Information Disclosure
Monthly
Information disclosure in the FluentBoards WordPress plugin before version 2.0.15 lets any authenticated user - including a Subscriber with no board access whatsoever - retrieve the private board memberships of arbitrary users simply by referencing their user ID. The flaw is an authorization failure rather than a memory-safety or injection bug: the endpoint that returns a user's board list performs no ownership or capability check, so the requester's identity is never validated against the target user. Publicly available exploit code exists, but there is no CISA KEV listing and no evidence of active exploitation; EPSS is just 0.18% (8th percentile), and CVE severity is low (CVSS 4.3) because only membership associations leak, not board contents, credentials, or write access.
Unauthenticated visitors can read the body content of WordPress posts that authors marked as password protected when the Schema & Structured Data for WP & AMP plugin is installed at any version before 1.66. The plugin assembles its structured-data output without checking WordPress's post-password state, and it leaks the protected text through more than one public output route, so the only real precondition is that the site actually uses password-protected posts holding content worth hiding; sites that never set post passwords have nothing to expose. Publicly available exploit code exists (no CISA KEV entry), the vendor has released a fix in 1.66 per WPScan, and EPSS is low at 0.19% (9th percentile), making this a genuine but low-to-moderate severity information-disclosure issue rather than a high-urgency emergency.
Unauthenticated information disclosure in the Ni WooCommerce Sales Report WordPress plugin before version 4.2.0 allows remote attackers to dump WooCommerce order details and customer contact information, target a specific order by identifier, and search the store's entire order set by customer name or email address. Exploitation requires only that the plugin be installed and active on a WordPress site with WooCommerce data present - no credentials, roles, or user interaction are needed (CVSS:3.1/AV:N/AC:L/PR:N/UI:N) - and publicly available exploit code exists alongside a WPScan-published proof of concept. Impact is limited to confidentiality (C:L) with no write or code-execution capability, and EPSS places exploitation likelihood at roughly 0.22% (13th percentile), making this a moderate-priority exposure whose real risk scales with the sensitivity and volume of customer records the store holds.
Mass assignment (CWE-915) in the a2ui message-processing component lets an authenticated remote attacker inject arbitrary, dynamically-determined object attributes by submitting crafted messages to the message processor, producing limited confidentiality, integrity and availability effects. All a2ui versions up to and including 0.10.6 are affected according to the CPE range, and the upstream maintainers have not responded to the reported issue (#2297), so no patched release exists. No public exploit code and no CISA KEV entry were identified at time of analysis; the EPSS probability was not supplied with the input data.
Token generation in EspoCRM through 10.0.8 relies on PHP's non-cryptographic rand() function, producing roughly 31-bit identifiers for lead-capture opt-in links, event invitations, and campaign URLs. Remote unauthenticated attackers who can reach those public endpoints can guess or enumerate valid tokens, allowing them to confirm opt-ins, accept or decline event invitations on behalf of other contacts, and read event details. Publicly available exploit code exists (a vendor commit and a public write-up), but there is no evidence of confirmed active exploitation in the wild, and the CVSS 6.3 rating reflects high attack complexity and only low confidentiality/integrity impact.
MikroTik firmware 7.19.4 stores sensitive authentication credentials and network state in cleartext within non-volatile storage. An attacker with physical access to the device can extract this material from an SPI flash dump, without authenticating to the device and without knowledge of the administrative password.
DD-WRT firmware, as deployed on TP-Link TL-WR740N v1 through v4 hardware, stores sensitive authentication credentials in cleartext within non-volatile memory. The exposed material includes SSH private keys, dynamic DNS passwords, email notification credentials and administrative passwords. An attacker with physical access to the device can extract these credentials from an SPI flash dump, leading to device compromise, infiltration of the connected network and unauthorised access to dependent third-party services.
Arbitrary host file creation in Podman's `podman load` command lets anyone who can supply a crafted tar archive write files on the host with the privileges of the user running Podman. The flaw (CWE-277, insecure inherited permissions) affects Podman installations where image archives are loaded from untrusted sources, and is scored a moderate CVSS 5.5 because the write primitive is limited to the invoking user's permissions rather than root. No public exploit code and no CISA KEV listing were identified at time of analysis, though the Red Hat advisory and Bugzilla tracker confirm the issue is acknowledged upstream.
An out-of-bounds read in the ARP filter import handler (filter_arp_put_file.cgi) of Netcore NR255-V firmware 1.5.130703 lets an attacker who can reach the router's web management interface and supply a malformed, non-null-terminated string cause the string-handling API to read past the end of an allocated buffer, exposing adjacent process memory in the response. The flaw is rated CVSS 5.3 (CVSS:4.0/AV:N/AC:L/PR:L/UI:N/VC:L/VI:N/VA:L), indicating a network-reachable, low-privilege issue with limited confidentiality and availability impact only — there is no confirmed integrity impact, no CISA KEV listing, and no confirmed public exploit code; the only public material is a VulnCheck advisory plus a third-party GitHub technical reference whose exploit content is unverified.
An incorrect authorization flaw in the Netcore NR255-V router (firmware 1.5.130703) lets any authenticated user with a broad or low-privileged role pull live QoS/bandwidth telemetry from the mod_qos_bandwidth plan.json read routes, exposing network activity data they are not entitled to see. The bug is rooted in missing role checks within filter_conns_dump_cgi.c and IGD_CgiCall.c, so the endpoints return connection and bandwidth statistics regardless of the caller's privilege level. Impact is confidentiality-only and rated moderate (CVSS 4.0 base 5.3, AV:N/PR:L/UI:N/VC:L); no CISA KEV listing or confirmed public exploit code exists, though a public technical write-up of the QoS telemetry disclosure is referenced from the NVD entry.
Authenticated users who hold log-read permission on Devolutions PowerShell Universal 2026.2.5 and earlier can recover application tokens, data protection key material, and other stored credentials, because the slow query logging feature writes raw SQL parameter values into the system log on instances backed by Microsoft SQL Server. The issue is CWE-532 (insertion of sensitive information into a log file) and carries a CVSS v3.1 score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), meaning confidentiality is fully impacted while integrity and availability are untouched. There is no public exploit identified at time of analysis, no CISA KEV listing, and EPSS is low at 0.15% (roughly the 5th percentile), consistent with a genuine but moderate-priority disclosure whose prerequisites - an authenticated log-viewing account, an MSSQL backend, and slow query logging actively enabled - narrow the exposed population.
Let me construct the JSON. CVE-2026-91744: Chrome on Mac, race condition in PlatformIntegration, renderer compromise + social engineering, info disclosure, CVSS 5.3, CWE-367. Let me write fields carefully. Product name: "Google Chrome" — 1-3 words. Or "Google Chrome (macOS)". Keep "Google Chrome". Summary: must not start with "A vulnerability". Start with impact verb + product. Info disclosure in Google Chrome for macOS prior to 153.0.8010.47... Race condition in PlatformIntegration component. Requires attacker to already have compromised renderer process and use social engineering (UI:R). CVSS 5.3. No KEV, no POC identified. Technical context: PlatformIntegration is macOS-specific integration layer (native macOS APIs, app bindings, drag-and-drop, services, etc.). CWE-367 TOCTOU race condition — check and use of resource with different timing, enabling a race window where a resource's state changes between check and use, allowing access to data not intended for the renderer. Chrome's multi-process architecture & site isolation — renderer compromise is assumed by Chrome's threat model. The flaw crosses the sandbox boundary in the sense that the renderer-obtained access to macOS integration surfaces yields sensitive info. Risk assessment: CVSS 5.3 moderate, AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N. AC:H reflects the race condition timing win. UI:R because social engineering. PR:N per the vector — unauthenticated. Requires a compromised renderer, which raises the practical bar considerably: a separate renderer exploit is needed first. EPSS not provided — state missing. KEV not listed. No POC identified. Include "radom" once, naturally, in one sentence as illustrative hypothetical mid-sized operator. Affected products: Google Chrome on macOS prior to 153.0.8010.47. EUVD lists Chrome 153.0.8010.47 <153.0.8010.47 (odd formatting). References: chromereleases blog, chromium issue 520019273. CPE not provided — state that. Remediation: upgrade to 153.0.8010.47 or later (Ch
Uninitialized memory handling in the Skia graphics library shipped with Google Chrome before 153.0.8010.47 lets a remote attacker leak cross-origin data when a victim opens a crafted HTML page. Exploitation is unauthenticated but requires the user to visit attacker-controlled content (UI:R), and impact is limited to partial confidentiality loss with no integrity or availability effect (CVSS 4.3). Google has released a stable-channel fix; no public exploit code and no CISA KEV listing were identified at time of analysis.
Cross-origin data disclosure in Google Chrome versions prior to 153.0.8010.47 occurs when an attacker who has already compromised the renderer process lures a victim to a crafted HTML page. The weakness lives in the GetUserMedia media-capture code path, where incomplete cleanup (CWE-459) leaves cross-origin data recoverable, as captured by the CVSS v3.1 vector AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N (score 3.1) - unauthenticated network reach but high attack complexity, mandatory user interaction, and confidentiality-only, low-magnitude impact. No public exploit code or confirmed active exploitation has been identified at time of analysis, and Google has shipped the fix in Chrome 153.0.8010.47.
Google Chrome for Android versions prior to 153.0.8010.47 contain an out-of-bounds read in the WebGL rendering path that allows a remote attacker to leak memory from outside the browser sandbox by luring a victim into opening a crafted HTML page. Google labels the Chromium security severity as Critical, while the published CVSS 3.1 base score is a comparatively modest 4.7 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N) because the flaw yields a limited confidentiality leak rather than code execution or data modification. A vendor patch is available, and no public exploit code or CISA KEV entry was identified at the time of analysis.
Information disclosure in Google Chrome desktop builds prior to 153.0.8010.47 allows a remote attacker to leak sensitive data by measuring observable CSS rendering discrepancies induced by a crafted HTML page. Exploitation is unauthenticated (PR:N) but requires the victim to open the attacker-controlled page (UI:R), and the leak depends on high-attack-complexity side-channel measurement rather than a deterministic parsing bug, so the impact is limited to confidentiality with no integrity or availability effect. The issue is rated Medium by Chromium; no public exploit code has been identified at time of analysis, and Google has released a fixed build.
An uninitialized-resource flaw (CWE-908) in ANGLE, the graphics translation layer used by Chrome to render WebGL and accelerated 2D content, is present in Google Chrome builds prior to 153.0.8010.47. A remote attacker who convinces a user to open a crafted HTML page can cause ANGLE to return memory contents that were never initialized, disclosing data that is outside Chrome's sandbox boundary — an information-disclosure primitive rather than a code-execution bug. Google rates the issue High severity (Chromium) and has published a fixed build; the NVD CVSS score is 4.7 and there is no CISA KEV entry or identified public exploit code at time of analysis.
Information disclosure in Google Chrome builds prior to 153.0.8010.47 allows a remote, unauthenticated attacker to leak sensitive data from the victim's browser by measuring font-related observable discrepancies on a crafted HTML page, a technique that requires the victim to be socially engineered into loading that page (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N, base 5.3). Impact is confidentiality-only, with no integrity or availability effect, and the high attack complexity reflects the probabilistic nature of the CWE-203 side channel, so reliable exfiltration demands specific conditions rather than a single deterministic request. No public exploit code was identified at time of analysis and the flaw is not listed in CISA KEV; Google has shipped a vendor-released patch in Chrome 153.0.8010.47, and auto-updating installations at or above that version are not affected.
Cross-origin data disclosure in Google Chrome prior to 153.0.8010.47: a race condition (TOCTOU) in the browser's Network component lets a remote attacker who has already achieved code execution inside the renderer process read data belonging to other origins by luring a victim to a crafted HTML page. The impact is limited to confidentiality of cross-origin responses (C:L, I:N, A:N), and exploitation is rated High complexity with required user interaction; no public exploit code or CISA KEV entry was present in the supplied intelligence, and the vendor has shipped a fix in 153.0.8010.47.
