Information Disclosure

Unauthorized data read in Oracle APEX 24.1, 24.2, and 26.1 is achievable by unauthenticated remote attackers via HTTP, exploiting an authentication bypass in the General component. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivial network reachability with no authentication required, allowing exposure of a subset of APEX-accessible data. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low complexity and zero-auth requirements make this a credible opportunistic threat against internet-facing APEX deployments.

Local privilege abuse in Oracle VM VirtualBox 7.2.12 Core component permits a high-privileged local attacker to read a subset of VirtualBox-accessible data, with confirmed scope change indicating potential exposure of data belonging to co-hosted or adjacent products. The CVSS score of 3.2 (Low) reflects the constrained attack surface - requiring local logon with high privileges - but the scope change flag (S:C) elevates the architectural concern, as information disclosed may originate outside the directly compromised VirtualBox instance. No public exploit code or active exploitation has been identified at time of analysis.

Physical-access data disclosure in Oracle Siebel CRM Integration's Event Publish and Subscribe component exposes a subset of CRM data under conditions requiring physical proximity, high privileges, and difficult exploit circumstances (CVSS 1.9). Versions 17.0 through 26.4 are affected, and a scope change in the CVSS vector signals that a successful attack may also read data from additional products beyond the Integration component itself. No public exploit code exists and this CVE does not appear in the CISA KEV catalog; real-world risk is negligible outside of insider-threat or physical-intrusion scenarios.

Unauthorized data exposure in Oracle Agile PLM 9.3.6 allows a remote unauthenticated attacker to compromise the confidentiality of all PLM-accessible data via HTTP, provided human interaction from a victim user is achieved. The vulnerability resides in the Folders, Files & Attachments component and is tagged as an Authentication Bypass, meaning access controls protecting sensitive product lifecycle and supply chain data can be circumvented without credentials. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and zero privilege requirement make this a meaningful risk for Oracle Agile PLM deployments exposed to untrusted networks.

Column-value inference via observable discrepancy in Electric Postgres Sync below 1.6.10 allows authenticated remote attackers to deduce the values of columns intentionally excluded from shape responses. By crafting subset WHERE clause conditions against shape endpoints and observing whether rows are matched or returned, an attacker can systematically enumerate sensitive field data that the application's column-based access restrictions are designed to conceal. No public exploit code or active exploitation has been identified at time of analysis; a vendor patch is available at version 1.6.10.

kirby-modules through version 5.5.7 exposes the complete plaintext commercial license key to any authenticated Kirby Panel user - including non-admin roles such as editors and authors - via a single GET request to the modules/activate dialog endpoint. The root cause is a missing authorization check (CWE-862) in lib/areas.php: the handler calls ModulesLicense::readKey() without verifying administrator status, relying instead on the access.system permission that defaults to true for all non-admin Panel roles. No active exploitation is confirmed by CISA KEV and no public exploit code has been identified, but the CVSS 4.0 vector (PR:L, AC:L, AV:N) indicates this is trivially reproducible by any Panel account holder, with the primary downstream consequence being unauthorized activation of the plugin on third-party Kirby installations.

RSS/Atom feed handlers in Gitea prior to v1.27.0 expose private repository content - commit metadata, release notes, tag names, and cross-repo activity streams - to holders of confined API tokens that are explicitly blocked from the same data via download routes. The bypass breaks the token-confinement guarantee introduced by PR #37698 for raw/archive/download handlers, which was never extended to the sibling feed endpoints despite those endpoints accepting identical token-based Basic auth. A working proof-of-concept is documented in the GHSA advisory verified against the official gitea/gitea:1.26.2 Docker image; the vulnerability is not confirmed in CISA KEV, and the primary realistic threat is a leaked or lower-trust token used in CI or third-party integrations circumventing its intended scope restrictions.

Cross-repository label-ID enumeration oracle in Gitea through v1.26.3 allows any authenticated user with write:issue permission on any repository to probe label ID existence across all repositories and organizations on the instance - including private ones they cannot access. The flaw arises because the DELETE /repos/{owner}/{repo}/issues/{index}/labels/{id} API handler performs a global, unscoped label lookup and leaks existence via differential HTTP status codes (204 vs. 422). No label names, colors, repository associations, or content are disclosed, and no cross-repository writes occur; however, a working proof of concept was verified against v1.26.3 and a fix is available in v1.27.0. No public exploit identified at time of analysis beyond the verified PoC in the advisory.

Server-side request forgery in Gitea's repository migration feature allows authenticated low-privilege users to bypass the SSRF allow/block-list filter by supplying an attacker-controlled DNS hostname that returns both a permitted public IP and a blocked private or loopback IP. Because the pre-flight validation accepts the hostname if any single resolved IP is permitted (OR logic), and because the subsequent `git clone --mirror` subprocess performs an independent DNS resolution with no binding to the validated IP set, an attacker can cause Gitea to connect to internal-only Git services and exfiltrate their contents into an attacker-controlled repository. No public exploit identified at time of analysis, but a functional proof-of-concept reproducer is included in the advisory and has been confirmed by the reporter against a specific Gitea commit.

User enumeration in djangoSIGE through version 1.10 exposes valid account identities to unauthenticated remote attackers via the POST login/esqueceu/ password reset endpoint. The ForgotPasswordView returned distinct error messages depending on account state - 'not found in database,' 'user has no email registered,' or a success message - allowing systematic harvesting of valid usernames and email addresses. A publicly available proof-of-concept exploit exists; no CISA KEV listing at time of analysis.

Information disclosure in Tanium Connect exposes sensitive data to local administrators via process invocation metadata. The vulnerability (CWE-214) allows a locally authenticated, highly privileged user to observe sensitive information - such as credentials or tokens - that the Connect component surfaces through visible process arguments or environment state. No active exploitation has been identified and no public proof-of-concept exists, but the high confidentiality impact (C:H) means exposed data could facilitate lateral movement or privilege escalation within the Tanium management plane.

