Information Disclosure
Monthly
In the Linux kernel, the following vulnerability has been resolved: net: remove WARN_ON_ONCE() from sk_mc_loop() sk_mc_loop() can be called for sockets that are neither AF_INET nor AF_INET6 (e.g. AF_PACKET sockets when sending packets via raw/packet socket over virtual devices such as VRF or ipvlan). In such cases, sk_family is not AF_INET/AF_INET6 and sk_mc_loop() falls through the switch statement and triggers WARN_ON_ONCE(1). Non-INET sockets do not support IP_MULTICAST_LOOP or IPV6_MULTICAST_LOOP options, so loopback should default to true without generating a warning.
In the Linux kernel, the following vulnerability has been resolved: mm/huge_memory: initialise workingset state before folio split xas_try_split() adds __GFP_ACCOUNT for page-cache xa_nodes, but __folio_split() leaves the xa_state's xa_lru unset. That lets a live, memcg-charged xa_node exist without being linked into the mapping's shadow_nodes list_lru; when reclaim later walks the list_lru it trips VM_WARN_ON(!css_is_dying()). Use mapping_set_update() to install both the workingset update callback and the shadow_nodes list_lru on the xa_state.
In the Linux kernel, the following vulnerability has been resolved: Revert "drm/amdgpu: fix aperture mapping leak" devres teardown is LIFO. The aperture devres node was registered after the DRM device node, so devres_release_all() unmaps the aperture before the DRM device release callback fires amdgpu_device_fini_sw(). IP sw_fini callbacks (e.g. vcn_v4_0_sw_fini) write to fw_shared through a pointer derived from aper_base_kaddr, causing a kernel page fault on probe failure / rollback: BUG: unable to handle page fault ... PMD 0 RIP: vcn_v4_0_sw_fini+0x7b/0x170 [amdgpu] Call Trace: amdgpu_device_fini_sw amdgpu_driver_release_kms devm_drm_dev_init_release devres_release_all This reverts commit d871e99879cb5fd1fa798b006b4888887e63a17a. (cherry picked from commit 336e0cd576817ac64a4b394ca2b3680029f3e37f)
In the Linux kernel, the following vulnerability has been resolved: x86/mce: Set up the polling timer before CMCI discovery I hit the following on one of my machines: mce: CPU0 BANK15 CMCI inherited storm ------------[ cut here ]------------ ODEBUG: assert_init not available (active state 0) object: (____ptrval____) object type: timer_list hint: 0x0 WARNING: lib/debugobjects.c:632 at debug_object_assert_init+0x178/0x230, CPU#0: swapper/0/0 CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 7.2.0-rc5 #3 PREEMPTLAZY RIP: 0010:debug_object_assert_init+0x18f/0x230 Call Trace: <TASK> __mod_timer mce_timer_kick cmci_discover intel_init_cmci mce_intel_feature_init mcheck_cpu_init identify_cpu identify_boot_cpu arch_cpu_finalize_init start_kernel A second splat follows right after, from timer_setup() finding that same timer already queued: ODEBUG: init active (active state 0) object: (____ptrval____) object type: timer_list hint: stub_timer+0x0/0x10 This is happening because CMCI storm detection is trying to modify the timer before latter was properly set up. Set up the timer first. __mcheck_cpu_setup_timer() only calls timer_setup(), and depends on neither the generic nor the vendor init. [ bp: Massage commit message. ]
PowerProtect Data Manager versions 20.2.0.0 and earlier contain a CWE-188 (Reliance on Data/Memory Layout) flaw that enables unauthenticated remote attackers to launch phishing attacks against users of the platform. The CVSS vector (AV:N/AC:H/PR:N/UI:R) indicates the attack is network-reachable without credentials but requires high complexity and user interaction, consistent with an open-redirect or token/URL-manipulation mechanism that makes the product's trusted domain a vehicle for directing victims to attacker-controlled infrastructure. Dell has addressed this in advisory DSA-2026-368; no public exploit code or CISA KEV listing has been identified at time of analysis.
Server-Side Request Forgery in Dell PowerProtect Data Manager's REST API (versions 20.2.0.0 and below) allows high-privileged remote attackers to induce the server to issue unauthorized outbound HTTP requests to internal or adjacent network resources. The CVSS scope-change metric (S:C) signals that successful exploitation can reach infrastructure beyond the PowerProtect instance itself, enabling partial internal-network reconnaissance even from a single compromised admin session. No public exploit code exists and no active exploitation has been confirmed; Dell has issued multi-vulnerability advisory DSA-2026-368 addressing this flaw.
Heap out-of-bounds read in FreeRDP before 3.31.0 allows a malicious RDP server to trigger adjacent heap memory disclosure and potential client instability by sending a crafted RFX_AVC444_BITMAP_STREAM during AVC444 chroma reconstruction. The root cause is a missing row-index bounds check in `general_ChromaV1ToYUV444` (and its ARM NEON and x86 SSE4.1 counterparts), causing `memcpy` to read past the end of the allocated luma plane when the server specifies specific frame geometry. No public exploit or CISA KEV listing exists at time of analysis; a confirmed fix is available in the 3.31.0 release.
CVE-2026-65165 describes unspecified issues in job step handling and node count tracking, reported via the Ubuntu vendor channel. The description '[Fix various issues around job steps and node count discrepancies]' reads as a commit message rather than a structured vulnerability disclosure, providing almost no actionable security detail. Without CVSS metrics, CWE classification, or references, the security impact - whether denial of service, privilege escalation, or incorrect resource allocation - cannot be determined from available data.
Path traversal during OCI container cleanup in Slurm's slurmstepd daemon allows files outside the designated container spool directory to be deleted on the host compute node. Affected clusters are those using Slurm's OCI container support; the bug manifests during job-step teardown, meaning any cluster user who can submit OCI-containerized jobs can trigger deletion of arbitrary files on the compute node. A secondary issue causes spool directories to be orphaned when ContainerPath includes a task ID pattern, resulting in disk resource leakage. No vendor CVSS score is published; exploitation conditions require a valid cluster account and OCI container feature enablement. No public exploit code has been identified at time of analysis.
Multiple unsafe database operations and query-construction flaws in slurmdbd, the SLURM Workload Manager's accounting database daemon, allow authenticated cluster users or malicious slurmctld nodes to send crafted requests that result in unvalidated or improperly sanitized queries against the underlying database. The precise impact - whether SQL injection, privilege escalation within Slurm accounting, or data corruption - is not fully disclosed in available sources. No CVSS score, CWE classification, or KEV listing is present at time of analysis; the vulnerability is known only through an Ubuntu vendor disclosure.
Cleartext vault data in UpSignOn for Windows before 7.19.0 persists in process memory after the application locks, exposing all stored secrets to any local attacker with standard user privileges. Using the Windows PROCESS_VM_READ permission, an attacker can call ReadProcessMemory() against UpSignOn.exe and extract entry names, URLs, usernames, passwords, TOTP secrets, and notes in plaintext - defeating the lock screen's security guarantee. No public exploit code is identified at time of analysis and no CISA KEV listing exists, but the technique is well within the reach of any attacker with local access to the workstation.
Insecure credential storage in UpSignOn for Windows (before 7.19.0) exposes the biometric unlock key from the Windows PasswordVault API to any standard process running in the same user session, requiring no authentication prompt. An attacker with low-privilege local code execution can retrieve this key, decrypt the protected vault files on disk, and export the entire password manager contents in cleartext. No public exploit has been identified at time of analysis, and the vendor-released patch is available in version 7.19.0.
Sensitive key retention in UpSignOn for Windows before 7.19.0 allows a local attacker with low privileges to recover the master password and decrypt the entire password vault. The backup key used to protect an encrypted master password backup is retained in the memory of UpSignOn.exe even after the vault is re-locked, enabling an attacker who can read process memory to extract it, decrypt the master password backup stored in v6-vault1.DATA.txt, and subsequently export all stored credentials in cleartext. No public exploit has been identified at time of analysis, but the attack chain is mechanically straightforward once local access is established.
Sensitive token logging in Boruta Server before 0.10.0 allows any party with read access to business event logs - including log aggregation systems and the built-in administration log viewer - to recover live OAuth 2.0 and OpenID Connect credentials. Exposed values include access tokens, refresh tokens, authorization codes, agent tokens, direct-post codes, ID tokens, and VP tokens logged during normal authorization and token issuance flows. An attacker who recovers these credentials can impersonate users or clients on any resource server that trusts the stolen tokens until expiration or explicit revocation. No public exploit or active exploitation has been identified.
The webhook shared secret stored in Nexus Repository 3's capability configuration is returned unmasked via the capability read API, exposing a sensitive HMAC credential to any account holding the nexus:capabilities:read privilege. Affected versions span 3.2.0 through 3.95.x - a broad exposure window stretching back to an early release - with a confirmed fix in version 3.96.0 published by Sonatype. No public exploit or active exploitation has been identified, but a leaked webhook secret enables downstream abuse including forging authenticated webhook payloads or validating intercepted outbound events targeting CI/CD or pipeline endpoints.
Plaintext recovery from S/MIME-encrypted email is possible in Cisco Secure Email due to insufficient message integrity validation during decryption. An unauthenticated remote attacker positioned as a machine-in-the-middle between email gateways can intercept and manipulate ciphertext, exploiting the CWE-345 flaw to extract plaintext content from messages that senders believed were encrypted end-to-end. No public exploit code or CISA KEV listing has been identified at time of analysis, and the AC:H vector reflects the non-trivial MITM positioning requirement.
Plaintext recovery from S/MIME-encrypted email is possible in Cisco Secure Email due to insufficient validation of message integrity during decryption. An unauthenticated remote attacker who achieves a machine-in-the-middle position between email gateways can intercept and manipulate encrypted messages in transit, causing the decryption process to yield recoverable plaintext. No public exploit code or active exploitation has been identified at time of analysis, but confidentiality impact is rated High given complete plaintext disclosure.
Plaintext token storage in Jenkins Parameterized Remote Trigger Plugin 3.2.2 and earlier exposes authentication tokens to any Jenkins user holding Item/Extended Read permission or to anyone with direct access to the Jenkins controller filesystem. Tokens written to job config.xml files are readable without decryption, potentially allowing lower-privileged users to impersonate legitimate remote-trigger callers and invoke builds on downstream Jenkins instances. No public exploit has been identified; SSVC assessment confirms no active exploitation and a non-automatable attack path.
Configuration integrity compromise in Jenkins GitLab Plugin 1.9.16 and earlier enables authenticated low-privileged users to overwrite the global GitLab connection URL via Stapler data binding, redirecting GitLab API calls to attacker-controlled infrastructure. This causes Jenkins to transmit administrator-configured GitLab API tokens to the attacker's endpoint whenever a pipeline, webhook, or scheduled job triggers a GitLab API interaction. No KEV listing or public exploit has been identified at time of analysis, but the low privilege bar means any Jenkins account holder can abuse this on unpatched installations.