A maliciously constructed mail header could lead to multiple fields being parsed as one, or potential memory safety violations. This vulnerability was fixed in Thunderbird 156 and Thunderbird 140.16.
A low-privileged, authenticated attacker with HTTP network access can read all data accessible through the Oracle Application Object Library (Core) component of Oracle E-Business Suite versions 12.2.3 through 12.2.15, resulting in a full confidentiality compromise of that component with no integrity or availability impact. Oracle rates it CVSS 3.1 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) and describes it as easily exploitable, meaning an existing low-privilege EBS account is enough to reach sensitive data beyond the account's intended scope. No public exploit code or active exploitation is indicated in the available intelligence, and the patch is delivered through Oracle's Critical Security Patch Update for E-Business Suite.
Arbitrary image-file read in Newell Brands DYMO Connect Desktop allows a crafted file-path parameter sent to the local LoadImageAsPngBase64 web-service endpoint to pull image files from anywhere on the host filesystem rather than from the intended directory. Versions before 1.6.2 are affected; the shipped fix only whitelists file extensions and does not enforce a directory boundary, so out-of-scope reads of files with allowed image extensions remain possible by accepted design. No public exploit code has been identified at time of analysis, and impact is limited to confidentiality (CVSS 4.0 base 5.1, Medium, AV:L/PR:N/UI:N/VC:L).
Unauthenticated memory disclosure in HPE Networking EdgeConnect SD-WAN Gateways lets an attacker on an adjacent network segment read portions of system memory, exposing internal service details and workflow information. All shipping 9.4.x, 9.5.x, 9.6.x and 9.7.0.0 branches are affected per the vendor-published version ranges. The CVSS score is only 4.3 (confidentiality-only, adjacent vector) and there is no public exploit code or CISA KEV listing, so this is best treated as a reconnaissance enabler rather than a standalone compromise — its value to an adversary is in chaining it with a separate privilege-escalation or authentication flaw.
Unauthenticated remote attackers can query an API endpoint in HPE Networking EdgeConnect SD-WAN Orchestrator and read security-relevant configuration details and security feature status. The flaw is a CWE-200 information exposure rated CVSS 5.3 (AV:N/AC:L/PR:N/UI:N, with only a low confidentiality impact and no integrity or availability impact), so it does not by itself compromise the platform but hands an adversary reconnaissance material that directly enables follow-on attacks against the managed SD-WAN fabric. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Denial of service in HPE Networking EdgeConnect SD-WAN Gateways lets an authenticated local attacker with low privileges destabilize the appliance operating system and disrupt traffic forwarding. Affected builds span the 9.4.x, 9.5.x, 9.6.x and 9.7.x branches — up to 9.4.8.2, 9.5.8.1, 9.6.3.1 and 9.7.0.0 respectively — and the trigger is both local-only and high-complexity, which keeps the CVSS score at 5.8 despite the High availability impact. No public exploit code or CISA KEV entry was identified at time of analysis, so the practical priority is patch hygiene on devices where local or delegated accounts exist.
The API endpoint exposed by HPE Networking EdgeConnect SD-WAN Gateways can be queried by an unauthenticated remote attacker in a way that returns sensitive information, with successful exploitation yielding data that could be reused to reach other network services. Affected firmware spans the 9.4.x, 9.5.x, 9.6.x and 9.7.0.0 branches, and exploitation is rated high complexity (AC:H) even though no authentication is required. There is no public exploit code identified at time of analysis and the issue is not listed in CISA KEV, so this is currently a targeted-risk disclosure bug rather than a mass-exploitation event.
Unauthenticated remote denial-of-service in HPE Networking EdgeConnect SD-WAN Gateways lets an attacker who can reach the appliance's exposed services interrupt normal operation and take the gateway's services offline, disrupting WAN connectivity for dependent sites. Affected branches are 9.4.0.0–9.4.8.2, 9.5.0.0–9.5.8.1, 9.6.0.0–9.6.3.1 and 9.7.0.0, reported by HPE's own security-alert address. CVSS is 5.9 with a high attack-complexity qualifier and availability-only impact, and no public exploit code or confirmed active exploitation was identified at time of analysis.
EdgeConnect SD-WAN Gateways expose sensitive information to any user who can authenticate to the web-based management interface with low privileges, letting them read data that can be reused to reach other network services managed by the gateway. All four supported branches listed by ENISA (9.4.0.0-9.4.8.2, 9.5.0.0-9.5.8.1, 9.6.0.0-9.6.3.1, and 9.7.0.0) are affected, per HPE's advisory hpesbnw05135en_us. The flaw is rated 6.5 (network vector, low privileges, no user interaction, confidentiality-only impact); no public exploit code and no CISA KEV listing were identified at time of analysis, so exploitation currently depends on an attacker already holding valid low-privilege credentials and reachability to the management interface.
DigestAuth replay protection in http4s mishandles the nonce-count it stores, so the server's counter can lag behind the highest value it has actually accepted; a passive network observer who captures one legitimate Digest Authorization header can therefore replay it repeatedly before the counter catches up. Successful replays are executed as the captured user and include state-changing requests, defeating the replay resistance that Digest authentication is supposed to provide over Basic auth. Only applications that explicitly mount the DigestAuth middleware are affected, versions 0.23.x before 0.23.35 and 1.0.0 milestones M1 through M46 are impacted, and the flaw is fixed in 0.23.35 and 1.0.0-M47. No public exploit code or active exploitation has been identified at time of analysis.
Improper certificate validation in the shared HTTP client used by Devolutions Server 2026.2.16 and earlier synchronization and integration features allows a network-positioned attacker to intercept and tamper with outbound TLS connections by presenting a spoofed or self-signed certificate. The flaw is unauthenticated (PR:N) with no user interaction required, but exploitation demands both the sync/integration feature to be configured and actively making outbound connections, and the attacker to already hold a man-in-the-middle position on that network path, which is why the assessed vector carries AC:H and the impact is limited to partial confidentiality and integrity loss (C:L/I:L) on outbound integration traffic only. No public exploit code has been identified at time of analysis, there is no CISA KEV entry, and the EPSS score is 0.09% (1st percentile), so this is a genuine but low-to-medium priority issue that should be remediated through normal patch cycles rather than emergency response.
Order access tokens in the J2Store/J2Commerce extension for Joomla (versions 1.0.0-3.3.2, 4.0.0-4.0.22, and 4.1.0-4.1.7) are derived predictably, so anyone who already knows the site's Joomla `secret` value can compute a valid token for any order on the store. This grants guest-level access to that order's details and any purchased digital downloads without the attacker ever placing an order. The token is never rotated, so the exposure survives even after the original secret-disclosure bug is patched unless the Joomla `secret` itself is changed. No public exploit tooling is identified at time of analysis, and the issue is not listed as confirmed actively exploited (CISA KEV); exploitation is non-trivial because it presumes a prior foothold or disclosure of the site secret (CVSS 4.0 AC:H).
The CookieJar client middleware in http4s before 0.23.35 and 1.0.0-M47 stores a response cookie's Domain attribute without verifying that it domain-matches the host that set it, so any malicious or compromised server reached through the same cookie jar can plant a cookie addressed to an unrelated victim domain. When the client later talks to that victim domain, the jar replays the attacker-controlled cookie, enabling session fixation or overwriting of security-sensitive cookies; the flaw has CVSS 6.8 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N) with no public exploit code identified at time of analysis, and fixes land in 0.23.35 and 1.0.0-M47.
The FollowRedirect client middleware in http4s strips Authorization and Cookie headers only when a redirect crosses to a different authority, ignoring URI scheme changes; a same-host redirect from HTTPS to HTTP therefore re-sends credentials in cleartext over the network. Applications using http4s client versions prior to 0.23.35 or 1.0.0-M47 and following attacker-influenced redirects can leak bearer tokens, basic-auth credentials, and session cookies to anyone able to observe the plaintext connection. The flaw is fixed in 0.23.35 and 1.0.0-M47; no public exploit code or CISA KEV entry was identified at time of analysis, and exploitation requires the attacker to influence a redirect target and sit on the network path.
Authenticated users with editor-level or higher privileges in Concrete CMS 9.x before 9.5.3 can degrade site availability by submitting keyword searches packed with SQL LIKE wildcard characters, which the application failed to escape before placing them into the LIKE clause. Because a single-character wildcard matches any row, a short request forces the database into full-table scans, and repeated or wildcard-dense searches can sustain elevated database CPU and I/O on large installations, slowing the site for all users. The Concrete CMS security team rated this CVSS v4.0 2.1 (availability-only, attack requirements present, high privileges); no public exploit code has been identified at time of analysis.
Http4s client applications that keep a cookie jar can leak stored cookies — including session and authentication cookies — to attacker-controlled hosts because versions prior to 0.23.35 and 1.0.0-M47 decide cookie applicability with unanchored substring checks instead of RFC 6265 domain and path matching. A cookie scoped to example.com is therefore also attached to requests for evilexample.com, api.example.com.attacker.net, or an unrelated path, so any attacker who can influence the outbound URL the application requests receives the cookie and can hijack that outbound session. The flaw is fixed in 0.23.35 and 1.0.0-M47; no public exploit code and no CISA KEV entry were identified at time of analysis.
Affected versions of Arista EOS can write plaintext TACACS+ shared secrets into a location an operator can read, exposing the secret that protects authentication traffic between the switch and its AAA servers. Exploitation is not remote: it requires a highly privileged local session (CVSS PR:H), a non-default/specific set of circumstances (AC:H), and a user action (UI:R), which is why the score sits at 6.3 despite high confidentiality, integrity, and availability metrics. There is no public exploit code identified and the issue is not listed in CISA KEV, so this is a hardening/credential-hygiene issue rather than an actively attacked one; note that a leaked TACACS+ secret is high-value for lateral movement across network infrastructure.
Cleartext user passwords can be written into Arista EOS log files when specialized, non-standard debugging trace levels are explicitly enabled on the device. Only operators who already hold authenticated local administrative shell access and who have turned on these unusual trace levels are exposed, and a user must actually authenticate while tracing is active for credentials to be recorded. Arista discovered the flaw internally, states it is not aware of any malicious exploitation, and no public exploit code or CISA KEV entry has been identified; vendor advisory SA-0153 documents the fix
Arista EOS switches can write plaintext private keys into log files when specialized, non-standard debugging trace levels are explicitly enabled on the device. Exploitation requires an attacker to already hold authenticated local administrative access to the device shell and to have those special debug trace levels turned on, so the practical exposure is primarily insider or post-compromise rather than remote. Arista discovered the flaw internally (SA-0153), states it is unaware of malicious exploitation in customer networks, and the issue is not listed in CISA KEV and no public exploit code has been identified.
An out-of-bounds read in the Pixel-specific physmem_extmem driver (physmem_extmem_linux.c) of the Android kernel lets a local process with low privileges read kernel memory that was never initialized, exposing potentially sensitive data. No user interaction or elevated execution privileges are required, and the impact is limited to confidentiality (CVSS 5.5, AV:L/PR:L/C:H). The issue is addressed in the September 2026 Android/Pixel security bulletin; no public exploit code or CISA KEV listing was identified at the time of analysis.
Uninitialized memory use in multiple locations of the Android kernel allows a locally-positioned attacker who already holds System-level execution privileges to read stale kernel memory contents, resulting in information disclosure. The flaw is rated CVSS 4.4 (AV:L/PR:H) and affects Android builds covered by the September 2026 Pixel/Android Security Bulletin; user interaction is not required. No public exploit code and no CISA KEV listing were identified at time of analysis, and the exploitation prerequisite of pre-existing System privileges keeps the practical risk confined to post-compromise or privileged-local scenarios.