UI Misrepresentation of Critical Information in Tanium Server enables a highly privileged network-accessible attacker to alter how critical data is presented within the administrative interface, potentially causing other operators to make incorrect security decisions based on falsified or obscured information. Classified under CWE-451, the flaw carries a CVSS score of 2.7 (Low), reflecting the high privilege barrier required for exploitation. No public exploit identified at time of analysis, and no CISA KEV listing has been associated with this vulnerability.

Private repository existence disclosure in Gitea allows fully unauthenticated remote attackers to confirm the existence, enumerate names, harvest clone URLs, and identify default branch names of private repositories by appending the `?go-get=1` query parameter to any repository-scoped URL. All Gitea instances running versions prior to 1.27.0 are affected regardless of repository visibility configuration. No public exploit identified at time of analysis as a dedicated exploit tool, though a detailed proof-of-concept with working `curl` and shell enumeration scripts is published in the GHSA advisory, making exploitation trivially repeatable.

OAuth token introspection in Gitea prior to v1.27.0 discloses token metadata - including active status, scope, username, and JWT registered claims - to any authenticated OAuth client regardless of whether that client is the token's intended audience, violating RFC 7662 section 4. Any registered OAuth application on the target instance can call `/login/oauth/introspect` with a token issued to a completely different client and receive a valid response. No public exploit is confirmed in CISA KEV, but a complete proof-of-concept reproduction script (`poc.sh`) is publicly attached to the GHSA advisory, making exploitation trivially reproducible by anyone with a registered OAuth client credential.

Draft release attachment disclosure in Gitea exposes files uploaded to draft releases to unauthenticated network callers via UUID-based web endpoints, bypassing access controls that correctly gate the parallel API handlers. This is an incomplete fix for CVE-2026-27660: that advisory's PR #36659 added `canAccessReleaseDraft` checks to every API code path but left the web-side `ServeAttachment` handler ungated, allowing anyone who obtains an attachment UUID to download its contents with no authentication. A working proof-of-concept is documented in the advisory and confirmed against Gitea v1.27.0+dev; no public exploit identified at time of analysis beyond the advisory PoC, and the vulnerability does not appear in CISA KEV.

Memory leak in Amazon s2n-tls's QUIC transport parameters handler exposes server-side QUIC deployments to gradual heap exhaustion by unauthenticated remote clients. The flaw is rooted in incorrect allocator use during TLS 1.3 HelloRetryRequest (HRR) flows - a standard protocol exchange that can be deliberately forced by clients advertising key share groups the server will reject - causing up to approximately 64 KB of unreachable memory per handshake. No active exploitation or public exploit code has been identified; vendor-confirmed patch v1.7.6 is available.

Ethereum transaction signing on Trezor Safe 3, Safe 5, and Safe 7 hardware wallets can be silently subverted because the device displays and requests on-screen confirmation only for the initial calldata chunk but cryptographically commits the entire streamed calldata into the final signature. A malicious dApp operator or man-in-the-middle attacker can present a benign-looking initial chunk for the victim to approve on the physical device, then stream a manipulated calldata tail that alters the actual transaction semantics - for example changing a token-approval recipient, amount, or contract target. No public exploit has been identified at time of analysis, and the flaw is fixed in upstream commit 70c9b0c per the vendor's firmware repository.

Incorrect Authorization (CWE-863) in Kibana's Entity Analytics Watchlist feature allows low-privileged authenticated users with read-only Security Solution access to perform unauthorized write operations against watchlist configuration endpoints that should require elevated privileges. The CVSS 5.4 vector (AV:N/AC:L/PR:L/UI:N) confirms network-exploitable but credential-gated exploitation with limited confidentiality and integrity impact; under specific deployment conditions, affected users may additionally access data outside their authorized scope. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.

Kibana's authorization layer fails to enforce ACLs correctly in certain code paths, allowing a lower-privileged authenticated user to cause data from restricted Elasticsearch sources to be processed under another user's elevated privileges - effectively a confused deputy attack resulting in unauthorized information disclosure. The CVSS 4.3 (Medium) rating reflects low confidentiality impact and the requirement for a valid Kibana account, but the real-world risk is material in multi-tenant or role-segregated deployments where data isolation is a compliance requirement. No active exploitation confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis.

Heap out-of-bounds read in libsoup's multipart HTTP message parser allows remote attackers to crash affected applications or leak heap memory contents. An integer type mismatch between the calling code and soup_headers_parse() causes the length parameter to be incorrectly truncated, enabling a read beyond the allocated heap buffer boundary. No active exploitation has been identified (no CISA KEV listing, no public POC), and the CVSS score of 4.2 with AC:H/UI:R reflects meaningful real-world friction for successful exploitation.

Insecure mmap backing-file creation in Data::DisjointSet::Shared (Perl/CPAN) before 0.02 exposes inter-process IPC payloads to any local user on the host. The module's dsu.h creates the shared segment with open(path, O_RDWR|O_CREAT, 0666), resulting in a 0644-mode file under the default umask - readable by all local accounts - typically placed in /tmp or /dev/shm. The absent O_EXCL flag silently adopts a pre-planted file, and the absent O_NOFOLLOW flag follows symlinks at the target path, enabling a local attacker to either read IPC data or redirect file operations. No active exploitation confirmed; EPSS is 0.16% (6th percentile), consistent with the niche deployment footprint.

World-readable IPC segment exposure in Data::SpatialHash::Shared (Perl) before version 0.02 allows any local user on a multi-user system to read the contents of shared memory payloads written by other processes using the module. The root cause is a combination of overly permissive file creation mode (0666, yielding 0644 under default umask) and the absence of O_EXCL and O_NOFOLLOW flags when opening the mmap backing file in sphash.h, enabling both passive eavesdropping and pre-creation file/symlink attacks. No active exploitation has been identified (EPSS: 0.16%, 6th percentile; not in CISA KEV), and the fix is available in version 0.02.

Insecure file creation in Data::Intern::Shared for Perl (all versions before 0.02) exposes shared memory IPC payloads to any local user on the same host. The module's intern.h opens its mmap backing file with mode 0666 - effective 0644 under the standard umask - making the segment world-readable, while missing O_EXCL and O_NOFOLLOW flags independently enable a pre-creation file-race and a symlink-redirect attack. No public exploit has been identified and EPSS sits at 0.16% (6th percentile), consistent with the niche deployment footprint of this CPAN IPC library.

