Information Disclosure
Monthly
Direct remote access to an unprotected SQL database backup file in code-projects Simple Inventory System 1.0 allows unauthenticated attackers to retrieve the full contents of the inventory database without any credentials or user interaction. The file inventorymanagement.sql is stored within the web-accessible directory and is directly downloadable via HTTP. A publicly documented proof-of-concept on GitHub confirms trivial exploitability of this exposure.
Tenant hijacking and request degradation in AshPhoenix (ash_phoenix 2.1.26 through 2.3.24) allows unauthenticated remote clients to force an Ash multi-tenant application to resolve an arbitrary tenant by supplying a crafted HTTP Host header. The root cause is that AshPhoenix.Helpers.get_subdomain/2 interpolated the configured root domain verbatim into a regex pattern, causing domain dots to act as any-character wildcards and the match to be applied unanchored and globally - so Host: foo.exampleXcom.attacker.net satisfied a rule intended to match only subdomains of example.com, returning foo as the tenant. A separate case-sensitivity flaw allowed TENANT.EXAMPLE.COM to bypass the allowlist check entirely. No CISA KEV listing and no public proof-of-concept have been identified at time of analysis, but exploitation requires no authentication and no special tooling.
Sensitive form parameters leak into server logs, crash reports, and the Phoenix development error page in ash_phoenix versions 1.2.17 through 2.3.24, where AshPhoenix.Form.Auto embeds the complete raw submitted param map verbatim into exception messages when a union sub-form receives an unrecognized _union_type value. Because the exception is raised inside library code rather than Phoenix's controller layer, the standard :filter_parameters configuration cannot redact the exposure-any field co-submitted with the union form field, including passwords and tokens, appears in plaintext in the raised message. No public exploit has been identified at time of analysis, but any user capable of submitting a form with a union field can deliberately trigger the leak regardless of intent.
Out-of-bounds read in Kamailio's IMS AVP handler exposes telecom infrastructure to remote memory disclosure and potential service disruption. The `get_4bytes()` function across five IMS modules - `ims_auth`, `ims_icscf`, `ims_registrar_scscf`, `ims_charging`, and `ims_ocs` - fails to validate that Diameter AVP data buffers contain at least 4 bytes before reading, allowing a remote attacker with low-privilege Diameter interface access to trigger the flaw via a crafted malformed message. Publicly available exploit code exists per GitHub issue #4816, and the vendor has confirmed that the 5.5.0 branch is end-of-life and will receive no further security updates, compounding risk for operators running that release.
Uncontrolled recursion in BBEdit's Java Language Module (versions through 15.5.5) allows a remote attacker to crash or hang the editor by delivering a specially crafted Java source file that a user then opens. The root cause is CWE-674: the Java parser lacks depth-limiting guards, enabling deeply nested constructs to exhaust the call stack and produce a denial-of-service against the editor process. No active exploitation has been recorded and no public proof-of-concept exploit code is known; the issue was surfaced through fuzzing research by Cipher Security Labs, and Bare Bones Software has released a fix in BBEdit 16.0.
Unfiltered exception serialization in ash_ai 0.6.0-0.x leaks internal application details - database schema, raw SQL fragments, policy module names - to authenticated chat users via the LLM conversation stream. AshAi.ToolLoop and AshAi.Tools used Elixir's Exception.message/1 verbatim to encode any raised tool exception into the tool-result payload, which the language model then relayed to the requesting user. Any authenticated user able to steer tool arguments into a code path that raises an exception could extract sensitive internal reconnaissance data; ash_ai 1.0.0 closes the gap by routing all tool exceptions through a safe formatter. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Improper authorization in LogNet's grpc-spring-boot-starter affects annotation processing logic in versions up to 5.2.0, allowing authenticated remote attackers with low privileges to bypass access controls under high-complexity conditions. The vulnerability stems from CWE-266 (Incorrect Privilege Assignment) in the component responsible for processing security annotations on gRPC service endpoints. A proof-of-concept exploit has been publicly disclosed; no vendor patch is available as the project has not yet responded to the responsible disclosure report.
CVE-2026-58582 is an Ubuntu-reported vulnerability for which no description, CVSS score, CWE classification, or technical detail has been made publicly available at time of analysis. The sole intelligence signal is a vendor attribution to Ubuntu, meaning the affected component is likely within the Ubuntu distribution or an upstream package it ships. Without further disclosure, the impact, exploitability, and scope cannot be characterized.
CVE-2026-58581 has been reported through Ubuntu's vendor channel, but no description, CVSS score, vector, or CWE data is available at time of analysis. The affected product, vulnerability class, and impact cannot be characterized without a description. No exploitation status, patch information, or affected version range can be determined from the supplied intelligence.
CVE-2026-50624 has no publicly available description, CVSS score, CWE classification, or reference data at time of analysis. The only available metadata is a reporter tag of 'vendor:ubuntu', indicating Ubuntu as the reporting source. No meaningful impact, affected component, or attack vector can be determined from the supplied data.
CVE-2026-61402 is reported by the Ubuntu vendor channel but carries no description, CVSS score, CWE classification, or reference URLs at this time. The affected package, vulnerability class, and impact are entirely unconfirmed from the available data. No meaningful characterization of attacker capability or affected user population is possible without additional intelligence.
CVE-2026-81493 is a Ubuntu-reported security update with no substantive public data available at time of analysis. The CVE record contains only the placeholder description 'security update' and carries no CVSS score, no CWE classification, no CPE strings, and no referenced advisories, making it impossible to characterize the vulnerability type, affected component, or attacker capability. No exploitation status, patch version, or technical detail can be derived from the available intelligence.
CVE-2026-81496 is documented only as a 'security update' by the Ubuntu vendor source, with no description, CVSS score, CWE classification, or reference links provided in the available intelligence. The affected component, impact class, and exploitation conditions cannot be determined from the current data. No meaningful characterization of attacker capability or victim exposure is possible without additional vendor disclosure.
Ubuntu has published a security advisory for CVE-2026-81498, but the provided intelligence contains no substantive technical content - the description is only 'security update' with no affected package, version, or vulnerability class identified. No CVSS score, CWE, CPE strings, EPSS data, or advisory URL were supplied. This entry cannot be meaningfully characterized without further enrichment from Ubuntu Security Notices or NVD.
CVE-2026-81497 is an Ubuntu-reported security update with no substantive technical detail available in the current data set. The description contains only the phrase 'security update,' which provides no insight into the affected component, vulnerability class, or impact. No CVSS score, CWE, CPE strings, EPSS data, KEV status, or references were supplied, making meaningful risk characterization impossible at this time.
Insufficient data exists to characterize CVE-2026-81495 beyond its origin as a Ubuntu vendor security update. The description field contains only the text 'security update' with no detail on the affected component, vulnerability class, or attacker capability. No CVSS vector, CWE, CPE, EPSS, KEV status, references, or patch version are available in the provided intelligence. No meaningful synthesis is possible without additional sourcing.
CVE-2026-66022 is reported by Ubuntu but carries no public description, CVSS score, vector, or CWE at time of analysis. The affected product, vulnerability class, and impact are entirely unknown from the available data. No meaningful characterization of attacker capability or affected scope is possible without a vendor advisory or NVD entry.
Insufficient data exists to characterize CVE-2026-63323 meaningfully. The CVE record contains no description, no CVSS score, no CWE, and no references beyond a single vendor:ubuntu tag. The affected product, vulnerability class, and impact are all unknown at this time. Security teams should treat this as an unresolved record and monitor NVD and Ubuntu Security Notices (USN) for updates.
CVE-2026-65928 has no available description, CVSS score, CWE classification, or affected version data at time of analysis. The sole intelligence signal is a vendor attribution to Ubuntu. No meaningful impact, attack vector, or affected population can be determined from the provided data. Security teams should monitor for NVD publication and Ubuntu Security Notices (USN) before making prioritization decisions.
CVE-2026-65929 is reported by Ubuntu with no description, CVSS data, CWE classification, or affected package information available at this time. The vulnerability cannot be characterized beyond its association with the Ubuntu vendor source. Security teams should monitor Ubuntu Security Notices (USN) and the NVD entry for this CVE as data becomes available.
CVE-2026-63321 has been reported via Ubuntu's vendor channel, but no description, CVSS score, CWE classification, or technical detail is available in the provided intelligence data. The affected component, vulnerability class, and impact cannot be characterized with the current dataset. Security teams should query Ubuntu's security tracker directly for authoritative details before making prioritization decisions.
CVE-2026-63322 has been reported by Ubuntu's security team, but no description, CVSS score, CWE classification, or exploit intelligence is publicly available at time of analysis. The vulnerability's impact, affected component, and exploitability cannot be determined from current data. Security teams should monitor the Ubuntu Security Notices portal and USN advisories for disclosure.
Insufficient data prevents meaningful synthesis for CVE-2026-17516. The only available signal is a vendor report attributed to Ubuntu, with no description, CVSS score, CWE, affected versions, or references provided. No impact, attack vector, or affected component can be determined from the supplied input.
CVE-2026-15264 is reported by the Ubuntu vendor source but carries no description, CVSS score, CWE classification, or reference links at time of analysis. No meaningful synthesis of impact, affected component, or attacker capability is possible from the available data. Security teams should treat this as an uncharacterized disclosure pending vendor publication of a full advisory.
CVE-2026-63110 is reported by Ubuntu but carries no description, CVSS score, vector, or CWE in the available intelligence data, making meaningful impact assessment impossible at this time. The sole attribution signal is 'vendor:ubuntu', indicating Ubuntu has acknowledged or reported this identifier, but the affected component, vulnerability class, and exploitability are entirely unknown. Security teams should monitor Ubuntu Security Notices (USN) and the NVD entry for this CVE until authoritative details are published.
CVE-2026-61476 is reported by Ubuntu with no description, CVSS score, vector, or CWE available at time of analysis. Affected component, vulnerability class, and impact cannot be determined from the provided data. No meaningful synthesis is possible until Ubuntu publishes a security advisory.
CVE-2026-61404 was reported by Ubuntu but carries no published description, CVSS score, vector, or CWE classification at the time of this analysis. The affected component, vulnerability class, and attacker capabilities cannot be determined from available data. No meaningful impact assessment is possible until Ubuntu publishes a security advisory.
