Information Disclosure

Sensitive API key credential exposure in django-tastypie up to 0.15.1 stems from the ApiKeyAuthentication class transmitting secrets via GET request query strings, making them visible in server access logs, proxy logs, browser history, and HTTP Referer headers. The flaw is a classic CWE-598 design error rooted in the authentication.py implementation and is remotely triggerable against any deployment using the ApiKeyAuthentication backend. No patch has been released; the project was notified via GitHub issue #1700 but has not yet responded. No public exploit code or CISA KEV listing exists at time of analysis, though the information disclosure risk is real in any environment where logs or network traffic are accessible to adversaries.

Insufficient session expiration in django-oauth-toolkit 3.3.0 allows authenticated network attackers to exploit the `_load_id_token` function in `oauth2_provider/oauth2_validators.py`, bypassing token expiration enforcement and maintaining access beyond their authorized session lifetime. The CVSS 4.0 score of 5.3 with PR:L confirms exploitation requires low-privilege access (a valid or expired token), and impacts confidentiality, integrity, and availability at a low level. No public exploit or active exploitation has been confirmed; the issue was submitted via a GitHub issue report and the project has not yet issued a response or patch.

Information disclosure in zevorn's rt-claw (all versions up to 0.2.0) is reachable remotely through manipulation of the claw_net_get and claw_net_post HTTP request functions in claw/services/tools/net.c, exposing sensitive data to unauthenticated network attackers. Publicly available exploit code exists (via GitHub issue #136), raising the practical exploitation threshold significantly. No vendor patch has been released; the project maintainer has not responded to the responsible disclosure report, leaving all deployed instances unmitigated.

Prototype pollution in CartoDB carto-api-client 0.5.29 exposes applications to object prototype manipulation via the `column` argument of the `addFilter` function in `src/filters.ts`. Authenticated remote attackers can inject arbitrary properties into the JavaScript Object prototype, affecting all runtime objects in the application and enabling limited confidentiality, integrity, and availability impacts as reflected by the CVSS 4.0 score of 5.3. No patch has been released - the vendor has not responded to the responsible disclosure filed via GitHub issue #299 - and no active exploitation or public exploit code has been identified at time of analysis.

Internal file disclosure in Stoat for Android allows any process capable of local intent dispatch to exfiltrate the app's internal storage - including the local message database and cached authentication tokens - through an unvalidated URI passed to the exported ShareTargetActivity. The attacker triggers a single, deceptive share interaction in which the victim selects a destination channel while the Stoat composer conceals the true nature of the attachment, showing only 'attachment' with no filename. No public exploit code has been identified and this CVE is not listed in CISA KEV; the upstream fix is confirmed via commit 50d5f5143940809ebb5a61e5f507c956c33aa970, though a specific patched release version is not independently confirmed.

Prototype pollution in RobinHerbots Inputmask up to version 5.0.9 allows low-privileged remote attackers to manipulate JavaScript's shared Object.prototype via the internal deep merge helper functions extendDefaults, extendDefinitions, and extendAliases in lib/dependencyLibs/extend.js. Successful exploitation enables injection of arbitrary properties onto the global prototype chain, potentially leading to information disclosure, logic bypass, or application state manipulation within any JavaScript runtime consuming the library with attacker-influenced configuration input. No vendor patch is available as the project has not responded to the responsible disclosure report filed via GitHub issue #2885; no public exploit code or CISA KEV listing has been identified at time of analysis.

Symlink following in nearai ironclaw up to 0.29.1 allows a local low-privileged user to redirect the write_file built-in tool's output to arbitrary files outside the agent's sandbox directory. The root cause is that the validate_path function in src/tools/builtin/path_utils.rs used metadata resolution that follows symlinks rather than symlink_metadata, permitting a dangling symlink inside the sandbox to pass validation and cause the subsequent write to land on an out-of-sandbox target. No confirmed active exploitation (not in CISA KEV) but a public proof-of-concept is referenced at GitHub issue #4797, and EPSS data was not supplied.

Incomplete shell command blacklist validation in SafestClaw up to version 4.2.4 allows a local low-privilege attacker to bypass the ShellAction._validate_command restriction in the Built-in Web Interface, potentially executing unintended shell commands. A proof-of-concept has been publicly disclosed via GitHub issue #59, though the project maintainer actively disputes that the disclosed exploit demonstrates any concrete user-facing threat, noting the AI-generated POC fails to show actual harm and that the open-source codebase allows operators to customize or remove the allow list. No public exploit has been confirmed in CISA KEV, and the CVSS 4.0 base score of 1.9 reflects the minimal assessed real-world impact.

Name resolution bypass in GoClaw's exec approval subsystem allows remote low-privileged attackers to circumvent the binary execution allowlist. Affecting all versions up to and including 3.13.3-beta.3, the flaw resides in the matchesAllowlist and extractBin functions within internal/tools/exec_approval.go, where crafted input causes the allowlist check to resolve a name or reference incorrectly, permitting unauthorized binary execution. A publicly disclosed proof-of-concept exploit exists (GitHub issue #1213); no CISA KEV listing is present, indicating no confirmed widespread active exploitation at time of analysis.

Inclusion of functionality from an untrusted control sphere (CWE-829) in Sipeed PicoClaw through version 0.2.9 allows a local low-privileged attacker to manipulate the NewContextBuilder function in pkg/agent/context.go, causing the application to load or execute functionality outside its intended control boundary. The impact is limited - partial confidentiality, integrity, and availability effects - but a publicly available proof-of-concept exploit exists. Critically, the vendor closed the disclosure issue on GitHub as 'not planned,' meaning no official patch will be released, leaving users without a vendor-supported remediation path.

Time-of-check time-of-use race condition in Sipeed PicoClaw up to version 0.2.9 allows locally authenticated low-privilege users to exploit the ExecTool.executeRun function in the Go-based pipeline execution agent, achieving limited confidentiality, integrity, and availability impacts. A publicly available proof-of-concept exists via GitHub issue #3081, though the vendor closed the report as 'not planned,' signaling no intent to patch. No public exploit identified at time of analysis in CISA KEV; the local-only attack vector and low impact ceiling make this a low-priority finding for most environments.

