Information Disclosure

Cross-tenant namespace disclosure in LangGraph's PostgreSQL and SQLite checkpoint stores allows an authenticated low-privileged user to read stored items belonging to other namespaces without any crafted input. The flaw arises from translating hierarchical namespaces into dot-joined strings and scoping reads with SQL LIKE patterns that have no understanding of the segment separator, so a query scoped to 'foo' also returns data from 'foobar' or 'foo2'. Exploitation requires the specific precondition of prefix-overlapping or wildcard-containing namespace labels; no public exploit code exists and the vendor confirms no evidence of in-the-wild exploitation.

Timing side-channel exposure in Apache Portable Runtime Utility (APR-util) versions 1.2.0 through 1.6.3 allows network-accessible attackers to statistically recover passwords or hashes by measuring response-time variance in the `apr_password_validate()` function, which performs non-constant-time comparisons. The risk is materially elevated on platforms lacking native `crypt()` support - specifically Windows, Android, BeOS, and NetWare - where the non-constant-time code path is always exercised rather than conditionally. No public exploit has been identified at time of analysis, though the SSVC framework assesses the attack as automatable with partial technical impact.

Sensitive data exposure in the Gutenberg Blocks by Kadence Blocks WordPress plugin (versions <= 3.7.8) allows authenticated Contributor-level users to access information they should not be permitted to view. The CVSS vector (PR:L/C:L) confirms this is a low-privilege, partial confidentiality breach rather than a full data dump, limiting its severity to medium-low. No public exploit code has been identified and CISA KEV does not list this vulnerability, indicating no confirmed active exploitation at time of analysis.

Unauthenticated sensitive data exposure in the Featured Video Plus WordPress plugin (versions <= 2.3.3) allows any remote attacker to retrieve sensitive information without credentials via a crafted network request. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this is exploitable against any default installation of the plugin with no prerequisites beyond network access. Classified under CWE-201, the plugin inserts sensitive information into its sent data, making it passively harvestable. No public exploit code or CISA KEV listing has been identified at time of analysis.

Unauthenticated sensitive data exposure in the Export Import Menus WordPress plugin (versions up to and including 1.9.2) allows remote, unauthenticated attackers to access sensitive information by invoking the plugin's export functionality without any credentials. Classified under CWE-201 (Insertion of Sensitive Information Into Sent Data), the plugin returns sensitive data in its HTTP responses to unauthenticated requests. No public exploit code has been identified at time of analysis, and this CVE does not appear on the CISA Known Exploited Vulnerabilities catalog.

Unauthenticated sensitive data exposure in the Custom CSS and JavaScript WordPress plugin (by WP Zone) versions up to and including 2.0.16 allows remote unauthenticated attackers to read sensitive information via network-accessible endpoints. Classified under CWE-201 (Insertion of Sensitive Information Into Sent Data), the flaw permits retrieval of data that the plugin transmits without requiring any authentication, with a CVSS 3.1 score of 5.3 (Medium). No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Broken authentication in WP Event Solution WordPress plugin (versions ≤4.1.9) permits unauthenticated remote attackers to bypass authentication controls via an alternate path or channel (CWE-288), resulting in limited information disclosure and partial integrity impact. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this is exploitable over the network with no credentials and no user interaction required against any WordPress installation running the affected plugin. No public exploit code and no CISA KEV listing have been identified at time of analysis.

Broken Authentication in Gutena Forms WordPress plugin (versions <= 1.9.0) allows unauthenticated remote attackers to bypass authentication controls, resulting in limited integrity and availability impacts against form configurations or submissions. The vulnerability is classified as CWE-288 (Authentication Bypass Using an Alternate Path or Channel) and was reported by Patchstack. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and lack of authentication requirements make it straightforward to attempt against any exposed WordPress installation running the affected plugin.

Unauthenticated sensitive data exposure in the YITH WooCommerce Zoom Magnifier WordPress plugin (versions ≤ 2.52.0) permits remote, unauthenticated attackers to retrieve sensitive information without any credentials. Classified under CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere), the plugin exposes data through a network-accessible endpoint that lacks proper authorization controls. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the low attack complexity makes opportunistic discovery straightforward.

RealHomes Memberships WordPress plugin before 3.1.0 permits any authenticated user - including low-privilege Subscribers - to claim paid membership packages for free by exploiting missing payment verification, absent nonce validation, and no capability checks on the membership grant endpoint. The business impact is direct financial loss for site operators running paid real estate membership tiers. No active exploitation has been confirmed by CISA KEV, but a public exploit is available via WPScan, lowering the barrier for abuse.

Business logic enforcement failure in WonderTrader's backtesting engine (versions up to 0.9.9) allows a low-privileged authenticated remote attacker to manipulate the internal limit order book cache through the MatchEngine::update_lob function in src/WtBtCore/MatchEngine.cpp. The flaw enables integrity-affecting manipulation of simulated or processed order book state in violation of expected matching workflow constraints. No vendor patch exists - the vendor did not respond to responsible disclosure - and proof-of-concept exploit code is publicly available (CVSS 4.0 E:P), though real-world risk is substantially bounded by the authentication requirement, low-only integrity impact, and niche deployment footprint.

Local privilege abuse in pardus-domain-joiner (TÜBİTAK BİLGEM Software Technologies Research Institute) before version 0.5.5 exposes Pardus Linux systems to unauthorized resource access through unverified ownership checks (CWE-283). A locally authenticated user with low privileges can trigger a code path where ownership of a resource is not validated before access or privileged operations are permitted, enabling privilege abuse. No public exploit code or active exploitation has been identified; the CVSS score of 3.3 reflects limited real-world impact confined to local sessions on Pardus Linux systems.

Improper input validation in OMICRON StationGuard 4.00 allows an adjacent network attacker to crash the IEC 61850 Sampled Values processing component by sending a specially crafted SV frame. The disruption is self-healing - the process restarts automatically and the failure is immediately surfaced to operators - leaving overall system availability and all other monitored traffic types unaffected. No public exploit code exists and this vulnerability is not listed in CISA KEV; the CVSS 4.0 score of 1.3 reflects the accurately bounded, minimal real-world impact.

openvpnserv on Windows insufficiently validates command line arguments received from its control socket before passing them to the openvpn.exe process, allowing a low-privileged local user to circumvent administrator-defined restrictions on permitted OpenVPN configuration directories. Affected installations span OpenVPN 2.4.0 through 2.6.21 and 2.7_alpha1 through 2.7.5 on Windows; fixed releases 2.6.22 and 2.7.6 shipped August 5, 2026. No public exploit or CISA KEV listing has been identified at time of analysis, though the CVSS 4.0 SC:H metric indicates that bypassing config directory controls could allow rogue VPN configurations to be loaded, with high downstream confidentiality impact on subsequent network systems.