CVE-2026-16288 is reported by Ubuntu but carries no public description, CVSS score, vector, or CWE at time of analysis. The vulnerability's nature, affected component, and impact are entirely unconfirmed. No meaningful synthesis is possible without a description or scoring data; treat this record as a placeholder pending vendor disclosure.
CVE-2026-18054 is associated with the Ubuntu platform per vendor reporting, but no description, CVSS score, CWE classification, or technical details are available in the provided data. Without a vulnerability description, the affected component, impact, and exploitation conditions cannot be determined. A meaningful security assessment is not possible from the supplied intelligence.
CVE-2026-63320 has no publicly available description, CVSS score, or CWE classification at time of analysis. The sole intelligence signal is a vendor report attributed to Ubuntu. Without a description, affected version range, or impact details, no meaningful impact statement can be made - this record should be treated as pending NVD enrichment.
Insufficient data prevents meaningful synthesis of CVE-2026-63109. The only confirmed intelligence signal is a vendor report attributed to Ubuntu, with no description, CVSS score, CWE classification, or version information available at time of analysis. No impact, affected component, or attack scenario can be characterized from the provided data.
CVE-2026-61405 has been reported via Ubuntu's vendor security channel, but no description, CVSS score, CWE classification, or supporting intelligence is available at time of analysis. The affected package, vulnerability class, and impact cannot be determined from the provided data. Security teams should consult Ubuntu Security Notices (USN) directly for authoritative details before making triage decisions.
CVE-2026-61406 is reported by Ubuntu with no public description, CVSS score, CWE classification, or affected version data available at time of analysis. The nature, impact, and exploitability of this vulnerability cannot be characterized from the provided intelligence. Security teams should monitor Ubuntu Security Notices (USN) and the Ubuntu CVE tracker for forthcoming disclosure.
Internal Ash attribute and argument names leak through GraphQL error responses in ash_graphql 1.9.0 through 1.10.x, bypassing application-configured error handlers intended to redact them. A logic flaw in AshGraphql.Errors causes a sanitizing error_handler's decision to suppress the :path field to be silently overridden, re-injecting raw internal field names via build_error_path/5. Unauthenticated remote clients can trigger validation failures on non-exposed or nested fields to enumerate internal schema structure that the application deliberately chose to hide. No public exploit or KEV listing exists at time of analysis.
Cross-session record leakage in ash_graphql's subscription batcher allows one subscriber's resolved GraphQL records to be delivered to a different subscriber's topic, potentially crossing tenant and actor boundaries. Versions 1.4.0 through 1.10.x are affected when the Batcher process falls back to inline `:backpressure_sync` or `:noproc` execution paths and a subscription resolver triggers a nested synchronous Ash notification in the same caller process. No public exploit has been identified at time of analysis, and a vendor-released patch is available in version 1.11.0.
Plaintext values of encrypted fields in ash_cloak leak verbatim into application logs, error-tracker payloads, changeset inspection output, and telemetry when the source attribute is not explicitly declared sensitive. All ash_cloak versions 0.1.0 through 0.3.x for the Elixir/Ash Framework are affected; a patch is available in 0.4.0. No public exploit is identified at time of analysis.
Predictable authentication token generation in TOTOLINK N600R firmware 4.3.0cu.7866_B20220506 exposes the router's web management interface to session token prediction attacks from the network. The loginAuth function in /web_cste/cgi-bin/cstecgi.cgi generates insufficiently random values (CWE-330), enabling unauthenticated remote attackers to predict valid session tokens and gain unauthorized access to router configuration data. A proof-of-concept exploit script (poc.py) is publicly available on GitHub, though high attack complexity limits practical exploitation to technically capable attackers.
State machine mismanagement in the NGSetup Handler of Linux Foundation Magma 1.9.0 allows remote, unauthenticated attackers to induce an invalid state in the AMF component by sending crafted NGAP NGSetup messages. The affected function resides in ngap_amf_handlers.c, which processes the initial setup handshake between 5G base stations (gNBs) and the Access and Mobility Management Function (AMF). A public proof-of-concept is available via a GitHub issue; this is not listed in the CISA KEV catalog.
Improper input validation in the NGSetupRequest Handler of Linux Foundation Magma 1.9.0 allows remote unauthenticated attackers to impact availability of the 5G core's Access and Mobility Management Function (AMF) by supplying a malformed NG-IoT-DefaultPagingDRX argument. A public proof-of-concept is available via GitHub issue #16023, though the vulnerability has not been added to CISA KEV and the project maintainers have not responded to the coordinated disclosure, meaning no patch is available. The CVSS 4.0 score of 6.9 reflects limited availability impact only, with no confidentiality or integrity exposure.
Improper integrity check validation in Linux Foundation Magma 1.9.0's SecurityModeComplete Handler allows remote unauthenticated attackers to bypass NAS-layer security verification in the mobile core network. The SecurityModeComplete message is part of the LTE Non-Access Stratum security negotiation procedure; failure to validate the integrity check value (CWE-354) means crafted messages can be accepted without proper cryptographic verification. A publicly available proof-of-concept exists on GitHub, and the CVSS 4.0 vector confirms network-reachable, zero-prerequisite exploitation with low-level impact across confidentiality, integrity, and availability dimensions.
Information disclosure in the InitialUEMessage Handler of Linux Foundation Magma 1.9.0 allows unauthenticated remote attackers to extract sensitive data by sending crafted UE attachment requests to the mobile core network. A proof-of-concept exploit has been publicly disclosed, elevating practical risk above theoretical concern despite the CVE's medium severity rating. The CVSS 4.0 vector confirms no integrity or availability impact - the exposure is limited to low-confidentiality data leakage - but the zero-authentication, network-accessible nature of the flaw broadens the attack surface for any operator with reachable core signaling interfaces.
SiYuan's publish mode before v3.8.1 leaks invisible-tier content to unauthenticated readers through three unguarded rendering pathways: SQL embed blocks, attribute-view keys, and attribute-view backlinks. Administrators who mark notes as invisible to control what anonymous visitors see receive no protection - those same visitors can enumerate the hidden content by exploiting any of the three listing mechanisms. No active exploitation has been identified (no CISA KEV listing, no public POC), and the vendor has released a fix in v3.8.1.
Authenticated administrators in SiYuan before v3.8.1 can bypass the IsForbiddenAbsPath security guard - introduced to remediate GHSA-c8r8-95hg-mp34 - by targeting the /history/*path and /repo/diff/*path API endpoints, which construct file paths independently and were never covered by the guard. Exploitation enables retrieval of historical file snapshots including data/.siyuan/publishAccess.json, which stores plaintext publish-mode passwords, and files under data/templates/. No public exploit identified at time of analysis; the vendor-released patch is v3.8.1.
Path traversal in SiYuan 3.8.0 allows an authenticated attacker to read arbitrary files within the workspace directory via the POST /api/template/render endpoint, including conf/conf.json, which contains the API token and cookie signing key. The RenderTemplate function enforces only a workspace-boundary check (util.IsAbsPathInWorkspace) but omits the sensitive-path exclusion (refuseToAccess() blocklist) applied by the file API, creating an inconsistency in access controls across API surfaces. The issue is fixed in v3.8.1; no public exploit identified at time of analysis.
WWBN AVideo's Live plugin exposes an unauthenticated endpoint at plugin/Live/api/preauthorize.json.php that accepts credentials via HTTP GET with no rate limiting, enabling two distinct abuse vectors: sustained brute-force password guessing against any user account and uncapped triggering of two-factor authentication confirmation emails. All versions of AVideo are affected per CPE data, and exploitation requires no privileges or user interaction. No public exploit code or active exploitation has been identified at time of analysis, though the attack surface is trivially low-complexity for any remote attacker.
Cleartext API key storage in browser-use web-ui versions 2.0.0 through 3.0.0 exposes configured LLM provider credentials to any local user with filesystem read access. The application writes API keys to predictably-named JSON files in a temporary settings directory without encryption or access controls, as identified in src/webui/webui_manager.py. An attacker who gains read access to that directory can silently harvest credentials and use them to impersonate the victim against third-party LLM APIs, incurring charges or extracting data. No public exploit code has been identified at time of analysis.
Arbitrary directory creation in browser-use web-ui 2.0.0-3.0.0 allows remote unauthenticated attackers to create directories at any path writable by the root-running container. The `run_agent_task` function passes user-supplied `save_recording_path`, `save_trace_path`, `save_agent_history_path`, and `save_download_path` values directly to filesystem operations without sanitizing absolute path inputs. Because the Gradio interface requires no authentication and containers commonly run as root, the effective write surface spans the entire container filesystem. No public exploit has been identified at time of analysis.
Race condition exploitation in FileCodeBox's Pickup Limit Handler allows remote unauthenticated attackers to bypass configured file download quotas by sending concurrent retrieval requests. The flaw exists in the `update_file_usage` function (`apps/base/views.py`) across all releases prior to v2.5.0 - including v2.4.0 despite the CVE description citing only 'up to 2.3'. A public proof-of-concept is available via GitHub issue #482, though no active exploitation has been confirmed by CISA KEV. The vendor-released fix is confirmed in v2.5.0 via commit 8d7d856.
Incorrect string trimming in ash_sql causes divergent behavior between SQL-layer and in-memory evaluation of the `string_trim/1` function, enabling users to pad string fields with tab, newline, carriage-return, or form-feed characters to bypass trimmed uniqueness or equality checks. All ash_sql versions from 0.1.0 up to (not including) 0.7.1 are affected wherever `string_trim/1` appears in Ash filters, validations, or identity constraints that are evaluated at the SQL layer. No public exploit has been identified and no active exploitation is confirmed; the overall risk is low (CVSS 4.0: 2.1), but the bypass can permit duplicate record creation or filter evasion in affected applications.
Uncontrolled recursion in ash_oban's compile-time-generated Oban worker code enables unbounded heap growth and CPU exhaustion in the BEAM worker process when a trigger's on_error action deterministically raises on the job's final attempt. Affected versions span 0.8.0-rc.1 through 0.8.13 of the ash-project/ash_oban Elixir library. Any condition that causes the on_error action to fail repeatedly - a data-layer outage, a misconfigured action, or a record the action validates and rejects - loops handle_error/4 forever, growing the process heap without bound until the BEAM runtime kills the worker. No public exploit has been identified at time of analysis; a vendor-released patch is confirmed at 0.8.14.