Improper use of the @DataBoundConstructor annotation in Jenkins Script Security Plugin versions ≤1412.v7737b_3405f86 enables low-privileged authenticated users to read the plugin's script approval configuration by submitting certain Jenkins forms. The flaw allows enumeration of which Groovy scripts, methods, and signatures have been approved for execution - information that could assist an attacker in mapping permitted scripted operations within the Jenkins environment. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at the time of analysis.
Observable response discrepancy in Kibana's Osquery feature enables cross-space scheduled query ID enumeration by authenticated low-privileged users. An attacker holding Osquery live-query privileges can determine whether a scheduled query identifier exists in a Kibana space they are not authorized to access by observing distinguishably different API responses. Vendor-released patch is version 9.4.4 per ESA-2026-161; no public exploit or CISA KEV listing is identified at time of analysis.
Incorrect Authorization (CWE-863) in Kibana's machine learning feature allows an authenticated low-privileged user to escalate their effective access beyond their assigned Kibana Space. A user holding ML job management privileges within a single Space can manipulate a job's saved object so it becomes accessible across all Spaces in the Kibana instance, bypassing the tenant-isolation boundary without holding rights to those additional Spaces. Vendor-released patches are available in versions 8.19.19, 9.3.8, and 9.4.4; no public exploit code or CISA KEV listing has been identified at time of analysis.
Path traversal in Elastic Maps Server exposes arbitrary files readable by the server process to unauthenticated network attackers. Insufficient path restriction in the content-directory serving logic allows crafted requests to escape the intended directory using traversal sequences, returning sensitive file contents. No KEV listing or public exploit code exists at time of analysis; Elastic has released fixed versions 8.19.19, 9.4.4, and 9.5.1 per advisory ESA-2026-148.
Missing authorization on a Kibana Entity Store configuration operation allows an authenticated user with elevated Kibana privileges to indirectly coerce a background task into reading Elasticsearch indices the user is not permitted to access directly. The vulnerability - tracked as ESA-2026-147, fixed in Kibana 9.4.5 - is a privilege abuse (CAPEC-122) rather than an authentication bypass: the attacker already holds high Kibana privileges but exploits the missing authz check to escalate their effective read access into restricted Elasticsearch index data. Derived entity records from those unauthorized indices are then surfaced through the Entity Store's output API, completing the information disclosure.
Improper input validation (CWE-20) in the Drupal Link Content Parser contributed module exposes sites to both confidentiality and integrity compromise under high-complexity, high-privilege conditions. All published versions of the module are affected per CPE cpe:2.3:a:drupal:link_content_parser:*:*:*:*:*:*:*:*, with Drupal's security team confirming the issue via advisory SA-contrib-2026-101. No public exploit has been identified at time of analysis, and the CVSS score of 5.9 reflects strong mitigating factors - specifically the requirement for administrator-level authentication and high attack complexity.
Drupal's Commerce CyberSource payment integration module (all versions prior to 1.10.0) contains a timing side-channel vulnerability (CWE-208) that enables brute-force attacks against authentication or token-validation operations. Remote unauthenticated attackers can exploit measurable differences in response timing to iteratively confirm the validity of credentials or secrets, achieving limited integrity impact. Vendor-released patch version 1.10.0 is available via the Drupal security advisory sa-contrib-2026-106; no public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated information disclosure in DXPR Builder, a Drupal page-building and AI editing module, exposes sensitive data through forceful browsing against insufficiently protected endpoints. All releases from 0.0.0 through 2.8.0 are affected; version 2.8.1 is the patched release per Drupal security advisory SA-CONTRIB-2026-112. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Missing authorization enforcement in Craft CMS versions 5.7.0 through 5.10.12 allows authenticated control panel users to query volume metadata for asset repositories they are not permitted to access. The AssetsController::actionMoveInfo method accepts POST requests with arbitrary folderIds and returns asset count and total storage size without verifying the requesting user's volume permissions, violating the principle of least privilege within Craft's multi-volume access model. No public exploit code exists at time of analysis and the vulnerability is absent from CISA KEV; the CVSS 4.0 score of 5.3 with PR:L accurately reflects that an authenticated session is required.
Unauthenticated information disclosure in MasterStudy LMS WordPress Plugin before 3.7.46 exposes learning statistics for any registered user without authorization. The plugin's student statistics endpoint performs no access control check, allowing any remote attacker to retrieve course counts, accumulated points, certificates, quiz totals, and assignment totals for arbitrary user accounts. A publicly available exploit exists per WPScan, and the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or user interaction is required.
Unauthenticated information disclosure in MasterStudy LMS WordPress Plugin before 3.7.46 exposes the titles and IDs of an author's unpublished courses - including draft, pending, and private posts - through an unprotected REST API endpoint. The affected route performs no access control check and applies no publication-status filter, meaning any unauthenticated network request can enumerate course content that site owners intended to keep hidden. A publicly available proof-of-concept exists per the WPScan advisory; no active exploitation has been confirmed in CISA KEV at time of analysis.
Unauthenticated information disclosure in MasterStudy LMS WordPress Plugin (all versions before 3.7.46) exposes per-student course enrollment and learning progress data to any remote attacker without credentials. The plugin fails to perform an authorization check before returning student-specific data, allowing enumeration of any registered user's enrolled courses and progress metrics. A publicly available exploit exists via WPScan; no active exploitation (KEV) has been confirmed, and the CVSS 5.3 score accurately reflects limited confidentiality impact.
FormLayer WordPress plugin before version 1.0.9 discloses full form configuration data to unauthenticated users through its public submission handler, which performs no authorization check before returning stored settings. Notification recipient email addresses, confirmation redirect targets, and third-party integration credentials are exposed for all forms - including unpublished drafts invisible to end users. A public exploit exists via WPScan, and a vendor patch is available at version 1.0.9.
Rank Math SEO WordPress plugin versions before 1.0.277.1 exposes the full content of password-protected posts to unauthenticated users via publicly generated SEO metadata. The plugin fails to enforce WordPress's native post-password gate before extracting post content for use in meta tags and structured data, making protected content readable by anyone who can access the SEO output. A publicly available proof-of-concept is documented by WPScan; a vendor patch (1.0.277.1) is available.
Unauthenticated information disclosure in the Ultimate Member WordPress plugin (all versions before 2.13.0) exposes the content of comments still awaiting moderation and activity from private user profiles to any anonymous visitor. The plugin's profile activity endpoint fails to verify both comment approval status and profile privacy settings before returning data, meaning moderated/private content is served as if it were public. A publicly available proof-of-concept exists; no active exploitation has been confirmed via CISA KEV.
Plaintext password disclosure in the Gutentor WordPress page builder plugin (before 4.0.6) allows any authenticated subscriber-level user to retrieve the passwords of password-protected posts via a misconfigured REST API endpoint. The endpoint fails to enforce WordPress's built-in content-access context restrictions, meaning the security model of password-protected posts is completely bypassed for any site user who can authenticate. A publicly available exploit exists per WPScan, and a patched release (4.0.6) is available from the vendor.
Unauthenticated information disclosure in the Solace Extra WordPress plugin before 1.7.0 exposes the full content of non-published Site Builder parts - drafts, pending posts, private pages, and trashed items - to any anonymous visitor via an unprotected AJAX action. The plugin registers an AJAX handler that performs no capability check and no post-status validation, bypassing WordPress's normal access controls entirely. A public proof-of-concept is available through WPScan; the vendor has released version 1.7.0 to close the gap.
Cross-origin data leak in Google Chrome's Skia graphics library (prior to 152.0.7977.75) enables an attacker who has already achieved renderer process compromise to extract cross-origin data via a crafted HTML page. This is a second-stage vulnerability in an exploit chain: it does not enable initial access but amplifies an existing renderer compromise by breaking the Same-Origin Policy boundary. No public exploit code and no CISA KEV listing have been identified at time of analysis, though Google internally rates this 'High' severity - notably elevated above the computed CVSS 3.1 (Low) score.
Information leakage via the MediaCapture component in Google Chrome prior to 152.0.7977.75 enables a remote attacker to exfiltrate sensitive browser-side data by directing a user to a specially crafted HTML page. The flaw (CWE-200) resides in Chrome's implementation of the W3C Media Capture API, which handles camera, microphone, and display-capture device access, and may expose captured media content or associated metadata beyond the intended same-origin boundary. Google has released a fix in the 152.0.7977.75 stable channel update; no public exploit has been identified at time of analysis.
Address bar spoofing in Google Chrome on Android prior to version 152.0.7977.75 allows an unauthenticated remote attacker to deceive users about their true browsing origin by triggering fullscreen mode via a crafted HTML page. The flaw (CWE-451: UI Misrepresentation of Critical Information) causes the address bar to be suppressed or misrepresented during fullscreen transitions, creating a reliable phishing surface on Android devices. Google has released a fix in Chrome 152.0.7977.75; no public exploit code has been identified and CISA SSVC rates exploitation as none at time of analysis.
Confused deputy vulnerability in Chrome's CredentialProvider component on Windows allows a remote attacker who has already established renderer process compromise to leak sensitive credential information via a crafted HTML page. Affected versions are Chrome for Windows prior to 152.0.7977.75. Google rates this Low severity internally, though the CVSS Confidentiality impact is scored High due to the potential for credential disclosure; the AC:H vector reflects the significant prerequisite of prior renderer compromise. No public exploit code or CISA KEV listing has been identified at time of analysis.
CVE-2026-80220 is attributed to Ubuntu but carries no description, CVSS score, CWE classification, or technical details in the available intelligence data. Without a vulnerability description or affected component, no characterization of attacker capability, impact type, or affected user population is possible. Security teams should monitor Ubuntu Security Notices directly at ubuntu.com/security/notices for authoritative details as they become available.
CVE-2026-16658 is attributed to Ubuntu (vendor source) but carries no available description, CVSS score, CWE classification, or reference data at time of analysis. The affected component, attack vector, and impact are entirely unknown from the provided intelligence. No meaningful characterization of attacker capability or defender exposure can be made without additional disclosure from Canonical or NVD.
Unauthenticated information disclosure in WWBN AVideo through 30.0 exposes sensitive configuration data via the MobileManager plugin's getConfiguration endpoint. Any remote attacker can issue a GET request to plugin/MobileManager/getConfiguration.json.php without credentials and receive TLS private key file paths, socket configuration details, platform version, and debug flags. While the direct confidentiality impact is limited (file paths and config metadata rather than key material itself), the leaked data provides meaningful reconnaissance for follow-on attacks targeting the installation. No public exploit or CISA KEV listing is identified at time of analysis.
Path traversal in WWBN AVideo's unauthenticated `get_api_login_code` API endpoint enables remote attackers to delete arbitrary `.log` files and enumerate filesystem paths by injecting directory traversal sequences into the `code` parameter. All versions covered by CPE `cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*` are affected, with exploitation requiring no authentication or user interaction. The primary security consequence is destruction of audit trails and access logs, which undermines incident detection and forensic response capabilities; no public exploit code has been identified at time of analysis.