Certificate validation bypass in OpenVPN 2.7 alpha series (mbedTLS builds) causes the --x509-username-field directive to unintentionally accept certificates that should be rejected, potentially granting unauthorized VPN network access. Only deployments running a 2.7 alpha or pre-release build compiled against mbedTLS and explicitly configured with --x509-username-field are exposed; OpenVPN 2.6.x stable series and OpenSSL-backend builds are not affected. The vendor characterizes this as a low-priority security finding; no public exploit has been identified at time of analysis and it is not listed in the CISA Known Exploited Vulnerabilities catalog.

eta-otp-lock before version 1.0.4 exposes sensitive information - likely OTP codes or credentials - as visible process arguments during invocation, enabling local system footprinting by other users. The vulnerability maps to CWE-214, where secrets passed via command-line arguments or process environment can be read by any local user through standard OS interfaces such as /proc or ps. No public exploit code exists and the product is not listed in CISA KEV, but the high confidentiality impact reflects the sensitivity of OTP material if intercepted.

Tenant isolation failure in WSO2 Identity Server allows authenticated low-privilege users to disclose personally identifiable information belonging to users in separate tenants. The vulnerability exists specifically when Email OTP, SMS OTP, or Magic Link are configured as first-factor authenticators - authentication requests processed through these flows lack sufficient validation to enforce organizational tenant boundaries, exposing data such as mobile numbers. No public exploit code or CISA KEV listing exists at time of analysis, but the low-complexity, network-accessible attack vector (CVSS PR:L/AV:N/AC:L) makes this a credible insider threat and compromised-account scenario for multi-tenant deployments.

Insufficient refresh token invalidation in WSO2 Identity Server's user impersonation flow allows a privileged attacker who has already obtained an impersonated access token to silently renew that authorization via the OAuth refresh token grant, sustaining unauthorized access well beyond the intended session lifetime. The integrity impact is two-fold: the attacker continues performing actions on behalf of the legitimate user, and audit logs attribute those actions to the victim identity rather than the true actor, corrupting traceability and compliance posture. No public exploit is identified and exploitation is bounded by high privilege prerequisites (PR:H) and adjacent network access (AV:A), placing realistic risk firmly in insider-threat and compromised-administrator scenarios.

Cross-organizational secret deletion in WSO2 Identity Server's Secret Type Management REST API allows an administrator with delete permissions to inadvertently remove secrets across all organizations in a multi-tenant deployment. The on-delete cascade logic, triggered when a secret type is deleted, fails to enforce organizational boundaries - a multi-tenancy isolation failure classified as CWE-281 (Improper Preservation of Permissions). Exploitation yields availability and integrity impact across the entire deployment, though it is constrained to high-privilege administrator accounts. No public exploit is identified and this vulnerability is not listed in the CISA KEV catalog.

Username enumeration via observable login response discrepancy affects WSO2 Identity Server, WSO2 Identity Server as Key Manager, WSO2 API Manager, WSO2 Open Banking AM, and WSO2 Open Banking IAM when the Multi-Attribute Login feature is enabled. When a valid username is submitted, the server resolves and returns the canonical form of that username; when an invalid username is submitted, the server echoes the raw input unchanged - creating a deterministic, scriptable oracle for account existence. This disclosure path persists regardless of the validate_username configuration setting, meaning a common hardening measure provides no defense. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Incomplete session cleanup in poco-ai/poco-agent up to version 0.5.4 can permanently destroy the host user's ~/.claude directory - including all Claude Code chat history stored under ~/.claude/projects - when the agent runs outside a container environment. The WorkspaceManager._setup_session_persistence method performs an unconditional rmtree followed by a symlink swap on ~/.claude without verifying a container context, and the corresponding cleanup phase can additionally unlink pre-existing ~/.claude symlinks unrelated to poco-agent. A publicly available exploit exists via GitHub issue #131 and PR #132, though the CVSS 4.0 base score of 2.9 reflects high attack complexity and impact limited to low integrity and availability loss with no confidentiality breach.

File inclusion in TinyAGI 0.0.20 exposes server-side files to remote unauthenticated attackers through the buildSystemPrompt function in packages/server/src/routes/agents.ts. Exploitation requires no privileges or user interaction, and a publicly available proof-of-concept exists via GitHub issue #283. No patch has been released - the vendor has not responded to the responsible disclosure despite being notified through the project's issue tracker.

In the Linux kernel, the following vulnerability has been resolved: iio: adc: spear: Initialize completion before requesting IRQ In the report from Jaeyoung Chung: "spear_adc_probe() in drivers/iio/adc/spear_adc.c registers its interrupt handler with devm_request_irq() before it initializes st->completion with init_completion(). If an interrupt arrives after devm_request_irq() and before init_completion(), the handler calls complete() on an uninitialized completion, causing a kernel panic. The probe path, in spear_adc_probe(): iodev = devm_iio_device_alloc(&pdev->dev, sizeof(*st)); /* st kzalloc-zeroed */ ... retval = devm_request_irq(&pdev->dev, irq, spear_adc_isr, 0, LPC32XXAD_NAME, st); /* register handler */ ... init_completion(&st->completion); /* initialize completion */ spear_adc_isr() calls complete(): complete(&st->completion); If the device raises an interrupt before init_completion() runs, complete() acquires the uninitialized wait.lock and walks the zeroed task_list in swake_up_locked(). The zeroed task_list makes list_empty() return false, so swake_up_locked() dereferences a NULL list entry, triggering a KASAN wild-memory-access." Fix the chance of a spurious IRQ causing an uninitialized pointer dereference by moving init_completion() above devm_request_irq().

In the Linux kernel, the following vulnerability has been resolved: HID: hid-lenovo-go: cancel cfg_setup work in hid_go_cfg_remove() hid_go_cfg_probe() initialises drvdata.go_cfg_setup and schedules it to run 2 ms later: INIT_DELAYED_WORK(&drvdata.go_cfg_setup, &cfg_setup); schedule_delayed_work(&drvdata.go_cfg_setup, msecs_to_jiffies(2)); cfg_setup() dereferences drvdata.hdev to issue MCU command requests. hid_go_cfg_remove() tears down sysfs and stops the HID device, but never drains the delayed work. If the device is unbound within the 2 ms scheduling delay (a probe failure rolling back via remove, or a fast rmmod after probe), the work fires after hid_destroy_device() has dropped its reference and released the underlying hdev struct, leaving cfg_setup() with a stale drvdata.hdev pointer. Mirror the sibling driver hid-lenovo-go-s.c, whose hid_gos_cfg_remove() already calls cancel_delayed_work_sync() on its analogous work, and drain go_cfg_setup at the top of hid_go_cfg_remove(). The cancel must come before guard(mutex)(&drvdata.cfg_mutex) because cfg_setup() acquires that mutex; reversing the order would deadlock.