Symlink following in AstrBot's Filesystem Computer-Use Tool (versions up to 4.25.5) allows a low-privileged local attacker to escape intended directory restrictions and access arbitrary files by manipulating the `_normalize_rw_path` function in `astrbot/core/tools/computer_tools/fs.py`. A proof-of-concept exploit has been publicly disclosed via GitHub Gist, and the vendor did not respond to coordinated disclosure - meaning no patch is confirmed available. No public exploit identified at time of analysis as confirmed active exploitation (not in CISA KEV), but the existence of public POC code lowers the barrier for any attacker who already has local access.

Race condition in IBM Cognos Analytics 12.1.3 (builds through 12.1.3-2606251736) allows authenticated users to obtain incorrect report summary results belonging to other users or trigger report-processing failures by exploiting improper synchronization in the Agentic AI assistant's concurrent request-handling logic. The flaw requires authenticated access and concurrent user activity, limiting opportunistic exploitation, though in high-concurrency enterprise deployments the race window may be reliably triggered. No public exploit code or active exploitation has been identified; a vendor patch is available.

IBM Security Verify exposes sensitive internal information to unauthenticated remote attackers through overly detailed technical error messages rendered in the browser. Affected deployments span four product variants - IBM Verify Identity Access, IBM Security Verify Access, and their respective container editions - all of which share the same CWE-209 root cause. No public exploit code or CISA KEV listing exists at time of analysis; the primary risk is reconnaissance enablement, where leaked error details lower the effort required for subsequent, more severe attacks.

Insufficient input validation in HCL DevOps Loop permits special characters in fields where they should be restricted, enabling authenticated network-accessible attackers under high-complexity conditions to trigger unintended application behavior resulting in limited information disclosure. The CVSS score of 3.1 (Low) reflects constrained real-world impact: exploitation requires prior authentication and specific conditions to materialize. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, indicating no confirmed active exploitation at time of analysis.

Sensitive credential exposure in the keycloak-services authentication configuration endpoint allows view-only administrators to retrieve unmasked third-party service secrets, such as reCAPTCHA secret keys, through the administrative API. Affected deployments include Red Hat Build of Keycloak, Red Hat Single Sign-On 7, Red Hat Data Grid 8, and the JBoss EAP Expansion Pack. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog; however, the confidential nature of the exposed values - functional API credentials for third-party services - elevates the practical impact beyond what the CVSS score of 4.3 might initially suggest.

Brute-force lockout bypass in Keycloak's Client-Initiated Backchannel Authentication (CIBA) flow allows an attacker holding valid OAuth client credentials to redeem previously approved authentication requests and obtain access and refresh tokens for a user account that has since been locked. This is an incomplete fix for CVE-2026-9798: the brute-force protection check was applied to the CIBA initiation handler but was never added to the token redemption handler, creating a gap that persists after the earlier patch. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.

Keycloak's default-groups REST endpoint and realm representation expose hidden group names and identifiers to delegated administrators who hold realm-viewing permissions but lack explicit group-viewing authorization. Affected products span Red Hat Build of Keycloak, Red Hat Single Sign-On 7, Red Hat Data Grid 8, and Red Hat JBoss EAP Expansion Pack. No public exploit code exists and CISA KEV listing is absent at time of analysis; the CVSS 4.3 Medium rating accurately reflects constrained impact limited to metadata disclosure.

Unauthenticated user enumeration in the Events Booking extension for Joomla (versions 1.0 through 5.8.0) exposes registered account usernames and email addresses to any unauthenticated remote attacker. The flaw requires no credentials, no user interaction, and no special configuration beyond the extension being installed and active - making it trivially accessible to automated tooling. While not confirmed actively exploited (no CISA KEV listing) and carrying a low EPSS probability of 0.15%, the harvested PII enables follow-on phishing, credential stuffing, or account targeting campaigns against Joomla site users.

Unauthenticated information disclosure in TheHive through 4.1.24 exposes sensitive configuration data - including the datastore attachment protection password, SSO settings, MFA capabilities, and clustered node addresses - to any network-reachable attacker via a single GET request to /api/status. The root cause is a missing authentication gate in the StatusCtrl.scala handler, a CWE-306 class defect. A public proof-of-concept is available on GitHub demonstrating trivial exploitation; no CISA KEV listing at time of analysis, though the exposed credentials materially increase lateral movement risk beyond the moderate CVSS score suggests.

Token forgery is possible against any Perl application using Mojo::JWT versions before 1.02 due to a timing side-channel in HMAC signature verification. The decode() method compared the supplied signature against the recomputed HMAC using Perl's native eq operator, which short-circuits on the first differing byte, leaking the expected signature byte-by-byte through measurable response time variation. An attacker with the ability to submit many attacker-controlled tokens to an endpoint that calls decode() can statistically aggregate these timing differences to reconstruct the valid HMAC signature and subsequently forge arbitrary JWT tokens. No public exploit has been identified at time of analysis, and EPSS sits at the 7th percentile, indicating low automated exploitation probability.

Missing firmware integrity verification in ABB KNX Update Tool versions through 2.0.175 allows an adjacent network attacker with low-privilege access to inject tampered updates onto KNX building automation devices, leading to high integrity and availability impact. The vulnerability (CWE-353) means the tool accepts update packages without cryptographic validation, enabling a man-in-the-middle or rogue-update attack on the KNX bus segment. No public exploit code or CISA KEV listing has been identified at time of analysis, and active exploitation has not been confirmed.

Authorization code injection in Red Hat Build of Keycloak's keycloak-services component enables a network-positioned attacker to hijack OAuth 2.0 flows by intercepting and cross-client redeeming authorization codes. Because codes are not cryptographically bound to the originating client, an attacker who obtains a victim's in-flight code can submit it using their own registered client credentials and receive access tokens tied to the victim's identity. No public exploit has been identified at time of analysis, and the CVSS AC:H rating reflects the non-trivial code interception prerequisite that constrains opportunistic exploitation.

