and the 2.x line (before 2.29.8 and 2.30.1), but only deployments configured with Google Service Account credentials are at risk. An attacker who captures these JWTs from logs, network traffic, or monitoring systems can extract the raw private key and fully impersonate the service account against any Google Cloud resource it is authorized to access. No public exploit code has been identified at time of analysis, and no confirmed active exploitation is recorded in CISA KEV.
Credential exposure in n8n's LLM sub-node allows authenticated users to read plaintext API keys and secrets persisted in workflow execution records. Versions before 1.123.64 fail to mask custom HTTP header values - such as Authorization or X-API-Key headers - when those headers are used in LLM node configurations, causing secrets to be written in cleartext to execution data stored in the database. While exploitation requires a low-privilege authenticated session, the downstream impact is high because recovered credentials can be used to access external APIs and services configured in those workflows. No public exploit code or KEV listing has been identified at time of analysis.
Unauthenticated remote information disclosure in Hikvision DS-2CD and DS-2DE series IP cameras exposes partial device memory contents to network-accessible attackers without any credentials. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no authentication and no user interaction against default configurations, making the attack surface broad given the cameras' typical internet or LAN exposure. While confidentiality impact is rated Low (partial memory only), leaked memory may contain sensitive fragments such as session tokens or configuration data, and no public exploit or CISA KEV listing is confirmed at time of analysis.
Off-by-one heap out-of-bounds read in the BlueZ SBC (Sub-Band Coding) frame decoder allows a Bluetooth-adjacent unauthenticated attacker to leak a single byte of heap memory by streaming a crafted audio payload. Red Hat Enterprise Linux 7 through 10 are confirmed affected via the bundled sbc library. No public exploit code exists and this vulnerability is not listed in CISA KEV, making active exploitation unlikely; the impact is constrained to minor information disclosure of a single heap byte.
Cross-space information disclosure in Kibana 9.4.0 through 9.4.3 allows authenticated users to access data from Kibana Spaces they are not authorized to view. The flaw (CWE-862, Missing Authorization) arises because user-supplied input can reference cross-space resources without adequate space-level authorization checks, enabling privilege boundary bypass within a multi-tenant Kibana deployment. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Kibana's multi-tenancy Spaces model can be bypassed through an Insecure Direct Object Reference (IDOR) vulnerability, allowing authenticated users to read scheduled query results belonging to Spaces they are not authorized to access. Affected versions span Kibana 9.4.0 through 9.4.3, with the fix delivered in 9.4.4. The CVSS vector (PR:L, C:L) confirms the impact is limited to low-privilege authenticated access resulting in partial confidentiality loss - no integrity or availability impact is involved. No public exploit code exists and no CISA KEV listing has been identified at time of analysis.
Unauthorized access to workflow execution outputs in Kibana 9.3.0-9.3.7 and 9.4.0-9.4.3 allows an authenticated low-privileged user to read sensitive data returned by workflow steps - including results from connected data sources they are not authorized to query - by directly calling the workflow output endpoint without the authorization the documented API requires. The flaw is classified as Missing Authorization (CWE-862) via Privilege Abuse (CAPEC-122), with impact limited to confidentiality within the user's accessible Kibana space. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog; Elastic has released patched versions 9.3.8 and 9.4.4.
Cross-origin information disclosure in Google Chrome prior to 150.0.7871.182 allows a remote attacker who has already compromised the renderer process to leak sensitive data from other origins via a crafted HTML page. The vulnerability arises from an uninitialized use in the Skia graphics library. Exploitation is unlikely given high complexity and the prerequisite of a separate renderer compromise; no active exploitation or public exploit has been identified at the time of analysis.
Spoofing of the Omnibox (URL bar) in Google Chrome versions prior to 150.0.7871.182 allows a remote attacker to mislead users via a crafted HTML page, exploiting insufficient input validation in the browser's Extensions handling. This Medium-severity vulnerability (CVSS 5.4) has no evidence of active exploitation or publicly available exploit code, and its exploitation requires user interaction to visit a malicious page.
Unauthorized critical data disclosure in Oracle HRMS (US) versions 12.2.3 through 12.2.15 exposes complete read access to all HRMS-accessible data via network HTTP, with a confirmed scope change that can impact additional Oracle E-Business Suite modules beyond HRMS itself. The CVSS vector (PR:H, S:C, C:H) indicates a high-privileged authenticated attacker operating over the network with low complexity can breach data boundaries across co-deployed EBS components. An 'Authentication Bypass' tag in the intelligence feed creates analytical tension with the PR:H prerequisite and warrants vendor clarification; no public exploit code has been identified at time of analysis, and Oracle disclosed this issue via the July 2026 Critical Patch Update.