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_fs: initialize reset_work at allocation time ffs_fs_kill_sb() unconditionally calls cancel_work_sync() on ffs->reset_work when a functionfs instance is unmounted: ffs_data_reset(ffs); cancel_work_sync(&ffs->reset_work); However ffs->reset_work is only ever initialized via INIT_WORK() in ffs_func_set_alt() and ffs_func_disable(), and only on the FFS_DEACTIVATED path. That state is reached solely by ffs_data_closed() when the instance is mounted with the "no_disconnect" option, so for the common case (no "no_disconnect", or mounted and unmounted without ever being deactivated) reset_work is never initialized. ffs_data_new() allocates the ffs_data with kzalloc_obj() and does not initialize reset_work, and ffs_data_reset()/ffs_data_clear() do not touch it either, so reset_work.func is left NULL. cancel_work_sync() on such a work then trips the WARN_ON(!work->func) guard in __flush_work(): WARNING: kernel/workqueue.c:4301 at __flush_work+0x330/0x360, CPU#3: umount Call trace: __flush_work cancel_work_sync ffs_fs_kill_sb [usb_f_fs] deactivate_locked_super deactivate_super cleanup_mnt __cleanup_mnt task_work_run exit_to_user_mode_loop el0_svc On older kernels cancel_work_sync() on a zero-initialized work struct was a silent no-op, which hid the missing initialization. Initialize reset_work once in ffs_data_new() so it is always valid for the lifetime of the ffs_data, and drop the now-redundant INIT_WORK() calls from the two deactivation paths.

In the Linux kernel, the following vulnerability has been resolved: dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning When CONFIG_DMA_API_DEBUG_SG is enabled, importing a udmabuf into a DRM driver (e.g. amdgpu for video playback in GNOME Videos / Showtime) triggers a spurious warning: DMA-API: amdgpu 0000:03:00.0: cacheline tracking EEXIST, \ overlapping mappings aren't supported WARNING: kernel/dma/debug.c:619 at add_dma_entry+0x473/0x5f0 The call chain is: amdgpu_cs_ioctl -> amdgpu_ttm_backend_bind -> dma_buf_map_attachment -> [udmabuf] map_udmabuf -> get_sg_table -> dma_map_sgtable(dev, sg, direction, 0) // attrs=0 -> debug_dma_map_sg -> add_dma_entry -> EEXIST This happens because udmabuf builds a per-page scatter-gather list via sg_set_folio(). When begin_cpu_udmabuf() has already created an sg table mapped for the misc device, and an importer such as amdgpu maps the same pages for its own device via map_udmabuf(), the DMA debug infrastructure sees two active mappings whose physical addresses share cacheline boundaries and warns about the overlap. The DMA_ATTR_SKIP_CPU_SYNC flag suppresses this check in add_dma_entry() because it signals that no CPU cache maintenance is performed at map/unmap time, making the cacheline overlap harmless. All other major dma-buf exporters already pass this flag: - drm_gem_map_dma_buf() passes DMA_ATTR_SKIP_CPU_SYNC - amdgpu_dma_buf_map() passes DMA_ATTR_SKIP_CPU_SYNC The CPU sync at map/unmap time is also redundant for udmabuf: begin_cpu_udmabuf() and end_cpu_udmabuf() already perform explicit cache synchronization via dma_sync_sgtable_for_cpu/device() when CPU access is requested through the dma-buf interface. Pass DMA_ATTR_SKIP_CPU_SYNC to dma_map_sgtable() and dma_unmap_sgtable() in udmabuf to suppress the spurious warning and skip the redundant sync.

In the Linux kernel, the following vulnerability has been resolved: i2c: core: fix NULL-deref on adapter registration failure If adapter registration ever fails the release callback would trigger a NULL-pointer dereference as the completion struct has not been initialised. Note that before the offending commit this would instead have resulted in a minor memory leak of the adapter name.

File inclusion via unsanitized path input in TinyAGI 0.0.20's Message API Endpoint exposes server-side files to remote unauthenticated attackers. The vulnerable surface is the `collectFiles` function in `packages/core/src/response.ts`, which accepts externally controlled file paths without adequate validation (CWE-73). Publicly available exploit code exists via GitHub issue #282, and the project maintainer had not issued a patch or response at time of disclosure - compounding risk for any internet-exposed deployments.

Symlink escape in openclaw-cn's apply_patch Tool allows authenticated remote attackers on versions up to 0.2.1 to traverse outside the intended sandbox boundary by exploiting a failure in the assertNoSymlinkEscape validation function in src/agents/sandbox-paths.ts. Attackers with low-level access can craft symbolic links within the sandbox that resolve to paths outside it, yielding limited unauthorized read and write access to the underlying filesystem. A public proof-of-concept exploit is documented in GitHub issue #566, and no vendor patch has been released as the project has not responded to disclosure.

Cleartext exposure of third-party API keys and authentication tokens in AI Engine WordPress plugin (before 3.6.4) allows Editor-role users to read secrets that are intended to be administrator-only. The plugin inlines sensitive configuration values into admin page JavaScript without redaction, making them readable to any authenticated user with Editor access who inspects the page source. A public proof-of-concept exists per WPScan, though EPSS remains low at 0.17% (7th percentile) and the vulnerability is not in the CISA KEV catalog.

tourmaster WordPress plugin (all versions before 5.4.9) exposes exported customer booking and order data via a fixed, predictable file path inside its publicly accessible web directory, with no authentication or access control enforcing download restrictions. Any unauthenticated network attacker who knows or can derive the static export file URL can retrieve personally identifiable information - names, contact details, and booking records - after an administrator has triggered an export. A publicly available proof-of-concept exists per WPScan, and exploitation is fully automatable (SSVC), though EPSS sits at 0.14% and no CISA KEV listing exists at time of analysis.

Unauthorized retrieval of other customers' payment receipt images is possible in PeproDev WooCommerce Receipt Uploader (≤ 2.8.0) because the plugin's token-based attachment access mechanism never validates that a requested attachment ID belongs to the order the token was issued for. Unauthenticated network attackers can forge or repurpose a token - trivially obtained by placing any order - to iterate over attachment IDs and exfiltrate payment receipts uploaded by unrelated customers, potentially exposing financial documents containing banking details or PII. A publicly available proof-of-concept exists per WPScan reporting (EUVD-2026-53719); no CISA KEV listing indicates widespread active exploitation has not been confirmed, though SSVC rates the attack as automatable.

Incorrect privilege assignment in cosmicstack-labs mercury-agent (all versions through 1.1.12) allows authenticated remote attackers to bypass shell command permission checks via the run_command Handler. The flaw resides in the PermissionManager.checkShellCommand function within src/capabilities/permissions.ts, where privilege levels are not correctly validated, potentially enabling a low-privileged user to execute shell commands exceeding their authorized scope. A public proof-of-concept exploit exists via GitHub issue #72, and the project maintainer has not responded to responsible disclosure, leaving no vendor-released patch available at time of analysis.