CAPTCHA bypass in GD::SecurityImage through version 1.75 for Perl stems from use of Perl's non-cryptographic rand() function to generate challenge text, making CAPTCHA tokens predictable and reversible by an unauthenticated network attacker. Any Perl web application relying on this library for bot protection is exposed to automated CAPTCHA solving, undermining form submission rate-limiting, account registration guards, and similar defenses. No public exploit code or active exploitation is identified at time of analysis, but the low attack complexity and the clear exploit path make this a practical integrity risk for deployed instances.

Keycloak's identity provider management component exposes OIDC client secrets to delegated administrators who manipulate the masked sentinel value mechanism during IdP updates. When a delegated admin submits a configuration update using the sentinel placeholder for the client secret while simultaneously changing the token URL to an attacker-controlled endpoint, Keycloak improperly reuses the real underlying secret without validating the consistency of the changed security-sensitive field. On the next authentication flow through that identity provider, Keycloak transmits the real client secret to the attacker's token URL, resulting in credential exfiltration. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.

Out-of-bounds read in CIPster's EtherNet/IP symbolic path parser exposes industrial control systems to remote availability disruption and potential memory disclosure. The flaw resides in `CipAppPath::deserialize_symbolic` (source/src/cip/cipepath.cc), where unsafe `memcpy` calls copy attacker-controlled byte counts from a network-supplied CIP symbolic path segment into a fixed-size stack buffer without bounds enforcement, reachable by a remote unauthenticated attacker sending a crafted EtherNet/IP explicit messaging request. No active exploitation is confirmed (not in CISA KEV), but a POC exploit archive has been publicly released and the CVSS 4.0 E:P modifier corroborates exploit availability.

Prototype pollution in sagold json-schema-library 11.5.0 and 11.5.1 allows remote low-privileged attackers to corrupt the JavaScript Object prototype by supplying crafted schema definitions or input data containing reserved keys such as `__proto__` processed by the `parsePropertyDependencies` function. The CVSS 4.0 vector confirms low-privilege network exploitation with limited but real confidentiality, integrity, and availability impact; the E:P supplemental metric confirms proof-of-concept code exists. No CISA KEV listing is present, so confirmed mass exploitation is not established at time of analysis.

OAuth refresh token theft in HubSpot All-In-One Marketing - Forms, Popups, Live Chat (WordPress plugin 'leadin') exposes connected HubSpot tenants to unauthorized access. Authenticated WordPress users at contributor level or above can extract a plaintext HubSpot OAuth refresh token directly from the client-side window.leadinConfig JavaScript object, which is populated server-side via wp_localize_script() after the plugin decrypts the at-rest AES-256-CTR-encrypted token - rendering the encryption entirely ineffective against this attack path. A stolen token can be replayed against the HubSpot OAuth API to access or modify CRM contacts, marketing campaigns, and other tenant data in the connected HubSpot account. No public exploit has been identified at time of analysis, and this CVE is not listed in CISA KEV.

Royal Addons for Elementor WordPress plugin before 1.7.1063 exposes private and draft Elementor template content to unauthenticated users through a REST endpoint that fails to enforce WordPress post-status access controls. Any unauthenticated visitor can retrieve rendered HTML of restricted templates referenced by non-public navigation menu items, bypassing intended content access controls. A public proof-of-concept exists per WPScan and SSVC flags this as automatable, though EPSS at 0.15% (4th percentile) reflects no confirmed widespread exploitation; no CISA KEV listing exists.

DLL hijacking in HCL Traveler for Microsoft Outlook (HTMO) permits a local, high-privileged attacker to replace or plant a malicious DLL in a directory searched by the application at load time, enabling arbitrary code execution within the HTMO process context. The CVSS vector (AV:L/AC:L/PR:H/UI:R) confirms the attack is constrained to local access with elevated privileges and requires a user to trigger application load, substantially limiting real-world exploitability despite the full C/I/A:H impact ratings. No public exploit code and no CISA KEV listing have been identified at time of analysis.

Sensitive information exposure in the pCloud WP Backup WordPress plugin (all versions up to and including 2.0.3) allows subscriber-level authenticated users to trigger full-site backup archive generation via the unprotected `wp2pcl_ajax_process_request_inner` AJAX endpoint. The resulting archive is deposited in the plugin's publicly web-accessible `tmp/` directory at a predictable URL, exposing `wp-config.php` database credentials, WordPress authentication secret salts, and the complete PHP source tree to unauthenticated HTTP retrieval by any internet visitor. No public exploit code has been identified at time of analysis, but the two-phase attack path (low-privilege trigger followed by unauthenticated exfiltration) makes this significantly more impactful than the 6.5 CVSS score suggests, as successful exploitation provides the material for full database access and authentication session forgery.

Bot token and credential exposure in OpenClaw Bot Framework (versions before 2026.5.28) enables low-privilege authenticated callers to exfiltrate sensitive authentication data by supplying crafted serviceUrl values that circumvent trusted boundary validation. The flaw resides in the Microsoft Teams integration component (openclaw:msteams) and allows attackers to redirect credential-bearing requests to attacker-controlled endpoints, compromising bot tokens and downstream authentication secrets. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, the CVSS 4.0 score of 6.0 reflects high confidentiality impact contingent on a specific attack prerequisite (AT:P) and low-privilege access.

Token leakage in OpenClaw's MS Teams integration (versions before 2026.5.27) allows lower-trust authenticated callers to retrieve Bot Framework tokens that should remain within the application's trusted boundary. Attackers exploit access to configured input paths involved in outbound MS Teams requests to harvest bearer tokens, which can then be used to authenticate to downstream Microsoft Bot Framework or Teams services as the compromised bot identity. No public exploit code exists and this vulnerability is not listed in CISA KEV, but the high confidentiality impact (VC:H) and credential theft potential make patching a priority for any organization running this integration.