Weak password recovery in Beetel 450TC3 router firmware 01.00.00_01 allows low-privileged authenticated attackers to exploit a flawed account recovery workflow over the network, potentially escalating privileges to administrative control of the device. A public proof-of-concept has been disclosed on GitHub, and the exploit reference explicitly describes authenticated privilege escalation as the realized impact. The vendor did not respond to coordinated disclosure, meaning no patch exists and no vendor-confirmed mitigations are available.
Integer underflow in NASA cFS's cFE Software Bus module (versions up to 7.0.1) allows a network-reachable, low-privileged attacker to manipulate TotalMsgSize and HdrSize arguments in CFE_SB_GetUserDataLength, triggering a CWE-191 wrap-around that produces an incorrect message-length value. The resulting memory misread yields low-level confidentiality, integrity, and availability impacts on both the vulnerable system and downstream Software Bus consumers. No vendor patch exists - NASA did not respond to coordinated disclosure - and no public exploit or CISA KEV listing has been identified at time of analysis.
JSON path injection in AshSqlite (0.1.2-rc.0 through 0.2.17) allows any attacker who can supply user-controlled input to a get_path/2 query segment to read nested JSON sub-fields that the application never intended to expose. The vulnerable AshSqlite.SqlImplementation code naively concatenates user-supplied segments with periods into a SQLite json_extract path, so a segment containing a dot (e.g., 'private.secret') descends two JSON levels instead of matching a single literal key. No public exploit has been identified and the vulnerability is absent from the CISA KEV catalog; a vendor patch is available targeting version 0.2.18.
Cleartext exposure of nested sensitive fields in Ash Paper Trail audit logs (versions 0.3.0-0.6.x) allows any principal with read access to the version resource table to recover credentials, tokens, or other sensitive values stored inside embedded resources, union types, or lists. The redaction logic in `maybe_redact_changes/3` and `AshPaperTrail.Resource.Changes.CreateNewVersion` only inspects top-level resource attributes for the `sensitive?` flag, never recursing into nested structures, so a parent attribute that is not itself marked sensitive silently passes its embedded sensitive children through to the version table in cleartext. No public exploit has been identified and the issue is not listed in CISA KEV; a vendor-released patch is available at version 0.7.0.
Cleartext storage of sensitive Ash resource attributes in AshPaperTrail versions 0.1.1 through 0.6.x allows any actor with read access to the generated version resource to recover plaintext values of fields marked `sensitive? true`. The library's `CreateVersionResource` transformer incorrectly derives the sensitivity flag for the `changes` map from the `ignore_attributes` exclusion list rather than from the actual tracked attributes, causing the map to always be declared `sensitive? false` and `public? true`, which bypasses Ash's built-in redaction and exposes sensitive values in API responses, logs, and inspect output. No public exploit is identified and no active exploitation is confirmed; a vendor patch was released in version 0.7.0.
The `qs.stringify` function in the qs Node.js query-string library throws an uncaught `TypeError` when serializing any object whose `constructor.isBuffer` property is truthy but not callable, enabling denial of service against applications that re-serialize attacker-controlled data. Express 4 (default query-parser) and body-parser with `extended: true` both parse incoming HTTP data using options that preserve the `constructor` key in output, meaning a crafted request body or query string can reach the vulnerable code path with no non-default configuration required on the target application. A working proof-of-concept is embedded in the CVE description; no CISA KEV listing exists at time of analysis.
Payment status workflow bypass in macrozheng mall up to version 1.0.3 allows authenticated remote attackers to manipulate the orderId parameter at the /order/paySuccess endpoint, potentially marking arbitrary orders as paid without completing actual payment. This CWE-841 business logic flaw directly threatens e-commerce transaction integrity - a proof-of-concept exists (CVSS 4.0 E:P), though no active exploitation is confirmed in CISA KEV. Notably, the vendor silently deleted the GitHub disclosure issue without providing any remediation, leaving no patch available at time of analysis.
Session termination via unsigned SAML LogoutRequest in pac4j-saml before 6.5.6 allows unauthenticated remote attackers to destroy any active SAML session by submitting a forged, unsigned LogoutRequest containing a guessed NameID (e.g., an email address used as the SAML subject identifier) when the IdP omits a SessionIndex. The root cause is that SAML2LogoutValidator.validateLogoutRequest() did not enforce signature validation in this code path, permitting the NameID alone to trigger session destruction without any cryptographic proof of IdP origin. No public exploit code is known and this is not listed in CISA KEV; however, the attack is low-complexity and entirely unauthenticated per the CVSS 4.0 vector.
Authentication bypass in pac4j-oidc before 6.5.6 allows remote unauthenticated attackers to establish authenticated sessions by submitting OIDC callback requests carrying only a third-party access token, bypassing issuer, audience, nonce, and subject validation entirely. Applications built on the pac4j Java security framework that use OIDC for single sign-on are vulnerable to token substitution attacks from any attacker who holds a valid access token issued by the same identity provider for any other registered OAuth client. No public exploit code has been identified at time of analysis; vendor-released patch is available in version 6.5.6.
Account enumeration in Cockpit CMS before 2.14.1 exposes valid usernames through measurable response-time differences in the authentication check endpoint. When a submitted username matches an existing account, the application performs a full bcrypt hash comparison - an intentionally slow operation - whereas non-existent accounts return immediately without any hash computation, creating a statistically detectable timing delta. Unauthenticated remote attackers can exploit this by issuing repeated authentication probes and measuring latency, building a list of valid accounts to target with credential stuffing or brute-force attacks. No public exploit code or CISA KEV listing has been identified at time of analysis, though a researcher advisory (MFC-2026-001) exists.
Race condition in macrozheng mall's /order/submit endpoint (versions up to 1.0.3) allows authenticated remote attackers to exploit unsynchronized order state through concurrent HTTP request timing. The CVSS 4.0 vector (AV:N/AC:H/PR:L) confirms network reachability but high attack complexity and a required authenticated session, yielding limited integrity and availability impact. No public exploit code has been identified and the vendor deleted the associated GitHub issue without explanation, reducing transparency around scope and remediation.
Predictable API key generation in the Newsletters WordPress plugin (versions before 4.17) enables unauthenticated network-accessible attackers who successfully derive the key to perform privileged API operations - including adding or deleting subscribers and sending bulk emails. Exploitation requires the plugin's optional API feature to be enabled. A publicly available proof-of-concept exists via WPScan, though EPSS stands at 0.10% (1st percentile), indicating minimal observed exploitation at time of analysis and no CISA KEV listing.
Cleartext password disclosure in MariaDB Connector/R2DBC (org.mariadb:r2dbc-mariadb) prior to 1.4.1 allows a network-positioned attacker posing as a database server to harvest user credentials during authentication. The connector's AuthenticationPlugin interface lacked any requireSecure() gate, so plugins transmitting credentials in cleartext - mysql_clear_password and PAM/dialog - could be triggered by a forged AuthSwitchRequest over an unencrypted plain-TCP connection, causing the client to respond with the user's database password as raw bytes on the wire. No public exploit code has been identified and no KEV listing exists; the issue is fully patched in version 1.4.1.
MariaDB Connector/R2DBC prior to 1.4.1 hardcodes UTF-8 for all character encoding and decoding but fails to reject mid-session charset changes announced by the server via the OK-packet session-state-tracking mechanism. A hostile or man-in-the-middle server, or server-side constructs such as stored routines, triggers, or server configuration, can shift character_set_client to a non-UTF-8 encoding after connection initialization, causing the driver and server to interpret identical bytes under different encodings. This produces silent data corruption and a charset-confusion mismatch that can undermine byte-wise quoting and escaping, creating a pathway to SQL injection in applications that rely on driver-level escaping; no public exploit has been identified at time of analysis and the vendor-released patch is available in version 1.4.1.
Charset-confusion in MariaDB Connector/J (all branches prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9) allows a server-side character set change mid-session to silently decouple the driver's UTF-8 encoding assumption from the server's active encoding. Because the driver continues escaping SQL string literals as UTF-8 while the server parses incoming bytes under a different multi-byte encoding (e.g., GBK or BIG5), the mismatch can defeat byte-wise SQL quoting and enable SQL injection - a well-documented attack class for charset-confusion primitives. No public exploit has been identified and this CVE is not listed in CISA KEV at time of analysis.
MariaDB Connector/J exposes database account passwords in cleartext to on-path attackers or hostile servers when PAM (dialog) authentication is used over plain TCP. The driver's PAM handler (SendPamAuthPacketFactory, plugin name 'dialog') failed to override the requireSsl() gate that correctly protects its sibling mysql_clear_password plugin, inheriting a default value of false and thus omitting the secure-transport requirement. Under the default connector configuration (sslMode=DISABLE, restrictedAuth=null), a man-in-the-middle or rogue server can issue an Authentication Switch Request for the dialog plugin and receive the account password in cleartext, granting full credential reuse against the real database. No public exploit has been identified and the vulnerability is not listed in CISA KEV, but the attack mechanics are straightforward for any on-path attacker against affected deployments.
Non-constant-time authentication comparisons and plaintext logging of XRES* in free5GC's AUSF component (v1.4.4 and earlier) expose two distinct vulnerability classes under CWE-208. The 5G-AKA confirmation path writes the expected XRES* value to INFO-level application logs immediately before comparison, making authentication material directly readable by any principal with AUSF log access - operators, SIEM agents, log-collection sidecars, or compromised containers. Both 5G-AKA and EAP-AKA' confirmation paths use non-constant-time Go primitives (strings.EqualFold, bytes.Equal, ==) instead of crypto/subtle.ConstantTimeCompare, though the researcher's own PoC confirmed the timing signal is too small to distinguish from HTTP/SBI noise under standard network conditions. No public exploit or CISA KEV listing; patched in v1.4.5.
PAM dialog authentication in MariaDB Connector/Node.js discloses account passwords in cleartext when connections use plain TCP, because the SendPamAuthPacketFactory handler omitted the secure-transport gate that was already applied to the sibling mysql_clear_password plugin. Applications connecting to MariaDB with default settings (sslMode=DISABLE, restrictedAuth=null) over untrusted network paths are exposed to credential theft by any on-path attacker or rogue server that issues an Authentication Switch Request for the dialog plugin. No active exploitation or public exploit code has been identified; vendor-released patches are available across all active 3.x branches.
IBM Integrated Analytics System versions 1.0.0.0 through 1.0.31.0 fails to properly validate TLS certificates, enabling network-positioned attackers to conduct man-in-the-middle attacks and intercept sensitive data in transit. IBM has confirmed the issue and released a patch via advisory node/7285149. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the network-accessible attack vector with no authentication requirement raises the relevance for deployments where the system communicates across untrusted network segments.