Information disclosure in netease-youdao LobsterAI 2026.6.10 exposes sensitive data through manipulation of the MEDIA Path Handler component. The vulnerable function parseMediaTokensFromText in src/renderer/services/artifactParser.ts can be triggered remotely when a user interacts with attacker-controlled content, leaking confidential information such as local file system paths or internal metadata. A publicly available exploit exists via GitHub issue #2176, and the vendor has not responded to coordinated disclosure, leaving no patch available at time of analysis.

Incorrect privilege assignment in NousResearch hermes-agent through 0.16.0 allows authenticated remote users to invoke toolsets that administrators have explicitly disabled via the disabled_toolsets configuration. The flaw resides in get_tool_definitions within agent/agent_init.py, where the disabled_toolsets list was not checked before injecting tool definitions into an agent session, causing disabled tools (e.g., 'memory') to remain fully accessible. No active exploitation is confirmed (not in CISA KEV), but a public proof-of-concept exists via GitHub issue #46171 and an upstream fix is available in PR #46185.

Unauthenticated remote information disclosure in heshengtao super-agent-party (up to version 0.4.1) allows remote attackers to read sensitive file content by manipulating the tool_name or tool_params arguments passed to the get_file_content function via the execute_tool_manually endpoint in server.py. The flaw requires no authentication and no user interaction, and a public proof-of-concept exploit is available on GitHub. No patch has been issued; the vendor did not respond to coordinated disclosure.

Out-of-bounds heap read in HDF5's N-Bit filter decompression affects all versions through 2.3.0, allowing an attacker who can deliver a crafted HDF5 file to a user or automated pipeline to trigger application crashes and, in constrained cases, leak adjacent heap memory contents into decompressed dataset values. The three affected functions - H5Z__nbit_decompress_one_byte, H5Z__nbit_decompress_one_nooptype, and H5Z__nbit_decompress_one_atomic - advance a buffer read index without bounding it against the actual compressed chunk size, exploitable whenever H5Dread is invoked, including via common tools like h5ls and h5repack. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.

Unauthorized component instantiation in Nuxt server islands (versions >=3.1.0 <3.21.10 and >=4.0.0 <4.5.1) allows remote unauthenticated attackers to render arbitrary globally-registered Vue components or native HTML elements - including constructs like `<iframe>` - by supplying a crafted string prop to the `/__nuxt_island/` endpoint. The attack exploits Vue's attribute fallthrough behavior: props an island does not declare pass through to its root element, so if that root is a polymorphic component (such as reka-ui or @nuxt/ui elements using an `as` prop), the attacker's string silently reaches dynamic component resolution without any explicit forwarding in the island author's code. Unlike the related RCE vector GHSA-9473-5f9j-94wq, this does not require `vue.runtimeCompiler`, making it reachable in substantially more configurations; however, no public exploit has been identified at time of analysis and real-world exploitation is constrained by application-specific island configuration requirements.

Credential exposure in HCL Digital Experience and Digital Experience Compose allows sensitive authentication material to be written to web server logs under specific, non-default configurations when the default login portlet is in use. The flaw, classed as CWE-522 (Insufficiently Protected Credentials), means that any party with read access to web server logs - such as operations staff, log aggregation systems, or an attacker who has compromised a log pipeline - may recover cleartext or weakly protected user credentials. No public exploit code has been identified at time of analysis, and active exploitation has not been confirmed by CISA KEV.

Authenticated users in IBM Langflow OSS 1.0.0 through 1.10.3 can exploit a privileged built-in component to read arbitrary server-side environment variables, bypassing security controls designed to restrict custom component execution. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H) confirms this is a low-complexity, network-accessible flaw requiring only standard user credentials, with high confidentiality impact. No active exploitation confirmed via CISA KEV, and no public exploit code has been identified at time of analysis; IBM has released a patch via its support portal.

Prototype pollution via Electron's contextBridge allows untrusted renderer-side web content to smuggle a malicious prototype across the isolation boundary into preload script context, bypassing context isolation in versions prior to 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.4. Exploitation is conditional on preload scripts accepting object arguments from untrusted content and reading inherited properties without own-property guards. No public exploit has been identified at time of analysis, and the flaw is not listed in CISA KEV; however, the scope-change (S:C) CVSS metric reflects that a successful attack crosses the renderer-to-preload privilege boundary, which can have amplified consequences in apps that expose sensitive Node.js APIs through the bridge.

Credential exposure in Cisco RoomOS allows an authenticated low-privilege local user to capture user login credentials by enabling a specific debug logging level and collecting the resulting system logs. The flaw (CWE-532) spans a wide version range from RoomOS 10.x through 26.x across Cisco's entire room collaboration device portfolio. No public exploit code has been identified and this CVE does not appear in the CISA KEV catalog at time of analysis, but the High confidentiality impact - plaintext credential disclosure - warrants prioritized patching on any device with non-administrative local accounts.

Cleartext credential exposure in Cisco Catalyst SD-WAN Manager's web-based management interface allows an authenticated low-privileged remote attacker to read sensitive authentication material from system logs. The root cause is an incomplete encryption allowlist: specific template types are excluded from the encryption policy, resulting in sensitive values being written to logs in cleartext - accessible both on the local system and on any configured remote logging server. No public exploit code has been identified and this vulnerability is not listed in CISA KEV, but successful exploitation directly enables credential theft that can cascade into broader SD-WAN infrastructure compromise.

Privilege escalation via command injection in Cisco Integrated Management Controller (IMC) allows authenticated Admin-level attackers to execute arbitrary OS commands and elevate to root on affected Cisco UCS Standalone and E-Series systems. Exploitation requires Admin credentials to the web-based management interface but results in full OS root access, which Cisco rates as High SIR despite a CVSS 6.5 (Medium) score - explicitly noting that root attainment carries security implications beyond what the base score reflects. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.

Electron's window.open() features string parsing forwards untrusted BrowserWindowConstructorOptions directly to child BrowserWindows without an allowlist, allowing renderer-side web content to supply privileged options - such as icon - that cause the trusted main process to access attacker-chosen file or network paths. All Electron apps serving untrusted web content without a setWindowOpenHandler guard are affected across the 39.x, 40.x, 41.x, and 42.x beta series. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog; the practical attack surface is narrowed to apps that load third-party or user-controlled content and omit the recommended setWindowOpenHandler override.

Bolt protocol handshake decoder in Neo4j Enterprise and Community Editions fails to distinguish overlong capability masks from truncated ones, leaving server-side channels permanently open without producing a finalization message. Any unauthenticated client reaching the Bolt connector (default TCP 7687) can trigger this pre-authentication stall by sending 32 continuation bytes in the capability mask, causing the decoder to loop on the same unread bytes. The CVSS 4.0 vector carries E:P (proof of concept exists) with a low availability impact; no active exploitation has been confirmed via CISA KEV, but the trivial pre-auth trigger and POC availability increase realistic risk to exposed Bolt endpoints.