DNS rebinding protection bypass in OpenClaw before 2026.5.28 allows a lower-privileged caller to win a TOCTOU race window in the MS Teams safeFetch DNS validation path, potentially enabling requests to internal or restricted resources that should have been blocked by policy. Exploitation requires the safeFetch DNS rebinding check feature to be both enabled and reachable, and practical impact is heavily configuration-dependent. No public exploit code has been identified and no CISA KEV listing exists; the issue is confirmed via a vendor GitHub security advisory and VulnCheck reporting.

Credential redaction bypass in OpenClaw before version 2026.6.1 allows lower-privileged local users to extract sensitive credentials through the trajectory export feature by exploiting misconfigured input paths or improperly accessible export functionality. The product's redaction controls fail to enforce trust boundaries, causing credentials that should remain opaque to lower-trust callers to surface in export output. No public exploit has been identified at time of analysis; exploitation requires local access, low privileges, and user interaction, which constrains realistic risk despite the high confidentiality impact when conditions are met.

Authorization header leakage in OpenClaw before 2026.6.5 exposes credentials to unintended servers during MCP SSE redirect handling, allowing an authenticated lower-trust caller to gain access to resources beyond their intended authorization scope. The vulnerability affects deployments where the MCP SSE redirect feature is enabled and reachable by lower-trust input paths, with practical impact varying by operator configuration. Vendor-released patch 2026.6.5 is available; no public exploit code or active exploitation has been identified at time of analysis.

Output-handling discrepancy in the OpenRISC OR1200 soft-core CPU (commit 83ac6b) causes the CPU output port to differ between the RTL source and the synthesized netlist, producing unexpected hardware behavior. The flaw was surfaced by the academic SynFuzz hardware-fuzzing research (arXiv 2504.18812) rather than in-the-wild attacks, affects the open-source mor1kx/OR1200 core used mainly in research and FPGA/SoC prototyping, and has no public exploit identified at time of analysis. Assigned CVSS 9.1 (NVD/MITRE) but with a very low EPSS of 0.17% (6th percentile), reflecting a research-grade correctness finding rather than a mass-exploitation threat.

Denial-of-service via malformed TLS/QUIC ClientHello in h2o HTTP server allows remote unauthenticated attackers to crash the server process by sending a zero-length SNI extension. The hostname-copy routine assumes NULL-termination on the empty SNI buffer (CWE-125 out-of-bounds read), reading beyond the allocation boundary and triggering a segmentation fault. No public exploit or active exploitation (CISA KEV) has been identified; the fix is available as an upstream commit but no confirmed tagged release exists at time of analysis.

Out-of-bounds read in AutomationDirect Productivity Suite exposes kernel memory and system stability to a physically-present, low-privileged attacker via manipulated USB data length values. Exploitation can result in disclosure of sensitive kernel memory contents or a full system crash - both significant outcomes in an OT/ICS environment where availability and data integrity are critical. Reported by ICS-CERT under advisory ICSA-26-197-04, with no public exploit code or CISA KEV listing identified at time of analysis.

Out-of-bounds read in AutomationDirect Productivity Suite enables a local low-privileged attacker to corrupt kernel memory by submitting a crafted IOCTL request, resulting in high availability impact (system or application disruption) and limited kernel memory disclosure. The vulnerability affects all documented versions per the CPE wildcard and was reported by ICS-CERT, placing it squarely in the operational technology threat landscape where availability is mission-critical. No public exploit code and no CISA KEV listing exist at time of analysis, placing current exploitation risk as low but warranting prompt patching in industrial environments.

Crash-inducing out-of-bounds panic in core-rs-albatross 1.5.1 and earlier allows a malicious state-sync peer to repeatedly restart a syncing Nimiq node without supplying a valid cryptographic proof. The panic fires in `KeyNibbles::Add` before `proof.verify()` is reached, meaning an unauthenticated network peer positioned as the victim's sync source can trigger the denial-of-service with a single crafted `TrieChunk` message. No CISA KEV listing exists and no public exploit code has been identified at time of analysis.

Out-of-bounds read in AutomationDirect Productivity Suite exposes kernel memory and enables denial-of-service on engineering workstations via a crafted IOCTL request sent by a local low-privileged attacker. Affecting all versions per CPE wildcard, the CWE-125 flaw causes the vulnerable kernel-mode driver to read memory outside intended buffer bounds, leaking sensitive kernel contents or triggering a kernel panic (BSOD). Reported by ICS-CERT under advisory ICSA-26-197-04, no public exploit code or active exploitation has been identified at time of analysis.

Unhandled Go runtime panic in CoreDNS 1.9.4 through 1.14.4 allows a network-reachable DNS client with AXFR permission to crash the CoreDNS process via a zone transfer request, causing a denial of service against cluster DNS. The crash path is triggered only when the k8s_external plugin is configured for headless-service zone transfers and Kubernetes contains a headless service with no declared ports - a condition that causes an empty record batch to be forwarded to plugin/transfer/transfer.go, where an unchecked index access (records[0]) panics the Go runtime. No public exploit identified at time of analysis; the vendor fix is confirmed in v1.14.5.

Kernel heap corruption in the illumos data-link pseudo-driver (dld) allows an unprivileged local user - including one confined to a non-global zone that owns a datalink - to panic the system or potentially escalate privileges. The flaw in drv_ioc_prop_common() exploits a classic double-copyin TOCTOU race on the DLDIOC_GETMACPROP and DLDIOC_SETMACPROP ioctls: the kernel sizes its heap allocation from pr_valsize on the first copyin but re-reads the entire ioctl struct from the same user address a second time, allowing a concurrent thread to enlarge pr_valsize between the two reads and overflow the under-sized buffer. No public exploit code has been identified and the CVE is not listed in CISA KEV, but the upstream fix is confirmed by an illumos-gate commit.

Envoy Gateway's Wasm extension cache HTTP server (port 18002) can be crashed by a tenant-level attacker, causing a cross-tenant control-plane denial of service. The race condition in httpserver.go causes Go's runtime to call runtime.throw upon detecting an unsynchronized concurrent map access - a fatal signal that net/http's per-connection recover cannot intercept - terminating the entire controller process. While Kubernetes restarts the pod, all tenants sharing the controller lose control-plane availability during the restart window. No public exploit has been identified at time of analysis, but the four-condition precondition set is largely within baseline tenant capabilities.