World-readable mmap backing file creation and missing symlink/exclusivity guards in Data::RingBuffer::Shared before version 0.04 expose inter-process IPC payloads to any local user on the host. The module creates its shared segment in ring.h with mode 0666 (effective 0644 under default umask 022), making contents in /tmp or /dev/shm readable by all local users; omission of O_EXCL and O_NOFOLLOW further enables pre-creation race and symlink-redirect attacks. No public exploit has been identified at time of analysis, and the EPSS score of 0.16% (6th percentile) reflects low exploitation probability commensurate with the module's niche deployment footprint.

Information disclosure in Data::RoaringBitmap::Shared Perl module before 0.02 allows local attackers to read sensitive IPC payloads from world-readable mmap backing files. The module creates files with insecure permissions in shared directories, while missing O_NOFOLLOW and O_EXCL flags enable symlink and race attacks. No active exploitation or public exploit code is known, and the EPSS score is low.

World-readable mmap backing file creation in Data::HashMap::Shared (Perl CPAN module) versions before 0.14 exposes inter-process communication payloads to any local user co-resident on the same system. The module's shm_generic.h opens its shared memory segment with mode 0666 (resulting in 0644 under default umask 022) in world-accessible directories such as /tmp or /dev/shm, while omitting both the O_EXCL and O_NOFOLLOW flags - enabling a local attacker to either read IPC payloads directly from the world-readable file or redirect the open via a pre-planted symlink. No public exploit has been identified (EPSS 0.16%, 6th percentile) and there is no CISA KEV listing, but the primary information-disclosure vector requires no race condition and is trivially exploitable by any unprivileged local user on a multi-tenant system.

World-readable mmap backing file creation in Data::RadixTree::Shared before 0.02 exposes inter-process communication payloads to any authenticated local user on the system. The Perl module's radix.h opens the shared segment file with mode 0666 (resolving to 0644 under default umask), while omitting both O_EXCL and O_NOFOLLOW, enabling two distinct local attack paths: passive reading of IPC segment contents from /tmp or /dev/shm, and an active file-planting or symlink-redirection attack exploiting the missing exclusive-creation guard. No public exploit is identified at time of analysis; EPSS at 0.16% (6th percentile) and absence from CISA KEV indicate no current active exploitation.

World-readable mmap backing file creation in Data::SortedSet::Shared before 0.03 exposes IPC payloads to any local user and enables symlink or pre-creation race attacks on the same host. The module's sortedset.h opens the shared segment file with mode 0666 (yielding 0644 after umask), no O_EXCL, and no O_NOFOLLOW, meaning a local attacker can passively read any data written to the segment or actively redirect the open() to an attacker-controlled file. No public exploit has been identified at time of analysis; EPSS is 0.16% at the 6th percentile, consistent with the niche footprint of this Perl CPAN module.

World-readable mmap backing files in Data::ReqRep::Shared (Perl) versions before 0.05 expose IPC request-reply payloads to any local user on multiuser Unix/Linux systems. The module's reqrep.h creates shared memory segments in directories like /tmp or /dev/shm with open() using O_RDWR|O_CREAT and mode 0666, yielding 0644 under a default umask of 022 - readable by all local users. Two additional unsafe-open defects compound the issue: the absence of O_NOFOLLOW enables symlink redirection, and the absence of O_EXCL allows silent reuse of a pre-planted file. No public exploit code has been identified and EPSS is 0.16% (6th percentile), indicating no current broad exploitation interest.

Insecure shared-memory file creation in the Perl module Data::PubSub::Shared before version 0.07 exposes inter-process communication payloads to any local user on the system. The backing mmap file is created with mode 0666 (effective 0644 under umask 022), is placed in world-accessible directories such as /tmp or /dev/shm, and is opened without O_EXCL or O_NOFOLLOW, enabling both passive eavesdropping on IPC traffic and active pre-creation or symlink-redirect attacks. No public exploit code has been identified at time of analysis, and EPSS sits at the 6th percentile, indicating low current exploitation interest; however, the world-readable condition requires no race-winning and is trivially exploitable by any local authenticated user.

World-readable shared memory segments in Data::NDArray::Shared before 0.02 expose IPC payloads to any local user on the system. The module's ndarray.h creates mmap backing files in shared directories such as /tmp or /dev/shm with effective permissions 0644 (world-readable under umask 022) and omits both O_EXCL and O_NOFOLLOW from the open call, enabling passive eavesdropping on shared memory contents and a pre-creation race or symlink-redirect attack by any unprivileged local account. No public exploit has been identified and the EPSS score of 0.16% (6th percentile) indicates very low exploitation probability; risk is concentrated in multi-tenant or shared-hosting environments where untrusted local users coexist with processes passing sensitive data through this module.

Insecure file creation in the Perl CPAN module Data::Graph::Shared before version 0.04 exposes inter-process communication (IPC) payloads to any local user on the system. The mmap backing file used for shared memory segments is created with permissions 0666 (effectively 0644 after umask), making stored IPC data world-readable in shared directories such as /tmp or /dev/shm. Two additional missing flags - O_EXCL and O_NOFOLLOW - allow a local attacker to either win a pre-creation race to substitute their own file or plant a symlink to redirect the open call. No public exploit code has been identified and EPSS is 0.16% (6th percentile), consistent with limited real-world exploitation interest.

Information disclosure in the Perl Data::Deque::Shared module before version 0.06 exposes inter-process communication queue contents to any local user due to a world-readable mmap backing file and unsafe open() flags. The shared segment is created in /tmp or /dev/shm with mode 0644 (after umask 022), and the absence of O_NOFOLLOW and O_EXCL permits symlink-following and pre-creation race attacks against the backing file path. Any local account on a multi-user host can passively read sensitive IPC payloads, or actively redirect the segment open via a pre-planted symlink. No active exploitation has been identified - EPSS is 0.16% (6th percentile) and the vulnerability is not in CISA KEV.