Session isolation bypass in Electron's custom protocol handler allows cached HTTP responses from defaultSession to leak across otherwise isolated session partitions. Electron versions 40.x through pre-release 43.x are affected when apps use ProtocolResponse.url without specifying ProtocolResponse.session, causing upstream requests to be routed through defaultSession regardless of which session registered the protocol handler. An attacker who can trigger a cross-session cache hit may read confidential session-scoped content (C:H) or partially influence cached responses (I:L) intended for a different, isolated session; no public exploit or CISA KEV listing exists at time of analysis.

IBM Maximo Application Suite 9.0, 9.1, and 9.2 fails to set the `Secure` attribute on authorization tokens and session cookies, enabling interception of credential material over unencrypted HTTP. An attacker who tricks an authenticated user into following an HTTP link - via phishing or a malicious page - causes the victim's browser to transmit the session cookie in plaintext, where it can be captured by a server the attacker controls or via network sniffing. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog; however, session token theft can lead to full account takeover, meaningfully exceeding the limited confidentiality scope implied by the raw CVSS score.

Session data tampering in IBM Maximo Application Suite 9.0, 9.1, and 9.2 is possible because the application signs session tokens with a weak HMAC secret, classified under CWE-330 (Use of Insufficiently Random Values). A remote unauthenticated attacker who can derive or predict the HMAC signing key may forge or modify session tokens, undermining session integrity across affected deployments. No public exploit code has been identified, this vulnerability is not listed in the CISA KEV catalog, and a vendor patch is available via IBM's advisory.

Improper TLS hostname verification in IBM Business Automation Workflow exposes high-privilege sessions to man-in-the-middle interception by failing to validate that server certificates match the target hostname. Affected deployments span both containerized (Kubernetes/OpenShift) and traditional on-premises models across multiple release trains from 24.0.0 through 26.0.0. No public exploit has been identified and the vulnerability is not listed in CISA KEV; real-world risk is substantially bounded by the PR:H requirement - an attacker must already hold administrative credentials before exploitation is feasible.

Unauthenticated remote information disclosure in IBM Cloud Pak for Business Automation 24.0.0 through 26.0.0 allows network attackers to retrieve sensitive data embedded in externally accessible manifest files. The vulnerability stems from CWE-538, where sensitive configuration or operational data is written into manifest files that are not adequately protected from external access. No public exploit has been identified at time of analysis, and a vendor patch is available via IBM's support portal.

Electron's permission check handler incorrectly exposes cross-origin iframes to unauthorized camera, microphone, and serial port access by passing the top-level frame's origin as `requestingOrigin` instead of the requesting iframe's own origin. Applications implementing `session.setPermissionCheckHandler` with origin-based grant logic that also embed cross-origin iframes with delegated device permissions are affected - the handler is deceived into approving the iframe's request as if it came from the trusted top-level origin. No public exploit code exists and CISA KEV listing is not confirmed; the CVSS score of 5.9 with AC:H accurately reflects the specific multi-condition deployment pattern required for exploitation.

Out-of-bounds memory read in Electron's offscreen rendering pipeline allows a compromised GPU process to cause the browser/main process to read beyond a shared memory mapping boundary when producing `paint` event images, disclosing process memory or crashing the application. Exploitation requires two independent preconditions: the host application must enable `webPreferences.offscreen` (non-default) and an attacker must have already achieved code execution in the GPU process via a separate vulnerability. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.

Arbitrary file write via crafted tar archive extraction in Jenkins 2.575 and earlier allows attackers controlling agent processes to escape extraction directory boundaries on the controller filesystem, directly enabling remote code execution. The root cause is unsafe handling of symbolic links with effectively empty names during .tar and .tar.gz extraction on the controller, permitting writes to sensitive paths such as JENKINS_HOME/init.groovy.d/ (Groovy init scripts) or JENKINS_HOME/plugins/ (plugin deployment). No public exploit or CISA KEV listing has been identified at time of analysis, but the agent-to-controller trust boundary is a well-established Jenkins attack surface with a history of critical exploitation.

Remote code execution and privilege escalation across Jenkins core and multiple plugins were disclosed in the 2026-08-05 security advisory, with the most critical issue being a JEP-200 deserialization filter bypass (CVE-2026-70426) in Remoting 3384.v60d89463d9e0 and earlier that allows agent processes or holders of Agent/Connect permission to execute arbitrary code on the Jenkins controller. Compounding this, two separate arbitrary file-write primitives (CVE-2026-70427 via malicious tar archives, CVE-2026-70428 via path traversal in file parameter names) independently enable code execution by writing into JENKINS_HOME/init.groovy.d/ or deploying rogue plugins. No public exploit code or CISA KEV listing was identified at time of analysis, but the attack surface spans both network-accessible agents and authenticated users with low-privilege build permissions.

CVE-2026-70437 is part of the Jenkins project's August 5, 2026 security advisory (jenkins.io/security/advisory/2026-08-05/), which addressed vulnerabilities across Jenkins core and at least ten plugins. The specific description for CVE-2026-70437 was not included in the provided data excerpt - the source text enumerates CVE-2026-70426 through CVE-2026-70435 before truncating. Based on sequential CVE assignment within this advisory, CVE-2026-70437 likely maps to one of the plugin fixes not yet accounted for: External Workspace Manager Plugin 1.4.2, SCM-Manager Plugin 1.12.1, or Webhook Secret Credentials Provider Plugin 32.v09c9b_522f0a_8, or to an unresolved issue in one of the eleven plugins named without fixes.

Case-insensitivity handling inconsistency in Jenkins 2.575 and earlier allows attackers to impersonate existing users or inherit their permissions by registering accounts with Unicode characters that case-insensitively match existing usernames. Jenkins generates canonical user IDs via lowercasing but performs comparisons using Java's `String#equalsIgnoreCase`, which follows Unicode case-folding semantics - for example, the Turkish dotless 'ı' is treated as equal to 'i' during comparison but produces a different canonical ID when lowercased. Exploitation is constrained to deployments using external security realms that permit non-ASCII characters in usernames; no public exploit has been identified at time of analysis.

Statamic CMS exposes authenticated users' raw two-factor authentication recovery codes through the Antlers templating engine due to a missing access restriction in the `AugmentedUser::get()` resolver. Unlike `password` and `password_hash` fields, which are explicitly excluded from augmentation, `two_factor_recovery_codes` is returned without restriction and is absent from all Antlers variable guard lists. An administrator or developer who has configured a blueprint field with dynamic Antlers rendering enabled can craft a template (`{{ current_user.two_factor_recovery_codes }}`) that, when rendered by a victim visiting the page, leaks that victim's 2FA recovery codes into the HTML response - enabling 2FA bypass. No public exploit has been identified at time of analysis, and exploitation requires a high-privilege prerequisite (blueprint configuration access).