Oracle HRMS (US) Internal Operations component exposes complete HR dataset read access to any low-privileged authenticated attacker over HTTP. Versions 12.2.6 through 12.2.15 of Oracle E-Business Suite are confirmed affected, enabling an attacker holding even a basic EBS user account to bypass authorization controls and access all data visible to the HRMS application. No public exploit or CISA KEV listing exists at time of analysis, but the low attack complexity (AC:L) means exploitation is straightforward once initial credentials are obtained, making insider threat and credential-compromise scenarios the primary risk vector.
Oracle Quality within Oracle E-Business Suite versions 12.2.3 through 12.2.15 exposes partial confidentiality, integrity, and availability compromise through its Quality Workbench HTML system component. A low-privileged authenticated attacker with HTTP network access can perform unauthorized read, write, and denial-of-service operations against Quality module data. No public exploit code or active exploitation has been identified at time of analysis; this vulnerability was disclosed by Oracle via the July 2026 Critical Patch Update.
Oracle HRMS (US) US Payroll - General component in Oracle E-Business Suite versions 12.2.3 through 12.2.15 exposes payroll data and service availability to low-privileged authenticated network attackers over HTTP. Successful exploitation yields partial unauthorized read of payroll records, unauthorized insert, update, or delete of accessible payroll data, and partial denial of service - impacts that are especially sensitive given the nature of US payroll information. Disclosed as part of Oracle's July 2026 Critical Patch Update, no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Confidential data exposure in Oracle Contracts Integration (Oracle E-Business Suite) versions 12.2.3 through 12.2.15 enables a low-privileged authenticated attacker with HTTP network access to bypass internal authorization controls in the Internal Operations component, gaining unauthorized access to critical or all accessible contract data. The CVSS confidentiality impact is rated High despite the moderate overall score of 5.3, reflecting complete in-scope data exposure when exploitation succeeds. No public exploit code or active exploitation has been identified at time of analysis; the high attack complexity (AC:H) constrains real-world opportunistic risk.
Unauthorized data disclosure in Oracle Self-Service Human Resources (E-Business Suite), Manager Self-Service component, affects versions 12.2.3 through 12.2.15. A low-privileged authenticated attacker with HTTP network access can exploit an authorization bypass to gain complete read access to all data within the Self-Service HR module - including sensitive employee and managerial records. No public exploit has been identified at time of analysis, and the vulnerability is not currently listed in the CISA KEV catalog, but the low attack complexity and broad data exposure make patching via the July 2026 CPU a priority for organizations running Oracle EBS.
Partial data compromise and denial of service in Oracle HRMS (UK) versions 12.2.3 through 12.2.15 allows low-privileged, network-authenticated attackers to perform unauthorized read, write, and partial disruption of HR data via HTTP. The vulnerability resides in the Internal Operations component of Oracle E-Business Suite and is characterized by Oracle as 'easily exploitable,' lowering the practical barrier for authenticated insiders or compromised accounts. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Oracle EDI Gateway versions 12.2.3 through 12.2.15, a component of Oracle E-Business Suite, exposes an information disclosure vulnerability allowing low-privileged network-authenticated attackers to read a subset of EDI transaction data without proper authorization. Tagged as an authentication bypass, the flaw is exploitable over HTTP with low attack complexity and no user interaction required, suggesting an access-control deficiency that permits privilege escalation within the application layer rather than a full bypass of authentication. No public exploit code and no active exploitation have been identified at time of analysis; Oracle addressed this in the July 2026 Critical Patch Update.
Oracle EDI Gateway versions 12.2.3 through 12.2.15 exposes an information disclosure vulnerability via HTTP that enables low-privileged authenticated network attackers to read a subset of EDI transaction data without proper authorization. The vulnerability is tagged 'Authentication Bypass' in threat intelligence sources, yet the CVSS vector assigns PR:L, suggesting the bypass operates within an authenticated session - likely circumventing object-level authorization controls rather than bypassing session authentication entirely. No public exploit code or CISA KEV listing has been identified at time of analysis, keeping real-world urgency moderate despite the vendor's characterization of the flaw as 'easily exploitable.'
Limited unauthorized data read in Oracle EDI Gateway (E-Business Suite versions 12.2.3-12.2.15) requires a high-privileged attacker with local logon access to the underlying infrastructure, combined with difficult exploitation conditions, to access a subset of EDI data without authorization. The confidentiality impact is narrow and no integrity or availability impact is present. No public exploit code or active exploitation has been identified at time of analysis; Oracle disclosed this via the July 2026 Critical Patch Update.
Unauthorized data disclosure in Oracle U.S. Federal Financials (Oracle E-Business Suite, Internal Operations component) allows a low-privileged, network-authenticated attacker to read a subset of sensitive financial data via HTTP. Versions 12.2.3 through 12.2.15 are confirmed affected. No public exploit code or CISA KEV listing has been identified at time of analysis, and the CVSS score of 4.3 reflects a moderate-severity information disclosure with no integrity or availability impact.