Cross-tenant step-file disclosure in Activepieces before 0.83.0 allows any authenticated user on a shared instance to retrieve a workflow step-file attachment belonging to a different tenant by exploiting two compounding defects in the `/v1/step-files/signed` download endpoint: a missing JWT audience check and an unguarded null fileId that causes PostgreSQL to return an arbitrary FLOW_STEP_FILE record. Access is strictly read-only and non-targeted - the attacker cannot choose which tenant's file is returned, as the result depends on PostgreSQL's internal scan order at query time. No public exploit has been identified and no active exploitation is listed in CISA KEV; the vulnerability is patched in version 0.83.0.

TLS certificate verification bypass in Kuma's kumactl CLI tool allows network-adjacent attackers to intercept API tokens via man-in-the-middle attack. When an operator adds an HTTPS control plane profile without supplying --ca-cert-file, kumactl silently disables TLS verification (InsecureSkipVerify=true) and transmits API tokens over the unverified connection. A successful intercept grants the attacker the ability to impersonate the operator and issue privileged commands to the control plane. No public exploit identified at time of analysis; vendor-released patches are available.

Plaintext credential exposure in Frogman's audit logging pipeline allows any authenticated low-privilege user holding PERM_READ access to recover passwords and extension secrets set by administrative operations. Frogman versions prior to 1.6.2 encode full tool response payloads - including the plaintext password returned by fm_reset_password and the plaintext secret returned by fm_add_extension - directly into the oc_audit_log.detail column via auditOutcome in Frogman.class.php. Because fm_audit_search was gated only at PERM_READ rather than PERM_ADMIN, any read-tier caller could query historical audit entries and extract those credentials. No public exploit code or active exploitation has been identified at time of analysis; the CVSS score of 6.5 reflects the authenticated-but-low-privilege access requirement and high confidentiality impact.

Unintended sensitive data exposure in AWS Bedrock AgentCore Python SDK versions 1.4.8 and 1.5.0 allows any low-privileged IAM principal with CloudWatch Logs read access to retrieve verbatim user prompts and complete AI agent responses from the aws/spans log group. The SDK's OpenTelemetry instrumentation populates span attributes with raw conversational content on every invocation without filtering or masking, and these spans are automatically exported to CloudWatch, bypassing any application-layer data controls. No public exploit has been identified at time of analysis, but the exposure is systemic and requires no special tooling beyond standard AWS console or CLI access with logs read permissions; vendor-released patch version 1.5.1 is available.

SMM memory address disclosure in Lenovo laptop BIOS firmware exposes the location of protected System Management Mode (SMRAM) regions to a local privileged attacker. Dozens of Lenovo consumer, gaming, and business laptop product lines are affected across IdeaPad, Legion, Yoga, ThinkBook, LOQ, and V-series models. While the direct impact is confidentiality-only, SMRAM address disclosure is a classic prerequisite step in firmware-level attack chains that seek to bypass address-space protections and ultimately plant persistent SMM rootkits. No public exploit has been identified at time of analysis, and exploitation is not confirmed in CISA KEV.

Signature bypass in Janssen jans-auth-server's OIDC authorization request object processing allows unauthenticated remote attackers to submit JWE-wrapped authorization requests containing unsigned plain JSON payloads, circumventing the integrity guarantee that JAR (RFC 9101) is designed to enforce. Two distinct code defects enable the bypass: the server silently skips nested JWS validation when getSignedJWTPayload() returns null, and the forceSignedRequestObject enforcement fails to reject null-mapped algorithm identifiers such as RSA-OAEP (an encryption algorithm, not a signature algorithm). No public exploit code has been identified and the vulnerability is not listed in CISA KEV; it is fixed in version 2.0.0.

Out-of-bounds read in rz-libdemangle's Rust v0 demangler leaks process memory when a caller invokes the demangling routine before the internal rust_v0_t structure is properly initialized. All builds of the library prior to commit 6bf56d3 are affected, putting security analysts and reverse engineers who process untrusted Rust binaries through the Rizin framework at risk of memory disclosure. No confirmed active exploitation (not in CISA KEV) and no public exploit code has been identified at time of analysis; the fix is available as an upstream commit but a versioned release is not independently confirmed.

Use-after-free in Buffa's OwnedView<V> type allows safe Rust calling code to hold field references that outlive the backing buffer, enabling read of freed heap memory and information disclosure. Affected are all Buffa releases prior to 0.7.0 (CPE: cpe:2.3:a:anthropics:buffa:*:*:*:*:*:*:*:*). The flaw is a soundness violation - no unsafe code in the caller is required - making it particularly insidious in a memory-safe language context. No public exploit identified at time of analysis and no CISA KEV listing; the CVSS 4.0 score of 5.9 reflects the high-complexity exploitation conditions acknowledged by the vendor.

Insecure Direct Object Reference (IDOR) in Microsoft SimpleChat exposes any authenticated user's profile data to other authenticated users without authorization checks. The GET /api/user/info/<user_id> and GET /api/user/profile-image/<user_id> endpoints in route_backend_users.py accept a caller-supplied user_id and query the Cosmos DB user-settings document directly, bypassing object-level authorization - enabling enumeration of email addresses, display names, and profile images across the entire user base. No public exploit code has been identified at time of analysis, and the issue is not listed in the CISA KEV catalog; the vendor-released fix is version 0.241.203.

HCL DFXAnalytics exposes internal file system paths and directory structure through unhandled error messages, system logs, or debugging output rendered by the application dashboard. All versions are affected per the wildcard CPE, and the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms unauthenticated remote attackers can trivially trigger and read this disclosure with no special configuration. No public exploit code exists and the vulnerability is not listed in CISA KEV; however, the leaked path information materially aids reconnaissance for chained attacks against the underlying server environment.