IBM Integrated Analytics System versions 1.0.0.0 through 1.0.31.0 employs cryptographic algorithms below acceptable security standards, exposing highly sensitive data to decryption by a network-positioned attacker. The CVSS vector (AV:N/AC:H/PR:N/UI:N) indicates network exploitation without authentication but requires high attack complexity, consistent with a passive interception or man-in-the-middle scenario. No public exploit code has been identified, and IBM has released a remediation patch via support advisory 7285147.
Memory corruption in the TP-Link TL-WR841N v14 embedded HTTP service allows an unauthenticated attacker with adjacent network access to trigger a buffer overflow by submitting a crafted multipart/form-data request containing an oversized boundary parameter. The confirmed impact is limited to undefined application behavior resulting from process memory corruption; TP-Link's own advisory and the CVE description both explicitly state that arbitrary code execution, information disclosure, and denial-of-service have not been demonstrated, despite those labels appearing in the CVE tags. No public exploit code has been identified at time of analysis, and this CVE is not listed in CISA's Known Exploited Vulnerabilities catalog.
CSV injection in the MongoDB MongoSQL Transition Readiness Tool allows a low-privileged cluster user to embed spreadsheet formula directives inside database or collection names, which are written unsanitized into generated CSV reports. When an operator opens the report in a spreadsheet application such as Microsoft Excel or LibreOffice Calc, the formula executes on the operator's workstation, potentially exfiltrating report contents to an attacker-controlled endpoint or triggering external content retrieval. No public exploit code or CISA KEV listing has been identified at time of analysis; exploitation is constrained by the requirement for both cluster write access and an operator who opens the file in a formula-evaluating spreadsheet.
Graylog Server's system catalog entity titles API endpoint leaks protected database fields - including user password hashes - to authenticated requesters who craft custom field-selection parameters. PR:L authentication is required, and permission checks are partially enforced: regular users are limited to their own password hash, but any user holding an admin role can extract password hashes for every account in the system. No public exploit or CISA KEV listing has been identified; vendor-released patch 7.1.4 is available and is the only remediation.
Copilot Chat in Microsoft Edge (Chromium-based) exposes a race condition that enables an authorized, low-privileged attacker to disclose information across a component scope boundary over the network. The flaw arises from improper synchronization of concurrent access to a shared resource within the Copilot Chat feature, producing partial confidentiality and, per the official CVSS vector, limited integrity exposure. No public exploit code has been identified at time of analysis, and this vulnerability does not appear in the CISA Known Exploited Vulnerabilities catalog.
Heap out-of-bounds read and stack out-of-bounds access in GIMP's file-psd plugin allow an attacker to crash the application or disclose limited memory contents by convincing a user to open a specially crafted PSD image. The flaw affects GIMP as shipped in Red Hat Enterprise Linux 6 through 9 and stems from missing validation of the channel-count parameter during PSD parsing. No active exploitation has been identified; the attack requires local file delivery and deliberate user interaction, significantly constraining real-world risk.
StarRocks through version 4.0.13 exposes complete query history for all users to any authenticated low-privilege user via the unguarded query_detail REST endpoint. The endpoint returns full SQL text, execution plans, and profiling data without filtering by the requesting user's identity, meaning statements containing embedded credentials - connection strings, passwords passed as query parameters - are fully readable by any logged-in account. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, but the low authentication bar (any valid account) and high confidentiality impact make this a meaningful lateral-movement and credential-harvesting risk in multi-tenant or shared StarRocks deployments.
Heap out-of-bounds read in GIMP's file-pvr plugin exposes users of Red Hat Enterprise Linux 6 through 9 to application crashes and limited heap memory disclosure when opening a crafted PVR image file. The VQ (Vector Quantization) compressed-texture decoder omits mandatory bounds validation, allowing a malicious image to read beyond allocated heap regions. Impact is primarily denial of service via crash, with a secondary low-severity information disclosure path; no public exploit code and no CISA KEV listing are associated with this issue at time of analysis.
Nonce reuse in wolfEngine's AES-CCM implementation for TLS 1.2 and DTLS 1.2 allows a network-positioned adversary to recover plaintext across records and forge authentication tags within a session. The root defect is that wolfEngine reads the explicit CCM nonce from the uninitialized record input buffer rather than deriving it from the TLS sequence number in the Additional Authenticated Data, producing a constant nonce for every record under the same key. Exposure is sharply constrained: AES-CCM cipher suites must be explicitly selected (non-default), only wolfEngine is affected (wolfProvider is not), and TLS 1.3 is entirely outside scope. No public exploit or CISA KEV listing exists at time of analysis; the vendor-released fix is wolfEngine 1.4.1.
Capture-replay authentication bypass in the Forminator WordPress plugin (versions up to and including 1.57.1) allows unauthenticated network-accessible attackers to achieve low-level integrity impact against affected installations. Reported by Patchstack under CWE-294, the flaw enables replay of captured authentication or nonce tokens, potentially allowing unauthorized form actions or integrity-affecting operations without valid credentials. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Heap out-of-bounds read in GIMP's file-ico plugin allows a local attacker to crash GIMP or leak limited heap memory contents by delivering a specially crafted ICO image file to a victim user. Affected packages span Red Hat Enterprise Linux 6 through 9. No public exploit code or CISA KEV listing exists at time of analysis, but the user-interaction requirement (opening a malicious file) is the primary delivery mechanism and a realistic social-engineering target in image-processing workflows.
Heap out-of-bounds read in GIMP's file-iff plugin allows a local attacker to crash the application or disclose limited heap memory contents by delivering a specially crafted IFF/ILBM image file. The flaw stems from missing validation of HAM row size when the number of color planes (nPlanes) is zero, causing a size mismatch that bypasses memory bounds checking. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis.
Log forging in morgan HTTP request logger middleware for Node.js (all versions prior to 1.12.0) allows unauthenticated remote attackers to inject Unicode line separator characters - U+0085 (Next Line), U+2028 (Line Separator), and U+2029 (Paragraph Separator) - into log output via attacker-controlled token values such as the Basic auth username surfaced through the remote-user token. This causes Unicode-aware downstream log processors and SIEM pipelines to split a single HTTP request record into multiple logical entries, enabling false log injection and audit trail manipulation. This is an incomplete-fix follow-up to CVE-2026-5078, which addressed only ASCII control characters; no public exploit has been identified at time of analysis.
Sensitive data exposure in Le-yan's Medical Practice Management System enables access to confidential medical or patient data through URL query string parameters that persist in browser history and server or proxy log files (CWE-598). The application transmits sensitive values via HTTP GET parameters rather than POST body or secure headers, causing this data to be recorded in multiple secondary storage locations outside the intended session scope. No public exploit code has been identified at the time of analysis, but the attack class requires minimal technical sophistication once access to affected log or history files is established; medical data sensitivity elevates real-world impact beyond what the base CVSS score alone suggests.
Uncontrolled recursion between Elixir's charlist inspection path and the error-message rescue clause in List.to_string/1 and List.to_charlist/1 can exhaust a BEAM node's memory when an attacker controls list data reaching those functions. A crafted list whose printable prefix exceeds the 4096-element printable_limit but which carries an invalid element beyond that threshold bypasses the ASCII classification check, triggers ArgumentError in IO.chardata_to_string/1, and then recurses infinitely through the rescue clause because the inner inspect/1 call is not in tail position - every frame is retained on the process heap. No public exploit has been identified at time of analysis; vendor-released patches are available as Elixir 1.18.5, 1.19.6, and 1.20.4.
Cross-user data disclosure in SvelteKit (npm/@sveltejs/kit versions 2.38.0 through 2.60.0) stems from a race condition in the query.batch() API that can cause concurrent HTTP requests from different authenticated users to merge under a single shared request context. Successful exploitation allows one user to receive response data belonging to another user's simultaneous session, including potentially sensitive application state. Vendor-released patch version 2.60.1 is available; no active exploitation has been confirmed and no public exploit code has been identified at time of analysis.
Prototype pollution in SvelteKit's remote form functions allows network-accessible attackers to remove methods from JavaScript object prototypes by supplying crafted, user-controlled file input path names. Affected versions are all @sveltejs/kit releases up to and including 2.69.0; the vendor released a fix in 2.69.1. No active exploitation is documented in CISA KEV, and no public exploit code has been identified at time of analysis, though the vulnerability is network-reachable and requires no authentication from the attacker.
Arbitrary file write outside the worktree boundary in gix-worktree-state (part of gitoxide) before 0.33.0 on Windows enables an attacker-controlled repository to overwrite files at arbitrary paths on a victim's filesystem. The flaw manifests when gix_worktree_state::checkout() performs an incremental materialization: a malicious repo first places a symlink entry at path P pointing outside the worktree, then a subsequent incremental checkout of a regular-file entry at the same path follows the Windows reparse point and writes attacker-supplied blob content through the link. No public exploit code is identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Stale public share links in filebrowser through 2.63.23 can silently redirect to unrelated files uploaded after a rename operation, unexpectedly exposing new content to anyone holding the original link. The defect (CWE-459, Incomplete Cleanup) arises because share records are keyed by file path rather than a file identifier - deletion triggers cleanup, but rename does not, leaving the share dormant. No public exploit or CISA KEV listing exists at time of analysis, and the CVSS 4.0 score of 2.3 reflects the multi-step preconditions required, but the confidentiality risk is real for deployments where multiple users share create permissions on overlapping directories.
Stale public share links in File Browser 2.63.6-2.63.23 expose subsequently uploaded content to unauthenticated network access after a privileged user deletes another user's shared file without triggering proper link invalidation. Because the surviving share URL continues to resolve to whatever is later placed at the same storage path, an attacker who retains or discovers the original link can retrieve entirely unrelated files without authentication. No public exploit code is identified at time of analysis, and the CVSS 4.0 score of 2.3 reflects the constrained, multi-step preconditions required.
Unauthenticated information disclosure in WWBN AVideo through version 30.0 exposes user registration statistics via two unprotected PHP endpoints. The report4.json.php and report4.1.json.php files return daily and cumulative user-registration counts to any remote requester without authentication or session validation. No public exploit code has been identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog; however, its trivial exploitation path and network accessibility make it easy for any actor who can reach the server to enumerate platform growth data.