Out-of-bounds read in the HPE AOS-CX network operating system allows adjacent unauthenticated attackers to disclose sensitive OS memory contents by sending a specially crafted packet. The flaw requires no credentials and no user interaction, but is constrained to same-segment network access (AV:A), limiting exposure to attackers who have already achieved a foothold on the target network or VLAN. This is one of several vulnerabilities disclosed in HPE advisory HPESBNW05134, which also covers more severe unauthenticated adjacent RCE issues (CVE-2026-73782, CVSS 8.8) and network-reachable RCE (CVE-2026-73749, CVSS 9.8) in the same product line - those higher-severity siblings should be prioritized alongside this finding. No public exploit has been identified at time of analysis.
Information disclosure in HPE AOS-CX exposes sensitive API endpoint data to a remote unauthenticated attacker who can achieve a man-in-the-middle position on the network path. Intercepted data could include credentials, session tokens, or configuration material usable to further compromise the affected switch or pivot into managed network infrastructure. This CVE is part of a broader HPE advisory (hpesbnw05134) covering at least four additional AOS-CX vulnerabilities; no public exploit code and no CISA KEV listing have been identified.
Cleartext exposure of sensitive information in HPE Networking Fabric Composer's management interface can be triggered by an authenticated administrator, potentially revealing credentials or configuration data for downstream network services. The vulnerability requires both administrative privileges and high attack complexity (CVSS 2.2, AV:N/AC:H/PR:H), meaning realistic exploitability is limited to insiders or attackers who have already fully compromised an admin account. Successful exploitation could enable lateral movement into network services managed by Fabric Composer. No public exploit code or CISA KEV listing has been identified.
Unauthenticated remote information disclosure in HPE Networking Fabric Composer exposes cleartext data through the web-based management interface to network-positioned attackers. Exploitation demands high attack complexity (CVSS AC:H), constraining real-world risk despite the network-accessible, no-authentication vector. The vendor advisory identifies remediation; no public exploit code or CISA KEV listing has been identified, though the disclosed data could enable secondary compromise of dependent network infrastructure.
Cleartext exposure of sensitive information in the HPE Networking Fabric Composer API allows a local attacker holding administrative credentials to retrieve secrets that the system is expected to protect in encrypted form. The vulnerability is constrained to local access with high privileges already obtained, yielding a CVSS 3.1 score of 4.4 (Medium). No public exploit code or active exploitation has been identified at time of analysis; the advisory originates from HPE itself, suggesting proactive disclosure rather than incident response.
Local information disclosure in HPE Networking Fabric Composer allows an authenticated low-privileged operator user with local system access to read sensitive OS-level data, potentially enabling privilege escalation on the affected host. The vulnerability resides in the underlying operating system layer exposed through Fabric Composer's operator access model, and is constrained by both a local attack vector and high complexity requirement. No public exploit code has been identified and this entry does not appear in the CISA KEV catalog.
Unauthenticated file read in HPE Networking Fabric Composer's web-based management interface exposes a subset of system files to remote attackers without requiring any credentials. The vulnerability is confined to files within a specific affected directory rather than offering arbitrary filesystem access, yielding a limited confidentiality impact consistent with the CVSS 5.3 (C:L) score. No active exploitation (KEV) or public proof-of-concept has been identified at time of analysis, and no EPSS signal is provided in available intelligence.
Authenticated privilege escalation in HPE Networking Fabric Composer's API allows low-privilege operator users to read limited information and make limited configuration changes beyond their authorized scope. The flaw affects all tracked versions per CPE data and requires only a valid low-privilege account to exploit - no special configuration or user interaction is needed. No public exploit code and no CISA KEV listing are present at time of analysis, keeping real-world risk moderate despite network accessibility.
Local information disclosure in HPE Networking Fabric Composer exposes sensitive operating-system-level data to authenticated low-privilege operator users with local system access. The CVSS Scope:Changed metric reflects that the leaked data crosses from the Fabric Composer application boundary into the underlying host OS, and HPE warns the recovered information could enable further unauthorized access to the affected system and interconnected infrastructure. No public exploit is identified at time of analysis; exploitation requires both a valid low-privilege credential and local system access, materially constraining the realistic threat population.
Unauthenticated information disclosure in HPE Networking Fabric Composer's API endpoint exposes internal service and workflow details to remote attackers under high-complexity conditions. The vulnerability requires user interaction per the CVSS vector (UI:R), which is atypical for an API endpoint flaw, suggesting a specific trigger mechanism or chained condition not fully described in the advisory. Impact is limited to low confidentiality exposure, though HPE's own advisory frames it as a stepping stone that increases risk when chained with other vulnerabilities. No public exploit or KEV listing identified at time of analysis.
Timing side-channel exposure in phpseclib's pure-PHP X25519 scalar multiplication allows a local observer to recover a reused 251-bit clamped private key. Data-dependent conditional modular reductions in PrimeField/Integer.php cause per-step timing and libgmp call-count variation during the Montgomery ladder, leaking scalar bits when the same private key is used across multiple operations. Only applications using a long-lived or reused X25519 private key on the pure-PHP code path are at risk; phpseclib's standard SSH ephemeral key exchange is explicitly unaffected. Vendor-released patches exist in versions 3.0.57 and 4.0.1; no public exploit has been identified at time of analysis.
NoSQL injection in Kibana exposes unauthorized Elasticsearch data to authenticated low-privilege users who can submit crafted query input. The flaw, classified as CWE-943 (Improper Neutralization of Special Elements in Data Query Logic / CAPEC-676), allows manipulation of backend NoSQL query logic to return records outside the user's authorized data scope. Elastic has released fixed versions 9.4.5 and 9.5.1 per ESA-2026-168; no public exploit or CISA KEV listing has been identified at time of analysis.
Kibana's missing server-side authorization check (CWE-862) allows any authenticated user holding only minimal Elasticsearch privileges to bypass Kibana feature authorization and Space access controls, reading Fleet deployment metadata from the default Kibana space without having been granted that permission. The flaw is rooted in an absent authorization gate on Fleet API paths rather than a misconfiguration, meaning the control is simply not enforced rather than configured incorrectly. Elastic has self-reported the issue and released fixes in versions 9.4.6 and 9.5.1 per advisory ESA-2026-149; no public exploit code or active exploitation (CISA KEV) has been identified.
Missing authorization on an internal Kibana APM integration function exposes APM server credentials to any authenticated Kibana user. The affected endpoint was designed for APM or Fleet administrators but lacked the corresponding role-based access control check, allowing lower-privileged authenticated users to retrieve secrets that govern access to the APM backend. No public exploit code or CISA KEV listing exists at time of analysis; however, the straightforward exploitation path and high confidentiality impact from credential exposure make this a meaningful lateral-movement risk in Elastic Stack deployments.
HTTP Request Smuggling in Elasticsearch allows a network attacker to intercept confidential HTTP responses intended for other authenticated users when Elasticsearch is deployed behind certain proxy configurations. The vulnerability (CWE-444, CAPEC-33) arises from inconsistent HTTP request boundary interpretation between the intermediary proxy and Elasticsearch, enabling response queue poisoning that leaks data across user sessions. Vendor-released patches 8.19.20, 9.4.5, and 9.5.1 are available per ESA-2026-141; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege abuse in Kibana's machine learning feature allows any user holding read-only ML access to retrieve data from Elasticsearch indices they are not authorized to see. The flaw (CWE-250) occurs because Kibana executes certain ML read operations under an internal service identity rather than forwarding the requesting user's credentials to Elasticsearch, effectively bypassing Elasticsearch's index-level access controls. Elastic self-disclosed the issue in ESA-2026-135 and released fixes across three active release lines; no public exploit code has been identified.
Authorization bypass in gRPC-Go's xDS RBAC HTTP filter prior to v1.83.1 allows network attackers to evade DENY policies when header matcher names use mixed case. Because gRPC metadata keys are always lowercased at the protocol layer, a DENY rule configured with canonical HTTP capitalization (e.g., `X-Role`, `User-Agent`) never fires, causing the policy to fail open and permit requests it should block. The same case mismatch also enables bypass of gRFC A41 pseudo-header validation (`:Scheme`, `Grpc-Status`) and prevents `Host` from being rewritten to `:authority`. No public exploit is identified at time of analysis; a vendor-confirmed fix ships in v1.83.1.
Uninitialized heap memory disclosure in gvfs's SFTP backend enables a malicious SFTP server to deterministically defeat ASLR on client systems running RHEL 6 through 10. When a user mounts a crafted SFTP share, the read_string() parser allocates a buffer for the FXP_HANDLE response but does not verify that the buffer is fully populated; the client subsequently echoes the uninitialized remainder - containing heap base pointers and the libgio load address - back to the attacker on every subsequent file-handle request. No public exploit has been identified at time of analysis, and the issue does not appear in CISA KEV, but the ASLR bypass it achieves is a high-value precursor for chained memory-corruption attacks against gvfsd-sftp.
Improper privilege management in Cleo Harmony's JWT Refresh Token Handler allows remote unauthenticated attackers to manipulate the Bearer argument on the /api/connections API endpoint, resulting in unauthorized access to connection data and potential privilege escalation. Affected versions span all releases up to and including 5.8.1.10, with a public exploit already available (E:P per CVSS 4.0 supplemental). No active exploitation confirmed in CISA KEV, but the combination of network accessibility, zero-privilege requirement, and public proof-of-concept materially elevates real-world risk.
Unauthenticated enumeration of internal PKI topology is possible in Red Hat Certificate System 9 through an unprotected REST endpoint. Any network-accessible client can issue GET /ca/rest/securityDomain/hosts and receive a structured inventory of all participating CA subsystem hosts, their roles, and security domain membership - without presenting credentials, a client certificate, or a session token. While the direct CVSS impact is rated medium (5.3), the real-world significance lies in enabling precise reconnaissance of internal PKI infrastructure that could facilitate targeted follow-on attacks against specific subsystems. No active exploitation is confirmed and no public exploit code has been identified at time of analysis.
Information disclosure in Firefox for Android's WebExtensions component exposes sensitive browser or cross-origin data to remote attackers who can induce user interaction. Affecting all Firefox for Android versions prior to 155, the flaw is accessible over the network with low complexity but requires a user to interact with attacker-controlled content, gating mass exploitation. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Use-after-free in Firefox's DOM Core & HTML component allows network-reachable attackers to achieve limited memory disclosure and DOM integrity impact against users running Firefox below version 155 or Firefox ESR below 153.2. Exploitation requires user interaction - a victim must visit or be redirected to attacker-controlled content - but no authentication or elevated privileges are needed. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; Mozilla has released patched versions addressing the flaw.
Use-after-free memory corruption in Firefox's DOM Core and HTML component allows a remote attacker to achieve limited confidentiality and integrity impact against users running unpatched Firefox versions by directing them to a crafted webpage. All Firefox releases prior to version 155, ESR 140.15, and ESR 153.2 are affected; Mozilla has shipped fixes across all three release channels. No public exploit code or active exploitation has been identified at time of analysis.