A logic error in the Android kernel's ACFW FF-A (Firmware Framework for Arm A-profile) driver, implemented in acfw_ffa.c, allows a caller already holding System-level execution privileges to read memory that should remain secret, resulting in local information disclosure. Exploitation requires local access and high privileges, needs no user interaction, and affects Android devices carrying the affected kernel build per Google's Pixel security bulletin for September 2026. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS 3.1 base score of 4.4 reflects limited confidentiality impact confined to already-privileged local actors.
An out-of-bounds read in the Android kernel driver routine gf_algo_get_cached_dump_data (gf_algo.c) lets a locally positioned attacker with limited privileges read past the end of a buffer and leak kernel memory contents, with no user interaction required. Pixel builds that ship the vulnerable gf_ driver are affected, and the September 2026 Android/Pixel security bulletin provides the fix. Neither public exploit code nor a CISA KEV entry was present in the supplied intelligence, and no EPSS score was provided, so active exploitation is unconfirmed and the practical threat at time of analysis is a local, post-compromise or malicious-app information leak.
Improper input validation in the MBU class handler (validate_ns_buf in mbu_class.rs) of the Android kernel allows a component already running with System execution privileges to supply a malformed namespace buffer and read kernel memory beyond the intended bounds, disclosing sensitive data. Affected are Android devices built on the impacted kernel (CPE cpe:2.3:a:google:android) as addressed by the September 2026 Android/Pixel security bulletin. The CVSS 3.1 score of 4.4 is intentionally modest because exploitation demands local code execution at a high privilege level (PR:H) with no user interaction; no public exploit code has been identified and no EPSS score was supplied with this record.
An out-of-bounds read in ReadDataElement (common.c) within the Android platform allows a locally installed application to disclose sensitive memory contents without any additional execution privileges or user interaction. The flaw is a missing/incorrect bounds check on an attacker-influenced length or index value, rated CVSS 5.5 (AV:L/AC:L/PR:L/UI:N, C:H/I:N/A:N), so the practical impact is confidentiality loss rather than code execution. Affected builds are Android platform components referenced by the September 2026 Pixel/Android security bulletin; no public exploit code or CISA KEV listing was identified at time of analysis, and the EPSS signal is absent from the supplied data.
A permission bypass in Google Android stemming from a side-channel information disclosure (CWE-203) allows a local attacker holding only low-privileged code execution to escalate privileges without any user interaction. The flaw yields high confidentiality impact (CVSS 5.5, AV:L/AC:L/PR:L/UI:N) by leaking observable discrepancies that undermine permission enforcement, though the vendor vector records no integrity or availability impact. It is addressed in the September 2026 Android/Pixel security bulletin; no public exploit code or CISA KEV listing was identified in the supplied intelligence at time of analysis.
A logic error in the Android kernel's VPU (Video Processing Unit) driver can disclose kernel memory contents to code that is already running with System-level privileges. The flaw is local-only: CVSS gives AV:L with PR:H, so an attacker must first obtain elevated (System) execution on the device before triggering the information leak, and no user interaction is required once that precondition is met. There is no public exploit code and no CISA KEV listing at time of analysis, and the associated EPSS data was not supplied, so this should be treated as a post-compromise information-disclosure primitive rather than a remotely exploitable issue.
Local information disclosure in Google Android's CPM component allows a caller holding System-level execution privileges to read protected data by abusing a confused deputy (CWE-441) that performs an action on behalf of a less privileged requester without re-validating the caller's authority. Only locally positioned code already running with System privileges on an affected Android build can trigger the flaw, and no user interaction is required. There is no CISA KEV listing and no public exploit code identified at time of analysis, so the practical risk is limited to post-compromise or privileged-app scenarios rather than remote attack.
An out-of-bounds read in the AES-GCM-256 crypto implementation of the Android kernel (function do_sss_aes_gcm_256_op in crypto-aes.c) allows disclosure of memory contents to code that is already running at System privilege on an affected device. The flaw is a missing bounds check on an input length or index (CWE-120 class buffer handling error), rated 4.4 (Medium) with the vector CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, meaning exploitation is local and requires the attacker to already hold System (PR:H) execution privileges; no user interaction is needed once that position is held. There is no indication of confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, and because the entry point sits behind a high privilege boundary the practical risk is a post-compromise or chained privilege-escalation information leak rather than an independent remote threat.
Arista EOS devices with password-based authentication enabled can accumulate orphan authentication sessions when a specially crafted password string is submitted to the management login path. Repeatedly sending such passwords exhausts the device's authentication resources, so legitimate administrators are locked out of the switch. Arista discovered the flaw internally and states it has no evidence of malicious exploitation in customer networks; no public exploit code or CISA KEV listing was identified in the supplied intelligence. The vendor-rated CVSS 4.0 score is 6.9 with availability-only impact.
Ingress Security ACLs applied to Switched Virtual Interfaces (SVIs) in shared mode on dual-switchcard Arista EOS platforms can silently stop filtering after the secondary switchcard forwarding agent restarts or a secondary switchcard is inserted, causing packets that should be denied to be permitted (and vice versa). The flaw is rated CVSS 4.8 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N, CWE-1419 incorrect resource initialization) and only affects modular chassis configured with dual switch cards plus shared-mode SVI ingress ACLs. Arista discovered the issue internally and states it is not aware of any malicious exploitation in customer networks; no public exploit code or CISA KEV listing is associated with this CVE.
Information tampering in Dell Wyse Management Suite (WMS) releases prior to 2605.0.3.683 is possible because the console omits a required cryptographic step (CWE-325), allowing an attacker who already holds a high-privileged WMS account to defeat integrity protections on data or artifacts the suite handles. The flaw is remotely reachable but constrained by PR:H and AC:H, making it a post-compromise or privileged-insider vector rather than an unauthenticated remote takeover. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was supplied in the intelligence feed.
Improper authorization checks on GitLab CE/EE internal data emission endpoints let an authenticated user retrieve sensitive credentials and tokens that should only have been returned along the expected proxy path. All releases from 10.1.0 before 19.1.8, the 19.2 branch before 19.2.6, and the 19.3 branch before 19.3.2 are affected according to the vendor, and publicly available exploit code exists (HackerOne report 3907835). Impact is confidentiality-only (CVSS 5.3, C:L/I:N/A:N), with no CISA KEV listing and no EPSS score supplied in the source data.
An XPath injection flaw (CWE-643) in IBM Cloud Pak for Business Automation lets an authenticated user manipulate XPath queries and read data the query engine should never return, including sensitive application records and structural details of the underlying XML documents. All shipped 24.0.x, 25.0.0 and 26.0.0 streams are affected up to and including Interim Fix 001/005/008/009 respectively, and exploitation only requires a low-privileged, network-reachable session — no user interaction and no special complexity. IBM has published a vendor fix; there is no CISA KEV listing and no public exploit code identified at time of analysis, so this is currently a patch-on-schedule issue rather than an emergency.
A path-handling flaw in the containers/storage Go library lets a crafted tar archive containing a malicious whiteout entry (for example 'victim/.wh.') cause UnpackLayer, ApplyLayer, or ApplyUncompressedLayer to replace the extraction destination directory with an arbitrary file. Systems that unpack container image layers with this library — notably Red Hat Enterprise Linux 10, Red Hat Ansible Automation Platform 2, OpenShift Container Platform 4, Quay 3, OpenShift Virtualization, Dev Spaces, and Red Hat Hardened Images — are in scope. Exploitation requires the operator or process to unpack an attacker-supplied archive, and the integrity impact is confined to the local extraction target; no public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, consistent with the modest CVSS 3.1 base score of 4.4.
Vikunja releases before 2.6.0 return the raw TOTP shared secret from the GET /api/v1/user/settings/totp and /api/v1/user/settings/totp/qrcode endpoints without demanding re-authentication, so anyone holding a valid access token can clone the victim's second factor. Because the exposed seed lets an attacker generate valid codes indefinitely, a hijacked session token can be converted into durable account takeover that survives password changes but not TOTP secret rotation. The vendor has shipped a fix in 2.6.0; no public exploit code or CISA KEV entry was identified at time of analysis.
Missing authorization checks in Vikunja's v2 API allow anyone holding a read-only project link-share token to enumerate users through the project users endpoint and to confirm arbitrary usernames exist via the global search endpoint. All Vikunja deployments before 2.6.0 are affected; the flaw is a limited-confidentiality information disclosure (CVSS 4.3, PR:L because a share token is required) and is fixed in 2.6.0. No public exploit code or CISA KEV entry was present at time of analysis.
Vikunja versions before 2.6.0 omit team-level access validation when a team is attached to a project, letting any authenticated user enumerate teams they do not belong to through the project teams endpoint. An attacker with a low-privileged account can supply arbitrary team IDs and receive complete rosters - member names and administrative flags - for unauthorized teams. Impact is confidential-only (CVSS 4.3, CWE-200) and no public exploit code or KEV listing was provided with the source data.
Opening a crafted .rdp connection file in the FreeRDP xfreerdp X11 client (versions 3.11.0 through 3.30.0) can trigger out-of-bounds heap reads and writes because the client fails to validate MonitorIds array values in xf_detect_monitors. This local, user-interaction-gated flaw requires a victim to open the malicious file and does not affect the RDP server side; publicly available exploit code exists, but there is no confirmation of active exploitation (not in CISA KEV). The vendor has released a patch in FreeRDP 3.31.0, and the CVSS 6.9 rating reflects limited confidentiality and integrity impact with a high availability impact.
Incomplete comparison logic in OpenClaw ClawScan's built-in static scanner (internal/runner/static_scanner.go) through version 0.1.6 lets packaged Python bytecode slip past the deterministic text scan, so malicious skills or OpenClaw plugins can pass inspection undetected. The vendor fix in v0.1.7 (commit 9f6a6fbb9f1137345566d0ab44c73893dfe112fa, PR #41) explicitly adds flagging of packaged Python bytecode as opaque executable content. A publicly available exploit (GitHub issue #40) demonstrates the bypass, but the flaw is local-only, requires a low-privileged local user plus passive user interaction, and yields only a low integrity impact (CVSS 4.0 base 0.9).
ClawScan 0.1.6 and earlier misclassifies NUL-obfuscated or otherwise ambiguous files as opaque binary content, so its built-in static scanner skips them and malicious OpenClaw skill or plugin code passes inspection undetected. Exploitation requires local access and the victim to run or act on a ClawScan report, giving the attacker a way to smuggle hostile code past the only automated gate. Public exploit code exists (GitHub issue #42), and the defect is resolved in 0.1.7 via commit 04401337b3adb9343bd338b21e5e258bf49ca9c8; CVSS 4.0 base score is 2.4, reflecting the limited integrity-only, local impact.
Payara Server ships by default without any cap on failed authentication attempts, so its administrative console and application login endpoints can be hammered with unlimited password guesses. The issue is a classic missing-lockout / missing-rate-limit weakness (CWE-307) affecting Payara Server Enterprise 4.x, 5.x, 6.x and 7.x plus the Payara Server Community 7 line, with fixes published in releases 4.1.2.191.57, 5.89.0, 6.40.0, 7.2.0 and Community 7.2026.7. With a vendor CVSS of 6.3 (4.0 vector AV:A/AC:L/PR:N/UI:N, VC:L/SC:H), success depends on the operator enabling the bundled automatic attack protection; no public exploit code or CISA KEV listing was present in the supplied intelligence, and no EPSS score was provided.
Incorrect boundary conditions in the Networking component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3.
Incorrect boundary conditions in the Safe Browsing component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3.
Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3.
Information disclosure in the Networking component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3.
Spoofing issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3.
Site isolation issue in the Reader Mode component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3.