World-readable mmap backing files and absent O_NOFOLLOW protection in Data::Buffer::Shared for Perl (versions before 0.05) expose inter-process communication payloads to any local user on the affected host. The module's buf_generic.h creates shared memory segments with mode 0666, resulting in 0644 files under the default umask of 022, and omits O_NOFOLLOW during segment attachment, enabling symlink-based file-redirect attacks against /tmp or /dev/shm paths. No exploit code is publicly available and no active exploitation has been confirmed; EPSS at 0.16% (6th percentile) reflects the niche deployment footprint, though any local user on a system running an affected Perl application can trivially read IPC payloads without elevated privileges.

Out-of-bounds read in Data::RoaringBitmap::Shared before version 0.02 for Perl allows a local peer with write access to the shared backing file to redirect memory reads to arbitrary locations. The module's attach-time header validator (rb_validate_header) checks structural metadata but skips bucket content validation, so rb_contains_locked blindly trusts file-stored container offsets and cardinalities. On the next membership query, the process dereferences a fully attacker-controlled pointer and iterates over an attacker-controlled count, exposing adjacent heap or stack memory and potentially crashing the querying process. No public exploit exists and EPSS sits at 0.17% (7th percentile), indicating low real-world exploitation activity.

Proxy credential leakage in libsoup's SoupAuthManager causes cached Proxy-Authorization headers to be forwarded to subsequently configured proxy endpoints without verifying the new proxy authority matches the original. Applications built on libsoup - including many GNOME-based applications on Red Hat Enterprise Linux 10 - are affected whenever the system proxy configuration changes mid-session via manual settings or WPAD. No public exploit or active exploitation has been identified at time of analysis; the CVSS score of 3.4 reflects low confidentiality impact constrained by the circumstantial trigger condition.

Incorrect interface method dispatch in Eclipse OpenJ9 up to version 0.60 causes the JVM to silently execute an unintended interface default method instead of raising AbstractMethodError or IllegalAccessError when a previously JIT-compiled concrete superclass method is subsequently recompiled as abstract. Applications running on OpenJ9 with dynamic class-loading or OSGi-style hot deployment are at risk of integrity violations - untended code paths execute where exceptions should be thrown. No confirmed active exploitation exists and this CVE does not appear in CISA KEV; EPSS data was not provided, and the high attack complexity (AC:H) and specific attack prerequisites (AT:P) significantly limit real-world exploitability.

Out-of-bounds read in Eclipse OMR's arraycmp SIMD JIT implementation for IBM Z (s390x) and IBM POWER (P10) architectures - versions up to 0.11 - allows a low-privileged network-reachable attacker to trigger an application crash when a zero-length array comparison is JIT-compiled and executed. The flaw exists exclusively in the SIMD code-generation paths for these two architectures and has no impact on x86 or ARM deployments. No active exploitation has been confirmed (no CISA KEV listing) and no public exploit has been identified at time of analysis; exploitation is further constrained by high attack complexity and the requirement for user interaction.

TLS session confidentiality in HCL MyCloud is undermined by the LUCKY13 padding oracle vulnerability, enabling a network-positioned attacker to partially decrypt TLS/SSL-protected communications through carefully crafted timing side-channel queries. The flaw stems from non-constant-time MAC processing in CBC-mode cipher suites, a cryptographic weakness first publicly documented in 2013. With a CVSS base score of 3.1 (Low) and high attack complexity, no public exploit code has been identified and the vulnerability has not been added to the CISA KEV catalog, indicating limited immediate threat despite the information disclosure potential.

HCL MyCloud ships a bundled IIS Server component containing publicly disclosed vulnerabilities, classified under CWE-1104 (Use of Unmaintained Third-Party Components). The CVSS 2.2 score (AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N) reflects an extremely constrained attack surface: only a highly privileged attacker navigating high complexity can achieve limited confidentiality disclosure. No public exploit code or active exploitation has been identified at time of analysis.

HCL MyCloud leaks license keys in HTTP responses, enabling authenticated low-privilege users who can observe or intercept the relevant response to capture and misuse the exposed key material. All versions appear affected per CPE wildcard data (cpe:2.3:a:hclsoftware:mycloud:*:*:*:*:*:*:*:*), and the vulnerability is vendor-confirmed via HCL advisory KB0132381. No public exploit code has been identified and the issue is not listed in the CISA KEV catalog, placing overall risk at low severity consistent with the CVSS 3.1 score of 3.1.

Server version disclosure in HCL MyCloud exposes software version strings - likely via HTTP response headers or application-layer output - enabling attackers to fingerprint the exact deployment version and correlate it against public vulnerability databases. The vendor-provided CVSS vector (AV:N/AC:H/PR:H/UI:N) constrains realistic risk significantly: exploitation requires both high privilege and high attack complexity, meaning this is not an opportunistic or mass-exploitable weakness. The vulnerability functions primarily as a reconnaissance enabler for chaining into separate, more severe attacks; no public exploit or active exploitation has been identified at time of analysis.

Weak password policy enforcement in HCL MyCloud exposes authenticated accounts to brute-force and credential-stuffing attacks, potentially enabling unauthorized account takeover. The flaw is classified under CWE-521 (Weak Password Requirements), meaning the platform fails to enforce sufficient password strength constraints on users. Despite tags indicating Information Disclosure risk, no public exploit code or active exploitation has been identified at time of analysis, and the vendor-assigned CVSS score of 3.1 reflects a Low severity rating.

Buffer underflow (CWE-124) in Eclipse OpenJ9 versions through 0.60 allows memory corruption via the JVM method argument tracing subsystem when the -Xtrace diagnostic flag is active, with potential high integrity and availability impact to the running JVM process. The defect resides in traceMethodArguments() within the trace runtime, where the cursor pointer could be decremented past the start of the allocated trace buffer when constructing an ellipsis truncation marker - a classic buffer underwrite. No active exploitation is confirmed in CISA KEV, and no public exploit code has been disclosed at time of analysis.