ESPHome's built-in web server unconditionally leaks plaintext passwords stored in password-mode text entities to any unauthenticated attacker on the local network. The web_server component on port 80 - which carries no authentication by default - serializes text entities with a dual-field JSON structure where the 'state' field is correctly redacted to '********' but the 'value' field is always populated with the raw secret via set_json_icon_state_value()/set_json_value(), exposing WiFi credentials, API tokens, and similar secrets through a trivial GET request or the /events EventSource stream. No public exploit code or CISA KEV listing has been identified at time of analysis, but exploitation requires only standard HTTP tooling against any reachable device with the web_server component enabled.

IV reuse in libkcapi's one-shot symmetric cipher operations allows a remote attacker to weaken data confidentiality for applications processing inputs larger than 64 KiB under stateful modes (CTR or CBC). Affected deployments include Red Hat Enterprise Linux 8, 9, and 10, Red Hat Hardened Images, and OpenShift Container Platform 4. No public exploit or active exploitation has been identified; the AV:N vector reflects an indirect attack path where an adversary induces a vulnerable application to process specially crafted oversized inputs, enabling ciphertext analysis to expose plaintext relationships or recover data.

Host header injection in SonicWall SonicOS enables remote unauthenticated attackers to manipulate the HTTP Host header on the firewall management interface, causing redirect responses that send management users to attacker-controlled web domains. Affected version branches span the SonicOS 6.5, 7.0, 7.3, and 8.2 lines, covering a wide installed base of SonicWall firewalls. No public exploit code exists and this vulnerability has not been added to CISA KEV at time of analysis, but the unauthenticated network-accessible attack surface and management-user targeting make it a meaningful phishing risk in environments where the management interface is internet-exposed.

AES-GCM nonce exhaustion in Kong Event Gateway 1.0.0-1.1.1 and 1.2.0 allows an authorized consumer to recover partial message plaintext when the AWS IAM encryption feature is enabled and key rotation has not occurred. Because keys are only rotated on gateway reboot, a producer sustaining a high message rate can exhaust the NIST SP 800-38D-recommended random nonce limit (~2^32 encryptions), making nonce collisions statistically likely and enabling ciphertext XOR attacks. No public exploit exists and the vulnerability is not in CISA KEV; the CVSS 4.0 score of 2.3 reflects the narrow, condition-heavy exploitation path.

Prototype pollution in Eclipse Theia's preference resolution system exposes developers to application-logic manipulation when opening crafted workspaces. The `PreferenceUtils.merge` function in `@theia/core`, invoked for every preference scope resolution, fails to reject reserved JavaScript prototype keys (`__proto__`, `constructor`, `prototype`), allowing a malicious `.theia/settings.json` or `.vscode/settings.json` to corrupt `Object.prototype` across the entire Theia Node.js process. Affected versions span 0.7.0 through 1.73.1 inclusive; no public exploit has been identified at time of analysis, and the CVSS 4.0 score of 5.7 appropriately reflects the social-engineering dependency and required user interaction.

SQL injection in the ZTE Smart Life mobile app enables a local attacker with physical device access to execute UNION SELECT statements against the app's feedback.db SQLite database, extracting sensitive personal data including user account details, phone numbers, feedback content, and local debug log paths. Exploitation is severely constrained by the CVSS:3.1/AV:P/AC:H/PR:L/UI:R vector, requiring physical access to the device, a low-privilege authenticated session within the app, user interaction, and non-trivial attack complexity. No public exploit code or CISA KEV listing has been identified at time of analysis, and the vendor (ZTE PSIRT) has published a bulletin acknowledging the issue.

In the Linux kernel, the following vulnerability has been resolved: ipv4: fib: free fib_alias with kfree_rcu() on insert error path fib_table_insert() publishes new_fa into the leaf's fa_list with fib_insert_alias() before calling the fib entry notifiers. When a notifier fails, the error path removes new_fa with fib_remove_alias() (hlist_del_rcu) and frees it right away with kmem_cache_free(). fib_table_lookup() walks that list under rcu_read_lock() only, so a concurrent lookup that already reached new_fa keeps reading it after the free: BUG: KASAN: slab-use-after-free in fib_table_lookup (net/ipv4/fib_trie.c:1601) Read of size 1 at addr ffff88810676d4eb by task exploit/297 Call Trace: fib_table_lookup (net/ipv4/fib_trie.c:1601) ip_route_output_key_hash_rcu (net/ipv4/route.c:2814) ip_route_output_key_hash (net/ipv4/route.c:2705) __ip4_datagram_connect (net/ipv4/datagram.c:49) udp_connect (net/ipv4/udp.c:2144) __sys_connect (net/socket.c:2167) __x64_sys_connect (net/socket.c:2173) do_syscall_64 entry_SYSCALL_64_after_hwframe which belongs to the cache ip_fib_alias of size 56 Triggering the error path needs CAP_NET_ADMIN and a registered fib notifier that can reject a route; a netdevsim device whose IPv4 FIB resource is exhausted is enough. Free new_fa with alias_free_mem_rcu(), as fib_table_delete() already does for a fib_alias removed from the trie.

In the Linux kernel, the following vulnerability has been resolved: wifi: p54: validate RX frame length in p54_rx_eeprom_readback() p54_rx_eeprom_readback() copies the requested EEPROM slice out of a device-supplied readback frame without checking that the skb actually holds that many bytes. Commit da1b9a55ff11 ("wifi: p54: prevent buffer-overflow in p54_rx_eeprom_readback()") closed the destination overflow by copying a fixed priv->eeprom_slice_size (and rejecting a mismatched advertised len), but the source side is still unbounded: nothing verifies the frame is long enough to supply that many bytes. A malicious USB device can send a short frame whose advertised len matches priv->eeprom_slice_size while the payload is truncated. The equality check passes and memcpy() reads past the end of the skb, leaking adjacent heap: BUG: KASAN: slab-out-of-bounds in p54_rx (drivers/net/wireless/intersil/p54/txrx.c:507) Read of size 1016 at addr ffff88800f077114 by task swapper/0/0 Call Trace: <IRQ> ... __asan_memcpy (mm/kasan/shadow.c:105) p54_rx (drivers/net/wireless/intersil/p54/txrx.c:507) p54u_rx_cb (drivers/net/wireless/intersil/p54/p54usb.c:163) __usb_hcd_giveback_urb (drivers/usb/core/hcd.c:1657) dummy_timer (drivers/usb/gadget/udc/dummy_hcd.c:2005) ... </IRQ> The buggy address belongs to the object at ffff88800f0770c0 which belongs to the cache skbuff_small_head of size 704 The buggy address is located 84 bytes inside of allocated 704-byte region [ffff88800f0770c0, ffff88800f077380) Check that the slice fits in the skb before copying.