An information-disclosure weakness in the Graphics: ImageLib component of Mozilla Firefox allows remote attackers to expose sensitive data when a victim loads attacker-controlled image content; because the CVSS vector carries PR:N with UI:R, no authentication or privileges are needed but the victim must open the crafted content. Impact is limited to confidentiality loss (C:H with I:N/A:N), so it is a moderate-severity flaw rather than a code-execution or availability risk. Mozilla fixed it in Firefox 156, Firefox ESR 140.16, and Firefox ESR 153.3, and EPSS is low at 0.16% (5th percentile) with no public exploit identified at time of analysis and no CISA KEV listing.
Unauthenticated information disclosure in Evolution API through 2.3.7: an incorrect array comparison in the metricsIPWhitelist middleware always evaluates to false, so the IP allowlist check never enforces and any network attacker can reach the Prometheus /metrics endpoint. The exposed metrics leak server version, database client name, configured server URL and WhatsApp instance details, which is useful reconnaissance material for follow-on attacks against self-hosted WhatsApp gateways. Publicly available exploit code exists (VulnCheck-reported, with a linked GitHub write-up); the issue is not listed in CISA KEV and no EPSS score was provided in the input.
Failed authentication attempts against MISP 2.5.45 and earlier stop being written to the audit log whenever the Redis instance used for log throttling is unreachable, and they remain unwritten for the entire duration of the outage. The flaw is in AppController::_shouldLog(), which treats 'Redis returned false' as 'nothing to log' rather than degrading to verbose logging, so brute-force or credential-stuffing activity against the login endpoint silently disappears from the record. No public exploit code and no CISA KEV entry exist for this issue, and the vendor shipped a fix in MISP 2.5.46 via commit a39b25d2f.
GNOME Shell fails to validate the declared dimensions of icons returned by a remote search provider over D-Bus against the actual icon data buffer, producing an out-of-bounds read when an oversized size is supplied. A malicious or compromised search provider registered in a user's session can crash the shell — terminating the desktop session — and may leak fragments of adjacent shell memory. Rated CVSS 6.1 (AV:L/UI:R/C:L/A:H) by Red Hat; no public exploit code or CISA KEV entry was identified at time of analysis, so exploitation currently requires a locally present hostile search provider rather than remote access.
The mailto scheme parser added to fast-uri 4.1.3 (and still present in 4.1.4) compares query field names against the reserved names 'to', 'subject' and 'body' while they are still percent-encoded, then decodes them only when storing them as generic headers — so a percent-encoded spelling of a reserved field is invisible to that check but is written back out as the literal field name during serialization. Any application built on Fastify, ajv or similar Node.js stacks that parses a mailto URI, validates, logs or displays the recipient list, and then re-serializes it with fast-uri before sending can be tricked into delivering mail to an attacker-chosen address, with subject and body content smuggled across the same roundtrip. The flaw is rated 4.8 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N, CWE-172 Encoding Error) and is fixed in fast-uri 4.1.5.
Host allowlist and denylist bypass in fast-uri, the dependency-free RFC 3986 URI parser used by Fastify and ajv, affects releases before 2.4.7, 3.0.0 through 3.1.7, and 4.0.0 through 4.1.4. Because the library lowercases the host before percent-decoding it, an encoded uppercase octet such as %41 survives as a literal 'A', and in scheme-relative references like //host the canonicalization pass that would normally repair this never runs, so parse, normalize, and equal disagree about the same hostname. Any application that makes a case-sensitive host decision on fast-uri output — a host allowlist or denylist comparing the parsed host, or code relying on equal — can be steered past that check while the evading spelling still resolves to the gated host in DNS and HTTP. Exploitation status: no public exploit identified at time of analysis.
WSO2 Identity Server exposes a user-enumeration weakness in its SMS OTP login flow: the error messages returned when the OTP challenge is initiated differ depending on whether the supplied account exists, giving unauthenticated remote attackers a way to confirm valid usernames. The signal is strongest for accounts that have no mobile number registered, which produce a distinct response. No public exploit code or CISA KEV entry was identified at time of analysis, and the CVSS 3.1 score is only 3.7 — the practical value to an attacker is the harvested username list, which feeds later brute-force and social-engineering campaigns rather than yielding direct compromise.
The self-registration flow in WSO2 Identity Server and related WSO2 identity/API management products returns a distinct error when a submitted username already exists, letting unauthenticated users enumerate valid accounts. Any remote party who can reach the self-registration endpoint can harvest a list of confirmed usernames, which then feeds credential-stuffing, brute-force, and targeted phishing campaigns. Rated CVSS 5.3 (medium) with confidentiality-only impact; no public exploit code or active exploitation is identified in the supplied data at time of analysis.
MISP 2.5.45 and earlier can write corrupted access-log records for any HTTP request that ends in an unhandled exception, because CakePHP's CakeErrorController extends AppController and re-runs the application startup path, causing AccessLog::logRequest() to register a second deferred writer that overwrites the row written by the first pass. The overwritten fields include request duration, SQL query count, memory usage and potentially the query log, silently degrading the fidelity of MISP's own audit trail. Exploitation requires an authenticated session (CVSS 4.0 PR:L, VI:L only); no public exploit code or CISA KEV listing was identified at time of analysis, and an upstream fix commit (0dae5c072) is available.
WP Directory Kit, a WordPress directory/listing plugin, exposes the content of draft and unapproved listings to anyone who can reach its public AJAX actions. Versions through 1.5.7 omit status and ownership checks before returning listing content, so unauthenticated attackers can enumerate other users' unpublished submissions (CWE-200, information disclosure). Publicly available exploit code exists per the WPScan reference, though EPSS is only 0.14% (4th percentile) and there is no CISA KEV listing, so this is a moderate, opportunistic-targeting issue rather than a mass-exploitation event.
Missing authorization and visibility checks in a WP Directory Kit shortcode (WordPress plugin versions up to and including 1.5.7) allow any logged-in user with a role as low as Contributor to read non-public listing content — including password-protected entries and hidden fields — that belongs to other users. The flaw is an information-disclosure issue (CWE-200) publicly documented by WPScan with exploit detail available, though the EPSS score of 0.14% (4th percentile) and the absence of any CISA KEV entry indicate no confirmed active exploitation and low predicted mass-exploitation risk. Impact is confidentiality-only and limited in scope: no data modification, no denial of service, and no privilege escalation beyond the reading of restricted listing data.
ManabiPocket for Parents 1.2.3 and earlier — an Android companion app for a Japanese parental school-communication service published by NTT Docomo Business, Inc. — exposes at least one application component that is reachable by other apps on the same device. A malicious app the user has already installed can send a crafted Intent to that component and read sensitive data held by the parental app, making this a local information-disclosure issue rather than a remote compromise. Severity is low (CVSS 4.0 base 1.8) because exploitation requires local code execution, user interaction and additional attack requirements; no public exploit code and no CISA KEV entry were identified at time of analysis, and EPSS data was not supplied.
TLS private key exposure in hawtio-operator affects Red Hat Build of Apache Camel - Hawtio 4 deployments on OpenShift. When a custom Route TLS secret is configured and debug logging is set to level 1 or higher, the operator serializes the complete Route object - including the TLS private key in PEM format - to its standard output. Because operator logs are routinely aggregated into centralized logging platforms and are accessible to any principal holding pods/log access in the openshift-operators namespace, this creates a pathway for credential exfiltration without direct secret access. No public exploit code exists and this CVE is not in CISA KEV, but the low debug threshold (level 1) means the exposure is frequently triggered during normal troubleshooting workflows.
Confused deputy exploitation in hawtio-operator on OpenShift allows a namespace-scoped edit user to claim arbitrary externally-routable Route hostnames that would normally require elevated cluster permissions. The operator holds a cluster-wide `routes/custom-host:create` privilege and blindly propagates the tenant-controlled `spec.routeHostName` field from Hawtio custom resources into OpenShift Route specs without validating whether the requesting user is authorized to claim that hostname. The captured subdomain can then be combined with the cluster's auto-grant OAuthClient to hijack OAuth redirect flows and steal tokens from legitimate users (PR:L, UI:R, C:H, CVSS 6.3). No public exploit code has been identified at time of analysis.
Unauthenticated access to the `/blacklist` endpoint of Maltrail (versions up to 3.0.1) allows any remote caller to retrieve source IP addresses of events that matched the operator's BLACKLIST rules, exposing internal network hosts flagged by the threat detection system. The oversight - a missing session check on one endpoint while all sibling endpoints (`/events`, `/counts`, `/hunt`, `/meta`, `/geo`) correctly required authentication - was confirmed by the vendor and patched in version 3.1 the same day it was reported. A public proof-of-concept exploit is available, making exploitation trivially scriptable against exposed instances.
Unauthenticated information disclosure in the 3D FlipBook - PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery WordPress plugin (all versions ≤1.16.20) allows any remote attacker to retrieve the full metadata payload of password-protected flipbooks - including title, outline, props, and the serialized data blob containing the underlying PDF file's direct URL - bypassing WordPress post-password confidentiality entirely. The plugin's AJAX handler in inc/ajax-get.php processes the 'id' parameter without verifying that the requestor has authenticated against the post password, and a companion unauthenticated AJAX action (fb3d_send_posts) enables systematic enumeration of all flipbook post IDs with no prior knowledge of the target site's content structure. No public exploit code and no CISA KEV listing exist at time of analysis.
Unauthenticated information disclosure in D-Link DIR-882 routers (firmware up to 20260814) allows remote attackers to retrieve sensitive data by sending crafted requests to the /HNAP1/dllog.cgi CGI binary endpoint. The vulnerability resides in the main() function of the dllog.cgi component, which fails to properly restrict output before returning it to the caller. A public proof-of-concept exists, per the GitHub reference, which also links this endpoint to quick VPN settings disclosure - suggesting credentials or configuration material may be exposed. No public KEV listing and no vendor patch have been identified at time of analysis.
PHPGurukul Blood Donor Management System 1.0 stores credentials in cleartext on disk when crafted values are supplied to the password, email, currentpassword, dbcurrentpwd, or newpassword arguments handled by application/models/admin/Login_Model.php. Vulnerable code paths are reachable remotely per the CVSS 4.0 vector (AV:N/PR:N/UI:N), although exploitation complexity is rated high (AC:H) and only a low confidentiality impact is scored. Publicly available exploit code exists and is flagged with an Exploit maturity of P in the CVSS vector, so the flaw should be treated as exploitable even though the base score is only 2.9 and no CISA KEV entry is present.
In BharatMLStack up to and including v1.3.0, Trufflebox UI stores the JWT authentication token, full user object, and session ID in the browser's localStorage, which is fully accessible to any JavaScript running on the page.
Tenda Technology Co., Ltd NVR_4H CH3 v2.1 V27.5.58.6 was discovered to contain a hardcoded cryptographic key.
SmartAdmin API Java17 SpringBoot3 version 3.30.0 contains an improper authorization vulnerability in the /employee/queryAll endpoint. The endpoint does not enforce the required function-level permission or data-scope authorization, allowing an authenticated low-privileged employee to retrieve employee records belonging to other departments and users
Local file enumeration in Keyfactor SignServer before 7.6.0 allows an authenticated administrator to confirm the existence and readability of arbitrary files on the application server by pointing configurable path properties at them and observing distinguishable error responses. The three affected properties are ATTRIBUTESFILE in PKCS11CryptoToken, KEYSTOREPATH in KeyStoreCryptoToken, and TRUSTSTOREPATH in RenewalWorker. No file contents are disclosed, exploitation requires a high-privileged admin account (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N, base 2.3), and there is no public exploit identified at time of analysis; EPSS is 0.15% (5th percentile), consistent with a low-priority information-disclosure issue.
An issue was discovered in Keyfactor SignServer before 7.6.0. The attribute ATTRIBUTESFILE in PKCS11CryptoToken can be set to a readable file but not an accepted file (i.e., recognized with attributes). In this case, an error is thrown which - together with the error - also prints the content of the file to the application server log. This gives a user that has both SignServer admin access and access to read the output of the server log (i.e., if remote syslog shipping is configured), the possibility to read the content of files accessible by the local user JBoss.