Cross-tenant authorization bypass in Plane's asset-management API allows any authenticated workspace member to read, delete, or duplicate file assets belonging to an entirely different workspace on the same instance, affecting all releases through 1.3.0. The API endpoints accept a workspace slug and asset ID as path parameters but perform no membership verification against the requesting user's session, returning presigned file URLs and permitting destructive operations across tenant boundaries. No public exploit has been identified at time of analysis, and EPSS exploitation probability stands at 0.15% (5th percentile), though the attack is mechanically straightforward for any authenticated user who can enumerate workspace slugs and asset IDs.

Improper deserialization of untrusted data in NVIDIA Transformers4Rec (all versions per CPE wildcard) exposes systems running the library to code execution, data tampering, and information disclosure via a local attack path. The official CVSS vector assigns C:N/I:N/A:L - a score of 4.3 - which is materially inconsistent with the vendor's own description of potential remote code execution and data tampering; this discrepancy warrants independent verification with NVIDIA's product security team. No public exploit code has been identified at time of analysis, and KEV status is not confirmed.

Stored cross-site scripting in SolarWinds Serv-U enables session hijacking and information disclosure from administrator accounts via malicious script persistence in the application. The vulnerability requires a high-privileged attacker to inject the payload, which then executes in the browser context of any administrator who views the poisoned content - a classic privilege-boundary-crossing XSS pattern confirmed by the CVSS scope-change flag. No public exploit code has been identified at time of analysis, and a vendor fix appears in Serv-U 2026.3 based on release note references.

Missing X-Content-Type-Options headers in Intelliops Event Management enable content-type sniffing attacks leading to script injection under man-in-the-middle conditions when user-controlled input is reflected. Exploitation requires high attack complexity, user browser interaction, and network positioning, with low integrity impact only (CVSS 3.1). No active exploitation or public exploit code identified.

HCL IntelliOps Event Management (IEM) fails to enforce HTTP Strict Transport Security (HSTS), enabling network-positioned attackers to perform SSL stripping and intercept communications that should be protected by TLS. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) indicates unauthenticated network exploitation but at high attack complexity, meaning the attacker must occupy a man-in-the-middle position on the network path. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, placing realistic risk in the low-to-moderate range confined to adversarial network environments.

Nginx server version disclosure in HCL IntelliOps Event Management (IEM) exposes the underlying web server version to unauthenticated remote attackers. This reconnaissance-class vulnerability allows adversaries to fingerprint the software stack, identify whether the nginx instance is outdated, and pivot to targeting known CVEs or publicly available exploits against that specific version. No public exploit code and no CISA KEV listing are associated with this CVE; the primary risk is as an enabler for follow-on attacks rather than direct exploitation.

Out-of-bounds read in Qt's QTextCodec::codecForName() causes incorrect text codec selection or a process crash (denial of service) when the function is supplied a non-NUL-terminated QByteArray constructed via QByteArray::fromRawData(). Affected components span Qt Core (qtbase) in Qt 4.x and 5.x, and the Qt5Compat module in Qt 6.0.0 onward. No public exploit has been identified and no CISA KEV listing exists; real-world risk is confined to applications whose codec-selection paths are reachable from attacker-controlled input and that specifically construct raw, non-NUL-terminated byte arrays before passing them to this API.

Address bar spoofing in Mozilla Firefox (all versions prior to 153) enables a remote, unauthenticated attacker to misrepresent the displayed origin in the browser's address bar, the primary trust signal users rely on to validate site authenticity. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) confirms exploitation is low-complexity and requires only a single user interaction - navigating to a crafted page - with no authentication or special privileges needed from the attacker. No public exploit has been identified and EPSS sits at 0.13% (3rd percentile), indicating limited exploitation activity; however, the integrity of user trust decisions is fully undermined when the flaw is triggered, making it an effective phishing enabler.

FlexCity by Universal Software Inc. exposes an authentication rate-limiting failure (CWE-307) across versions 5.536.0 through 11052026, allowing low-privileged network attackers to submit unbounded authentication requests and cause excessive server-side resource allocation that degrades availability. The CVSS vector (AV:N/AC:L/PR:L/A:L) indicates a moderate, network-reachable flaw requiring existing credentials, though the vendor-applied 'Information Disclosure' tag conflicts with the C:N CVSS metric and raises the possibility of concurrent username enumeration not captured in the base score. Reported by TR-CERT; no public exploit code and no CISA KEV listing exist at time of analysis.

Cross-tenant information disclosure in OpenRemote versions before 1.26.2 allows any authenticated user holding the read:rules role to retrieve operational syslog events from arbitrary tenants by querying the GET /api/{realm}/syslog/event endpoint. The SyslogResource REST endpoint fails to scope log retrieval to the caller's own realm, exposing asset IDs, agent connection details, rule names, and protocol errors belonging to other organizations in the same multi-tenant deployment. No public exploit code or active exploitation has been identified at time of analysis; the vendor has addressed the issue in version 1.26.2.

Schema identifier disclosure in Parse Server allows unauthenticated callers to reconstruct hidden GraphQL schema elements by exploiting 'Did you mean ...?' suggestions emitted during variable coercion error handling - a pathway left ungated by the graphQLPublicIntrospection: false hardening control, which only covered the validation phase. Affected versions span the 9.x line (9.0.0 through 9.10.0-alpha.4) and the 8.x line (before 8.6.85), and the flaw represents a confirmed bypass of prior fix GHSA-8cph-rgr4-g5vj. An attacker bearing only the public application ID can iteratively enumerate Cloud Code function names, Parse class names, and field names without triggering the introspection guard; no public exploit code is confirmed and no CISA KEV listing is present at time of analysis.

Memory exhaustion in libssh's SFTP server subsystem allows authenticated remote clients to degrade or crash the service by sending SSH_FXP_READ requests specifying an arbitrarily large read length, causing the server to allocate unbounded memory for each request. The CVSS vector (PR:L) confirms exploitation requires valid credentials, limiting the attack surface to authenticated SFTP users. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the low complexity and network-accessible attack path make this a realistic insider or credential-abuse scenario.