Use-after-free in Firefox's Audio/Video media pipeline allows unauthenticated remote attackers - requiring only user interaction - to read or modify limited browser memory content. Affected releases span Firefox stable prior to 155 and both ESR tracks prior to 140.15 and 153.2, covered by three separate Mozilla security advisories (MFSA2026-82, MFSA2026-84, MFSA2026-85). No public exploit code exists at time of analysis and SSVC exploitation status is 'none,' though the CWE-416 class carries inherent escalation risk beyond the partial impact Mozilla scored.
Use-after-free in Firefox's JavaScript garbage collector (GC) component exposes users to partial memory disclosure and corruption when visiting attacker-controlled web pages. Both the standard release line (Firefox 155) and the extended support release (Firefox ESR 153.2) are patched. No public exploit or active exploitation is confirmed; SSVC exploitation status is none and the vulnerability is absent from CISA KEV.
Use-after-free in Firefox's Audio/Video component exposes users running Firefox prior to version 155 and affected ESR branches to potential heap memory disclosure and limited data modification when processing attacker-controlled media. The vulnerability is network-reachable but requires user interaction - visiting a malicious or compromised page that triggers media playback - and carries a CVSS score of 5.4 reflecting bounded C:L/I:L impact with no availability loss. No public exploit code or active exploitation has been identified at time of analysis; SSVC assessment classifies exploitation status as none and the vulnerability as non-automatable.
Unauthenticated network attackers can elicit Java stack traces from Red Hat IdM's Dogtag CA REST enrollment endpoint (POST /ca/rest/certrequests) by submitting malformed requests, causing HTTP 500 responses that expose internal implementation details under CWE-209. The same error path simultaneously amplifies the CA debug log with large multi-line stack traces, creating a log-fill resource exhaustion vector that drives disk growth and I/O contention on affected RHEL 6 through 10 deployments. No public exploit has been identified at time of analysis, but the attack requires no authentication and low complexity, making it accessible to unskilled opportunistic attackers targeting IdM infrastructure.
Untrusted pointer dereference in Samsung mTower's Secure world entry point allows a Non-Secure world caller to supply pointer values referencing Secure RAM, causing the TEE kernel to dereference those addresses on behalf of the attacker and potentially exposing or corrupting cryptographic material and other Secure world state. All mTower deployments before commit 06994e303637512e39062f3e037c222e8448e57e on ARM Cortex-M TrustZone hardware are affected, spanning both the session-open and invoke-command paths. No public exploit code has been identified and the vulnerability is absent from CISA KEV; however, the security boundary violated - Normal World to Secure World - represents a fundamental TrustZone integrity failure with real confidentiality and integrity consequences that the provided CVSS score significantly understates.
Unauthenticated REST endpoint access in the KiviCare WordPress plugin (before 4.5.5) exposes both a clinic's full patient roster and, critically, the configured payment gateway secret key to any unauthenticated remote attacker. The vulnerability stems from missing authorization checks on specific REST API routes, requiring no credentials or user interaction to exploit. A publicly available proof-of-concept is documented by WPScan, materially lowering the bar for exploitation across any WordPress site running an unpatched version of this clinic management plugin.
Shortcode injection in MW WP Form WordPress plugin (versions before 5.1.5) allows unauthenticated remote attackers to execute any WordPress shortcode registered on the target site. The plugin fails to neutralize shortcode syntax in user-submitted form values before passing those values through WordPress's shortcode processing engine. A publicly available proof-of-concept exists (via WPScan), though exploitation is gated by a non-default site configuration requirement, which suppresses real-world risk despite the network-accessible attack vector.
Web cache poisoning in WP Fastest Cache WordPress plugin before 1.5.1 enables unauthenticated attackers to inject content into the site-wide page cache by exploiting its failure to include tracking-related query parameters in cache key construction. Because the plugin caches responses to URLs containing these parameters under the canonical clean-URL key, an attacker-controlled page render is stored and subsequently served to every visitor of the legitimate URL. A publicly available proof-of-concept exploit exists; no active exploitation confirmed in CISA KEV at time of analysis.
Sensitive field value disclosure in Ash Framework's atomic confirmation validator allows any caller of a vulnerable action to extract a stored sensitive attribute by intentionally submitting a wrong confirmation argument. Versions 2.17.20 through before 3.32.2 of ash-project/ash are affected: when an actor supplies only the confirmation argument and omits the field itself, the atomic `Confirm` validator resolves the mismatch error's `value` through `atomic_ref/2` to the field's current stored database value and returns it in the error payload. No public exploit exists beyond the regression test shipped with the fix commit, and this vulnerability does not appear in the CISA KEV catalog.
Sensitive application data leaks from HTTP 500 responses in ash_typescript versions 0.15.0 through 0.17.x due to an ungated code path that serializes handler return values verbatim using Elixir's inspect/2. Any unauthenticated caller who can trigger a typed-controller route whose handler falls through with a non-conn term - such as {:error, %User{}} - receives the full Elixir struct inspection, potentially including hashed passwords, session tokens, and tenant identifiers, in the JSON error body. No public exploit identified at time of analysis, but the disclosure is trivially reproducible with a standard HTTP client given the right application-layer condition.
Sensitive internal error data - including runtime secrets potentially carried in Ash error vars fields - leaks to unauthenticated network clients in ash_typescript 0.8.0 through 0.17.x when a configured error handler raises a FunctionClauseError on an unmatched error shape. The rescue clause in apply_error_handler/3 was intended as a safety net but fell back to returning the original, unredacted error map rather than a safe generic response, inverting the intended suppress-on-failure semantics. No public exploit code has been identified and there is no CISA KEV listing; a patched release (0.18.0) is available from the Ash Project.
HTTP request smuggling in Node.js's HTTP client module enables forwarding proxies to desynchronize backend connections when request headers exceed the maxHeadersCount or maxHeaderPairs thresholds. When a Node.js-based proxy rebuilds outbound request headers from the visible IncomingMessage properties and pipes the original body over a reused backend connection, framing-critical headers such as Content-Length are silently omitted from the proxy's outbound request while still governing body delivery internally - causing the backend to misparse the request stream. No public exploit has been identified at time of analysis, and exploitation is constrained to specific proxy architectures, which is reflected in the CVSS 3.7 Low score.
Sensitive WooCommerce order and product data is exposed to authenticated subscribers in the 'Print Barcode Labels for your WooCommerce products/orders' WordPress plugin versions 4.0.0 and below, developed by ukr_solution. The flaw (CWE-201) allows low-privilege authenticated users - those holding only a subscriber role - to retrieve data beyond their authorized scope, yielding a High confidentiality impact per CVSS. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Revoked API token enforcement is absent in QuantumNous new-api up to 1.0.0-rc.15, allowing a holder of a disabled token to query read-only endpoints such as /api/usage/token/ and retrieve usage log data. The root cause (CWE-613, Insufficient Session Expiration) lies in the TokenAuthReadOnly middleware in middleware/auth.go, which skipped the disabled-token status check entirely before the patch. A public POC is available; no active exploitation is confirmed in CISA KEV, and the CVSS 4.0 score of 2.1 reflects the narrow, low-impact attack surface.
Address bar spoofing in Firefox for iOS lets a malicious webpage stall a popup's cross-origin navigation after the browser internally commits it, causing the address bar to display the intended destination's origin while the popup continues rendering attacker-controlled content. All Firefox for iOS releases prior to 155.0 are affected; the fix shipped in version 155.0 per Mozilla advisory MFSA2026-81. No public exploit has been identified and CISA SSVC confirms exploitation status as none, but the phishing potential is realistic given the deceptive UI state.
Improper access control in dibo-software diboot 3.8.0 allows authenticated remote attackers to bypass tenant isolation by manipulating the tenantId parameter in the Tenant Administrator Management API at /admin/. An attacker with low-privileged access to one tenant can read and modify data belonging to other tenants, breaking the multi-tenant security boundary. A public proof-of-concept exploit exists, and the vendor has not responded to disclosure, leaving users without an official patch.
Information disclosure in extension.vn 2FA Authenticator Extension 1.0.0.2 for Chrome exposes stored TOTP secrets via an unvalidated external message listener. The Background Service Worker's `chrome.runtime.onMessageExternal.addListener` handler fails to verify the `sender.id` field, meaning any other locally-installed Chrome extension can send a crafted message and receive TOTP seeds in response. A public proof-of-concept exploit exists; exploitation is constrained to local access with low-privilege conditions per the CVSS 4.0 vector (AV:L/PR:L), and no active exploitation has been confirmed.
Information disclosure in vidIQ Vision for YouTube Extension 3.199.0 on Chrome exposes YouTube video frame captures to any web page able to send crafted postMessage events. The extension's window.addEventListener handler processes incoming messages without validating the sender origin, allowing a remotely-hosted malicious page to exfiltrate frame capture data by manipulating the vidiqEvent argument. No patch is available - the vendor has explicitly stated they do not accept vulnerability submissions and operate no bug bounty program - and a public proof-of-concept exploit is available on GitHub.
HCL Connections exposes sensitive information to unauthorized users through improper handling of request data, classified under CWE-359 (Exposure of Private Personal Information to an Unauthorized Actor). The vulnerability affects all tracked versions per the wildcard CPE and is exploitable over the network, though high attack complexity (AC:H) and required user interaction (UI:R) substantially constrain real-world exploitability. No public exploit code or active exploitation has been identified at the time of analysis, and the CVSS score of 3.1 reflects the limited confidentiality impact and constrained attack prerequisites.
Cleartext password storage in sambitraj's Student Management System exposes user credentials to privileged attackers who can access the database or application backend. The flaw resides in aca.sql within the Password Handler component, where passwords are persisted without hashing or encryption. A proof-of-concept has been publicly disclosed via a GitHub issue, though exploitation requires high-privilege access, keeping real-world risk low despite the sensitive nature of the exposed data.
Default credentials hardcoded in the aca.sql database initialization file of sambitraj's Student-Management-System expose unauthenticated remote attackers to authentication bypass using publicly known passwords across all commits through 56ba287f. The project's GitHub issue tracker hosts a public proof-of-concept, and the maintainer has not responded to the disclosure, leaving no remediated release available. The limited deployment footprint (a niche student-facing open-source project) constrains aggregate real-world impact despite the trivial exploitability of default credentials.
Session cookie exposure in sambitraj's Student-Management-System allows attackers to steal session tokens via client-side JavaScript due to the absence of the HttpOnly flag in the `session_start` function. All commits up to 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5 are affected, and no vendor patch exists as the maintainer has not responded to the responsible disclosure. A publicly available proof-of-concept exists, though exploitation requires high attack complexity and a co-present XSS vector to materialize as a session hijack.
Double-free memory corruption in Valkey 9.1.0's Module Timer Subsystem allows a high-privileged remote attacker to crash the server by triggering a self-stopping timer callback pattern. The moduleTimerHandler function in src/module.c frees the timer object both inside the callback (via ValkeyModule_StopTimer) and again after callback return, causing a double-free. A public proof-of-concept has been disclosed via GitHub, though the CVSS 4.0 score of 1.9 reflects that exploitation requires high-privilege module control, severely constraining real-world impact to low-severity availability disruption.