In the Linux kernel, the following vulnerability has been resolved: mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n On CONFIG_INET=n builds, mpls_valid_fib_dump_req() walks the parsed attribute table itself instead of calling ip_valid_fib_dump_req(). The RTA_OIF arm passes tb[RTA_OIF] to nla_get_u32() without checking it is present, so an RTM_GETROUTE dump for AF_MPLS with strict checking and no RTA_OIF hits a NULL dereference. RTM_GETROUTE is RTNL_KIND_GET, which rtnetlink_rcv_msg() permits without CAP_NET_ADMIN, so an unprivileged user can trigger it. Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:mpls_valid_fib_dump_req (net/mpls/af_mpls.c:2189) Call Trace: mpls_dump_routes (net/mpls/af_mpls.c:2236) netlink_dump (net/netlink/af_netlink.c:2331) __netlink_dump_start (net/netlink/af_netlink.c:2446) rtnetlink_rcv_msg (net/core/rtnetlink.c:7033) netlink_rcv_skb (net/netlink/af_netlink.c:2556) netlink_unicast (net/netlink/af_netlink.c:1345) netlink_sendmsg (net/netlink/af_netlink.c:1900) __sock_sendmsg (net/socket.c:790) ____sys_sendmsg (net/socket.c:2684) ___sys_sendmsg (net/socket.c:2738) __sys_sendmsg (net/socket.c:2770) do_syscall_64 (arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) Skip unset attributes, as ip_valid_fib_dump_req() does.

Cluster ID enumeration in SUSE Rancher exposes a reliable oracle via the unauthenticated `/v3/import/{token}_{clusterId}.yaml` endpoint, which performs cluster object retrieval before token validation. Remote unauthenticated attackers can distinguish valid cluster IDs (HTTP 502, triggered by a nil pointer dereference in `pkg/systemtemplate/private_registry.go` when private registry secrets exist) from non-existent ones (HTTP 200), leaking the presence and private-registry configuration status of clusters. This is not listed in CISA KEV and no public exploit code has been identified, but the zero-prerequisite network accessibility makes enumeration trivially scriptable.

Unrestricted brute-force against changedetection.io's /login endpoint allows a remote unauthenticated attacker to systematically guess the single shared application password with no throttling, lockout, or attempt counter to impede automated attacks. Because the entire application is protected by one shared credential with no per-user account model, a successful guess grants full administrative control - including the ability to view and regenerate the API token and access all monitored URL configurations. No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack is trivially automatable given the network-accessible endpoint, low complexity (CVSS AC:L), and complete absence of brute-force controls confirmed by requirements.txt inspection.

Unauthorized information disclosure in the MLSImport: IDX Plugin & MLS Plugin for Real Estate Listings WordPress plugin (all versions before 7.0.4) exposes import log files and import-related post metadata to any authenticated user, including low-privilege subscribers. The flaw stems from a missing authorization and CSRF check on an AJAX action, meaning any logged-in WordPress user on an affected site can invoke the endpoint and read sensitive operational data. A publicly available proof-of-concept exists (reported by WPScan), though EPSS places exploitation probability at 0.10% and SSVC confirms no known active exploitation at time of analysis.

Unauthenticated information disclosure in DHL Shipping Germany for WooCommerce (versions before 4.0.1) exposes stored shipping labels - each containing customer name and postal address - to any visitor who can request predictable filenames from the label storage directory. The plugin relies exclusively on an Apache .htaccess file for directory access control, which nginx and other non-Apache web servers silently ignore, leaving the directory fully browsable over the network. A publicly available exploit exists (via WPScan), though EPSS of 0.14% at the 4th percentile indicates low observed exploitation activity, and the vulnerability is not listed in the CISA KEV catalog.

Information disclosure in the GeoDirectory WordPress plugin (before 2.8.168) exposes the email addresses of all registered users - including site administrators - to any authenticated Contributor-level or higher user. The root cause is an unrestricted user-search handler that performs no authorization check against WordPress's capability system, meaning any low-privilege authenticated user can invoke it freely. Publicly available exploit code exists per WPScan, though EPSS at 0.14% (4th percentile) and absence from CISA KEV suggest opportunistic exploitation remains limited at time of analysis.

Cost Calculator Builder for WordPress exposes live payment gateway credentials to any authenticated site user through a missing authorization check on its calculator export AJAX endpoint. All plugin versions through 3.6.17 are affected; attackers holding a Subscriber-level WordPress account - the lowest authenticated role - can invoke the `cost-calculator-custom-export-run` AJAX action to receive a full configuration export containing Stripe secret keys, PayPal client secrets, Razorpay secret keys, webhook secret keys, and reCAPTCHA secret keys. No public proof-of-concept exploit or CISA KEV listing has been identified at time of analysis, but the attack requires only a valid site account and basic HTTP knowledge, and an upstream fix has been committed to the plugin's trunk repository.

Out-of-bounds read in OpenSIPS versions prior to 3.6.6 and 4.0.0-rc1 allows unauthenticated remote attackers to trigger memory over-reads in the multipart SIP body parser by sending a crafted message with Content-Type: multipart/mixed whose body contains "--" within two to three bytes of the buffer end. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms network-reachable, zero-prerequisite exploitation with low availability impact, though the reporter's "Information Disclosure" tag conflicts with the official C:N rating, suggesting potential memory leakage beyond what the score reflects. No public exploit or CISA KEV listing has been identified at time of analysis; vendor-released patches are confirmed in 3.6.6 and 4.0.0-rc1.

Epsilla-cloud VectorDB's filter query parser crashes under malformed input due to an improper exception/condition check (CWE-754) in the SplitTokens and ShuntingYard functions of engine/query/expr/expr.cpp. All releases from 0.3.0 through 0.3.18 (including commit df5a5f5afb85a2376a0f2f316c79dea9b2c6ac7a) are affected. A local, low-privileged user who can submit filter expressions to the database engine can trigger an abnormal termination of the parser, causing an availability impact. A public proof-of-concept exploit exists; the vendor did not respond to responsible disclosure.

Baserow's admin impersonation endpoint in versions 2.3.0 through 2.3.2 allows authenticated administrators to obtain authentication tokens for deactivated (inactive, non-staff) users via an improper authorization flaw in `BaserowImpersonateAuthTokenSerializer`. The Baserow maintainer explicitly notes that issued tokens for deactivated accounts are functionally inert because all downstream API endpoints reject them, calling the issue 'more like a bug instead of a vulnerability.' No public exploit code exists, no active exploitation has been observed, and a CVSS 4.0 score of 2.1 reflects the extreme privilege requirement and negligible real-world impact.