Information disclosure in the FluentBoards WordPress plugin before version 2.0.15 lets any authenticated user - including a Subscriber with no board access whatsoever - retrieve the private board memberships of arbitrary users simply by referencing their user ID. The flaw is an authorization failure rather than a memory-safety or injection bug: the endpoint that returns a user's board list performs no ownership or capability check, so the requester's identity is never validated against the target user. Publicly available exploit code exists, but there is no CISA KEV listing and no evidence of active exploitation; EPSS is just 0.18% (8th percentile), and CVE severity is low (CVSS 4.3) because only membership associations leak, not board contents, credentials, or write access.
Unauthenticated visitors can read the body content of WordPress posts that authors marked as password protected when the Schema & Structured Data for WP & AMP plugin is installed at any version before 1.66. The plugin assembles its structured-data output without checking WordPress's post-password state, and it leaks the protected text through more than one public output route, so the only real precondition is that the site actually uses password-protected posts holding content worth hiding; sites that never set post passwords have nothing to expose. Publicly available exploit code exists (no CISA KEV entry), the vendor has released a fix in 1.66 per WPScan, and EPSS is low at 0.19% (9th percentile), making this a genuine but low-to-moderate severity information-disclosure issue rather than a high-urgency emergency.
Unauthenticated information disclosure in the Ni WooCommerce Sales Report WordPress plugin before version 4.2.0 allows remote attackers to dump WooCommerce order details and customer contact information, target a specific order by identifier, and search the store's entire order set by customer name or email address. Exploitation requires only that the plugin be installed and active on a WordPress site with WooCommerce data present - no credentials, roles, or user interaction are needed (CVSS:3.1/AV:N/AC:L/PR:N/UI:N) - and publicly available exploit code exists alongside a WPScan-published proof of concept. Impact is limited to confidentiality (C:L) with no write or code-execution capability, and EPSS places exploitation likelihood at roughly 0.22% (13th percentile), making this a moderate-priority exposure whose real risk scales with the sensitivity and volume of customer records the store holds.
Mass assignment (CWE-915) in the a2ui message-processing component lets an authenticated remote attacker inject arbitrary, dynamically-determined object attributes by submitting crafted messages to the message processor, producing limited confidentiality, integrity and availability effects. All a2ui versions up to and including 0.10.6 are affected according to the CPE range, and the upstream maintainers have not responded to the reported issue (#2297), so no patched release exists. No public exploit code and no CISA KEV entry were identified at time of analysis; the EPSS probability was not supplied with the input data.
Token generation in EspoCRM through 10.0.8 relies on PHP's non-cryptographic rand() function, producing roughly 31-bit identifiers for lead-capture opt-in links, event invitations, and campaign URLs. Remote unauthenticated attackers who can reach those public endpoints can guess or enumerate valid tokens, allowing them to confirm opt-ins, accept or decline event invitations on behalf of other contacts, and read event details. Publicly available exploit code exists (a vendor commit and a public write-up), but there is no evidence of confirmed active exploitation in the wild, and the CVSS 6.3 rating reflects high attack complexity and only low confidentiality/integrity impact.
MikroTik firmware 7.19.4 stores sensitive authentication credentials and network state in cleartext within non-volatile storage. An attacker with physical access to the device can extract this material from an SPI flash dump, without authenticating to the device and without knowledge of the administrative password.
DD-WRT firmware, as deployed on TP-Link TL-WR740N v1 through v4 hardware, stores sensitive authentication credentials in cleartext within non-volatile memory. The exposed material includes SSH private keys, dynamic DNS passwords, email notification credentials and administrative passwords. An attacker with physical access to the device can extract these credentials from an SPI flash dump, leading to device compromise, infiltration of the connected network and unauthorised access to dependent third-party services.
Arbitrary host file creation in Podman's `podman load` command lets anyone who can supply a crafted tar archive write files on the host with the privileges of the user running Podman. The flaw (CWE-277, insecure inherited permissions) affects Podman installations where image archives are loaded from untrusted sources, and is scored a moderate CVSS 5.5 because the write primitive is limited to the invoking user's permissions rather than root. No public exploit code and no CISA KEV listing were identified at time of analysis, though the Red Hat advisory and Bugzilla tracker confirm the issue is acknowledged upstream.
An out-of-bounds read in the ARP filter import handler (filter_arp_put_file.cgi) of Netcore NR255-V firmware 1.5.130703 lets an attacker who can reach the router's web management interface and supply a malformed, non-null-terminated string cause the string-handling API to read past the end of an allocated buffer, exposing adjacent process memory in the response. The flaw is rated CVSS 5.3 (CVSS:4.0/AV:N/AC:L/PR:L/UI:N/VC:L/VI:N/VA:L), indicating a network-reachable, low-privilege issue with limited confidentiality and availability impact only — there is no confirmed integrity impact, no CISA KEV listing, and no confirmed public exploit code; the only public material is a VulnCheck advisory plus a third-party GitHub technical reference whose exploit content is unverified.
An incorrect authorization flaw in the Netcore NR255-V router (firmware 1.5.130703) lets any authenticated user with a broad or low-privileged role pull live QoS/bandwidth telemetry from the mod_qos_bandwidth plan.json read routes, exposing network activity data they are not entitled to see. The bug is rooted in missing role checks within filter_conns_dump_cgi.c and IGD_CgiCall.c, so the endpoints return connection and bandwidth statistics regardless of the caller's privilege level. Impact is confidentiality-only and rated moderate (CVSS 4.0 base 5.3, AV:N/PR:L/UI:N/VC:L); no CISA KEV listing or confirmed public exploit code exists, though a public technical write-up of the QoS telemetry disclosure is referenced from the NVD entry.
Authenticated users who hold log-read permission on Devolutions PowerShell Universal 2026.2.5 and earlier can recover application tokens, data protection key material, and other stored credentials, because the slow query logging feature writes raw SQL parameter values into the system log on instances backed by Microsoft SQL Server. The issue is CWE-532 (insertion of sensitive information into a log file) and carries a CVSS v3.1 score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), meaning confidentiality is fully impacted while integrity and availability are untouched. There is no public exploit identified at time of analysis, no CISA KEV listing, and EPSS is low at 0.15% (roughly the 5th percentile), consistent with a genuine but moderate-priority disclosure whose prerequisites - an authenticated log-viewing account, an MSSQL backend, and slow query logging actively enabled - narrow the exposed population.
Let me construct the JSON. CVE-2026-91744: Chrome on Mac, race condition in PlatformIntegration, renderer compromise + social engineering, info disclosure, CVSS 5.3, CWE-367. Let me write fields carefully. Product name: "Google Chrome" — 1-3 words. Or "Google Chrome (macOS)". Keep "Google Chrome". Summary: must not start with "A vulnerability". Start with impact verb + product. Info disclosure in Google Chrome for macOS prior to 153.0.8010.47... Race condition in PlatformIntegration component. Requires attacker to already have compromised renderer process and use social engineering (UI:R). CVSS 5.3. No KEV, no POC identified. Technical context: PlatformIntegration is macOS-specific integration layer (native macOS APIs, app bindings, drag-and-drop, services, etc.). CWE-367 TOCTOU race condition — check and use of resource with different timing, enabling a race window where a resource's state changes between check and use, allowing access to data not intended for the renderer. Chrome's multi-process architecture & site isolation — renderer compromise is assumed by Chrome's threat model. The flaw crosses the sandbox boundary in the sense that the renderer-obtained access to macOS integration surfaces yields sensitive info. Risk assessment: CVSS 5.3 moderate, AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N. AC:H reflects the race condition timing win. UI:R because social engineering. PR:N per the vector — unauthenticated. Requires a compromised renderer, which raises the practical bar considerably: a separate renderer exploit is needed first. EPSS not provided — state missing. KEV not listed. No POC identified. Include "radom" once, naturally, in one sentence as illustrative hypothetical mid-sized operator. Affected products: Google Chrome on macOS prior to 153.0.8010.47. EUVD lists Chrome 153.0.8010.47 <153.0.8010.47 (odd formatting). References: chromereleases blog, chromium issue 520019273. CPE not provided — state that. Remediation: upgrade to 153.0.8010.47 or later (Ch
Uninitialized memory handling in the Skia graphics library shipped with Google Chrome before 153.0.8010.47 lets a remote attacker leak cross-origin data when a victim opens a crafted HTML page. Exploitation is unauthenticated but requires the user to visit attacker-controlled content (UI:R), and impact is limited to partial confidentiality loss with no integrity or availability effect (CVSS 4.3). Google has released a stable-channel fix; no public exploit code and no CISA KEV listing were identified at time of analysis.
Cross-origin data disclosure in Google Chrome versions prior to 153.0.8010.47 occurs when an attacker who has already compromised the renderer process lures a victim to a crafted HTML page. The weakness lives in the GetUserMedia media-capture code path, where incomplete cleanup (CWE-459) leaves cross-origin data recoverable, as captured by the CVSS v3.1 vector AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N (score 3.1) - unauthenticated network reach but high attack complexity, mandatory user interaction, and confidentiality-only, low-magnitude impact. No public exploit code or confirmed active exploitation has been identified at time of analysis, and Google has shipped the fix in Chrome 153.0.8010.47.
Google Chrome for Android versions prior to 153.0.8010.47 contain an out-of-bounds read in the WebGL rendering path that allows a remote attacker to leak memory from outside the browser sandbox by luring a victim into opening a crafted HTML page. Google labels the Chromium security severity as Critical, while the published CVSS 3.1 base score is a comparatively modest 4.7 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N) because the flaw yields a limited confidentiality leak rather than code execution or data modification. A vendor patch is available, and no public exploit code or CISA KEV entry was identified at the time of analysis.
Information disclosure in Google Chrome desktop builds prior to 153.0.8010.47 allows a remote attacker to leak sensitive data by measuring observable CSS rendering discrepancies induced by a crafted HTML page. Exploitation is unauthenticated (PR:N) but requires the victim to open the attacker-controlled page (UI:R), and the leak depends on high-attack-complexity side-channel measurement rather than a deterministic parsing bug, so the impact is limited to confidentiality with no integrity or availability effect. The issue is rated Medium by Chromium; no public exploit code has been identified at time of analysis, and Google has released a fixed build.
An uninitialized-resource flaw (CWE-908) in ANGLE, the graphics translation layer used by Chrome to render WebGL and accelerated 2D content, is present in Google Chrome builds prior to 153.0.8010.47. A remote attacker who convinces a user to open a crafted HTML page can cause ANGLE to return memory contents that were never initialized, disclosing data that is outside Chrome's sandbox boundary — an information-disclosure primitive rather than a code-execution bug. Google rates the issue High severity (Chromium) and has published a fixed build; the NVD CVSS score is 4.7 and there is no CISA KEV entry or identified public exploit code at time of analysis.
Information disclosure in Google Chrome builds prior to 153.0.8010.47 allows a remote, unauthenticated attacker to leak sensitive data from the victim's browser by measuring font-related observable discrepancies on a crafted HTML page, a technique that requires the victim to be socially engineered into loading that page (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N, base 5.3). Impact is confidentiality-only, with no integrity or availability effect, and the high attack complexity reflects the probabilistic nature of the CWE-203 side channel, so reliable exfiltration demands specific conditions rather than a single deterministic request. No public exploit code was identified at time of analysis and the flaw is not listed in CISA KEV; Google has shipped a vendor-released patch in Chrome 153.0.8010.47, and auto-updating installations at or above that version are not affected.
Cross-origin data disclosure in Google Chrome prior to 153.0.8010.47: a race condition (TOCTOU) in the browser's Network component lets a remote attacker who has already achieved code execution inside the renderer process read data belonging to other origins by luring a victim to a crafted HTML page. The impact is limited to confidentiality of cross-origin responses (C:L, I:N, A:N), and exploitation is rated High complexity with required user interaction; no public exploit code or CISA KEV entry was present in the supplied intelligence, and the vendor has shipped a fix in 153.0.8010.47.