In the Linux kernel, the following vulnerability has been resolved: net: remove WARN_ON_ONCE() from sk_mc_loop() sk_mc_loop() can be called for sockets that are neither AF_INET nor AF_INET6 (e.g. AF_PACKET sockets when sending packets via raw/packet socket over virtual devices such as VRF or ipvlan). In such cases, sk_family is not AF_INET/AF_INET6 and sk_mc_loop() falls through the switch statement and triggers WARN_ON_ONCE(1). Non-INET sockets do not support IP_MULTICAST_LOOP or IPV6_MULTICAST_LOOP options, so loopback should default to true without generating a warning.
In the Linux kernel, the following vulnerability has been resolved: mm/huge_memory: initialise workingset state before folio split xas_try_split() adds __GFP_ACCOUNT for page-cache xa_nodes, but __folio_split() leaves the xa_state's xa_lru unset. That lets a live, memcg-charged xa_node exist without being linked into the mapping's shadow_nodes list_lru; when reclaim later walks the list_lru it trips VM_WARN_ON(!css_is_dying()). Use mapping_set_update() to install both the workingset update callback and the shadow_nodes list_lru on the xa_state.
In the Linux kernel, the following vulnerability has been resolved: Revert "drm/amdgpu: fix aperture mapping leak" devres teardown is LIFO. The aperture devres node was registered after the DRM device node, so devres_release_all() unmaps the aperture before the DRM device release callback fires amdgpu_device_fini_sw(). IP sw_fini callbacks (e.g. vcn_v4_0_sw_fini) write to fw_shared through a pointer derived from aper_base_kaddr, causing a kernel page fault on probe failure / rollback: BUG: unable to handle page fault ... PMD 0 RIP: vcn_v4_0_sw_fini+0x7b/0x170 [amdgpu] Call Trace: amdgpu_device_fini_sw amdgpu_driver_release_kms devm_drm_dev_init_release devres_release_all This reverts commit d871e99879cb5fd1fa798b006b4888887e63a17a. (cherry picked from commit 336e0cd576817ac64a4b394ca2b3680029f3e37f)
In the Linux kernel, the following vulnerability has been resolved: x86/mce: Set up the polling timer before CMCI discovery I hit the following on one of my machines: mce: CPU0 BANK15 CMCI inherited storm ------------[ cut here ]------------ ODEBUG: assert_init not available (active state 0) object: (____ptrval____) object type: timer_list hint: 0x0 WARNING: lib/debugobjects.c:632 at debug_object_assert_init+0x178/0x230, CPU#0: swapper/0/0 CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 7.2.0-rc5 #3 PREEMPTLAZY RIP: 0010:debug_object_assert_init+0x18f/0x230 Call Trace: <TASK> __mod_timer mce_timer_kick cmci_discover intel_init_cmci mce_intel_feature_init mcheck_cpu_init identify_cpu identify_boot_cpu arch_cpu_finalize_init start_kernel A second splat follows right after, from timer_setup() finding that same timer already queued: ODEBUG: init active (active state 0) object: (____ptrval____) object type: timer_list hint: stub_timer+0x0/0x10 This is happening because CMCI storm detection is trying to modify the timer before latter was properly set up. Set up the timer first. __mcheck_cpu_setup_timer() only calls timer_setup(), and depends on neither the generic nor the vendor init. [ bp: Massage commit message. ]
PowerProtect Data Manager versions 20.2.0.0 and earlier contain a CWE-188 (Reliance on Data/Memory Layout) flaw that enables unauthenticated remote attackers to launch phishing attacks against users of the platform. The CVSS vector (AV:N/AC:H/PR:N/UI:R) indicates the attack is network-reachable without credentials but requires high complexity and user interaction, consistent with an open-redirect or token/URL-manipulation mechanism that makes the product's trusted domain a vehicle for directing victims to attacker-controlled infrastructure. Dell has addressed this in advisory DSA-2026-368; no public exploit code or CISA KEV listing has been identified at time of analysis.
Server-Side Request Forgery in Dell PowerProtect Data Manager's REST API (versions 20.2.0.0 and below) allows high-privileged remote attackers to induce the server to issue unauthorized outbound HTTP requests to internal or adjacent network resources. The CVSS scope-change metric (S:C) signals that successful exploitation can reach infrastructure beyond the PowerProtect instance itself, enabling partial internal-network reconnaissance even from a single compromised admin session. No public exploit code exists and no active exploitation has been confirmed; Dell has issued multi-vulnerability advisory DSA-2026-368 addressing this flaw.
Heap out-of-bounds read in FreeRDP before 3.31.0 allows a malicious RDP server to trigger adjacent heap memory disclosure and potential client instability by sending a crafted RFX_AVC444_BITMAP_STREAM during AVC444 chroma reconstruction. The root cause is a missing row-index bounds check in `general_ChromaV1ToYUV444` (and its ARM NEON and x86 SSE4.1 counterparts), causing `memcpy` to read past the end of the allocated luma plane when the server specifies specific frame geometry. No public exploit or CISA KEV listing exists at time of analysis; a confirmed fix is available in the 3.31.0 release.
CVE-2026-65165 describes unspecified issues in job step handling and node count tracking, reported via the Ubuntu vendor channel. The description '[Fix various issues around job steps and node count discrepancies]' reads as a commit message rather than a structured vulnerability disclosure, providing almost no actionable security detail. Without CVSS metrics, CWE classification, or references, the security impact - whether denial of service, privilege escalation, or incorrect resource allocation - cannot be determined from available data.
Path traversal during OCI container cleanup in Slurm's slurmstepd daemon allows files outside the designated container spool directory to be deleted on the host compute node. Affected clusters are those using Slurm's OCI container support; the bug manifests during job-step teardown, meaning any cluster user who can submit OCI-containerized jobs can trigger deletion of arbitrary files on the compute node. A secondary issue causes spool directories to be orphaned when ContainerPath includes a task ID pattern, resulting in disk resource leakage. No vendor CVSS score is published; exploitation conditions require a valid cluster account and OCI container feature enablement. No public exploit code has been identified at time of analysis.
Multiple unsafe database operations and query-construction flaws in slurmdbd, the SLURM Workload Manager's accounting database daemon, allow authenticated cluster users or malicious slurmctld nodes to send crafted requests that result in unvalidated or improperly sanitized queries against the underlying database. The precise impact - whether SQL injection, privilege escalation within Slurm accounting, or data corruption - is not fully disclosed in available sources. No CVSS score, CWE classification, or KEV listing is present at time of analysis; the vulnerability is known only through an Ubuntu vendor disclosure.
Cleartext vault data in UpSignOn for Windows before 7.19.0 persists in process memory after the application locks, exposing all stored secrets to any local attacker with standard user privileges. Using the Windows PROCESS_VM_READ permission, an attacker can call ReadProcessMemory() against UpSignOn.exe and extract entry names, URLs, usernames, passwords, TOTP secrets, and notes in plaintext - defeating the lock screen's security guarantee. No public exploit code is identified at time of analysis and no CISA KEV listing exists, but the technique is well within the reach of any attacker with local access to the workstation.
Insecure credential storage in UpSignOn for Windows (before 7.19.0) exposes the biometric unlock key from the Windows PasswordVault API to any standard process running in the same user session, requiring no authentication prompt. An attacker with low-privilege local code execution can retrieve this key, decrypt the protected vault files on disk, and export the entire password manager contents in cleartext. No public exploit has been identified at time of analysis, and the vendor-released patch is available in version 7.19.0.
Sensitive key retention in UpSignOn for Windows before 7.19.0 allows a local attacker with low privileges to recover the master password and decrypt the entire password vault. The backup key used to protect an encrypted master password backup is retained in the memory of UpSignOn.exe even after the vault is re-locked, enabling an attacker who can read process memory to extract it, decrypt the master password backup stored in v6-vault1.DATA.txt, and subsequently export all stored credentials in cleartext. No public exploit has been identified at time of analysis, but the attack chain is mechanically straightforward once local access is established.
Sensitive token logging in Boruta Server before 0.10.0 allows any party with read access to business event logs - including log aggregation systems and the built-in administration log viewer - to recover live OAuth 2.0 and OpenID Connect credentials. Exposed values include access tokens, refresh tokens, authorization codes, agent tokens, direct-post codes, ID tokens, and VP tokens logged during normal authorization and token issuance flows. An attacker who recovers these credentials can impersonate users or clients on any resource server that trusts the stolen tokens until expiration or explicit revocation. No public exploit or active exploitation has been identified.
The webhook shared secret stored in Nexus Repository 3's capability configuration is returned unmasked via the capability read API, exposing a sensitive HMAC credential to any account holding the nexus:capabilities:read privilege. Affected versions span 3.2.0 through 3.95.x - a broad exposure window stretching back to an early release - with a confirmed fix in version 3.96.0 published by Sonatype. No public exploit or active exploitation has been identified, but a leaked webhook secret enables downstream abuse including forging authenticated webhook payloads or validating intercepted outbound events targeting CI/CD or pipeline endpoints.
Plaintext recovery from S/MIME-encrypted email is possible in Cisco Secure Email due to insufficient message integrity validation during decryption. An unauthenticated remote attacker positioned as a machine-in-the-middle between email gateways can intercept and manipulate ciphertext, exploiting the CWE-345 flaw to extract plaintext content from messages that senders believed were encrypted end-to-end. No public exploit code or CISA KEV listing has been identified at time of analysis, and the AC:H vector reflects the non-trivial MITM positioning requirement.
Plaintext recovery from S/MIME-encrypted email is possible in Cisco Secure Email due to insufficient validation of message integrity during decryption. An unauthenticated remote attacker who achieves a machine-in-the-middle position between email gateways can intercept and manipulate encrypted messages in transit, causing the decryption process to yield recoverable plaintext. No public exploit code or active exploitation has been identified at time of analysis, but confidentiality impact is rated High given complete plaintext disclosure.
Plaintext token storage in Jenkins Parameterized Remote Trigger Plugin 3.2.2 and earlier exposes authentication tokens to any Jenkins user holding Item/Extended Read permission or to anyone with direct access to the Jenkins controller filesystem. Tokens written to job config.xml files are readable without decryption, potentially allowing lower-privileged users to impersonate legitimate remote-trigger callers and invoke builds on downstream Jenkins instances. No public exploit has been identified; SSVC assessment confirms no active exploitation and a non-automatable attack path.
Configuration integrity compromise in Jenkins GitLab Plugin 1.9.16 and earlier enables authenticated low-privileged users to overwrite the global GitLab connection URL via Stapler data binding, redirecting GitLab API calls to attacker-controlled infrastructure. This causes Jenkins to transmit administrator-configured GitLab API tokens to the attacker's endpoint whenever a pipeline, webhook, or scheduled job triggers a GitLab API interaction. No KEV listing or public exploit has been identified at time of analysis, but the low privilege bar means any Jenkins account holder can abuse this on unpatched installations.