Missing HSTS header in HCL DFXAnalytics exposes authenticated sessions to protocol downgrade and man-in-the-middle attacks by network-positioned adversaries. All versions per the CPE wildcard are affected, and the application fails to include the Strict-Transport-Security response header, leaving browsers without enforcement of HTTPS-only communication. No active exploitation has been identified (not in CISA KEV) and no public exploit code is known, consistent with the low CVSS score of 3.1.

Cross-Site Request Forgery exposure in HCL DFXAnalytics arises because session cookies generated during authentication are issued without the SameSite attribute, allowing browsers to attach them to cross-origin requests. An attacker who can lure an authenticated victim to a malicious page may issue forged state-changing requests that the server honors under the victim's identity, provided the application also lacks Anti-CSRF token validation - a condition the CVE description explicitly names as the decisive amplifying factor. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog; real-world risk is further constrained by modern browser defaults (Chrome 80+ and Firefox apply SameSite=Lax by default), high attack complexity, and the required user interaction.

Insecure symlink following in Canonical's ubuntu-pro-client `pro collect-logs` command allows a low-privileged local attacker to cause a root-executing diagnostic tool to read arbitrary root-owned files - including `/etc/shadow` - and bundle their contents into a support archive accessible to the attacker. All supported Ubuntu LTS releases from 16.04 through 26.04 are affected, as confirmed by Canonical's own advisory and CPE data spanning the full product history. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, but the attack primitive is trivially simple - standard Unix symlink creation - making exploitation straightforward once local access is obtained.

ubuntu-pro-client (formerly ubuntu-advantage-tools) leaks Ubuntu Pro bearer tokens to unprivileged local users via the Linux /proc filesystem on all supported Ubuntu LTS releases from 14.04 through 26.04. When the client validates APT credentials, it spawns /usr/lib/apt/apt-helper with the secret token embedded in a cleartext URL argument (https://bearer:<token>@esm.ubuntu.com/), which any local low-privileged user can read from /proc/<pid>/cmdline on default-configured systems. The stolen token enables unauthorized access to the victim's Ubuntu Pro ESM repositories. No public exploit has been identified at time of analysis, and this is not listed in CISA KEV.

HCL DFXServer permits client connections over plaintext HTTP, exposing all transmitted data to interception by any attacker with a man-in-the-middle position on the network path. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) confirms remote exploitation without authentication, contingent on a user initiating an HTTP session. No public exploit code exists and the vulnerability is not listed in CISA KEV, but the risk is structurally inherent to any deployment where HTTP remains permitted alongside or instead of HTTPS.

Use-after-free in ESET's Linux security product kernel components enables a local high-privileged attacker to trigger a kernel panic, causing a complete system crash and denial of service. Both ESET Endpoint Antivirus for Linux and ESET Server Security for Linux are affected across unspecified versions, per ESET's own customer advisory. No public exploit code has been identified and CISA has not added this to the Known Exploited Vulnerabilities catalog; however, server-deployed AV with kernel-level hooks makes the DoS impact operationally significant in production environments.

Sensitive information exposure in the List Category Posts WordPress plugin (all versions through 0.95.0) allows authenticated contributors to read non-public posts belonging to other users - including pending-review, scheduled, and trashed content with full body text, excerpts, authors, and custom-field metadata. Exploitation requires only a contributor-level account and the ability to embed the native [catlist] shortcode in a draft post, then preview it, triggering the flawed sanitize_status logic. This is a confirmed bypass of the incomplete authorization fix shipped in version 0.93.0 for CVE-2025-11377, indicating the root authorization flaw was never fully remediated. No public exploit code or CISA KEV listing is identified at time of analysis.

URLAUTH token forgery in Cyrus IMAP through 3.12.2 allows a network-based unauthenticated attacker to read the contents of a victim's mailbox folder by computing a forged authentication token using a predictable HMAC-SHA1 key. The predictability arises specifically when a victim has never issued a URLAUTH-authenticated URL for a given folder, leaving the per-folder mboxkey absent and thus falling back to a computable value. No public exploit code has been identified and no active exploitation has been confirmed; real-world impact is further constrained by URLAUTH being an obscure IMAP extension with negligible public client adoption.

Cyrus IMAP through version 3.12.2 fails to invalidate URLAUTH-minted URLs when the authorizer's access is subsequently revoked, allowing continued unauthorized access to delegated mailbox content. The flaw (CWE-672: Operation on Resource after Expiration or Release) affects the URLAUTH extension defined in RFC 4467, which is designed to let users grant third-party access to mailbox data without sharing credentials. No public exploit code exists and this vulnerability is not listed in CISA KEV; real-world risk is highest in environments with active IMAP delegation workflows where access revocation is security-critical, such as departing employee scenarios.

Cross-user information disclosure in Cyrus IMAP through 3.12.2 allows any authenticated IMAP user to enumerate folder names and retrieve message UIDs belonging to arbitrary other accounts via the ESEARCH command, creating a content oracle. The flaw (CWE-204, Observable Response Discrepancy) leaks mailbox structure - including folder names that may reveal sensitive organizational or personal context - without permitting reads of actual message content. No public exploit code has been identified at time of analysis, no CISA KEV listing exists, and the CVSS score of 4.3 reflects the authentication prerequisite and limited confidentiality impact, though risk is elevated in shared multi-tenant deployments such as ISPs and universities.

Cross-namespace information disclosure in open-feature-operator allows a tenant with workload creation privileges to read another tenant's FeatureFlagSource or InProcessConfiguration spec contents on multi-tenant Kubernetes clusters. The operator resolves references across namespace boundaries using a documented annotation syntax, leaking inline env vars, bearer tokens, and sync URIs into the attacker's pod. No public exploit has been identified, and the behavior is intentional but contradicts namespace-as-trust-boundary expectations.

Pixeldrain API key exfiltration in cyberdrop-dl-patched (versions 8.5.0 through 9.13.x) allows a network attacker who controls a lookalike domain (e.g., evil-pixeldrain.com) to receive the victim's Pixeldrain Authorization header when the tool processes a crafted URL. The root cause is substring-based host matching: any domain containing 'pixeldrain' as a substring is accepted as a valid Pixeldrain host, causing the tool to blindly send API credentials to attacker-controlled infrastructure. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, but the attack path is straightforward and fully described in the advisory.