Out-of-bounds heap read in libssh exposes small amounts of server memory during GSSAPI key exchange, exploitable by remote unauthenticated attackers. When a client submits a Curve25519 public key shorter than the expected 32 bytes during server-side GSSAPI key exchange, libssh copies the key without validating its length, triggering a read beyond the intended buffer boundary. No public exploit has been identified at time of analysis; exploitation is constrained to servers with GSSAPI key exchange explicitly enabled, which is a non-default configuration.

Cleartext transmission of sensitive information in Zohocorp ManageEngine Endpoint Central before version 11.4.2528.34 exposes mail configuration credentials to network interception. Authenticated users who trigger mail-related functionality cause the application to transmit sensitive data - likely SMTP credentials and server configuration - without encryption, making it capturable by any attacker with a network vantage point between the client and server. No public exploit code or active exploitation (CISA KEV) has been identified; the CVSS score of 4.3 (Medium) reflects the limited scope and authentication prerequisite.

Sensitive memory exposure in kronosnet (versions <=1.34) allows a local attacker to recover live cluster encryption keys from freed heap memory following cryptographic configuration changes. Affected deployments include Red Hat Enterprise Linux 8, 9, 10, and OpenShift Container Platform 4, where kronosnet underpins the high-availability networking stack. Successful key recovery enables full decryption of cluster communications or malicious packet injection capable of destabilizing HA cluster quorum - no public exploit code identified and no CISA KEV listing at time of analysis.

Prototype Pollution in the mongo-object npm package (versions before 3.0.3) allows network-reachable attackers to corrupt the JavaScript Object.prototype by supplying crafted property paths containing special keys such as __proto__, constructor, or prototype to the expandKey() function in util.ts. No authentication or user interaction is required, though high attack complexity reflects the need for attacker-controlled input to reach the vulnerable function. No public exploit code or CISA KEV listing is identified at time of analysis; EPSS data is not provided, and the CVSS base score of 4.0 (Medium) reflects a narrowly scoped integrity impact without confidentiality or availability consequences.

File Browser's share API (confirmed vulnerable through v2.63.16) leaks bcrypt password hashes and bypass tokens for password-protected shares via unfiltered JSON serialization of the internal `Link` storage struct. Authenticated users receive these secrets for their own shares on every create or list call, while administrators calling `GET /api/shares` obtain the password hash and bypass token for every user's shares across the entire instance. A working proof-of-concept is publicly available against the v2.63.15 Docker image; the exposed bypass token grants direct, password-free access to any protected share without cracking, while the bcrypt hash enables offline recovery of reused credentials.

Policy signing key bypass in ClearanceKit prior to 5.0.10 permits any root process on macOS to forge valid signatures over arbitrary policy database content, granting full control over ClearanceKit's per-process file-system access enforcement plane. The root cause is a silent ACL failure specific to the macOS legacy System Keychain: ECDSA key items persisted via SecItemAdd silently lose their kSecAttrAccess restriction, leaving the signing key unrestricted to any root caller. No public exploit has been identified and no CISA KEV listing exists, but the integrity impact extends beyond the vulnerable component to the entire policy enforcement layer ClearanceKit provides.

ClearanceKit's on-disk SQLite policy store on macOS is vulnerable to a replay attack that allows a high-privileged local attacker to substitute a previously-captured, legitimately-signed policy snapshot, causing the opfilter component to enforce outdated or permissive per-process file-access policies on the next boot. All releases prior to version 5.0.10 are affected, with exploitation gated to specific windows: the opfilter-update period when the Endpoint Security filter is offline, offline-boot scenarios, or decrypted-backup restoration. No public exploit code or CISA KEV listing exists at time of analysis, and EPSS data was not provided in available intelligence.

rsync client versions prior to 3.4.3 crash deterministically when connecting to a malicious sender due to an out-of-bounds array read in recv_files(). Any client performing a standard recursive pull - the default behavior since protocol version 30 - against an attacker-controlled rsync server or URL is exposed without any special victim-side configuration. Impact is strictly denial-of-service (client crash via SIGSEGV); remote code execution has been explicitly ruled out on glibc x86-64 Linux, though non-glibc allocators remain unaudited. No public exploit identified at time of analysis; vendor-released patch is available in version 3.4.3.

Arbitrary file write in Apache MINA SSHD's sshd-git component enables any SSH-authenticated user to write files to arbitrary server filesystem paths via the JGit git archive --output argument. Servers are only affected when explicitly configured with GitPgmCommandFactory; the vulnerability does not exist in default MINA SSHD deployments. No public exploit code or CISA KEV listing exists at time of analysis; vendor-confirmed fixes are available in versions 2.19.0 and 3.0.0-M5.

Rsync daemon versions prior to 3.4.3 expose a symlink race condition (TOCTOU) in path-based system calls - specifically chmod() and chown() - that prior security patches overlooked when fixing analogous races in open(). When deployed with 'use chroot = no', an attacker with local filesystem write access to an exported module directory can redirect these calls through a symlink to files outside the module boundary, altering permissions, ownership, or timestamps on otherwise inaccessible files. No public exploit has been identified at time of analysis, and the issue is addressed in rsync 3.4.3.

Prototype Pollution in FreeScout's client-side `getQueryParam` function allows an authenticated attacker to write arbitrary properties into `Object.prototype` via crafted URL query strings on any page loading `main.js`. An initial mitigation introduced in version 1.8.139 blocked direct top-level `__proto__` keys but failed to sanitize nested bracket-notation bypass forms such as `b[__proto__][polluted]=PWNED`, leaving all installations between 1.8.139 and 1.8.222 still exploitable. The complete fix shipped in version 1.8.223; no public exploit or active exploitation is confirmed at time of analysis.

Arbitrary host file disclosure in BuildKit's WCOW (Windows Container on Windows) worker mode allows an untrusted build author to read any file reachable by the BuildKit daemon process. By placing NTFS directory junctions inside the cache mount root - a technique the `source=` selector fails to detect on Windows - a malicious Dockerfile can redirect cache access to traverse outside the container's expected filesystem boundary. This affects any multi-tenant or shared CI/CD environment running a WCOW-configured BuildKit daemon where untrusted users can submit builds; no active exploitation has been confirmed (not listed in CISA KEV) and no public exploit code has been identified at time of analysis.