A maliciously constructed mail header could lead to multiple fields being parsed as one, or potential memory safety violations. This vulnerability was fixed in Thunderbird 156 and Thunderbird 140.16.
A low-privileged, authenticated attacker with HTTP network access can read all data accessible through the Oracle Application Object Library (Core) component of Oracle E-Business Suite versions 12.2.3 through 12.2.15, resulting in a full confidentiality compromise of that component with no integrity or availability impact. Oracle rates it CVSS 3.1 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) and describes it as easily exploitable, meaning an existing low-privilege EBS account is enough to reach sensitive data beyond the account's intended scope. No public exploit code or active exploitation is indicated in the available intelligence, and the patch is delivered through Oracle's Critical Security Patch Update for E-Business Suite.
Arbitrary image-file read in Newell Brands DYMO Connect Desktop allows a crafted file-path parameter sent to the local LoadImageAsPngBase64 web-service endpoint to pull image files from anywhere on the host filesystem rather than from the intended directory. Versions before 1.6.2 are affected; the shipped fix only whitelists file extensions and does not enforce a directory boundary, so out-of-scope reads of files with allowed image extensions remain possible by accepted design. No public exploit code has been identified at time of analysis, and impact is limited to confidentiality (CVSS 4.0 base 5.1, Medium, AV:L/PR:N/UI:N/VC:L).
Unauthenticated memory disclosure in HPE Networking EdgeConnect SD-WAN Gateways lets an attacker on an adjacent network segment read portions of system memory, exposing internal service details and workflow information. All shipping 9.4.x, 9.5.x, 9.6.x and 9.7.0.0 branches are affected per the vendor-published version ranges. The CVSS score is only 4.3 (confidentiality-only, adjacent vector) and there is no public exploit code or CISA KEV listing, so this is best treated as a reconnaissance enabler rather than a standalone compromise — its value to an adversary is in chaining it with a separate privilege-escalation or authentication flaw.
Unauthenticated remote attackers can query an API endpoint in HPE Networking EdgeConnect SD-WAN Orchestrator and read security-relevant configuration details and security feature status. The flaw is a CWE-200 information exposure rated CVSS 5.3 (AV:N/AC:L/PR:N/UI:N, with only a low confidentiality impact and no integrity or availability impact), so it does not by itself compromise the platform but hands an adversary reconnaissance material that directly enables follow-on attacks against the managed SD-WAN fabric. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Denial of service in HPE Networking EdgeConnect SD-WAN Gateways lets an authenticated local attacker with low privileges destabilize the appliance operating system and disrupt traffic forwarding. Affected builds span the 9.4.x, 9.5.x, 9.6.x and 9.7.x branches — up to 9.4.8.2, 9.5.8.1, 9.6.3.1 and 9.7.0.0 respectively — and the trigger is both local-only and high-complexity, which keeps the CVSS score at 5.8 despite the High availability impact. No public exploit code or CISA KEV entry was identified at time of analysis, so the practical priority is patch hygiene on devices where local or delegated accounts exist.
The API endpoint exposed by HPE Networking EdgeConnect SD-WAN Gateways can be queried by an unauthenticated remote attacker in a way that returns sensitive information, with successful exploitation yielding data that could be reused to reach other network services. Affected firmware spans the 9.4.x, 9.5.x, 9.6.x and 9.7.0.0 branches, and exploitation is rated high complexity (AC:H) even though no authentication is required. There is no public exploit code identified at time of analysis and the issue is not listed in CISA KEV, so this is currently a targeted-risk disclosure bug rather than a mass-exploitation event.
Unauthenticated remote denial-of-service in HPE Networking EdgeConnect SD-WAN Gateways lets an attacker who can reach the appliance's exposed services interrupt normal operation and take the gateway's services offline, disrupting WAN connectivity for dependent sites. Affected branches are 9.4.0.0–9.4.8.2, 9.5.0.0–9.5.8.1, 9.6.0.0–9.6.3.1 and 9.7.0.0, reported by HPE's own security-alert address. CVSS is 5.9 with a high attack-complexity qualifier and availability-only impact, and no public exploit code or confirmed active exploitation was identified at time of analysis.
EdgeConnect SD-WAN Gateways expose sensitive information to any user who can authenticate to the web-based management interface with low privileges, letting them read data that can be reused to reach other network services managed by the gateway. All four supported branches listed by ENISA (9.4.0.0-9.4.8.2, 9.5.0.0-9.5.8.1, 9.6.0.0-9.6.3.1, and 9.7.0.0) are affected, per HPE's advisory hpesbnw05135en_us. The flaw is rated 6.5 (network vector, low privileges, no user interaction, confidentiality-only impact); no public exploit code and no CISA KEV listing were identified at time of analysis, so exploitation currently depends on an attacker already holding valid low-privilege credentials and reachability to the management interface.
DigestAuth replay protection in http4s mishandles the nonce-count it stores, so the server's counter can lag behind the highest value it has actually accepted; a passive network observer who captures one legitimate Digest Authorization header can therefore replay it repeatedly before the counter catches up. Successful replays are executed as the captured user and include state-changing requests, defeating the replay resistance that Digest authentication is supposed to provide over Basic auth. Only applications that explicitly mount the DigestAuth middleware are affected, versions 0.23.x before 0.23.35 and 1.0.0 milestones M1 through M46 are impacted, and the flaw is fixed in 0.23.35 and 1.0.0-M47. No public exploit code or active exploitation has been identified at time of analysis.
Improper certificate validation in the shared HTTP client used by Devolutions Server 2026.2.16 and earlier synchronization and integration features allows a network-positioned attacker to intercept and tamper with outbound TLS connections by presenting a spoofed or self-signed certificate. The flaw is unauthenticated (PR:N) with no user interaction required, but exploitation demands both the sync/integration feature to be configured and actively making outbound connections, and the attacker to already hold a man-in-the-middle position on that network path, which is why the assessed vector carries AC:H and the impact is limited to partial confidentiality and integrity loss (C:L/I:L) on outbound integration traffic only. No public exploit code has been identified at time of analysis, there is no CISA KEV entry, and the EPSS score is 0.09% (1st percentile), so this is a genuine but low-to-medium priority issue that should be remediated through normal patch cycles rather than emergency response.
Order access tokens in the J2Store/J2Commerce extension for Joomla (versions 1.0.0-3.3.2, 4.0.0-4.0.22, and 4.1.0-4.1.7) are derived predictably, so anyone who already knows the site's Joomla `secret` value can compute a valid token for any order on the store. This grants guest-level access to that order's details and any purchased digital downloads without the attacker ever placing an order. The token is never rotated, so the exposure survives even after the original secret-disclosure bug is patched unless the Joomla `secret` itself is changed. No public exploit tooling is identified at time of analysis, and the issue is not listed as confirmed actively exploited (CISA KEV); exploitation is non-trivial because it presumes a prior foothold or disclosure of the site secret (CVSS 4.0 AC:H).
The CookieJar client middleware in http4s before 0.23.35 and 1.0.0-M47 stores a response cookie's Domain attribute without verifying that it domain-matches the host that set it, so any malicious or compromised server reached through the same cookie jar can plant a cookie addressed to an unrelated victim domain. When the client later talks to that victim domain, the jar replays the attacker-controlled cookie, enabling session fixation or overwriting of security-sensitive cookies; the flaw has CVSS 6.8 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N) with no public exploit code identified at time of analysis, and fixes land in 0.23.35 and 1.0.0-M47.
The FollowRedirect client middleware in http4s strips Authorization and Cookie headers only when a redirect crosses to a different authority, ignoring URI scheme changes; a same-host redirect from HTTPS to HTTP therefore re-sends credentials in cleartext over the network. Applications using http4s client versions prior to 0.23.35 or 1.0.0-M47 and following attacker-influenced redirects can leak bearer tokens, basic-auth credentials, and session cookies to anyone able to observe the plaintext connection. The flaw is fixed in 0.23.35 and 1.0.0-M47; no public exploit code or CISA KEV entry was identified at time of analysis, and exploitation requires the attacker to influence a redirect target and sit on the network path.
Authenticated users with editor-level or higher privileges in Concrete CMS 9.x before 9.5.3 can degrade site availability by submitting keyword searches packed with SQL LIKE wildcard characters, which the application failed to escape before placing them into the LIKE clause. Because a single-character wildcard matches any row, a short request forces the database into full-table scans, and repeated or wildcard-dense searches can sustain elevated database CPU and I/O on large installations, slowing the site for all users. The Concrete CMS security team rated this CVSS v4.0 2.1 (availability-only, attack requirements present, high privileges); no public exploit code has been identified at time of analysis.
Http4s client applications that keep a cookie jar can leak stored cookies — including session and authentication cookies — to attacker-controlled hosts because versions prior to 0.23.35 and 1.0.0-M47 decide cookie applicability with unanchored substring checks instead of RFC 6265 domain and path matching. A cookie scoped to example.com is therefore also attached to requests for evilexample.com, api.example.com.attacker.net, or an unrelated path, so any attacker who can influence the outbound URL the application requests receives the cookie and can hijack that outbound session. The flaw is fixed in 0.23.35 and 1.0.0-M47; no public exploit code and no CISA KEV entry were identified at time of analysis.
Affected versions of Arista EOS can write plaintext TACACS+ shared secrets into a location an operator can read, exposing the secret that protects authentication traffic between the switch and its AAA servers. Exploitation is not remote: it requires a highly privileged local session (CVSS PR:H), a non-default/specific set of circumstances (AC:H), and a user action (UI:R), which is why the score sits at 6.3 despite high confidentiality, integrity, and availability metrics. There is no public exploit code identified and the issue is not listed in CISA KEV, so this is a hardening/credential-hygiene issue rather than an actively attacked one; note that a leaked TACACS+ secret is high-value for lateral movement across network infrastructure.
Cleartext user passwords can be written into Arista EOS log files when specialized, non-standard debugging trace levels are explicitly enabled on the device. Only operators who already hold authenticated local administrative shell access and who have turned on these unusual trace levels are exposed, and a user must actually authenticate while tracing is active for credentials to be recorded. Arista discovered the flaw internally, states it is not aware of any malicious exploitation, and no public exploit code or CISA KEV entry has been identified; vendor advisory SA-0153 documents the fix
Arista EOS switches can write plaintext private keys into log files when specialized, non-standard debugging trace levels are explicitly enabled on the device. Exploitation requires an attacker to already hold authenticated local administrative access to the device shell and to have those special debug trace levels turned on, so the practical exposure is primarily insider or post-compromise rather than remote. Arista discovered the flaw internally (SA-0153), states it is unaware of malicious exploitation in customer networks, and the issue is not listed in CISA KEV and no public exploit code has been identified.
An out-of-bounds read in the Pixel-specific physmem_extmem driver (physmem_extmem_linux.c) of the Android kernel lets a local process with low privileges read kernel memory that was never initialized, exposing potentially sensitive data. No user interaction or elevated execution privileges are required, and the impact is limited to confidentiality (CVSS 5.5, AV:L/PR:L/C:H). The issue is addressed in the September 2026 Android/Pixel security bulletin; no public exploit code or CISA KEV listing was identified at the time of analysis.
Uninitialized memory use in multiple locations of the Android kernel allows a locally-positioned attacker who already holds System-level execution privileges to read stale kernel memory contents, resulting in information disclosure. The flaw is rated CVSS 4.4 (AV:L/PR:H) and affects Android builds covered by the September 2026 Pixel/Android Security Bulletin; user interaction is not required. No public exploit code and no CISA KEV listing were identified at time of analysis, and the exploitation prerequisite of pre-existing System privileges keeps the practical risk confined to post-compromise or privileged-local scenarios.