Server-side request forgery (SSRF) in 9Router's Kiro API-key validation endpoint allows authenticated attackers to redirect outbound validation requests to an attacker-controlled host, exfiltrating the submitted Kiro API key via the Authorization header. Affected are all 9Router deployments prior to version 0.5.6 where the Kiro OAuth provider is configured. No public exploit code exists and the vulnerability is not listed in CISA KEV, but the attack is low-complexity once authenticated. Vendor-released patch is available in v0.5.6.

PostgreSQL password hash disclosure in NocoBase 2.0.59 and earlier allows an authenticated administrator to extract pg_shadow credential hashes and database metadata by submitting raw SQL queries that reference system catalog tables omitted from the checkSQL() keyword blacklist. The SQL Collection plugin's blocklist-based validation failed to restrict pg_shadow, pg_roles, pg_stat_activity, and information_schema, and the commit diff confirms the bypass also worked via subquery wrapping (e.g., SELECT * FROM (SELECT usename, passwd FROM pg_shadow) AS passwords). No public exploit identified at time of analysis, and this CVE is not listed in CISA KEV; a vendor-released patch is available in v2.1.0-alpha.46.

Non-persistent denial-of-service affecting Absolute Secure Access clients prior to version 14.55 can be triggered by an attacker who possesses intimate knowledge of and total control over the underlying tunnel protocol, yielding low availability impact limited to the client process. The CVSS 4.0 score of 2.3 reflects the highly constrained exploitation requirements captured by AT:P and UI:P - this is not opportunistic exploitation but a targeted, condition-heavy attack against a specific client. No active exploitation has been identified, no public exploit code exists, and the DoS is explicitly described as non-persistent, meaning the client recovers without lasting damage.

Memory disclosure in Absolute Security Secure Access client (versions prior to 14.55) permits a small, indeterminate amount of process memory to leak to an adversary who has already achieved full control over the tunnel protocol. The CVSS 4.0 score of 2.1 accurately reflects the narrow real-world impact: an attacker must simultaneously possess intimate protocol knowledge and the ability to manipulate tunnel communications end-to-end, a prerequisite that dramatically limits the exploitable population. No public exploit code exists and the vulnerability does not appear in the CISA KEV catalog, reinforcing its low operational priority for most enterprises.

Integer underflow in the traffic parsing function of Absolute Security Secure Access clients prior to version 14.55 enables a non-persistent denial-of-service condition against the client application. Exploitation demands the attacker possess intimate knowledge of the proprietary tunnel protocol AND maintain total control over that tunnel - an exceptionally high bar that drastically limits realistic attacker population. The impact is restricted to temporarily disrupting the Secure Access client on the victim endpoint; the service recovers without persistent damage. No public exploit code exists and this vulnerability is not listed in CISA KEV.

Integer underflow in Absolute Security's Secure Access client prior to version 14.55 allows an attacker with full control over the tunnel protocol to cause a non-persistent denial of service against the client. The exploitation bar is extremely high - the attacker must possess both intimate knowledge of the proprietary tunnel protocol and total control over the communication channel. No public exploit code exists and this vulnerability is not listed in CISA KEV; the vendor-reported CVSS 4.0 score of 2.1 reflects the negligible real-world risk.

Out-of-bounds read in TDengine's SQL tokenizer (versions prior to 3.4.1.14) allows an authenticated user with SQL query access to crash the database server and potentially leak one byte of adjacent heap memory. The flaw resides in tGetToken() within source/libs/parser/src/parTokenizer.c, triggered by submitting a SQL string literal ending in a bare backslash (e.g., 'abc\). No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.

Credential hash exposure in Splunk Enterprise and Splunk Cloud Platform allows low-privileged users - those without the 'admin' or 'power' roles - to retrieve stored credential hashes by issuing the `|rest` SPL command against the `/servicesNS/-/-/storage/passwords` endpoint, which incorrectly returns the `encr_password` field. Affected are Splunk Enterprise branches below 10.4.1, 10.2.5, 10.0.8, and 9.4.13, and multiple Splunk Cloud Platform versions. No public exploit has been identified at time of analysis and this CVE is not in CISA KEV, but the real-world impact is significant wherever Splunk stores credentials for external services such as databases, APIs, or cloud accounts.

Fullscreen mode in Zen Browser desktop prior to 1.19.13b exposes users to credential-theft phishing by failing to display a persistent, visible security notification when a webpage enters fullscreen. An attacker-controlled page can completely occlude the real browser chrome - including the address bar and origin indicators - then render a convincing imitation of a trusted site's login interface. When combined with long-domain URL eliding, this allows precise origin spoofing; no public exploit has been identified at time of analysis, and the CVSS 4.0 score of 6.3 reflects high subsequent-system integrity and confidentiality impacts despite the attack requiring user interaction.

Heap buffer over-read in NGINX Plus's MQTT filter module (ngx_stream_mqtt_filter_module) allows unauthenticated remote attackers to crash the NGINX worker process, causing a brief, recoverable service disruption. The vulnerability is data-plane only - no control plane exposure exists - and exploitation depends partly on runtime conditions outside the attacker's control, reflected by the CVSS 4.0 AT:P metric. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; F5 has released a patch documented in advisory K000162101.

Flameshot's 'Open With' feature prior to version 14.0.0 contains a TOCTOU (time-of-check to time-of-use) symlink-following race condition that allows a local unprivileged attacker on the same machine to overwrite arbitrary files writable by the victim user. By pre-planting a symlink at the predictable temporary file path before Flameshot writes the screenshot PNG, an attacker can redirect the write operation to any file within the victim's permissions - including configuration files, SSH keys, or application data. No public exploit identified at time of analysis, though the attack is straightforward given the deterministic path; the vendor-confirmed fix is available in v14.0.0.