Oracle Proposals (component of Oracle E-Business Suite versions 12.2.3 through 12.2.15) is exploitable by low-privileged authenticated remote attackers over HTTP, enabling unauthorized read access to a subset of data, unauthorized data manipulation (insert, update, delete), and partial denial of service against the Proposals component. Oracle disclosed this vulnerability in its July 2026 Critical Patch Update (CPU). No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Unauthorized payroll data exposure in Oracle E-Business Suite's HRMS (Australia) Payroll component allows a low-privileged, network-authenticated attacker to access all HR and payroll data accessible to the application. Affecting versions 12.2.3 through 12.2.15, Oracle classifies this as 'easily exploitable' in the July 2026 Critical Patch Update, requiring only low user privileges over HTTP with no user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis, though the confidentiality impact against sensitive payroll records elevates practical priority for affected Australian EBS deployments.
Unauthorized data disclosure in Oracle Learning Management (E-Business Suite) versions 12.2.3 through 12.2.15 allows a low-privileged, network-authenticated attacker to access critical or complete LMS data via the Import and Export component over HTTP. Tagged as an Authentication Bypass, the flaw enables privilege escalation beyond the attacker's granted access level, resulting in full confidentiality compromise of all Learning Management accessible data. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and network vector make this straightforward to exploit once credentials are obtained.
Oracle Payroll within Oracle E-Business Suite (EBS) versions 12.2.3 through 12.2.15 is exploitable by low-privileged authenticated network attackers via HTTP, enabling unauthorized read, write, and partial denial-of-service against payroll data. Oracle's own advisory classifies this as 'easily exploitable,' indicating low attack complexity for any valid EBS user with HTTP reachability. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, placing this as a moderate real-world priority requiring prompt patching for exposed EBS deployments.
Partial confidentiality exposure in Oracle HRMS (UK)'s UK Payroll component allows a network-adjacent, high-privileged attacker to read a limited subset of HRMS data under difficult exploitation conditions. Affecting E-Business Suite versions 12.2.3 through 12.2.15, this low-severity (CVSS 2.2) vulnerability is tagged as an authentication bypass, suggesting an authorization control weakness within an already-authenticated session rather than a full unauthenticated bypass - consistent with the PR:H and AC:H vector. No public exploit code exists and it is not listed in the CISA KEV catalog, placing real-world risk at the lower end of the spectrum.
Oracle HRMS (US) Internal Operations component in E-Business Suite versions 12.2.3 through 12.2.15 exposes a network-accessible flaw that allows a low-privileged authenticated attacker to read a subset of HRMS data and cause partial denial of service via HTTP under high-complexity conditions. Disclosed by Oracle via the July 2026 Critical Patch Update (CPU), the vulnerability carries a CVSS 3.1 score of 4.2 (Medium), with no public exploit and no active exploitation confirmed at time of analysis. The high attack complexity (AC:H) materially constrains real-world exploitability despite the network-accessible attack vector.
Unauthorized data exfiltration in Oracle HRMS (UK), a component of Oracle E-Business Suite, exposes complete HR records to low-privileged network attackers via a scope-changing vulnerability in the Internal Operations component. Versions 12.2.8 through 12.2.15 are affected, and successful exploitation can breach data beyond the immediate HRMS (UK) boundary, impacting additional E-Business Suite products. Tagged as an authentication bypass by EUVD intelligence, the attack requires HTTP network access and low privilege credentials but no user interaction, though high attack complexity (AC:H) limits opportunistic exploitation. No public exploit is identified at time of analysis, and the issue is not listed in CISA KEV.
Unauthorized data disclosure in Oracle Order Management's Product Diagnostic Tools component (E-Business Suite 12.2.3-12.2.15) allows a low-privileged network attacker to read all data accessible to the application over HTTP with no user interaction required. The 'Authentication Bypass' tag suggests the diagnostic interface fails to enforce proper authorization boundaries, enabling a minimally privileged account to exceed its intended data access scope. No public exploit has been identified at time of analysis, but the low attack complexity and ERP-grade data sensitivity - order records, customer PII, financial data - elevate business impact well beyond the moderate CVSS 6.5 score.
Unauthorized read access to a subset of student records data is possible in Oracle PeopleSoft Enterprise CS Student Records 9.2.38 via the Research Tracking component over HTTP. An unauthenticated network attacker exploiting an authentication bypass condition (tagged explicitly by the reporter) can retrieve confidential academic data without credentials, though the high attack complexity constrains opportunistic mass exploitation. No public exploit code or active exploitation has been identified; however, even partial disclosure of student records carries regulatory significance under FERPA regardless of the low CVSS score of 3.7.