Direct remote access to an unprotected SQL database backup file in code-projects Simple Inventory System 1.0 allows unauthenticated attackers to retrieve the full contents of the inventory database without any credentials or user interaction. The file inventorymanagement.sql is stored within the web-accessible directory and is directly downloadable via HTTP. A publicly documented proof-of-concept on GitHub confirms trivial exploitability of this exposure.
Tenant hijacking and request degradation in AshPhoenix (ash_phoenix 2.1.26 through 2.3.24) allows unauthenticated remote clients to force an Ash multi-tenant application to resolve an arbitrary tenant by supplying a crafted HTTP Host header. The root cause is that AshPhoenix.Helpers.get_subdomain/2 interpolated the configured root domain verbatim into a regex pattern, causing domain dots to act as any-character wildcards and the match to be applied unanchored and globally - so Host: foo.exampleXcom.attacker.net satisfied a rule intended to match only subdomains of example.com, returning foo as the tenant. A separate case-sensitivity flaw allowed TENANT.EXAMPLE.COM to bypass the allowlist check entirely. No CISA KEV listing and no public proof-of-concept have been identified at time of analysis, but exploitation requires no authentication and no special tooling.
Sensitive form parameters leak into server logs, crash reports, and the Phoenix development error page in ash_phoenix versions 1.2.17 through 2.3.24, where AshPhoenix.Form.Auto embeds the complete raw submitted param map verbatim into exception messages when a union sub-form receives an unrecognized _union_type value. Because the exception is raised inside library code rather than Phoenix's controller layer, the standard :filter_parameters configuration cannot redact the exposure-any field co-submitted with the union form field, including passwords and tokens, appears in plaintext in the raised message. No public exploit has been identified at time of analysis, but any user capable of submitting a form with a union field can deliberately trigger the leak regardless of intent.
Out-of-bounds read in Kamailio's IMS AVP handler exposes telecom infrastructure to remote memory disclosure and potential service disruption. The `get_4bytes()` function across five IMS modules - `ims_auth`, `ims_icscf`, `ims_registrar_scscf`, `ims_charging`, and `ims_ocs` - fails to validate that Diameter AVP data buffers contain at least 4 bytes before reading, allowing a remote attacker with low-privilege Diameter interface access to trigger the flaw via a crafted malformed message. Publicly available exploit code exists per GitHub issue #4816, and the vendor has confirmed that the 5.5.0 branch is end-of-life and will receive no further security updates, compounding risk for operators running that release.
Uncontrolled recursion in BBEdit's Java Language Module (versions through 15.5.5) allows a remote attacker to crash or hang the editor by delivering a specially crafted Java source file that a user then opens. The root cause is CWE-674: the Java parser lacks depth-limiting guards, enabling deeply nested constructs to exhaust the call stack and produce a denial-of-service against the editor process. No active exploitation has been recorded and no public proof-of-concept exploit code is known; the issue was surfaced through fuzzing research by Cipher Security Labs, and Bare Bones Software has released a fix in BBEdit 16.0.
Unfiltered exception serialization in ash_ai 0.6.0-0.x leaks internal application details - database schema, raw SQL fragments, policy module names - to authenticated chat users via the LLM conversation stream. AshAi.ToolLoop and AshAi.Tools used Elixir's Exception.message/1 verbatim to encode any raised tool exception into the tool-result payload, which the language model then relayed to the requesting user. Any authenticated user able to steer tool arguments into a code path that raises an exception could extract sensitive internal reconnaissance data; ash_ai 1.0.0 closes the gap by routing all tool exceptions through a safe formatter. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Improper authorization in LogNet's grpc-spring-boot-starter affects annotation processing logic in versions up to 5.2.0, allowing authenticated remote attackers with low privileges to bypass access controls under high-complexity conditions. The vulnerability stems from CWE-266 (Incorrect Privilege Assignment) in the component responsible for processing security annotations on gRPC service endpoints. A proof-of-concept exploit has been publicly disclosed; no vendor patch is available as the project has not yet responded to the responsible disclosure report.
CVE-2026-58582 is an Ubuntu-reported vulnerability for which no description, CVSS score, CWE classification, or technical detail has been made publicly available at time of analysis. The sole intelligence signal is a vendor attribution to Ubuntu, meaning the affected component is likely within the Ubuntu distribution or an upstream package it ships. Without further disclosure, the impact, exploitability, and scope cannot be characterized.
CVE-2026-58581 has been reported through Ubuntu's vendor channel, but no description, CVSS score, vector, or CWE data is available at time of analysis. The affected product, vulnerability class, and impact cannot be characterized without a description. No exploitation status, patch information, or affected version range can be determined from the supplied intelligence.
CVE-2026-50624 has no publicly available description, CVSS score, CWE classification, or reference data at time of analysis. The only available metadata is a reporter tag of 'vendor:ubuntu', indicating Ubuntu as the reporting source. No meaningful impact, affected component, or attack vector can be determined from the supplied data.
CVE-2026-61402 is reported by the Ubuntu vendor channel but carries no description, CVSS score, CWE classification, or reference URLs at this time. The affected package, vulnerability class, and impact are entirely unconfirmed from the available data. No meaningful characterization of attacker capability or affected user population is possible without additional intelligence.
CVE-2026-81493 is a Ubuntu-reported security update with no substantive public data available at time of analysis. The CVE record contains only the placeholder description 'security update' and carries no CVSS score, no CWE classification, no CPE strings, and no referenced advisories, making it impossible to characterize the vulnerability type, affected component, or attacker capability. No exploitation status, patch version, or technical detail can be derived from the available intelligence.
CVE-2026-81496 is documented only as a 'security update' by the Ubuntu vendor source, with no description, CVSS score, CWE classification, or reference links provided in the available intelligence. The affected component, impact class, and exploitation conditions cannot be determined from the current data. No meaningful characterization of attacker capability or victim exposure is possible without additional vendor disclosure.
Ubuntu has published a security advisory for CVE-2026-81498, but the provided intelligence contains no substantive technical content - the description is only 'security update' with no affected package, version, or vulnerability class identified. No CVSS score, CWE, CPE strings, EPSS data, or advisory URL were supplied. This entry cannot be meaningfully characterized without further enrichment from Ubuntu Security Notices or NVD.
CVE-2026-81497 is an Ubuntu-reported security update with no substantive technical detail available in the current data set. The description contains only the phrase 'security update,' which provides no insight into the affected component, vulnerability class, or impact. No CVSS score, CWE, CPE strings, EPSS data, KEV status, or references were supplied, making meaningful risk characterization impossible at this time.
Insufficient data exists to characterize CVE-2026-81495 beyond its origin as a Ubuntu vendor security update. The description field contains only the text 'security update' with no detail on the affected component, vulnerability class, or attacker capability. No CVSS vector, CWE, CPE, EPSS, KEV status, references, or patch version are available in the provided intelligence. No meaningful synthesis is possible without additional sourcing.
CVE-2026-66022 is reported by Ubuntu but carries no public description, CVSS score, vector, or CWE at time of analysis. The affected product, vulnerability class, and impact are entirely unknown from the available data. No meaningful characterization of attacker capability or affected scope is possible without a vendor advisory or NVD entry.
Insufficient data exists to characterize CVE-2026-63323 meaningfully. The CVE record contains no description, no CVSS score, no CWE, and no references beyond a single vendor:ubuntu tag. The affected product, vulnerability class, and impact are all unknown at this time. Security teams should treat this as an unresolved record and monitor NVD and Ubuntu Security Notices (USN) for updates.
CVE-2026-65928 has no available description, CVSS score, CWE classification, or affected version data at time of analysis. The sole intelligence signal is a vendor attribution to Ubuntu. No meaningful impact, attack vector, or affected population can be determined from the provided data. Security teams should monitor for NVD publication and Ubuntu Security Notices (USN) before making prioritization decisions.
CVE-2026-65929 is reported by Ubuntu with no description, CVSS data, CWE classification, or affected package information available at this time. The vulnerability cannot be characterized beyond its association with the Ubuntu vendor source. Security teams should monitor Ubuntu Security Notices (USN) and the NVD entry for this CVE as data becomes available.
CVE-2026-63321 has been reported via Ubuntu's vendor channel, but no description, CVSS score, CWE classification, or technical detail is available in the provided intelligence data. The affected component, vulnerability class, and impact cannot be characterized with the current dataset. Security teams should query Ubuntu's security tracker directly for authoritative details before making prioritization decisions.
CVE-2026-63322 has been reported by Ubuntu's security team, but no description, CVSS score, CWE classification, or exploit intelligence is publicly available at time of analysis. The vulnerability's impact, affected component, and exploitability cannot be determined from current data. Security teams should monitor the Ubuntu Security Notices portal and USN advisories for disclosure.
Insufficient data prevents meaningful synthesis for CVE-2026-17516. The only available signal is a vendor report attributed to Ubuntu, with no description, CVSS score, CWE, affected versions, or references provided. No impact, attack vector, or affected component can be determined from the supplied input.
CVE-2026-15264 is reported by the Ubuntu vendor source but carries no description, CVSS score, CWE classification, or reference links at time of analysis. No meaningful synthesis of impact, affected component, or attacker capability is possible from the available data. Security teams should treat this as an uncharacterized disclosure pending vendor publication of a full advisory.
CVE-2026-63110 is reported by Ubuntu but carries no description, CVSS score, vector, or CWE in the available intelligence data, making meaningful impact assessment impossible at this time. The sole attribution signal is 'vendor:ubuntu', indicating Ubuntu has acknowledged or reported this identifier, but the affected component, vulnerability class, and exploitability are entirely unknown. Security teams should monitor Ubuntu Security Notices (USN) and the NVD entry for this CVE until authoritative details are published.
CVE-2026-61476 is reported by Ubuntu with no description, CVSS score, vector, or CWE available at time of analysis. Affected component, vulnerability class, and impact cannot be determined from the provided data. No meaningful synthesis is possible until Ubuntu publishes a security advisory.
CVE-2026-61404 was reported by Ubuntu but carries no published description, CVSS score, vector, or CWE classification at the time of this analysis. The affected component, vulnerability class, and attacker capabilities cannot be determined from available data. No meaningful impact assessment is possible until Ubuntu publishes a security advisory.