Information disclosure in the Quix Page Builder Pro Joomla extension exposes raw exception data to unauthenticated remote attackers via AJAX handler responses. The affected component fails to sanitize or suppress server-side exception output before returning it to the client, potentially leaking internal application state, file paths, database structure, or configuration details depending on what triggers the exception. No public exploit or CISA KEV listing is identified at time of analysis, but the unauthenticated network-accessible attack vector lowers the barrier for reconnaissance abuse.

NanoMQ's MQTT v5 SUBSCRIBE packet parser fails to enforce the mandatory 1-byte Subscription Options field, enabling remote unauthenticated attackers to submit malformed SUBSCRIBE packets that the broker silently accepts and installs into internal subscription state. Under a precisely crafted packet-length condition, the same defect manifests as a 1-byte heap-buffer-overflow (CWE-125), confirmed by ASAN, which can crash the broker and disrupt all connected MQTT clients. All NanoMQ releases up to and including 0.24.14 are affected; no confirmed active exploitation (KEV) or public exploit code has been identified at time of analysis, though the unauthenticated network attack surface warrants prompt remediation in internet-exposed deployments.

Buffer underflow in HDF5 library versions through 1.14.6 corrupts memory when H5Iget_name is called with a size parameter of zero on a group identifier, writing a null terminator before the intended buffer boundary and potentially crashing the host application. Applications that ingest attacker-supplied HDF5 files and expose user-controlled size values to H5Iget_name face availability disruption and, under specific heap layouts, possible disclosure of adjacent memory contents. No public exploit has been identified at time of analysis and the vulnerability is absent from CISA KEV; the CVSS 4.0 score of 5.9 reflects the high attack complexity and required active user interaction that meaningfully constrain real-world exploitation.

Out-of-bounds read in HDF5 (all versions prior to 2.0.0) is triggered when parsing a maliciously crafted file whose array datatype metadata violates the internal invariant that element_size × nelem must equal the stored full datatype size. When a victim opens such a file, the HDF5 parser reads beyond its intended buffer boundary, causing application crash or potential memory disclosure. No active exploitation is confirmed in CISA KEV, but SSVC intelligence confirms a POC exists, and the vendor has released a patch in version 2.0.0.

Client-side security enforcement bypass in Gobito's Corporate Training Management System permits authenticated users to manipulate input data that the server accepts without independent validation. The root cause is CWE-602: security controls enforced only in the browser are trivially circumvented by crafting direct HTTP requests, bypassing form-level restrictions. No active exploitation has been identified, and CVSS places this at Medium (4.3), reflecting limited integrity impact constrained by the authentication prerequisite.

Username enumeration via authentication timing side-channel in FileBrowser Quantum's `/api/auth/login` endpoint allows unauthenticated remote attackers to distinguish valid from invalid usernames by measuring response latency. Valid usernames trigger a bcrypt password hash comparison (~40-50 ms), while non-existent usernames return almost immediately (~1-4 ms), creating a statistically exploitable timing differential. A working proof-of-concept Python script was published in the GHSA advisory; the CVE is not in CISA KEV, so active exploitation is not confirmed at time of analysis.

Windu CMS 4.1 stores user passwords using MD5 and SHA1 with a static salt, providing negligible resistance against offline cracking once password hashes are obtained. An attacker who acquires the credential database - through SQL injection, a backup exposure, or any secondary breach - can recover plaintext passwords rapidly using precomputed rainbow tables or GPU-accelerated cracking tools. No active exploitation has been confirmed (no CISA KEV listing, no public proof-of-concept), though the weakness is structurally severe: static salts eliminate the primary defense against precomputation attacks and MD5/SHA1 are high-throughput algorithms entirely unsuited to password storage.

SurrealDB before v3.1.0 silently substitutes ES384 (P-384 curve) when operators configure JWT access methods with ALGORITHM ES512 (P-521 curve), because the underlying Rust jsonwebtoken crate v10.x omits an ES512 variant entirely. Operators who provision correct P-521 keys experience authentication handshake failures, and external systems expecting genuine ES512 signatures will reject SurrealDB-issued tokens. No public exploit has been identified at time of analysis; the vendor and GHSA advisory both confirm the flaw cannot be used to forge tokens or compromise confidentiality or integrity, as ES384 itself remains cryptographically strong.

LIVE SELECT subscriptions in SurrealDB before 3.1.0 persist real-time change notifications under revoked, expired, or superseded session credentials, violating session boundary enforcement. Authenticated users who register a LIVE SELECT query retain delivery of change notifications after their session is invalidated, expires via TTL, or is replaced by a different identity authenticating on the same WebSocket connection. No public exploit has been identified and no active exploitation is confirmed; vendor-released patch is available in SurrealDB 3.1.0.

SurrealDB versions before 3.1.0 expose field values protected by field-level SELECT permissions through verbose error messages returned to authenticated users who hold UPDATE access. By issuing UPDATE statements that trigger arithmetic or extend operations against hidden fields - such as adding an integer to a string-typed email field - an attacker receives an error response embedding the raw operand value (e.g., 'Tried to compute "alice@example.com" + 1'). No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog, but the technique is trivially repeatable across any field on any record the attacker holds UPDATE permission on.

Denial of service in claircore's Alpine APK package scanner affects Red Hat Advanced Cluster Security 4 and Red Hat Quay 3, where a low-privileged remote attacker can submit a container image containing malformed APK package-database data to trigger an out-of-bounds read (CWE-125) that panics the Go scanner. If the panic is not recovered, the Clair indexer process crashes, interrupting container vulnerability scanning workflows. No public exploit code exists and this CVE is not listed in the CISA KEV catalog, placing this at moderate priority despite network reachability.

Information disclosure in Elementor Website Builder (all versions before 4.1.4) allows authenticated WordPress users with Contributor-level access or above to read the title, body, and metadata of private posts, private pages, and drafts belonging to other users - including site administrators - via an improperly permission-checked REST endpoint. A publicly available proof-of-concept exploit exists (reported by WPScan), though EPSS places exploitation probability at 0.14% (4th percentile), indicating limited current in-the-wild activity despite public PoC. No active exploitation has been confirmed by CISA KEV; the vendor has released a patched version (4.1.4).