Improper use of the @DataBoundConstructor annotation in Jenkins Script Security Plugin versions ≤1412.v7737b_3405f86 enables low-privileged authenticated users to read the plugin's script approval configuration by submitting certain Jenkins forms. The flaw allows enumeration of which Groovy scripts, methods, and signatures have been approved for execution - information that could assist an attacker in mapping permitted scripted operations within the Jenkins environment. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at the time of analysis.
Observable response discrepancy in Kibana's Osquery feature enables cross-space scheduled query ID enumeration by authenticated low-privileged users. An attacker holding Osquery live-query privileges can determine whether a scheduled query identifier exists in a Kibana space they are not authorized to access by observing distinguishably different API responses. Vendor-released patch is version 9.4.4 per ESA-2026-161; no public exploit or CISA KEV listing is identified at time of analysis.
Incorrect Authorization (CWE-863) in Kibana's machine learning feature allows an authenticated low-privileged user to escalate their effective access beyond their assigned Kibana Space. A user holding ML job management privileges within a single Space can manipulate a job's saved object so it becomes accessible across all Spaces in the Kibana instance, bypassing the tenant-isolation boundary without holding rights to those additional Spaces. Vendor-released patches are available in versions 8.19.19, 9.3.8, and 9.4.4; no public exploit code or CISA KEV listing has been identified at time of analysis.
Path traversal in Elastic Maps Server exposes arbitrary files readable by the server process to unauthenticated network attackers. Insufficient path restriction in the content-directory serving logic allows crafted requests to escape the intended directory using traversal sequences, returning sensitive file contents. No KEV listing or public exploit code exists at time of analysis; Elastic has released fixed versions 8.19.19, 9.4.4, and 9.5.1 per advisory ESA-2026-148.
Missing authorization on a Kibana Entity Store configuration operation allows an authenticated user with elevated Kibana privileges to indirectly coerce a background task into reading Elasticsearch indices the user is not permitted to access directly. The vulnerability - tracked as ESA-2026-147, fixed in Kibana 9.4.5 - is a privilege abuse (CAPEC-122) rather than an authentication bypass: the attacker already holds high Kibana privileges but exploits the missing authz check to escalate their effective read access into restricted Elasticsearch index data. Derived entity records from those unauthorized indices are then surfaced through the Entity Store's output API, completing the information disclosure.
Improper input validation (CWE-20) in the Drupal Link Content Parser contributed module exposes sites to both confidentiality and integrity compromise under high-complexity, high-privilege conditions. All published versions of the module are affected per CPE cpe:2.3:a:drupal:link_content_parser:*:*:*:*:*:*:*:*, with Drupal's security team confirming the issue via advisory SA-contrib-2026-101. No public exploit has been identified at time of analysis, and the CVSS score of 5.9 reflects strong mitigating factors - specifically the requirement for administrator-level authentication and high attack complexity.
Drupal's Commerce CyberSource payment integration module (all versions prior to 1.10.0) contains a timing side-channel vulnerability (CWE-208) that enables brute-force attacks against authentication or token-validation operations. Remote unauthenticated attackers can exploit measurable differences in response timing to iteratively confirm the validity of credentials or secrets, achieving limited integrity impact. Vendor-released patch version 1.10.0 is available via the Drupal security advisory sa-contrib-2026-106; no public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated information disclosure in DXPR Builder, a Drupal page-building and AI editing module, exposes sensitive data through forceful browsing against insufficiently protected endpoints. All releases from 0.0.0 through 2.8.0 are affected; version 2.8.1 is the patched release per Drupal security advisory SA-CONTRIB-2026-112. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Missing authorization enforcement in Craft CMS versions 5.7.0 through 5.10.12 allows authenticated control panel users to query volume metadata for asset repositories they are not permitted to access. The AssetsController::actionMoveInfo method accepts POST requests with arbitrary folderIds and returns asset count and total storage size without verifying the requesting user's volume permissions, violating the principle of least privilege within Craft's multi-volume access model. No public exploit code exists at time of analysis and the vulnerability is absent from CISA KEV; the CVSS 4.0 score of 5.3 with PR:L accurately reflects that an authenticated session is required.
Unauthenticated information disclosure in MasterStudy LMS WordPress Plugin before 3.7.46 exposes learning statistics for any registered user without authorization. The plugin's student statistics endpoint performs no access control check, allowing any remote attacker to retrieve course counts, accumulated points, certificates, quiz totals, and assignment totals for arbitrary user accounts. A publicly available exploit exists per WPScan, and the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or user interaction is required.
Unauthenticated information disclosure in MasterStudy LMS WordPress Plugin before 3.7.46 exposes the titles and IDs of an author's unpublished courses - including draft, pending, and private posts - through an unprotected REST API endpoint. The affected route performs no access control check and applies no publication-status filter, meaning any unauthenticated network request can enumerate course content that site owners intended to keep hidden. A publicly available proof-of-concept exists per the WPScan advisory; no active exploitation has been confirmed in CISA KEV at time of analysis.
Unauthenticated information disclosure in MasterStudy LMS WordPress Plugin (all versions before 3.7.46) exposes per-student course enrollment and learning progress data to any remote attacker without credentials. The plugin fails to perform an authorization check before returning student-specific data, allowing enumeration of any registered user's enrolled courses and progress metrics. A publicly available exploit exists via WPScan; no active exploitation (KEV) has been confirmed, and the CVSS 5.3 score accurately reflects limited confidentiality impact.
FormLayer WordPress plugin before version 1.0.9 discloses full form configuration data to unauthenticated users through its public submission handler, which performs no authorization check before returning stored settings. Notification recipient email addresses, confirmation redirect targets, and third-party integration credentials are exposed for all forms - including unpublished drafts invisible to end users. A public exploit exists via WPScan, and a vendor patch is available at version 1.0.9.
Rank Math SEO WordPress plugin versions before 1.0.277.1 exposes the full content of password-protected posts to unauthenticated users via publicly generated SEO metadata. The plugin fails to enforce WordPress's native post-password gate before extracting post content for use in meta tags and structured data, making protected content readable by anyone who can access the SEO output. A publicly available proof-of-concept is documented by WPScan; a vendor patch (1.0.277.1) is available.
Unauthenticated information disclosure in the Ultimate Member WordPress plugin (all versions before 2.13.0) exposes the content of comments still awaiting moderation and activity from private user profiles to any anonymous visitor. The plugin's profile activity endpoint fails to verify both comment approval status and profile privacy settings before returning data, meaning moderated/private content is served as if it were public. A publicly available proof-of-concept exists; no active exploitation has been confirmed via CISA KEV.
Plaintext password disclosure in the Gutentor WordPress page builder plugin (before 4.0.6) allows any authenticated subscriber-level user to retrieve the passwords of password-protected posts via a misconfigured REST API endpoint. The endpoint fails to enforce WordPress's built-in content-access context restrictions, meaning the security model of password-protected posts is completely bypassed for any site user who can authenticate. A publicly available exploit exists per WPScan, and a patched release (4.0.6) is available from the vendor.
Unauthenticated information disclosure in the Solace Extra WordPress plugin before 1.7.0 exposes the full content of non-published Site Builder parts - drafts, pending posts, private pages, and trashed items - to any anonymous visitor via an unprotected AJAX action. The plugin registers an AJAX handler that performs no capability check and no post-status validation, bypassing WordPress's normal access controls entirely. A public proof-of-concept is available through WPScan; the vendor has released version 1.7.0 to close the gap.
Cross-origin data leak in Google Chrome's Skia graphics library (prior to 152.0.7977.75) enables an attacker who has already achieved renderer process compromise to extract cross-origin data via a crafted HTML page. This is a second-stage vulnerability in an exploit chain: it does not enable initial access but amplifies an existing renderer compromise by breaking the Same-Origin Policy boundary. No public exploit code and no CISA KEV listing have been identified at time of analysis, though Google internally rates this 'High' severity - notably elevated above the computed CVSS 3.1 (Low) score.
Information leakage via the MediaCapture component in Google Chrome prior to 152.0.7977.75 enables a remote attacker to exfiltrate sensitive browser-side data by directing a user to a specially crafted HTML page. The flaw (CWE-200) resides in Chrome's implementation of the W3C Media Capture API, which handles camera, microphone, and display-capture device access, and may expose captured media content or associated metadata beyond the intended same-origin boundary. Google has released a fix in the 152.0.7977.75 stable channel update; no public exploit has been identified at time of analysis.
Address bar spoofing in Google Chrome on Android prior to version 152.0.7977.75 allows an unauthenticated remote attacker to deceive users about their true browsing origin by triggering fullscreen mode via a crafted HTML page. The flaw (CWE-451: UI Misrepresentation of Critical Information) causes the address bar to be suppressed or misrepresented during fullscreen transitions, creating a reliable phishing surface on Android devices. Google has released a fix in Chrome 152.0.7977.75; no public exploit code has been identified and CISA SSVC rates exploitation as none at time of analysis.
Confused deputy vulnerability in Chrome's CredentialProvider component on Windows allows a remote attacker who has already established renderer process compromise to leak sensitive credential information via a crafted HTML page. Affected versions are Chrome for Windows prior to 152.0.7977.75. Google rates this Low severity internally, though the CVSS Confidentiality impact is scored High due to the potential for credential disclosure; the AC:H vector reflects the significant prerequisite of prior renderer compromise. No public exploit code or CISA KEV listing has been identified at time of analysis.
CVE-2026-80220 is attributed to Ubuntu but carries no description, CVSS score, CWE classification, or technical details in the available intelligence data. Without a vulnerability description or affected component, no characterization of attacker capability, impact type, or affected user population is possible. Security teams should monitor Ubuntu Security Notices directly at ubuntu.com/security/notices for authoritative details as they become available.
CVE-2026-16658 is attributed to Ubuntu (vendor source) but carries no available description, CVSS score, CWE classification, or reference data at time of analysis. The affected component, attack vector, and impact are entirely unknown from the provided intelligence. No meaningful characterization of attacker capability or defender exposure can be made without additional disclosure from Canonical or NVD.
Unauthenticated information disclosure in WWBN AVideo through 30.0 exposes sensitive configuration data via the MobileManager plugin's getConfiguration endpoint. Any remote attacker can issue a GET request to plugin/MobileManager/getConfiguration.json.php without credentials and receive TLS private key file paths, socket configuration details, platform version, and debug flags. While the direct confidentiality impact is limited (file paths and config metadata rather than key material itself), the leaked data provides meaningful reconnaissance for follow-on attacks targeting the installation. No public exploit or CISA KEV listing is identified at time of analysis.
Path traversal in WWBN AVideo's unauthenticated `get_api_login_code` API endpoint enables remote attackers to delete arbitrary `.log` files and enumerate filesystem paths by injecting directory traversal sequences into the `code` parameter. All versions covered by CPE `cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*` are affected, with exploitation requiring no authentication or user interaction. The primary security consequence is destruction of audit trails and access logs, which undermines incident detection and forensic response capabilities; no public exploit code has been identified at time of analysis.