CVE-2026-16288 is reported by Ubuntu but carries no public description, CVSS score, vector, or CWE at time of analysis. The vulnerability's nature, affected component, and impact are entirely unconfirmed. No meaningful synthesis is possible without a description or scoring data; treat this record as a placeholder pending vendor disclosure.
CVE-2026-18054 is associated with the Ubuntu platform per vendor reporting, but no description, CVSS score, CWE classification, or technical details are available in the provided data. Without a vulnerability description, the affected component, impact, and exploitation conditions cannot be determined. A meaningful security assessment is not possible from the supplied intelligence.
CVE-2026-63320 has no publicly available description, CVSS score, or CWE classification at time of analysis. The sole intelligence signal is a vendor report attributed to Ubuntu. Without a description, affected version range, or impact details, no meaningful impact statement can be made - this record should be treated as pending NVD enrichment.
Insufficient data prevents meaningful synthesis of CVE-2026-63109. The only confirmed intelligence signal is a vendor report attributed to Ubuntu, with no description, CVSS score, CWE classification, or version information available at time of analysis. No impact, affected component, or attack scenario can be characterized from the provided data.
CVE-2026-61405 has been reported via Ubuntu's vendor security channel, but no description, CVSS score, CWE classification, or supporting intelligence is available at time of analysis. The affected package, vulnerability class, and impact cannot be determined from the provided data. Security teams should consult Ubuntu Security Notices (USN) directly for authoritative details before making triage decisions.
CVE-2026-61406 is reported by Ubuntu with no public description, CVSS score, CWE classification, or affected version data available at time of analysis. The nature, impact, and exploitability of this vulnerability cannot be characterized from the provided intelligence. Security teams should monitor Ubuntu Security Notices (USN) and the Ubuntu CVE tracker for forthcoming disclosure.
Internal Ash attribute and argument names leak through GraphQL error responses in ash_graphql 1.9.0 through 1.10.x, bypassing application-configured error handlers intended to redact them. A logic flaw in AshGraphql.Errors causes a sanitizing error_handler's decision to suppress the :path field to be silently overridden, re-injecting raw internal field names via build_error_path/5. Unauthenticated remote clients can trigger validation failures on non-exposed or nested fields to enumerate internal schema structure that the application deliberately chose to hide. No public exploit or KEV listing exists at time of analysis.
Cross-session record leakage in ash_graphql's subscription batcher allows one subscriber's resolved GraphQL records to be delivered to a different subscriber's topic, potentially crossing tenant and actor boundaries. Versions 1.4.0 through 1.10.x are affected when the Batcher process falls back to inline `:backpressure_sync` or `:noproc` execution paths and a subscription resolver triggers a nested synchronous Ash notification in the same caller process. No public exploit has been identified at time of analysis, and a vendor-released patch is available in version 1.11.0.
Plaintext values of encrypted fields in ash_cloak leak verbatim into application logs, error-tracker payloads, changeset inspection output, and telemetry when the source attribute is not explicitly declared sensitive. All ash_cloak versions 0.1.0 through 0.3.x for the Elixir/Ash Framework are affected; a patch is available in 0.4.0. No public exploit is identified at time of analysis.
Predictable authentication token generation in TOTOLINK N600R firmware 4.3.0cu.7866_B20220506 exposes the router's web management interface to session token prediction attacks from the network. The loginAuth function in /web_cste/cgi-bin/cstecgi.cgi generates insufficiently random values (CWE-330), enabling unauthenticated remote attackers to predict valid session tokens and gain unauthorized access to router configuration data. A proof-of-concept exploit script (poc.py) is publicly available on GitHub, though high attack complexity limits practical exploitation to technically capable attackers.
State machine mismanagement in the NGSetup Handler of Linux Foundation Magma 1.9.0 allows remote, unauthenticated attackers to induce an invalid state in the AMF component by sending crafted NGAP NGSetup messages. The affected function resides in ngap_amf_handlers.c, which processes the initial setup handshake between 5G base stations (gNBs) and the Access and Mobility Management Function (AMF). A public proof-of-concept is available via a GitHub issue; this is not listed in the CISA KEV catalog.
Improper input validation in the NGSetupRequest Handler of Linux Foundation Magma 1.9.0 allows remote unauthenticated attackers to impact availability of the 5G core's Access and Mobility Management Function (AMF) by supplying a malformed NG-IoT-DefaultPagingDRX argument. A public proof-of-concept is available via GitHub issue #16023, though the vulnerability has not been added to CISA KEV and the project maintainers have not responded to the coordinated disclosure, meaning no patch is available. The CVSS 4.0 score of 6.9 reflects limited availability impact only, with no confidentiality or integrity exposure.
Improper integrity check validation in Linux Foundation Magma 1.9.0's SecurityModeComplete Handler allows remote unauthenticated attackers to bypass NAS-layer security verification in the mobile core network. The SecurityModeComplete message is part of the LTE Non-Access Stratum security negotiation procedure; failure to validate the integrity check value (CWE-354) means crafted messages can be accepted without proper cryptographic verification. A publicly available proof-of-concept exists on GitHub, and the CVSS 4.0 vector confirms network-reachable, zero-prerequisite exploitation with low-level impact across confidentiality, integrity, and availability dimensions.
Information disclosure in the InitialUEMessage Handler of Linux Foundation Magma 1.9.0 allows unauthenticated remote attackers to extract sensitive data by sending crafted UE attachment requests to the mobile core network. A proof-of-concept exploit has been publicly disclosed, elevating practical risk above theoretical concern despite the CVE's medium severity rating. The CVSS 4.0 vector confirms no integrity or availability impact - the exposure is limited to low-confidentiality data leakage - but the zero-authentication, network-accessible nature of the flaw broadens the attack surface for any operator with reachable core signaling interfaces.
SiYuan's publish mode before v3.8.1 leaks invisible-tier content to unauthenticated readers through three unguarded rendering pathways: SQL embed blocks, attribute-view keys, and attribute-view backlinks. Administrators who mark notes as invisible to control what anonymous visitors see receive no protection - those same visitors can enumerate the hidden content by exploiting any of the three listing mechanisms. No active exploitation has been identified (no CISA KEV listing, no public POC), and the vendor has released a fix in v3.8.1.
Authenticated administrators in SiYuan before v3.8.1 can bypass the IsForbiddenAbsPath security guard - introduced to remediate GHSA-c8r8-95hg-mp34 - by targeting the /history/*path and /repo/diff/*path API endpoints, which construct file paths independently and were never covered by the guard. Exploitation enables retrieval of historical file snapshots including data/.siyuan/publishAccess.json, which stores plaintext publish-mode passwords, and files under data/templates/. No public exploit identified at time of analysis; the vendor-released patch is v3.8.1.
Path traversal in SiYuan 3.8.0 allows an authenticated attacker to read arbitrary files within the workspace directory via the POST /api/template/render endpoint, including conf/conf.json, which contains the API token and cookie signing key. The RenderTemplate function enforces only a workspace-boundary check (util.IsAbsPathInWorkspace) but omits the sensitive-path exclusion (refuseToAccess() blocklist) applied by the file API, creating an inconsistency in access controls across API surfaces. The issue is fixed in v3.8.1; no public exploit identified at time of analysis.
WWBN AVideo's Live plugin exposes an unauthenticated endpoint at plugin/Live/api/preauthorize.json.php that accepts credentials via HTTP GET with no rate limiting, enabling two distinct abuse vectors: sustained brute-force password guessing against any user account and uncapped triggering of two-factor authentication confirmation emails. All versions of AVideo are affected per CPE data, and exploitation requires no privileges or user interaction. No public exploit code or active exploitation has been identified at time of analysis, though the attack surface is trivially low-complexity for any remote attacker.
Cleartext API key storage in browser-use web-ui versions 2.0.0 through 3.0.0 exposes configured LLM provider credentials to any local user with filesystem read access. The application writes API keys to predictably-named JSON files in a temporary settings directory without encryption or access controls, as identified in src/webui/webui_manager.py. An attacker who gains read access to that directory can silently harvest credentials and use them to impersonate the victim against third-party LLM APIs, incurring charges or extracting data. No public exploit code has been identified at time of analysis.
Arbitrary directory creation in browser-use web-ui 2.0.0-3.0.0 allows remote unauthenticated attackers to create directories at any path writable by the root-running container. The `run_agent_task` function passes user-supplied `save_recording_path`, `save_trace_path`, `save_agent_history_path`, and `save_download_path` values directly to filesystem operations without sanitizing absolute path inputs. Because the Gradio interface requires no authentication and containers commonly run as root, the effective write surface spans the entire container filesystem. No public exploit has been identified at time of analysis.
Race condition exploitation in FileCodeBox's Pickup Limit Handler allows remote unauthenticated attackers to bypass configured file download quotas by sending concurrent retrieval requests. The flaw exists in the `update_file_usage` function (`apps/base/views.py`) across all releases prior to v2.5.0 - including v2.4.0 despite the CVE description citing only 'up to 2.3'. A public proof-of-concept is available via GitHub issue #482, though no active exploitation has been confirmed by CISA KEV. The vendor-released fix is confirmed in v2.5.0 via commit 8d7d856.
Incorrect string trimming in ash_sql causes divergent behavior between SQL-layer and in-memory evaluation of the `string_trim/1` function, enabling users to pad string fields with tab, newline, carriage-return, or form-feed characters to bypass trimmed uniqueness or equality checks. All ash_sql versions from 0.1.0 up to (not including) 0.7.1 are affected wherever `string_trim/1` appears in Ash filters, validations, or identity constraints that are evaluated at the SQL layer. No public exploit has been identified and no active exploitation is confirmed; the overall risk is low (CVSS 4.0: 2.1), but the bypass can permit duplicate record creation or filter evasion in affected applications.
Uncontrolled recursion in ash_oban's compile-time-generated Oban worker code enables unbounded heap growth and CPU exhaustion in the BEAM worker process when a trigger's on_error action deterministically raises on the job's final attempt. Affected versions span 0.8.0-rc.1 through 0.8.13 of the ash-project/ash_oban Elixir library. Any condition that causes the on_error action to fail repeatedly - a data-layer outage, a misconfigured action, or a record the action validates and rejects - loops handle_error/4 forever, growing the process heap without bound until the BEAM runtime kills the worker. No public exploit has been identified at time of analysis; a vendor-released patch is confirmed at 0.8.14.