A logic error in the Android kernel's ACFW FF-A (Firmware Framework for Arm A-profile) driver, implemented in acfw_ffa.c, allows a caller already holding System-level execution privileges to read memory that should remain secret, resulting in local information disclosure. Exploitation requires local access and high privileges, needs no user interaction, and affects Android devices carrying the affected kernel build per Google's Pixel security bulletin for September 2026. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS 3.1 base score of 4.4 reflects limited confidentiality impact confined to already-privileged local actors.
An out-of-bounds read in the Android kernel driver routine gf_algo_get_cached_dump_data (gf_algo.c) lets a locally positioned attacker with limited privileges read past the end of a buffer and leak kernel memory contents, with no user interaction required. Pixel builds that ship the vulnerable gf_ driver are affected, and the September 2026 Android/Pixel security bulletin provides the fix. Neither public exploit code nor a CISA KEV entry was present in the supplied intelligence, and no EPSS score was provided, so active exploitation is unconfirmed and the practical threat at time of analysis is a local, post-compromise or malicious-app information leak.
Improper input validation in the MBU class handler (validate_ns_buf in mbu_class.rs) of the Android kernel allows a component already running with System execution privileges to supply a malformed namespace buffer and read kernel memory beyond the intended bounds, disclosing sensitive data. Affected are Android devices built on the impacted kernel (CPE cpe:2.3:a:google:android) as addressed by the September 2026 Android/Pixel security bulletin. The CVSS 3.1 score of 4.4 is intentionally modest because exploitation demands local code execution at a high privilege level (PR:H) with no user interaction; no public exploit code has been identified and no EPSS score was supplied with this record.
An out-of-bounds read in ReadDataElement (common.c) within the Android platform allows a locally installed application to disclose sensitive memory contents without any additional execution privileges or user interaction. The flaw is a missing/incorrect bounds check on an attacker-influenced length or index value, rated CVSS 5.5 (AV:L/AC:L/PR:L/UI:N, C:H/I:N/A:N), so the practical impact is confidentiality loss rather than code execution. Affected builds are Android platform components referenced by the September 2026 Pixel/Android security bulletin; no public exploit code or CISA KEV listing was identified at time of analysis, and the EPSS signal is absent from the supplied data.
A permission bypass in Google Android stemming from a side-channel information disclosure (CWE-203) allows a local attacker holding only low-privileged code execution to escalate privileges without any user interaction. The flaw yields high confidentiality impact (CVSS 5.5, AV:L/AC:L/PR:L/UI:N) by leaking observable discrepancies that undermine permission enforcement, though the vendor vector records no integrity or availability impact. It is addressed in the September 2026 Android/Pixel security bulletin; no public exploit code or CISA KEV listing was identified in the supplied intelligence at time of analysis.
A logic error in the Android kernel's VPU (Video Processing Unit) driver can disclose kernel memory contents to code that is already running with System-level privileges. The flaw is local-only: CVSS gives AV:L with PR:H, so an attacker must first obtain elevated (System) execution on the device before triggering the information leak, and no user interaction is required once that precondition is met. There is no public exploit code and no CISA KEV listing at time of analysis, and the associated EPSS data was not supplied, so this should be treated as a post-compromise information-disclosure primitive rather than a remotely exploitable issue.
Local information disclosure in Google Android's CPM component allows a caller holding System-level execution privileges to read protected data by abusing a confused deputy (CWE-441) that performs an action on behalf of a less privileged requester without re-validating the caller's authority. Only locally positioned code already running with System privileges on an affected Android build can trigger the flaw, and no user interaction is required. There is no CISA KEV listing and no public exploit code identified at time of analysis, so the practical risk is limited to post-compromise or privileged-app scenarios rather than remote attack.
An out-of-bounds read in the AES-GCM-256 crypto implementation of the Android kernel (function do_sss_aes_gcm_256_op in crypto-aes.c) allows disclosure of memory contents to code that is already running at System privilege on an affected device. The flaw is a missing bounds check on an input length or index (CWE-120 class buffer handling error), rated 4.4 (Medium) with the vector CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, meaning exploitation is local and requires the attacker to already hold System (PR:H) execution privileges; no user interaction is needed once that position is held. There is no indication of confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, and because the entry point sits behind a high privilege boundary the practical risk is a post-compromise or chained privilege-escalation information leak rather than an independent remote threat.
Arista EOS devices with password-based authentication enabled can accumulate orphan authentication sessions when a specially crafted password string is submitted to the management login path. Repeatedly sending such passwords exhausts the device's authentication resources, so legitimate administrators are locked out of the switch. Arista discovered the flaw internally and states it has no evidence of malicious exploitation in customer networks; no public exploit code or CISA KEV listing was identified in the supplied intelligence. The vendor-rated CVSS 4.0 score is 6.9 with availability-only impact.
Ingress Security ACLs applied to Switched Virtual Interfaces (SVIs) in shared mode on dual-switchcard Arista EOS platforms can silently stop filtering after the secondary switchcard forwarding agent restarts or a secondary switchcard is inserted, causing packets that should be denied to be permitted (and vice versa). The flaw is rated CVSS 4.8 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N, CWE-1419 incorrect resource initialization) and only affects modular chassis configured with dual switch cards plus shared-mode SVI ingress ACLs. Arista discovered the issue internally and states it is not aware of any malicious exploitation in customer networks; no public exploit code or CISA KEV listing is associated with this CVE.
Information tampering in Dell Wyse Management Suite (WMS) releases prior to 2605.0.3.683 is possible because the console omits a required cryptographic step (CWE-325), allowing an attacker who already holds a high-privileged WMS account to defeat integrity protections on data or artifacts the suite handles. The flaw is remotely reachable but constrained by PR:H and AC:H, making it a post-compromise or privileged-insider vector rather than an unauthenticated remote takeover. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was supplied in the intelligence feed.
Improper authorization checks on GitLab CE/EE internal data emission endpoints let an authenticated user retrieve sensitive credentials and tokens that should only have been returned along the expected proxy path. All releases from 10.1.0 before 19.1.8, the 19.2 branch before 19.2.6, and the 19.3 branch before 19.3.2 are affected according to the vendor, and publicly available exploit code exists (HackerOne report 3907835). Impact is confidentiality-only (CVSS 5.3, C:L/I:N/A:N), with no CISA KEV listing and no EPSS score supplied in the source data.
An XPath injection flaw (CWE-643) in IBM Cloud Pak for Business Automation lets an authenticated user manipulate XPath queries and read data the query engine should never return, including sensitive application records and structural details of the underlying XML documents. All shipped 24.0.x, 25.0.0 and 26.0.0 streams are affected up to and including Interim Fix 001/005/008/009 respectively, and exploitation only requires a low-privileged, network-reachable session — no user interaction and no special complexity. IBM has published a vendor fix; there is no CISA KEV listing and no public exploit code identified at time of analysis, so this is currently a patch-on-schedule issue rather than an emergency.
A path-handling flaw in the containers/storage Go library lets a crafted tar archive containing a malicious whiteout entry (for example 'victim/.wh.') cause UnpackLayer, ApplyLayer, or ApplyUncompressedLayer to replace the extraction destination directory with an arbitrary file. Systems that unpack container image layers with this library — notably Red Hat Enterprise Linux 10, Red Hat Ansible Automation Platform 2, OpenShift Container Platform 4, Quay 3, OpenShift Virtualization, Dev Spaces, and Red Hat Hardened Images — are in scope. Exploitation requires the operator or process to unpack an attacker-supplied archive, and the integrity impact is confined to the local extraction target; no public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, consistent with the modest CVSS 3.1 base score of 4.4.
Vikunja releases before 2.6.0 return the raw TOTP shared secret from the GET /api/v1/user/settings/totp and /api/v1/user/settings/totp/qrcode endpoints without demanding re-authentication, so anyone holding a valid access token can clone the victim's second factor. Because the exposed seed lets an attacker generate valid codes indefinitely, a hijacked session token can be converted into durable account takeover that survives password changes but not TOTP secret rotation. The vendor has shipped a fix in 2.6.0; no public exploit code or CISA KEV entry was identified at time of analysis.
Missing authorization checks in Vikunja's v2 API allow anyone holding a read-only project link-share token to enumerate users through the project users endpoint and to confirm arbitrary usernames exist via the global search endpoint. All Vikunja deployments before 2.6.0 are affected; the flaw is a limited-confidentiality information disclosure (CVSS 4.3, PR:L because a share token is required) and is fixed in 2.6.0. No public exploit code or CISA KEV entry was present at time of analysis.
Vikunja versions before 2.6.0 omit team-level access validation when a team is attached to a project, letting any authenticated user enumerate teams they do not belong to through the project teams endpoint. An attacker with a low-privileged account can supply arbitrary team IDs and receive complete rosters - member names and administrative flags - for unauthorized teams. Impact is confidential-only (CVSS 4.3, CWE-200) and no public exploit code or KEV listing was provided with the source data.
Opening a crafted .rdp connection file in the FreeRDP xfreerdp X11 client (versions 3.11.0 through 3.30.0) can trigger out-of-bounds heap reads and writes because the client fails to validate MonitorIds array values in xf_detect_monitors. This local, user-interaction-gated flaw requires a victim to open the malicious file and does not affect the RDP server side; publicly available exploit code exists, but there is no confirmation of active exploitation (not in CISA KEV). The vendor has released a patch in FreeRDP 3.31.0, and the CVSS 6.9 rating reflects limited confidentiality and integrity impact with a high availability impact.
Incomplete comparison logic in OpenClaw ClawScan's built-in static scanner (internal/runner/static_scanner.go) through version 0.1.6 lets packaged Python bytecode slip past the deterministic text scan, so malicious skills or OpenClaw plugins can pass inspection undetected. The vendor fix in v0.1.7 (commit 9f6a6fbb9f1137345566d0ab44c73893dfe112fa, PR #41) explicitly adds flagging of packaged Python bytecode as opaque executable content. A publicly available exploit (GitHub issue #40) demonstrates the bypass, but the flaw is local-only, requires a low-privileged local user plus passive user interaction, and yields only a low integrity impact (CVSS 4.0 base 0.9).
ClawScan 0.1.6 and earlier misclassifies NUL-obfuscated or otherwise ambiguous files as opaque binary content, so its built-in static scanner skips them and malicious OpenClaw skill or plugin code passes inspection undetected. Exploitation requires local access and the victim to run or act on a ClawScan report, giving the attacker a way to smuggle hostile code past the only automated gate. Public exploit code exists (GitHub issue #42), and the defect is resolved in 0.1.7 via commit 04401337b3adb9343bd338b21e5e258bf49ca9c8; CVSS 4.0 base score is 2.4, reflecting the limited integrity-only, local impact.
Payara Server ships by default without any cap on failed authentication attempts, so its administrative console and application login endpoints can be hammered with unlimited password guesses. The issue is a classic missing-lockout / missing-rate-limit weakness (CWE-307) affecting Payara Server Enterprise 4.x, 5.x, 6.x and 7.x plus the Payara Server Community 7 line, with fixes published in releases 4.1.2.191.57, 5.89.0, 6.40.0, 7.2.0 and Community 7.2026.7. With a vendor CVSS of 6.3 (4.0 vector AV:A/AC:L/PR:N/UI:N, VC:L/SC:H), success depends on the operator enabling the bundled automatic attack protection; no public exploit code or CISA KEV listing was present in the supplied intelligence, and no EPSS score was provided.
Incorrect boundary conditions in the Networking component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3.
Incorrect boundary conditions in the Safe Browsing component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3.
Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3.
Information disclosure in the Networking component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3.
Spoofing issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3.
Site isolation issue in the Reader Mode component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3.