Out-of-bounds read in the HPE AOS-CX network operating system allows adjacent unauthenticated attackers to disclose sensitive OS memory contents by sending a specially crafted packet. The flaw requires no credentials and no user interaction, but is constrained to same-segment network access (AV:A), limiting exposure to attackers who have already achieved a foothold on the target network or VLAN. This is one of several vulnerabilities disclosed in HPE advisory HPESBNW05134, which also covers more severe unauthenticated adjacent RCE issues (CVE-2026-73782, CVSS 8.8) and network-reachable RCE (CVE-2026-73749, CVSS 9.8) in the same product line - those higher-severity siblings should be prioritized alongside this finding. No public exploit has been identified at time of analysis.
Information disclosure in HPE AOS-CX exposes sensitive API endpoint data to a remote unauthenticated attacker who can achieve a man-in-the-middle position on the network path. Intercepted data could include credentials, session tokens, or configuration material usable to further compromise the affected switch or pivot into managed network infrastructure. This CVE is part of a broader HPE advisory (hpesbnw05134) covering at least four additional AOS-CX vulnerabilities; no public exploit code and no CISA KEV listing have been identified.
Cleartext exposure of sensitive information in HPE Networking Fabric Composer's management interface can be triggered by an authenticated administrator, potentially revealing credentials or configuration data for downstream network services. The vulnerability requires both administrative privileges and high attack complexity (CVSS 2.2, AV:N/AC:H/PR:H), meaning realistic exploitability is limited to insiders or attackers who have already fully compromised an admin account. Successful exploitation could enable lateral movement into network services managed by Fabric Composer. No public exploit code or CISA KEV listing has been identified.
Unauthenticated remote information disclosure in HPE Networking Fabric Composer exposes cleartext data through the web-based management interface to network-positioned attackers. Exploitation demands high attack complexity (CVSS AC:H), constraining real-world risk despite the network-accessible, no-authentication vector. The vendor advisory identifies remediation; no public exploit code or CISA KEV listing has been identified, though the disclosed data could enable secondary compromise of dependent network infrastructure.
Cleartext exposure of sensitive information in the HPE Networking Fabric Composer API allows a local attacker holding administrative credentials to retrieve secrets that the system is expected to protect in encrypted form. The vulnerability is constrained to local access with high privileges already obtained, yielding a CVSS 3.1 score of 4.4 (Medium). No public exploit code or active exploitation has been identified at time of analysis; the advisory originates from HPE itself, suggesting proactive disclosure rather than incident response.
Local information disclosure in HPE Networking Fabric Composer allows an authenticated low-privileged operator user with local system access to read sensitive OS-level data, potentially enabling privilege escalation on the affected host. The vulnerability resides in the underlying operating system layer exposed through Fabric Composer's operator access model, and is constrained by both a local attack vector and high complexity requirement. No public exploit code has been identified and this entry does not appear in the CISA KEV catalog.
Unauthenticated file read in HPE Networking Fabric Composer's web-based management interface exposes a subset of system files to remote attackers without requiring any credentials. The vulnerability is confined to files within a specific affected directory rather than offering arbitrary filesystem access, yielding a limited confidentiality impact consistent with the CVSS 5.3 (C:L) score. No active exploitation (KEV) or public proof-of-concept has been identified at time of analysis, and no EPSS signal is provided in available intelligence.
Authenticated privilege escalation in HPE Networking Fabric Composer's API allows low-privilege operator users to read limited information and make limited configuration changes beyond their authorized scope. The flaw affects all tracked versions per CPE data and requires only a valid low-privilege account to exploit - no special configuration or user interaction is needed. No public exploit code and no CISA KEV listing are present at time of analysis, keeping real-world risk moderate despite network accessibility.
Local information disclosure in HPE Networking Fabric Composer exposes sensitive operating-system-level data to authenticated low-privilege operator users with local system access. The CVSS Scope:Changed metric reflects that the leaked data crosses from the Fabric Composer application boundary into the underlying host OS, and HPE warns the recovered information could enable further unauthorized access to the affected system and interconnected infrastructure. No public exploit is identified at time of analysis; exploitation requires both a valid low-privilege credential and local system access, materially constraining the realistic threat population.
Unauthenticated information disclosure in HPE Networking Fabric Composer's API endpoint exposes internal service and workflow details to remote attackers under high-complexity conditions. The vulnerability requires user interaction per the CVSS vector (UI:R), which is atypical for an API endpoint flaw, suggesting a specific trigger mechanism or chained condition not fully described in the advisory. Impact is limited to low confidentiality exposure, though HPE's own advisory frames it as a stepping stone that increases risk when chained with other vulnerabilities. No public exploit or KEV listing identified at time of analysis.
Timing side-channel exposure in phpseclib's pure-PHP X25519 scalar multiplication allows a local observer to recover a reused 251-bit clamped private key. Data-dependent conditional modular reductions in PrimeField/Integer.php cause per-step timing and libgmp call-count variation during the Montgomery ladder, leaking scalar bits when the same private key is used across multiple operations. Only applications using a long-lived or reused X25519 private key on the pure-PHP code path are at risk; phpseclib's standard SSH ephemeral key exchange is explicitly unaffected. Vendor-released patches exist in versions 3.0.57 and 4.0.1; no public exploit has been identified at time of analysis.
NoSQL injection in Kibana exposes unauthorized Elasticsearch data to authenticated low-privilege users who can submit crafted query input. The flaw, classified as CWE-943 (Improper Neutralization of Special Elements in Data Query Logic / CAPEC-676), allows manipulation of backend NoSQL query logic to return records outside the user's authorized data scope. Elastic has released fixed versions 9.4.5 and 9.5.1 per ESA-2026-168; no public exploit or CISA KEV listing has been identified at time of analysis.
Kibana's missing server-side authorization check (CWE-862) allows any authenticated user holding only minimal Elasticsearch privileges to bypass Kibana feature authorization and Space access controls, reading Fleet deployment metadata from the default Kibana space without having been granted that permission. The flaw is rooted in an absent authorization gate on Fleet API paths rather than a misconfiguration, meaning the control is simply not enforced rather than configured incorrectly. Elastic has self-reported the issue and released fixes in versions 9.4.6 and 9.5.1 per advisory ESA-2026-149; no public exploit code or active exploitation (CISA KEV) has been identified.
Missing authorization on an internal Kibana APM integration function exposes APM server credentials to any authenticated Kibana user. The affected endpoint was designed for APM or Fleet administrators but lacked the corresponding role-based access control check, allowing lower-privileged authenticated users to retrieve secrets that govern access to the APM backend. No public exploit code or CISA KEV listing exists at time of analysis; however, the straightforward exploitation path and high confidentiality impact from credential exposure make this a meaningful lateral-movement risk in Elastic Stack deployments.
HTTP Request Smuggling in Elasticsearch allows a network attacker to intercept confidential HTTP responses intended for other authenticated users when Elasticsearch is deployed behind certain proxy configurations. The vulnerability (CWE-444, CAPEC-33) arises from inconsistent HTTP request boundary interpretation between the intermediary proxy and Elasticsearch, enabling response queue poisoning that leaks data across user sessions. Vendor-released patches 8.19.20, 9.4.5, and 9.5.1 are available per ESA-2026-141; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege abuse in Kibana's machine learning feature allows any user holding read-only ML access to retrieve data from Elasticsearch indices they are not authorized to see. The flaw (CWE-250) occurs because Kibana executes certain ML read operations under an internal service identity rather than forwarding the requesting user's credentials to Elasticsearch, effectively bypassing Elasticsearch's index-level access controls. Elastic self-disclosed the issue in ESA-2026-135 and released fixes across three active release lines; no public exploit code has been identified.
Authorization bypass in gRPC-Go's xDS RBAC HTTP filter prior to v1.83.1 allows network attackers to evade DENY policies when header matcher names use mixed case. Because gRPC metadata keys are always lowercased at the protocol layer, a DENY rule configured with canonical HTTP capitalization (e.g., `X-Role`, `User-Agent`) never fires, causing the policy to fail open and permit requests it should block. The same case mismatch also enables bypass of gRFC A41 pseudo-header validation (`:Scheme`, `Grpc-Status`) and prevents `Host` from being rewritten to `:authority`. No public exploit is identified at time of analysis; a vendor-confirmed fix ships in v1.83.1.
Uninitialized heap memory disclosure in gvfs's SFTP backend enables a malicious SFTP server to deterministically defeat ASLR on client systems running RHEL 6 through 10. When a user mounts a crafted SFTP share, the read_string() parser allocates a buffer for the FXP_HANDLE response but does not verify that the buffer is fully populated; the client subsequently echoes the uninitialized remainder - containing heap base pointers and the libgio load address - back to the attacker on every subsequent file-handle request. No public exploit has been identified at time of analysis, and the issue does not appear in CISA KEV, but the ASLR bypass it achieves is a high-value precursor for chained memory-corruption attacks against gvfsd-sftp.
Improper privilege management in Cleo Harmony's JWT Refresh Token Handler allows remote unauthenticated attackers to manipulate the Bearer argument on the /api/connections API endpoint, resulting in unauthorized access to connection data and potential privilege escalation. Affected versions span all releases up to and including 5.8.1.10, with a public exploit already available (E:P per CVSS 4.0 supplemental). No active exploitation confirmed in CISA KEV, but the combination of network accessibility, zero-privilege requirement, and public proof-of-concept materially elevates real-world risk.
Unauthenticated enumeration of internal PKI topology is possible in Red Hat Certificate System 9 through an unprotected REST endpoint. Any network-accessible client can issue GET /ca/rest/securityDomain/hosts and receive a structured inventory of all participating CA subsystem hosts, their roles, and security domain membership - without presenting credentials, a client certificate, or a session token. While the direct CVSS impact is rated medium (5.3), the real-world significance lies in enabling precise reconnaissance of internal PKI infrastructure that could facilitate targeted follow-on attacks against specific subsystems. No active exploitation is confirmed and no public exploit code has been identified at time of analysis.
Information disclosure in Firefox for Android's WebExtensions component exposes sensitive browser or cross-origin data to remote attackers who can induce user interaction. Affecting all Firefox for Android versions prior to 155, the flaw is accessible over the network with low complexity but requires a user to interact with attacker-controlled content, gating mass exploitation. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Use-after-free in Firefox's DOM Core & HTML component allows network-reachable attackers to achieve limited memory disclosure and DOM integrity impact against users running Firefox below version 155 or Firefox ESR below 153.2. Exploitation requires user interaction - a victim must visit or be redirected to attacker-controlled content - but no authentication or elevated privileges are needed. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; Mozilla has released patched versions addressing the flaw.
Use-after-free memory corruption in Firefox's DOM Core and HTML component allows a remote attacker to achieve limited confidentiality and integrity impact against users running unpatched Firefox versions by directing them to a crafted webpage. All Firefox releases prior to version 155, ESR 140.15, and ESR 153.2 are affected; Mozilla has shipped fixes across all three release channels. No public exploit code or active exploitation has been identified at time of analysis.