Authentication bypass in Oracle PeopleSoft Enterprise CS Campus Community 9.2.38 (Security component) enables an unauthenticated attacker positioned on the adjacent physical network segment to access critical application data and manipulate select records. The exploit is rated difficult due to adjacent-network positioning requirements and high attack complexity, yielding a moderate CVSS 5.9 score despite the high confidentiality impact. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, limiting immediate mass-exploitation risk.
Unauthorized access to critical data is achievable against MySQL Connector/J versions 9.7.0 and 9.7.1 via a network-accessible authentication bypass flaw requiring human interaction. Oracle classifies this as easily exploitable, meaning a network-positioned unauthenticated attacker can intercept or otherwise obtain complete access to all data flowing through the affected connector when a legitimate application initiates a database connection. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Unauthorized data read in MySQL Server and MySQL Cluster's Performance Schema component exposes a subset of accessible data to highly privileged, network-connected attackers. Affected releases span MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1, disclosed as part of Oracle's July 2026 Critical Patch Update. No public exploit code and no CISA KEV listing are identified at time of analysis; the CVSS 2.7 score reflects the limited scope and elevated privilege bar.
Unauthorized data disclosure in Oracle Production Scheduling (E-Business Suite versions 12.2.3 through 12.2.15) allows a low-privileged network attacker to gain complete read access to all data within the application via a difficult-to-exploit flaw in the User Interface component. Tagged as an authentication bypass, the vulnerability suggests improper access control enforcement in the UI layer that permits privilege escalation beyond the attacker's normally granted permissions, enabling full confidentiality compromise of Production Scheduling data. No public exploit code or active exploitation has been identified; Oracle addressed this in the Critical Patch Update for July 2026.
Unauthorized read access to Oracle Time and Labor data is achievable by unauthenticated remote attackers targeting the Internal Operations component via HTTP, affecting E-Business Suite versions 12.2.3 through 12.2.15. Tagged as an Authentication Bypass, the flaw allows network-based attackers to circumvent access controls without credentials, though the high attack complexity (AC:H) constrains reliable exploitation. Impact is confined to partial confidentiality loss - no integrity or availability impact - and no public exploit or active exploitation (CISA KEV) has been identified at time of analysis.
Partial confidentiality exposure in Oracle HRMS (Ireland), a component of Oracle E-Business Suite versions 12.2.3 through 12.2.15, permits a network-based high-privileged attacker to read a limited subset of HRMS data via HTTP under high-complexity conditions. The impact is confined solely to confidentiality with no integrity or availability consequence, and the CVSS 3.1 base score of 2.2 reflects how constrained exploitation is in practice. No public exploit code has been identified and this vulnerability does not appear in the CISA KEV catalog. Notably, the intelligence tag 'Authentication Bypass' conflicts with the PR:H vector - this discrepancy warrants verification against the Oracle July 2026 CPU advisory.
Unauthorized read access in Oracle Project Contracts (E-Business Suite component: Internal Operations) can be achieved by a low-privileged network attacker under high-complexity exploit conditions, exposing a subset of Project Contracts data. Affected versions span 12.2.3 through 12.2.15, as confirmed by Oracle Security Alerts via the July 2026 Critical Patch Update. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, keeping real-world risk low despite the network-accessible attack surface and the notable 'Authentication Bypass' tag applied by ENISA EUVD.
Partial unauthorized read access in Oracle Public Sector Financials (E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged authenticated attacker over HTTP to read a limited subset of data they are not authorized to access. Despite the 'Authentication Bypass' tag in intelligence sources, the CVSS vector confirms authentication is required (PR:L), suggesting this is a partial authorization bypass or privilege boundary failure rather than a full authentication bypass. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Unauthorized read access to a subset of procurement data is achievable in Oracle iSupplier Portal versions 12.2.3 through 12.2.15 via the Internal Operations component over HTTP, requiring a low-privileged account and difficult attack conditions. The intelligence tags classify this as an Authentication Bypass, creating tension with the official CVSS PR:L metric - if bypass is possible, the real-world requirement may be lower than the vector implies. No public exploit or active exploitation has been identified at time of analysis; this vulnerability is addressed in Oracle's July 2026 Critical Patch Update.
Unauthorized read access to Oracle iSupplier Portal (E-Business Suite versions 12.2.3-12.2.15) is possible for unauthenticated network attackers targeting the Internal Operations component over HTTP. The Authentication Bypass tag indicates the root cause involves inadequate access controls on internal HTTP endpoints, though exploitation is constrained by high attack complexity (AC:H), meaning specific conditions must be met. Impact is confined to partial confidentiality loss - no integrity or availability impact - with no public exploit code or active exploitation confirmed at time of analysis.