Uncontrolled memory allocation in Huawei's vibration service crashes affected HarmonyOS and EMUI devices, resulting in a denial-of-service condition impacting device availability. The flaw is remotely triggerable with no privileges required but demands user interaction, consistent with delivery via crafted content such as a malicious application, webpage, or message that exercises the vibration API. No public exploit code or active exploitation has been identified at time of analysis, though Huawei has issued a July 2026 security bulletin addressing the issue.

Design defect in HarmonyOS's 'Expedition mode' allows a high-privileged local attacker, with user interaction, to cause significant availability disruption and minor integrity impact. Reported by Huawei in its July 2026 security bulletin, the vulnerability carries a CVSS 3.1 base score of 4.8, reflecting constrained exploitability due to local access, high privilege, and required user interaction. No public exploit code has been identified, and the flaw does not appear in the CISA KEV catalog. Notably, the 'Information Disclosure' tag associated with this CVE is inconsistent with the CVSS confidentiality metric of C:N - this discrepancy should be verified against the vendor advisory.

Permission control bypass in the Settings module of Huawei HarmonyOS and EMUI exposes sensitive service data to unauthorized local actors. A locally-installed application without elevated privileges can exploit the flaw (CWE-200) during user interaction with the Settings UI to read confidential configuration or service data - with a CVSS-rated High confidentiality impact (C:H). No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.

Memory leak in ImageMagick's TIFF encoder - affecting the 7.x branch before 7.1.2-26 and the 6.x branch before 6.9.13-51 - allows an attacker or application to cause gradual memory exhaustion by repeatedly supplying an invalid tiff:tile-geometry parameter during TIFF encoding operations. The flaw scores 2.0 under CVSS 4.0 with only low availability impact, a local attack vector, high complexity, and prerequisite conditions, placing it firmly in the low-severity tier. No public exploit code has been identified and the vulnerability is absent from the CISA KEV catalog, indicating no confirmed active exploitation at the time of analysis.

ImageMagick's hough lines operation leaks a small amount of memory when a specific internal sub-operation fails, affecting the 7.x branch before 7.1.2-26 and the 6.x legacy branch before 6.9.13-51. This CWE-401 flaw is locally exploitable only under high attack complexity with specific prerequisites, producing a low availability impact with no confidentiality or integrity consequence - reflected in the CVSS 4.0 score of 2.1. No public exploit or active exploitation has been identified at time of analysis; this is a low-priority maintenance patch with no realistic threat-actor motivation.

ImageMagick's log colorspace color transformation leaks a small amount of memory when the operation fails, affecting versions prior to 7.1.2-26 and 6.9.13-51. The flaw (CWE-401) resides in an error-handling code path that fails to release allocated memory, meaning repeated invocations that trigger failures could contribute to incremental memory exhaustion. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified; the CVSS 4.0 score of 2.1 reflects the highly constrained and low-impact nature of this issue.

ImageMagick's TIFF encoder leaks a small quantity of memory when a temporary file cannot be created during encoding operations, affecting versions 7.x before 7.1.2-26 and 6.x before 6.9.13-51. The CVSS 4.0 score of 2.1 and vector (AV:L/AC:H/AT:P) place this firmly in minimal-severity territory: exploitation is local, requires high complexity, and depends on a platform-specific precondition. No public exploit has been identified, the flaw is not listed in CISA KEV, and the described impact is limited to a small, incremental availability reduction with no confidentiality or integrity consequences.

ImageMagick before 7.1.2-26 (7.x branch) and 6.9.13-51 (6.x branch) discloses one byte of process memory beyond a profile boundary when the `identify` command is run with debug output enabled and the embedded profile ends with a non-printable byte. The out-of-bounds read (CWE-125) is highly conditional - requiring local access, explicit debug mode activation, and a specifically crafted profile payload - keeping real-world impact extremely low despite ImageMagick's broad deployment footprint. No public exploit code or active exploitation has been identified at time of analysis.

Insufficient session invalidation in the Grav API plugin (getgrav/grav-plugin-api) before 2.0.4 renders stolen JWT access tokens permanently valid for up to one hour post-compromise. Because tokens are issued without a jti (JWT ID) claim, the server retains no mechanism to selectively revoke them - meaning logout events, password resets, new token issuance, and even account disablement are all ineffective at terminating an active attacker's session. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis; however, the CVSS 4.0 vector (AV:N/AC:L/PR:N) reflects that any attacker already in possession of a token can trivially exploit this revocation gap over the network.

PraisonAI's MCP HTTP-stream transport silently skips authentication when no API key is configured at startup, allowing unauthenticated clients to initialize sessions, enumerate tools via tools/list, and invoke arbitrary tools via tools/call. Affected versions are all releases before 4.6.78. Compounding this, the dispatcher passes tool-call arguments directly to handlers without validating them against the advertised inputSchema, meaning a client can supply malformed or out-of-schema arguments to any registered tool. No public exploit code or CISA KEV listing has been identified at the time of analysis.

Unauthorized external secret disclosure in n8n before 2.28.1 allows authenticated project editors to read plaintext secret values from external secret managers by embedding references in workflow node expressions. The flaw bypasses the intended access control model: users with project editor roles - who are not granted explicit secrets access permissions - can nonetheless resolve and exfiltrate secrets via expression syntax. No public exploit or active exploitation has been identified, but the CVSS 4.0 vector assigns SC:H (high confidentiality impact on subsequent systems), reflecting that secrets stored in downstream vaults or secret managers are fully exposed to insufficiently privileged users.

Credential inference via timing side-channel is possible in Hono before 4.11.10 when the built-in `basicAuth` or `bearerAuth` middlewares are in use, due to JavaScript's short-circuit `===` string equality operator being used inside the `timingSafeEqual` function for hash comparison. Because `===` terminates on the first differing character, response times vary slightly based on how many leading characters of a credential match the stored hash, enabling an attacker to recover credentials one character at a time through statistical timing analysis. No public exploit has been identified and the vendor GHSA advisory explicitly characterizes this as a hardening improvement with low practical exploitability outside highly controlled, low-jitter network environments.