An information-disclosure weakness in the Graphics: ImageLib component of Mozilla Firefox allows remote attackers to expose sensitive data when a victim loads attacker-controlled image content; because the CVSS vector carries PR:N with UI:R, no authentication or privileges are needed but the victim must open the crafted content. Impact is limited to confidentiality loss (C:H with I:N/A:N), so it is a moderate-severity flaw rather than a code-execution or availability risk. Mozilla fixed it in Firefox 156, Firefox ESR 140.16, and Firefox ESR 153.3, and EPSS is low at 0.16% (5th percentile) with no public exploit identified at time of analysis and no CISA KEV listing.
Unauthenticated information disclosure in Evolution API through 2.3.7: an incorrect array comparison in the metricsIPWhitelist middleware always evaluates to false, so the IP allowlist check never enforces and any network attacker can reach the Prometheus /metrics endpoint. The exposed metrics leak server version, database client name, configured server URL and WhatsApp instance details, which is useful reconnaissance material for follow-on attacks against self-hosted WhatsApp gateways. Publicly available exploit code exists (VulnCheck-reported, with a linked GitHub write-up); the issue is not listed in CISA KEV and no EPSS score was provided in the input.
Failed authentication attempts against MISP 2.5.45 and earlier stop being written to the audit log whenever the Redis instance used for log throttling is unreachable, and they remain unwritten for the entire duration of the outage. The flaw is in AppController::_shouldLog(), which treats 'Redis returned false' as 'nothing to log' rather than degrading to verbose logging, so brute-force or credential-stuffing activity against the login endpoint silently disappears from the record. No public exploit code and no CISA KEV entry exist for this issue, and the vendor shipped a fix in MISP 2.5.46 via commit a39b25d2f.
GNOME Shell fails to validate the declared dimensions of icons returned by a remote search provider over D-Bus against the actual icon data buffer, producing an out-of-bounds read when an oversized size is supplied. A malicious or compromised search provider registered in a user's session can crash the shell — terminating the desktop session — and may leak fragments of adjacent shell memory. Rated CVSS 6.1 (AV:L/UI:R/C:L/A:H) by Red Hat; no public exploit code or CISA KEV entry was identified at time of analysis, so exploitation currently requires a locally present hostile search provider rather than remote access.
The mailto scheme parser added to fast-uri 4.1.3 (and still present in 4.1.4) compares query field names against the reserved names 'to', 'subject' and 'body' while they are still percent-encoded, then decodes them only when storing them as generic headers — so a percent-encoded spelling of a reserved field is invisible to that check but is written back out as the literal field name during serialization. Any application built on Fastify, ajv or similar Node.js stacks that parses a mailto URI, validates, logs or displays the recipient list, and then re-serializes it with fast-uri before sending can be tricked into delivering mail to an attacker-chosen address, with subject and body content smuggled across the same roundtrip. The flaw is rated 4.8 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N, CWE-172 Encoding Error) and is fixed in fast-uri 4.1.5.
Host allowlist and denylist bypass in fast-uri, the dependency-free RFC 3986 URI parser used by Fastify and ajv, affects releases before 2.4.7, 3.0.0 through 3.1.7, and 4.0.0 through 4.1.4. Because the library lowercases the host before percent-decoding it, an encoded uppercase octet such as %41 survives as a literal 'A', and in scheme-relative references like //host the canonicalization pass that would normally repair this never runs, so parse, normalize, and equal disagree about the same hostname. Any application that makes a case-sensitive host decision on fast-uri output — a host allowlist or denylist comparing the parsed host, or code relying on equal — can be steered past that check while the evading spelling still resolves to the gated host in DNS and HTTP. Exploitation status: no public exploit identified at time of analysis.
WSO2 Identity Server exposes a user-enumeration weakness in its SMS OTP login flow: the error messages returned when the OTP challenge is initiated differ depending on whether the supplied account exists, giving unauthenticated remote attackers a way to confirm valid usernames. The signal is strongest for accounts that have no mobile number registered, which produce a distinct response. No public exploit code or CISA KEV entry was identified at time of analysis, and the CVSS 3.1 score is only 3.7 — the practical value to an attacker is the harvested username list, which feeds later brute-force and social-engineering campaigns rather than yielding direct compromise.
The self-registration flow in WSO2 Identity Server and related WSO2 identity/API management products returns a distinct error when a submitted username already exists, letting unauthenticated users enumerate valid accounts. Any remote party who can reach the self-registration endpoint can harvest a list of confirmed usernames, which then feeds credential-stuffing, brute-force, and targeted phishing campaigns. Rated CVSS 5.3 (medium) with confidentiality-only impact; no public exploit code or active exploitation is identified in the supplied data at time of analysis.
MISP 2.5.45 and earlier can write corrupted access-log records for any HTTP request that ends in an unhandled exception, because CakePHP's CakeErrorController extends AppController and re-runs the application startup path, causing AccessLog::logRequest() to register a second deferred writer that overwrites the row written by the first pass. The overwritten fields include request duration, SQL query count, memory usage and potentially the query log, silently degrading the fidelity of MISP's own audit trail. Exploitation requires an authenticated session (CVSS 4.0 PR:L, VI:L only); no public exploit code or CISA KEV listing was identified at time of analysis, and an upstream fix commit (0dae5c072) is available.
WP Directory Kit, a WordPress directory/listing plugin, exposes the content of draft and unapproved listings to anyone who can reach its public AJAX actions. Versions through 1.5.7 omit status and ownership checks before returning listing content, so unauthenticated attackers can enumerate other users' unpublished submissions (CWE-200, information disclosure). Publicly available exploit code exists per the WPScan reference, though EPSS is only 0.14% (4th percentile) and there is no CISA KEV listing, so this is a moderate, opportunistic-targeting issue rather than a mass-exploitation event.
Missing authorization and visibility checks in a WP Directory Kit shortcode (WordPress plugin versions up to and including 1.5.7) allow any logged-in user with a role as low as Contributor to read non-public listing content — including password-protected entries and hidden fields — that belongs to other users. The flaw is an information-disclosure issue (CWE-200) publicly documented by WPScan with exploit detail available, though the EPSS score of 0.14% (4th percentile) and the absence of any CISA KEV entry indicate no confirmed active exploitation and low predicted mass-exploitation risk. Impact is confidentiality-only and limited in scope: no data modification, no denial of service, and no privilege escalation beyond the reading of restricted listing data.
ManabiPocket for Parents 1.2.3 and earlier — an Android companion app for a Japanese parental school-communication service published by NTT Docomo Business, Inc. — exposes at least one application component that is reachable by other apps on the same device. A malicious app the user has already installed can send a crafted Intent to that component and read sensitive data held by the parental app, making this a local information-disclosure issue rather than a remote compromise. Severity is low (CVSS 4.0 base 1.8) because exploitation requires local code execution, user interaction and additional attack requirements; no public exploit code and no CISA KEV entry were identified at time of analysis, and EPSS data was not supplied.
TLS private key exposure in hawtio-operator affects Red Hat Build of Apache Camel - Hawtio 4 deployments on OpenShift. When a custom Route TLS secret is configured and debug logging is set to level 1 or higher, the operator serializes the complete Route object - including the TLS private key in PEM format - to its standard output. Because operator logs are routinely aggregated into centralized logging platforms and are accessible to any principal holding pods/log access in the openshift-operators namespace, this creates a pathway for credential exfiltration without direct secret access. No public exploit code exists and this CVE is not in CISA KEV, but the low debug threshold (level 1) means the exposure is frequently triggered during normal troubleshooting workflows.
Confused deputy exploitation in hawtio-operator on OpenShift allows a namespace-scoped edit user to claim arbitrary externally-routable Route hostnames that would normally require elevated cluster permissions. The operator holds a cluster-wide `routes/custom-host:create` privilege and blindly propagates the tenant-controlled `spec.routeHostName` field from Hawtio custom resources into OpenShift Route specs without validating whether the requesting user is authorized to claim that hostname. The captured subdomain can then be combined with the cluster's auto-grant OAuthClient to hijack OAuth redirect flows and steal tokens from legitimate users (PR:L, UI:R, C:H, CVSS 6.3). No public exploit code has been identified at time of analysis.
Unauthenticated access to the `/blacklist` endpoint of Maltrail (versions up to 3.0.1) allows any remote caller to retrieve source IP addresses of events that matched the operator's BLACKLIST rules, exposing internal network hosts flagged by the threat detection system. The oversight - a missing session check on one endpoint while all sibling endpoints (`/events`, `/counts`, `/hunt`, `/meta`, `/geo`) correctly required authentication - was confirmed by the vendor and patched in version 3.1 the same day it was reported. A public proof-of-concept exploit is available, making exploitation trivially scriptable against exposed instances.
Unauthenticated information disclosure in the 3D FlipBook - PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery WordPress plugin (all versions ≤1.16.20) allows any remote attacker to retrieve the full metadata payload of password-protected flipbooks - including title, outline, props, and the serialized data blob containing the underlying PDF file's direct URL - bypassing WordPress post-password confidentiality entirely. The plugin's AJAX handler in inc/ajax-get.php processes the 'id' parameter without verifying that the requestor has authenticated against the post password, and a companion unauthenticated AJAX action (fb3d_send_posts) enables systematic enumeration of all flipbook post IDs with no prior knowledge of the target site's content structure. No public exploit code and no CISA KEV listing exist at time of analysis.
Unauthenticated information disclosure in D-Link DIR-882 routers (firmware up to 20260814) allows remote attackers to retrieve sensitive data by sending crafted requests to the /HNAP1/dllog.cgi CGI binary endpoint. The vulnerability resides in the main() function of the dllog.cgi component, which fails to properly restrict output before returning it to the caller. A public proof-of-concept exists, per the GitHub reference, which also links this endpoint to quick VPN settings disclosure - suggesting credentials or configuration material may be exposed. No public KEV listing and no vendor patch have been identified at time of analysis.
PHPGurukul Blood Donor Management System 1.0 stores credentials in cleartext on disk when crafted values are supplied to the password, email, currentpassword, dbcurrentpwd, or newpassword arguments handled by application/models/admin/Login_Model.php. Vulnerable code paths are reachable remotely per the CVSS 4.0 vector (AV:N/PR:N/UI:N), although exploitation complexity is rated high (AC:H) and only a low confidentiality impact is scored. Publicly available exploit code exists and is flagged with an Exploit maturity of P in the CVSS vector, so the flaw should be treated as exploitable even though the base score is only 2.9 and no CISA KEV entry is present.
In BharatMLStack up to and including v1.3.0, Trufflebox UI stores the JWT authentication token, full user object, and session ID in the browser's localStorage, which is fully accessible to any JavaScript running on the page.
Tenda Technology Co., Ltd NVR_4H CH3 v2.1 V27.5.58.6 was discovered to contain a hardcoded cryptographic key.
SmartAdmin API Java17 SpringBoot3 version 3.30.0 contains an improper authorization vulnerability in the /employee/queryAll endpoint. The endpoint does not enforce the required function-level permission or data-scope authorization, allowing an authenticated low-privileged employee to retrieve employee records belonging to other departments and users
Local file enumeration in Keyfactor SignServer before 7.6.0 allows an authenticated administrator to confirm the existence and readability of arbitrary files on the application server by pointing configurable path properties at them and observing distinguishable error responses. The three affected properties are ATTRIBUTESFILE in PKCS11CryptoToken, KEYSTOREPATH in KeyStoreCryptoToken, and TRUSTSTOREPATH in RenewalWorker. No file contents are disclosed, exploitation requires a high-privileged admin account (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N, base 2.3), and there is no public exploit identified at time of analysis; EPSS is 0.15% (5th percentile), consistent with a low-priority information-disclosure issue.
An issue was discovered in Keyfactor SignServer before 7.6.0. The attribute ATTRIBUTESFILE in PKCS11CryptoToken can be set to a readable file but not an accepted file (i.e., recognized with attributes). In this case, an error is thrown which - together with the error - also prints the content of the file to the application server log. This gives a user that has both SignServer admin access and access to read the output of the server log (i.e., if remote syslog shipping is configured), the possibility to read the content of files accessible by the local user JBoss.