Use-after-free in Firefox's Audio/Video media pipeline allows unauthenticated remote attackers - requiring only user interaction - to read or modify limited browser memory content. Affected releases span Firefox stable prior to 155 and both ESR tracks prior to 140.15 and 153.2, covered by three separate Mozilla security advisories (MFSA2026-82, MFSA2026-84, MFSA2026-85). No public exploit code exists at time of analysis and SSVC exploitation status is 'none,' though the CWE-416 class carries inherent escalation risk beyond the partial impact Mozilla scored.
Use-after-free in Firefox's JavaScript garbage collector (GC) component exposes users to partial memory disclosure and corruption when visiting attacker-controlled web pages. Both the standard release line (Firefox 155) and the extended support release (Firefox ESR 153.2) are patched. No public exploit or active exploitation is confirmed; SSVC exploitation status is none and the vulnerability is absent from CISA KEV.
Use-after-free in Firefox's Audio/Video component exposes users running Firefox prior to version 155 and affected ESR branches to potential heap memory disclosure and limited data modification when processing attacker-controlled media. The vulnerability is network-reachable but requires user interaction - visiting a malicious or compromised page that triggers media playback - and carries a CVSS score of 5.4 reflecting bounded C:L/I:L impact with no availability loss. No public exploit code or active exploitation has been identified at time of analysis; SSVC assessment classifies exploitation status as none and the vulnerability as non-automatable.
Unauthenticated network attackers can elicit Java stack traces from Red Hat IdM's Dogtag CA REST enrollment endpoint (POST /ca/rest/certrequests) by submitting malformed requests, causing HTTP 500 responses that expose internal implementation details under CWE-209. The same error path simultaneously amplifies the CA debug log with large multi-line stack traces, creating a log-fill resource exhaustion vector that drives disk growth and I/O contention on affected RHEL 6 through 10 deployments. No public exploit has been identified at time of analysis, but the attack requires no authentication and low complexity, making it accessible to unskilled opportunistic attackers targeting IdM infrastructure.
Untrusted pointer dereference in Samsung mTower's Secure world entry point allows a Non-Secure world caller to supply pointer values referencing Secure RAM, causing the TEE kernel to dereference those addresses on behalf of the attacker and potentially exposing or corrupting cryptographic material and other Secure world state. All mTower deployments before commit 06994e303637512e39062f3e037c222e8448e57e on ARM Cortex-M TrustZone hardware are affected, spanning both the session-open and invoke-command paths. No public exploit code has been identified and the vulnerability is absent from CISA KEV; however, the security boundary violated - Normal World to Secure World - represents a fundamental TrustZone integrity failure with real confidentiality and integrity consequences that the provided CVSS score significantly understates.
Unauthenticated REST endpoint access in the KiviCare WordPress plugin (before 4.5.5) exposes both a clinic's full patient roster and, critically, the configured payment gateway secret key to any unauthenticated remote attacker. The vulnerability stems from missing authorization checks on specific REST API routes, requiring no credentials or user interaction to exploit. A publicly available proof-of-concept is documented by WPScan, materially lowering the bar for exploitation across any WordPress site running an unpatched version of this clinic management plugin.
Shortcode injection in MW WP Form WordPress plugin (versions before 5.1.5) allows unauthenticated remote attackers to execute any WordPress shortcode registered on the target site. The plugin fails to neutralize shortcode syntax in user-submitted form values before passing those values through WordPress's shortcode processing engine. A publicly available proof-of-concept exists (via WPScan), though exploitation is gated by a non-default site configuration requirement, which suppresses real-world risk despite the network-accessible attack vector.
Web cache poisoning in WP Fastest Cache WordPress plugin before 1.5.1 enables unauthenticated attackers to inject content into the site-wide page cache by exploiting its failure to include tracking-related query parameters in cache key construction. Because the plugin caches responses to URLs containing these parameters under the canonical clean-URL key, an attacker-controlled page render is stored and subsequently served to every visitor of the legitimate URL. A publicly available proof-of-concept exploit exists; no active exploitation confirmed in CISA KEV at time of analysis.
Sensitive field value disclosure in Ash Framework's atomic confirmation validator allows any caller of a vulnerable action to extract a stored sensitive attribute by intentionally submitting a wrong confirmation argument. Versions 2.17.20 through before 3.32.2 of ash-project/ash are affected: when an actor supplies only the confirmation argument and omits the field itself, the atomic `Confirm` validator resolves the mismatch error's `value` through `atomic_ref/2` to the field's current stored database value and returns it in the error payload. No public exploit exists beyond the regression test shipped with the fix commit, and this vulnerability does not appear in the CISA KEV catalog.
Sensitive application data leaks from HTTP 500 responses in ash_typescript versions 0.15.0 through 0.17.x due to an ungated code path that serializes handler return values verbatim using Elixir's inspect/2. Any unauthenticated caller who can trigger a typed-controller route whose handler falls through with a non-conn term - such as {:error, %User{}} - receives the full Elixir struct inspection, potentially including hashed passwords, session tokens, and tenant identifiers, in the JSON error body. No public exploit identified at time of analysis, but the disclosure is trivially reproducible with a standard HTTP client given the right application-layer condition.
Sensitive internal error data - including runtime secrets potentially carried in Ash error vars fields - leaks to unauthenticated network clients in ash_typescript 0.8.0 through 0.17.x when a configured error handler raises a FunctionClauseError on an unmatched error shape. The rescue clause in apply_error_handler/3 was intended as a safety net but fell back to returning the original, unredacted error map rather than a safe generic response, inverting the intended suppress-on-failure semantics. No public exploit code has been identified and there is no CISA KEV listing; a patched release (0.18.0) is available from the Ash Project.
HTTP request smuggling in Node.js's HTTP client module enables forwarding proxies to desynchronize backend connections when request headers exceed the maxHeadersCount or maxHeaderPairs thresholds. When a Node.js-based proxy rebuilds outbound request headers from the visible IncomingMessage properties and pipes the original body over a reused backend connection, framing-critical headers such as Content-Length are silently omitted from the proxy's outbound request while still governing body delivery internally - causing the backend to misparse the request stream. No public exploit has been identified at time of analysis, and exploitation is constrained to specific proxy architectures, which is reflected in the CVSS 3.7 Low score.
Sensitive WooCommerce order and product data is exposed to authenticated subscribers in the 'Print Barcode Labels for your WooCommerce products/orders' WordPress plugin versions 4.0.0 and below, developed by ukr_solution. The flaw (CWE-201) allows low-privilege authenticated users - those holding only a subscriber role - to retrieve data beyond their authorized scope, yielding a High confidentiality impact per CVSS. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Revoked API token enforcement is absent in QuantumNous new-api up to 1.0.0-rc.15, allowing a holder of a disabled token to query read-only endpoints such as /api/usage/token/ and retrieve usage log data. The root cause (CWE-613, Insufficient Session Expiration) lies in the TokenAuthReadOnly middleware in middleware/auth.go, which skipped the disabled-token status check entirely before the patch. A public POC is available; no active exploitation is confirmed in CISA KEV, and the CVSS 4.0 score of 2.1 reflects the narrow, low-impact attack surface.
Address bar spoofing in Firefox for iOS lets a malicious webpage stall a popup's cross-origin navigation after the browser internally commits it, causing the address bar to display the intended destination's origin while the popup continues rendering attacker-controlled content. All Firefox for iOS releases prior to 155.0 are affected; the fix shipped in version 155.0 per Mozilla advisory MFSA2026-81. No public exploit has been identified and CISA SSVC confirms exploitation status as none, but the phishing potential is realistic given the deceptive UI state.
Improper access control in dibo-software diboot 3.8.0 allows authenticated remote attackers to bypass tenant isolation by manipulating the tenantId parameter in the Tenant Administrator Management API at /admin/. An attacker with low-privileged access to one tenant can read and modify data belonging to other tenants, breaking the multi-tenant security boundary. A public proof-of-concept exploit exists, and the vendor has not responded to disclosure, leaving users without an official patch.
Information disclosure in extension.vn 2FA Authenticator Extension 1.0.0.2 for Chrome exposes stored TOTP secrets via an unvalidated external message listener. The Background Service Worker's `chrome.runtime.onMessageExternal.addListener` handler fails to verify the `sender.id` field, meaning any other locally-installed Chrome extension can send a crafted message and receive TOTP seeds in response. A public proof-of-concept exploit exists; exploitation is constrained to local access with low-privilege conditions per the CVSS 4.0 vector (AV:L/PR:L), and no active exploitation has been confirmed.
Information disclosure in vidIQ Vision for YouTube Extension 3.199.0 on Chrome exposes YouTube video frame captures to any web page able to send crafted postMessage events. The extension's window.addEventListener handler processes incoming messages without validating the sender origin, allowing a remotely-hosted malicious page to exfiltrate frame capture data by manipulating the vidiqEvent argument. No patch is available - the vendor has explicitly stated they do not accept vulnerability submissions and operate no bug bounty program - and a public proof-of-concept exploit is available on GitHub.
HCL Connections exposes sensitive information to unauthorized users through improper handling of request data, classified under CWE-359 (Exposure of Private Personal Information to an Unauthorized Actor). The vulnerability affects all tracked versions per the wildcard CPE and is exploitable over the network, though high attack complexity (AC:H) and required user interaction (UI:R) substantially constrain real-world exploitability. No public exploit code or active exploitation has been identified at the time of analysis, and the CVSS score of 3.1 reflects the limited confidentiality impact and constrained attack prerequisites.
Cleartext password storage in sambitraj's Student Management System exposes user credentials to privileged attackers who can access the database or application backend. The flaw resides in aca.sql within the Password Handler component, where passwords are persisted without hashing or encryption. A proof-of-concept has been publicly disclosed via a GitHub issue, though exploitation requires high-privilege access, keeping real-world risk low despite the sensitive nature of the exposed data.
Default credentials hardcoded in the aca.sql database initialization file of sambitraj's Student-Management-System expose unauthenticated remote attackers to authentication bypass using publicly known passwords across all commits through 56ba287f. The project's GitHub issue tracker hosts a public proof-of-concept, and the maintainer has not responded to the disclosure, leaving no remediated release available. The limited deployment footprint (a niche student-facing open-source project) constrains aggregate real-world impact despite the trivial exploitability of default credentials.
Session cookie exposure in sambitraj's Student-Management-System allows attackers to steal session tokens via client-side JavaScript due to the absence of the HttpOnly flag in the `session_start` function. All commits up to 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5 are affected, and no vendor patch exists as the maintainer has not responded to the responsible disclosure. A publicly available proof-of-concept exists, though exploitation requires high attack complexity and a co-present XSS vector to materialize as a session hijack.
Double-free memory corruption in Valkey 9.1.0's Module Timer Subsystem allows a high-privileged remote attacker to crash the server by triggering a self-stopping timer callback pattern. The moduleTimerHandler function in src/module.c frees the timer object both inside the callback (via ValkeyModule_StopTimer) and again after callback return, causing a double-free. A public proof-of-concept has been disclosed via GitHub, though the CVSS 4.0 score of 1.9 reflects that exploitation requires high-privilege module control, severely constraining real-world impact to low-severity availability disruption.