Weak password recovery in Beetel 450TC3 router firmware 01.00.00_01 allows low-privileged authenticated attackers to exploit a flawed account recovery workflow over the network, potentially escalating privileges to administrative control of the device. A public proof-of-concept has been disclosed on GitHub, and the exploit reference explicitly describes authenticated privilege escalation as the realized impact. The vendor did not respond to coordinated disclosure, meaning no patch exists and no vendor-confirmed mitigations are available.
Integer underflow in NASA cFS's cFE Software Bus module (versions up to 7.0.1) allows a network-reachable, low-privileged attacker to manipulate TotalMsgSize and HdrSize arguments in CFE_SB_GetUserDataLength, triggering a CWE-191 wrap-around that produces an incorrect message-length value. The resulting memory misread yields low-level confidentiality, integrity, and availability impacts on both the vulnerable system and downstream Software Bus consumers. No vendor patch exists - NASA did not respond to coordinated disclosure - and no public exploit or CISA KEV listing has been identified at time of analysis.
JSON path injection in AshSqlite (0.1.2-rc.0 through 0.2.17) allows any attacker who can supply user-controlled input to a get_path/2 query segment to read nested JSON sub-fields that the application never intended to expose. The vulnerable AshSqlite.SqlImplementation code naively concatenates user-supplied segments with periods into a SQLite json_extract path, so a segment containing a dot (e.g., 'private.secret') descends two JSON levels instead of matching a single literal key. No public exploit has been identified and the vulnerability is absent from the CISA KEV catalog; a vendor patch is available targeting version 0.2.18.
Cleartext exposure of nested sensitive fields in Ash Paper Trail audit logs (versions 0.3.0-0.6.x) allows any principal with read access to the version resource table to recover credentials, tokens, or other sensitive values stored inside embedded resources, union types, or lists. The redaction logic in `maybe_redact_changes/3` and `AshPaperTrail.Resource.Changes.CreateNewVersion` only inspects top-level resource attributes for the `sensitive?` flag, never recursing into nested structures, so a parent attribute that is not itself marked sensitive silently passes its embedded sensitive children through to the version table in cleartext. No public exploit has been identified and the issue is not listed in CISA KEV; a vendor-released patch is available at version 0.7.0.
Cleartext storage of sensitive Ash resource attributes in AshPaperTrail versions 0.1.1 through 0.6.x allows any actor with read access to the generated version resource to recover plaintext values of fields marked `sensitive? true`. The library's `CreateVersionResource` transformer incorrectly derives the sensitivity flag for the `changes` map from the `ignore_attributes` exclusion list rather than from the actual tracked attributes, causing the map to always be declared `sensitive? false` and `public? true`, which bypasses Ash's built-in redaction and exposes sensitive values in API responses, logs, and inspect output. No public exploit is identified and no active exploitation is confirmed; a vendor patch was released in version 0.7.0.
The `qs.stringify` function in the qs Node.js query-string library throws an uncaught `TypeError` when serializing any object whose `constructor.isBuffer` property is truthy but not callable, enabling denial of service against applications that re-serialize attacker-controlled data. Express 4 (default query-parser) and body-parser with `extended: true` both parse incoming HTTP data using options that preserve the `constructor` key in output, meaning a crafted request body or query string can reach the vulnerable code path with no non-default configuration required on the target application. A working proof-of-concept is embedded in the CVE description; no CISA KEV listing exists at time of analysis.
Payment status workflow bypass in macrozheng mall up to version 1.0.3 allows authenticated remote attackers to manipulate the orderId parameter at the /order/paySuccess endpoint, potentially marking arbitrary orders as paid without completing actual payment. This CWE-841 business logic flaw directly threatens e-commerce transaction integrity - a proof-of-concept exists (CVSS 4.0 E:P), though no active exploitation is confirmed in CISA KEV. Notably, the vendor silently deleted the GitHub disclosure issue without providing any remediation, leaving no patch available at time of analysis.
Session termination via unsigned SAML LogoutRequest in pac4j-saml before 6.5.6 allows unauthenticated remote attackers to destroy any active SAML session by submitting a forged, unsigned LogoutRequest containing a guessed NameID (e.g., an email address used as the SAML subject identifier) when the IdP omits a SessionIndex. The root cause is that SAML2LogoutValidator.validateLogoutRequest() did not enforce signature validation in this code path, permitting the NameID alone to trigger session destruction without any cryptographic proof of IdP origin. No public exploit code is known and this is not listed in CISA KEV; however, the attack is low-complexity and entirely unauthenticated per the CVSS 4.0 vector.
Authentication bypass in pac4j-oidc before 6.5.6 allows remote unauthenticated attackers to establish authenticated sessions by submitting OIDC callback requests carrying only a third-party access token, bypassing issuer, audience, nonce, and subject validation entirely. Applications built on the pac4j Java security framework that use OIDC for single sign-on are vulnerable to token substitution attacks from any attacker who holds a valid access token issued by the same identity provider for any other registered OAuth client. No public exploit code has been identified at time of analysis; vendor-released patch is available in version 6.5.6.
Account enumeration in Cockpit CMS before 2.14.1 exposes valid usernames through measurable response-time differences in the authentication check endpoint. When a submitted username matches an existing account, the application performs a full bcrypt hash comparison - an intentionally slow operation - whereas non-existent accounts return immediately without any hash computation, creating a statistically detectable timing delta. Unauthenticated remote attackers can exploit this by issuing repeated authentication probes and measuring latency, building a list of valid accounts to target with credential stuffing or brute-force attacks. No public exploit code or CISA KEV listing has been identified at time of analysis, though a researcher advisory (MFC-2026-001) exists.
Race condition in macrozheng mall's /order/submit endpoint (versions up to 1.0.3) allows authenticated remote attackers to exploit unsynchronized order state through concurrent HTTP request timing. The CVSS 4.0 vector (AV:N/AC:H/PR:L) confirms network reachability but high attack complexity and a required authenticated session, yielding limited integrity and availability impact. No public exploit code has been identified and the vendor deleted the associated GitHub issue without explanation, reducing transparency around scope and remediation.
Predictable API key generation in the Newsletters WordPress plugin (versions before 4.17) enables unauthenticated network-accessible attackers who successfully derive the key to perform privileged API operations - including adding or deleting subscribers and sending bulk emails. Exploitation requires the plugin's optional API feature to be enabled. A publicly available proof-of-concept exists via WPScan, though EPSS stands at 0.10% (1st percentile), indicating minimal observed exploitation at time of analysis and no CISA KEV listing.
Cleartext password disclosure in MariaDB Connector/R2DBC (org.mariadb:r2dbc-mariadb) prior to 1.4.1 allows a network-positioned attacker posing as a database server to harvest user credentials during authentication. The connector's AuthenticationPlugin interface lacked any requireSecure() gate, so plugins transmitting credentials in cleartext - mysql_clear_password and PAM/dialog - could be triggered by a forged AuthSwitchRequest over an unencrypted plain-TCP connection, causing the client to respond with the user's database password as raw bytes on the wire. No public exploit code has been identified and no KEV listing exists; the issue is fully patched in version 1.4.1.
MariaDB Connector/R2DBC prior to 1.4.1 hardcodes UTF-8 for all character encoding and decoding but fails to reject mid-session charset changes announced by the server via the OK-packet session-state-tracking mechanism. A hostile or man-in-the-middle server, or server-side constructs such as stored routines, triggers, or server configuration, can shift character_set_client to a non-UTF-8 encoding after connection initialization, causing the driver and server to interpret identical bytes under different encodings. This produces silent data corruption and a charset-confusion mismatch that can undermine byte-wise quoting and escaping, creating a pathway to SQL injection in applications that rely on driver-level escaping; no public exploit has been identified at time of analysis and the vendor-released patch is available in version 1.4.1.
Charset-confusion in MariaDB Connector/J (all branches prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9) allows a server-side character set change mid-session to silently decouple the driver's UTF-8 encoding assumption from the server's active encoding. Because the driver continues escaping SQL string literals as UTF-8 while the server parses incoming bytes under a different multi-byte encoding (e.g., GBK or BIG5), the mismatch can defeat byte-wise SQL quoting and enable SQL injection - a well-documented attack class for charset-confusion primitives. No public exploit has been identified and this CVE is not listed in CISA KEV at time of analysis.
MariaDB Connector/J exposes database account passwords in cleartext to on-path attackers or hostile servers when PAM (dialog) authentication is used over plain TCP. The driver's PAM handler (SendPamAuthPacketFactory, plugin name 'dialog') failed to override the requireSsl() gate that correctly protects its sibling mysql_clear_password plugin, inheriting a default value of false and thus omitting the secure-transport requirement. Under the default connector configuration (sslMode=DISABLE, restrictedAuth=null), a man-in-the-middle or rogue server can issue an Authentication Switch Request for the dialog plugin and receive the account password in cleartext, granting full credential reuse against the real database. No public exploit has been identified and the vulnerability is not listed in CISA KEV, but the attack mechanics are straightforward for any on-path attacker against affected deployments.
Non-constant-time authentication comparisons and plaintext logging of XRES* in free5GC's AUSF component (v1.4.4 and earlier) expose two distinct vulnerability classes under CWE-208. The 5G-AKA confirmation path writes the expected XRES* value to INFO-level application logs immediately before comparison, making authentication material directly readable by any principal with AUSF log access - operators, SIEM agents, log-collection sidecars, or compromised containers. Both 5G-AKA and EAP-AKA' confirmation paths use non-constant-time Go primitives (strings.EqualFold, bytes.Equal, ==) instead of crypto/subtle.ConstantTimeCompare, though the researcher's own PoC confirmed the timing signal is too small to distinguish from HTTP/SBI noise under standard network conditions. No public exploit or CISA KEV listing; patched in v1.4.5.
PAM dialog authentication in MariaDB Connector/Node.js discloses account passwords in cleartext when connections use plain TCP, because the SendPamAuthPacketFactory handler omitted the secure-transport gate that was already applied to the sibling mysql_clear_password plugin. Applications connecting to MariaDB with default settings (sslMode=DISABLE, restrictedAuth=null) over untrusted network paths are exposed to credential theft by any on-path attacker or rogue server that issues an Authentication Switch Request for the dialog plugin. No active exploitation or public exploit code has been identified; vendor-released patches are available across all active 3.x branches.
IBM Integrated Analytics System versions 1.0.0.0 through 1.0.31.0 fails to properly validate TLS certificates, enabling network-positioned attackers to conduct man-in-the-middle attacks and intercept sensitive data in transit. IBM has confirmed the issue and released a patch via advisory node/7285149. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the network-accessible attack vector with no authentication requirement raises the relevance for deployments where the system communicates across untrusted network segments.