Missing length validation for the NEW_TOKEN format in HAProxy Community Edition 3.0 through 3.3 exposes network-accessible deployments to low-integrity and availability impacts via crafted requests. The flaw affects HAProxy Enterprise and ALOHA distributions as well, broadening the potential attack surface beyond the open-source edition. No public exploit code and no CISA KEV listing have been identified at time of analysis; patches are available across all affected release branches. Notably, the 'Information Disclosure' tag attached to this CVE conflicts with the CVSS C:N rating - defenders should consult the vendor advisory to clarify whether memory exposure is a realistic outcome.

Sysfs group corruption in the Linux kernel's kernfs/sysfs subsystem can cause local denial of service when a pre-existing attribute group directory is silently deleted during a failed update operation. When `sysfs_update_group()` encounters an allocation failure (-ENOMEM) in `create_files()`, the cleanup code in `internal_create_group()` calls `kernfs_remove(kn)` on a kernfs node obtained via `kernfs_find_and_get()` - a directory that existed before the call - rather than restricting removal to directories it created. This logic error, affecting multiple stable kernel branches prior to the respective fix commits, is not in CISA KEV, carries an EPSS of 0.17% (6th percentile), and no public exploit has been identified.

Reference leak in the Linux kernel DAMON sysfs-schemes subsystem allows a local low-privilege attacker to cause a denial of service through accumulated cgroup object reference exhaustion. Affected are kernel builds from Linux 6.3 (commit 29cbb9a13f05b20f0777c60db9603730b487a4e0) through stable branches prior to 6.6.142, 6.12.92, 6.18.34, 7.0.11, and 7.1, on systems where DAMON is active and cgroup-path-based memory schemes are configured via sysfs. No public exploit has been identified and EPSS is 0.16% (5th percentile), consistent with a kernel resource-management flaw requiring specific local conditions.

Reference count leaking in the Linux kernel's hardware memory poison accounting subsystem (drivers/base/memory) causes memory block device objects to remain unreleased across repeated hardware memory error events, gradually degrading system stability. Affected kernels span multiple stable branches from introducing commit 5033091de814 through their respective fix commits, with patched releases available at 6.6.142, 6.12.92, 6.18.34, 7.0.11, and 7.1. No public exploit code exists and no active exploitation is recorded (EPSS 0.16%, 5th percentile); this is a slow-accumulating resource leak rather than an immediately weaponizable flaw.

Memory hotplug removal in the Linux kernel leaks device references because `find_memory_block()` acquires a kobject reference inside `remove_memory_blocks_and_altmaps()` that is never released, allowing the reference count to accumulate unchecked across repeated memory block removal cycles. Systems with memory hotplug support - including virtual machines using ACPI memory balloon drivers and bare-metal servers with hot-pluggable DIMM slots - are affected across multiple stable kernel branches, with patches confirmed for 6.12.92, 6.18.34, 7.0.11, and 7.1. No public exploit code exists and exploitation probability is extremely low (EPSS 0.16%), though the availability impact is rated high: leaked references accumulated over repeated hotplug cycles can eventually precipitate a kernel panic.

Memory exhaustion in the Linux kernel WWAN IOSM driver allows a local low-privileged attacker to deplete kernel memory by repeatedly triggering error paths in `ipc_imem_init()` where memory allocated by `ipc_protocol_init()` is never released. Affected systems running kernel versions from 5.14 through the unpatched branches of 5.15, 6.1, 6.6, 6.12, 6.18, 7.0, and pre-7.1 with Intel WWAN IOSM modem hardware loaded are vulnerable to availability-impact memory exhaustion. No public exploit exists and EPSS probability sits at 0.16% (6th percentile), indicating negligible real-world exploitation likelihood; however, patched stable releases are available across all major kernel branches.

Kernel self-deadlock in the Linux phonet/pep subsystem allows a local low-privilege attacker to crash affected systems by triggering an inconsistent bottom-half (BH) lock state on a child PEP socket. The flaw exists from kernel 2.6.28 through unpatched stable branches up to 7.x, and is reachable only when the Phonet protocol module is active. No public exploit or active exploitation is confirmed; EPSS is 0.16% (6th percentile), consistent with the niche deployment context.

CPU exhaustion in the Linux kernel's cfg80211 WiFi subsystem allows an attacker within radio range to trigger a runaway loop in cfg80211_merge_profile() by broadcasting a specially crafted Multi-BSSID beacon frame, consuming up to 2 milliseconds of kernel CPU time per beacon received. Devices running Linux 5.2 and later with cfg80211-based WiFi drivers are affected across eight stable kernel branches, from 5.10.x through 7.0.x, until patched. No public exploit has been identified at time of analysis, and EPSS probability is 0.17% at the 7th percentile, indicating no observed active exploitation.

Invalid cleanup in the Linux kernel's tracing_map subsystem causes a kernel panic when memory allocation fails during element initialization. Specifically, the error path in tracing_map_elt_alloc() incorrectly invokes map->ops->elt_free() on uninitialized data when elt_alloc() was never successfully called, producing an invalid memory operation that crashes the kernel. This affects all kernel branches from 4.17 through the respective fixed stable releases. No public exploit exists and EPSS is 0.16% (6th percentile), but any local low-privileged user with access to the tracing subsystem who can induce allocation failures can trigger a denial of service.

Runtime PM reference count leak in the Linux kernel's Tegra I2C driver permanently prevents the affected I2C controller from entering runtime suspend when tegra_i2c_mutex_lock() returns an error. The asymmetric acquire-without-release of pm_runtime_get_sync() causes device power management to malfunction on NVIDIA Tegra SoC hardware, covering Linux 7.0 through pre-7.0.11 and pre-7.1. No public exploit exists and EPSS at 0.14% (4th percentile) reflects minimal exploitation interest; this is a stability and power management correctness defect rather than a security attack vector in the conventional sense.