Session fixation in Ghost Admin (v2.2.0-v6.54.0) allows an attacker who can plant a known session identifier in a victim's browser - via a secondary vulnerability on the same domain - to hijack an authenticated Ghost Admin session after the victim logs in. The root cause is that Ghost Admin's login flow did not call session regeneration, leaving the pre-login session ID valid post-authentication. Exploitation is chained and non-trivial, but the upstream fix (v6.54.1) is confirmed and straightforward to apply. No public exploit code and no CISA KEV listing identified at time of analysis.

Blind password hash disclosure in Ghost Admin API versions prior to 6.54.1 allows any authenticated staff-level user to retrieve hashed passwords of other staff accounts by crafting filtered API queries against the posts or pages browse endpoints. The root cause is insufficient field-level access control in MongoDB filter queries, exposing internal authentication fields (CWE-200). No active exploitation is confirmed (not in CISA KEV), and downstream account takeover is partially mitigated by Ghost's Device Verification and email MFA features, though the hash disclosure itself is confirmed and unambiguously fixed in 6.54.1.

Ghost CMS subscription checkout accepts redemption of archived offers due to missing offer-status validation in the member router controller, affecting all self-hosted Ghost instances from v4.22.0 through v6.54.0. Unauthenticated users who possess or can discover an archived offer ID can submit a valid checkout request and obtain unauthorized subscription discounts or access at a revoked price point. No public exploit code has been identified and this CVE is absent from CISA KEV, but the direct financial impact on subscription-based Ghost sites makes it a meaningful business-logic risk for affected operators.

Tool source code disclosure in Open WebUI (≤ 0.10.2) allows any authenticated non-admin user who holds a read grant on a shared workspace tool to retrieve the full Python source of that tool via three unguarded API endpoints. The root cause is a Pydantic response-model inheritance defect where the `ToolUserResponse` subclass re-admitted the `content` field that the parent `ToolResponse` schema deliberately excluded, combined with a separate query-level defect in the list path. Because tool source commonly embeds hard-coded API keys, credentials, and internal service URLs, the practical confidentiality loss frequently exceeds the code itself; a detailed proof-of-concept is published in the GitHub security advisory, and the vendor-confirmed fix is available in 0.11.0 with no active exploitation (CISA KEV) recorded at time of analysis.

DNS rebinding bypasses Open WebUI's SSRF protection in all versions prior to 0.11.0, enabling authenticated attackers who control authoritative DNS for a submitted hostname to reach internal resources - including cloud instance metadata services (e.g., 169.254.169.254), loopback admin APIs, and internal network services. The root cause is a TOCTOU race: the hostname is resolved once for validation and again at connection time, letting a TTL=0 DNS record switch from a public IP during the check to an internal IP during the actual fetch. On most vulnerable paths the internal response is returned directly to the attacker; the OAuth path additionally forwards the OAuth access token as a Bearer header to the attacker-controlled internal target, enabling credential theft. No public exploit identified at time of analysis.

Insecure temporary file creation in Lenovo XClarity Essentials OneCLI 5.5.0 and earlier on Linux enables a local low-privileged attacker to overwrite or truncate arbitrary system files via a race condition (CWE-377), but only when a privileged user concurrently executes OneCLI with elevated rights. The attack timing requirement (AT:P in the vendor CVSS 4.0 vector) confirms this is a classic TOCTOU-style symlink race, limiting realistic exploitation to shared multi-user Linux environments where an administrator routinely runs the tool elevated. No public exploit code or CISA KEV listing exists; the vendor has released a patch via advisory LEN-ht116433.

NVIDIA Dynamo for Linux versions 0 through v1.2.0 leaks sensitive information through crafted error message generation, exploitable remotely without authentication. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) confirms low-complexity unauthenticated network access is sufficient to trigger disclosure. No public exploit code has been identified at time of analysis and no CISA KEV listing exists, indicating this is not currently confirmed as actively exploited at scale.

Out-of-bounds read in Systerel S2OPC versions 1.7.0 through 1.7.3 allows a local, low-privileged attacker to disrupt the OPC-UA client process by triggering a memory read violation in the DeleteMonitoredItemsRequest handler state machine function. The flaw is confined to the client-side wrapper component and results in an availability impact rather than code execution or data exfiltration. A public proof-of-concept exploit has been released on GitHub, and the vendor has not responded to coordinated disclosure, leaving no official patch confirmed at time of analysis.

Memory exhaustion in Django's `check_for_language()` function allows denial-of-service via the `set_language` view when it is explicitly enabled in URL configuration. Attackers can submit many distinct, very long language codes via POST requests, causing each code to be cached as an in-memory key and progressively consuming process memory. Django rates this severity 'low' because built-in guards - `DATA_UPLOAD_MAX_MEMORY_SIZE` and the cache's maximum entry count - bound the total exploitable memory; no public exploit identified at time of analysis.

Denial-of-service via recursive GEOMETRYCOLLECTION parsing crashes Django processes through a segmentation fault in the underlying GEOS library. Django's GEOSGeometry class, GeometryField form field, and spatial field lookups in versions 5.2, 6.0, 6.1 (RC), and main are all affected when processing WKT or WKB input containing deeply nested or excessively numerous GEOMETRYCOLLECTION objects. No public exploit code or active exploitation has been identified at time of analysis; the Django team rated this 'moderate' severity and issued fixed releases Django 5.2.17 and 6.0.8 on August 4, 2026.

Information disclosure in Qualcomm Snapdragon chipsets exposes private data transmitted during NG-eCall SIP signaling when IPSec negotiation fails or is improperly established. Attackers adjacent to the network can intercept unprotected signaling traffic, gaining access to sensitive session data - potentially including location coordinates and caller identity transmitted as part of the automated emergency call system. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Information disclosure in Qualcomm Snapdragon wireless subsystem allows an adjacent-network attacker to leak sensitive memory contents by transmitting malformed wireless channel switch frames with invalid length fields. The root cause is CWE-191 (integer underflow), where improperly formatted length values trigger an arithmetic wrap condition during 802.11 management frame parsing, resulting in out-of-bounds memory reads. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, though the low attack complexity and no-authentication requirement on an adjacent wireless segment represent a meaningful real-world risk for shared wireless environments.

Stack-based out-of-bounds read in stunnel's s_vlog logging function allows remote unauthenticated attackers to crash the service by sending protocol inputs that generate log messages exceeding 1024 bytes via vsnprintf. The primary impact is service disruption (availability), with a limited integrity impact in corner cases where trailing newline characters in the stack buffer can be overwritten with null bytes. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.

Information disclosure in Firefox for Android and Firefox Focus for Android exposes sensitive user data to network-based attackers who can lure a victim into interacting with a crafted web resource. The vulnerability, tracked under CWE-200 and assigned a CVSS score of 6.5 with high confidentiality impact, is limited to Android platform builds and does not affect desktop Firefox. Mozilla patched this in Firefox 153.0.3 per advisory mfsa2026-73; no public exploit or active exploitation has been identified at time of analysis.