IBM Integrated Analytics System versions 1.0.0.0 through 1.0.31.0 employs cryptographic algorithms below acceptable security standards, exposing highly sensitive data to decryption by a network-positioned attacker. The CVSS vector (AV:N/AC:H/PR:N/UI:N) indicates network exploitation without authentication but requires high attack complexity, consistent with a passive interception or man-in-the-middle scenario. No public exploit code has been identified, and IBM has released a remediation patch via support advisory 7285147.
Memory corruption in the TP-Link TL-WR841N v14 embedded HTTP service allows an unauthenticated attacker with adjacent network access to trigger a buffer overflow by submitting a crafted multipart/form-data request containing an oversized boundary parameter. The confirmed impact is limited to undefined application behavior resulting from process memory corruption; TP-Link's own advisory and the CVE description both explicitly state that arbitrary code execution, information disclosure, and denial-of-service have not been demonstrated, despite those labels appearing in the CVE tags. No public exploit code has been identified at time of analysis, and this CVE is not listed in CISA's Known Exploited Vulnerabilities catalog.
CSV injection in the MongoDB MongoSQL Transition Readiness Tool allows a low-privileged cluster user to embed spreadsheet formula directives inside database or collection names, which are written unsanitized into generated CSV reports. When an operator opens the report in a spreadsheet application such as Microsoft Excel or LibreOffice Calc, the formula executes on the operator's workstation, potentially exfiltrating report contents to an attacker-controlled endpoint or triggering external content retrieval. No public exploit code or CISA KEV listing has been identified at time of analysis; exploitation is constrained by the requirement for both cluster write access and an operator who opens the file in a formula-evaluating spreadsheet.
Graylog Server's system catalog entity titles API endpoint leaks protected database fields - including user password hashes - to authenticated requesters who craft custom field-selection parameters. PR:L authentication is required, and permission checks are partially enforced: regular users are limited to their own password hash, but any user holding an admin role can extract password hashes for every account in the system. No public exploit or CISA KEV listing has been identified; vendor-released patch 7.1.4 is available and is the only remediation.
Copilot Chat in Microsoft Edge (Chromium-based) exposes a race condition that enables an authorized, low-privileged attacker to disclose information across a component scope boundary over the network. The flaw arises from improper synchronization of concurrent access to a shared resource within the Copilot Chat feature, producing partial confidentiality and, per the official CVSS vector, limited integrity exposure. No public exploit code has been identified at time of analysis, and this vulnerability does not appear in the CISA Known Exploited Vulnerabilities catalog.
Heap out-of-bounds read and stack out-of-bounds access in GIMP's file-psd plugin allow an attacker to crash the application or disclose limited memory contents by convincing a user to open a specially crafted PSD image. The flaw affects GIMP as shipped in Red Hat Enterprise Linux 6 through 9 and stems from missing validation of the channel-count parameter during PSD parsing. No active exploitation has been identified; the attack requires local file delivery and deliberate user interaction, significantly constraining real-world risk.
StarRocks through version 4.0.13 exposes complete query history for all users to any authenticated low-privilege user via the unguarded query_detail REST endpoint. The endpoint returns full SQL text, execution plans, and profiling data without filtering by the requesting user's identity, meaning statements containing embedded credentials - connection strings, passwords passed as query parameters - are fully readable by any logged-in account. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, but the low authentication bar (any valid account) and high confidentiality impact make this a meaningful lateral-movement and credential-harvesting risk in multi-tenant or shared StarRocks deployments.
Heap out-of-bounds read in GIMP's file-pvr plugin exposes users of Red Hat Enterprise Linux 6 through 9 to application crashes and limited heap memory disclosure when opening a crafted PVR image file. The VQ (Vector Quantization) compressed-texture decoder omits mandatory bounds validation, allowing a malicious image to read beyond allocated heap regions. Impact is primarily denial of service via crash, with a secondary low-severity information disclosure path; no public exploit code and no CISA KEV listing are associated with this issue at time of analysis.
Nonce reuse in wolfEngine's AES-CCM implementation for TLS 1.2 and DTLS 1.2 allows a network-positioned adversary to recover plaintext across records and forge authentication tags within a session. The root defect is that wolfEngine reads the explicit CCM nonce from the uninitialized record input buffer rather than deriving it from the TLS sequence number in the Additional Authenticated Data, producing a constant nonce for every record under the same key. Exposure is sharply constrained: AES-CCM cipher suites must be explicitly selected (non-default), only wolfEngine is affected (wolfProvider is not), and TLS 1.3 is entirely outside scope. No public exploit or CISA KEV listing exists at time of analysis; the vendor-released fix is wolfEngine 1.4.1.
Capture-replay authentication bypass in the Forminator WordPress plugin (versions up to and including 1.57.1) allows unauthenticated network-accessible attackers to achieve low-level integrity impact against affected installations. Reported by Patchstack under CWE-294, the flaw enables replay of captured authentication or nonce tokens, potentially allowing unauthorized form actions or integrity-affecting operations without valid credentials. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Heap out-of-bounds read in GIMP's file-ico plugin allows a local attacker to crash GIMP or leak limited heap memory contents by delivering a specially crafted ICO image file to a victim user. Affected packages span Red Hat Enterprise Linux 6 through 9. No public exploit code or CISA KEV listing exists at time of analysis, but the user-interaction requirement (opening a malicious file) is the primary delivery mechanism and a realistic social-engineering target in image-processing workflows.
Heap out-of-bounds read in GIMP's file-iff plugin allows a local attacker to crash the application or disclose limited heap memory contents by delivering a specially crafted IFF/ILBM image file. The flaw stems from missing validation of HAM row size when the number of color planes (nPlanes) is zero, causing a size mismatch that bypasses memory bounds checking. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis.
Log forging in morgan HTTP request logger middleware for Node.js (all versions prior to 1.12.0) allows unauthenticated remote attackers to inject Unicode line separator characters - U+0085 (Next Line), U+2028 (Line Separator), and U+2029 (Paragraph Separator) - into log output via attacker-controlled token values such as the Basic auth username surfaced through the remote-user token. This causes Unicode-aware downstream log processors and SIEM pipelines to split a single HTTP request record into multiple logical entries, enabling false log injection and audit trail manipulation. This is an incomplete-fix follow-up to CVE-2026-5078, which addressed only ASCII control characters; no public exploit has been identified at time of analysis.
Sensitive data exposure in Le-yan's Medical Practice Management System enables access to confidential medical or patient data through URL query string parameters that persist in browser history and server or proxy log files (CWE-598). The application transmits sensitive values via HTTP GET parameters rather than POST body or secure headers, causing this data to be recorded in multiple secondary storage locations outside the intended session scope. No public exploit code has been identified at the time of analysis, but the attack class requires minimal technical sophistication once access to affected log or history files is established; medical data sensitivity elevates real-world impact beyond what the base CVSS score alone suggests.
Uncontrolled recursion between Elixir's charlist inspection path and the error-message rescue clause in List.to_string/1 and List.to_charlist/1 can exhaust a BEAM node's memory when an attacker controls list data reaching those functions. A crafted list whose printable prefix exceeds the 4096-element printable_limit but which carries an invalid element beyond that threshold bypasses the ASCII classification check, triggers ArgumentError in IO.chardata_to_string/1, and then recurses infinitely through the rescue clause because the inner inspect/1 call is not in tail position - every frame is retained on the process heap. No public exploit has been identified at time of analysis; vendor-released patches are available as Elixir 1.18.5, 1.19.6, and 1.20.4.
Cross-user data disclosure in SvelteKit (npm/@sveltejs/kit versions 2.38.0 through 2.60.0) stems from a race condition in the query.batch() API that can cause concurrent HTTP requests from different authenticated users to merge under a single shared request context. Successful exploitation allows one user to receive response data belonging to another user's simultaneous session, including potentially sensitive application state. Vendor-released patch version 2.60.1 is available; no active exploitation has been confirmed and no public exploit code has been identified at time of analysis.
Prototype pollution in SvelteKit's remote form functions allows network-accessible attackers to remove methods from JavaScript object prototypes by supplying crafted, user-controlled file input path names. Affected versions are all @sveltejs/kit releases up to and including 2.69.0; the vendor released a fix in 2.69.1. No active exploitation is documented in CISA KEV, and no public exploit code has been identified at time of analysis, though the vulnerability is network-reachable and requires no authentication from the attacker.
Arbitrary file write outside the worktree boundary in gix-worktree-state (part of gitoxide) before 0.33.0 on Windows enables an attacker-controlled repository to overwrite files at arbitrary paths on a victim's filesystem. The flaw manifests when gix_worktree_state::checkout() performs an incremental materialization: a malicious repo first places a symlink entry at path P pointing outside the worktree, then a subsequent incremental checkout of a regular-file entry at the same path follows the Windows reparse point and writes attacker-supplied blob content through the link. No public exploit code is identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Stale public share links in filebrowser through 2.63.23 can silently redirect to unrelated files uploaded after a rename operation, unexpectedly exposing new content to anyone holding the original link. The defect (CWE-459, Incomplete Cleanup) arises because share records are keyed by file path rather than a file identifier - deletion triggers cleanup, but rename does not, leaving the share dormant. No public exploit or CISA KEV listing exists at time of analysis, and the CVSS 4.0 score of 2.3 reflects the multi-step preconditions required, but the confidentiality risk is real for deployments where multiple users share create permissions on overlapping directories.
Stale public share links in File Browser 2.63.6-2.63.23 expose subsequently uploaded content to unauthenticated network access after a privileged user deletes another user's shared file without triggering proper link invalidation. Because the surviving share URL continues to resolve to whatever is later placed at the same storage path, an attacker who retains or discovers the original link can retrieve entirely unrelated files without authentication. No public exploit code is identified at time of analysis, and the CVSS 4.0 score of 2.3 reflects the constrained, multi-step preconditions required.
Unauthenticated information disclosure in WWBN AVideo through version 30.0 exposes user registration statistics via two unprotected PHP endpoints. The report4.json.php and report4.1.json.php files return daily and cumulative user-registration counts to any remote requester without authentication or session validation. No public exploit code has been identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog; however, its trivial exploitation path and network accessibility make it easy for any actor who can reach the server to enumerate platform growth data.