Information Disclosure

Password reset token exposure in phpMyFAQ before 4.1.7 enables unauthenticated account takeover by reading a publicly accessible, date-stamped tracking file. When user tracking is enabled, the application writes password reset tokens to content/core/data/trackingDDMMYYYY without access controls, allowing any network attacker to retrieve the file and replay the token against the reset API. No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack path is low-complexity once the preconditions are met.

Unauthenticated information disclosure in Citrix NetScaler ADC and NetScaler Gateway (versions 14.1 before 73.32 and 13.1 before 63.21) allows remote attackers to access sensitive data over the network without credentials or user interaction. The CVSS 4.0 base score of 9.3 reflects network-reachable, low-complexity exploitation with high impact to the vulnerable appliance; no public exploit identified at time of analysis and no CISA KEV listing is present in the provided data. Because NetScaler Gateway is typically internet-facing, exposed data such as session material could enable follow-on account or session takeover.

Local File Inclusion in the Resido WordPress theme (versions 1.5 and below) allows unauthenticated remote attackers to include arbitrary files server-side via unsanitized PHP include/require logic. The CVSS 3.1 score of 8.1 with full Confidentiality, Integrity, and Availability impact reflects the potential for sensitive file disclosure, server-side code execution via log poisoning or similar LFI chaining techniques, and service disruption - though the High Attack Complexity metric signals that reliable exploitation requires specific preconditions. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.

Sensitive data exposure in the Track Geolocation Of Users Using Contact Form 7 WordPress plugin (versions <= 3.0.2) permits remote unauthenticated attackers to retrieve geolocation records collected from Contact Form 7 form submissions with no credentials or user interaction required. The vulnerability is rooted in CWE-201 - sensitive information returned in responses to unauthorized parties - yielding high confidentiality impact consistent with the CVSS vector (C:H/I:N/A:N). No public exploit code has been confirmed and the CVE does not appear in CISA KEV at time of analysis, though the trivial attack prerequisites (AV:N/AC:L/PR:N/UI:N) mean that exploitation would be straightforward once the plugin's vulnerable endpoint is identified.

Unauthenticated sensitive data exposure in the CMSMinds Pay with Contact Form 7 WordPress plugin (versions through 1.0.4) allows remote, unauthenticated attackers to retrieve sensitive information - likely payment-related or personal contact data - without any credentials or user interaction. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms a fully network-accessible attack path requiring zero privileges, yielding high confidentiality impact. No public exploit or CISA KEV listing has been identified at time of analysis.

Privilege management regression in FreeBSD 15.x ktrace(2) allows an unprivileged jail user to manipulate or suppress the jailed root user's kernel tracing configuration. Because an unrelated code change inadvertently causes PRIV_KTRACE to always be denied to jailed root, that user's active trace sessions are not marked as privileged - permitting any jail user holding debug rights over a traced process to alter or clear those trace flags. No public exploit has been identified and the EPSS score of 0.18% (8th percentile) reflects negligible opportunistic exploitation probability, though multi-tenant jail environments relying on ktrace for security auditing face a meaningful auditability risk.

Timing side-channel in Net::OAuth before 0.33 for Perl allows remote unauthenticated attackers to recover valid signatures byte-by-byte by measuring server response latency during signature rejection. For HMAC-SHA1 and HMAC-SHA256 methods the oracle yields a forged HMAC token; under the PLAINTEXT signature method the comparison is performed directly against the signature key, meaning the timing oracle exposes the raw consumer_secret and token_secret. No public exploit has been identified at time of analysis and EPSS is 0.17% (6th percentile), but the PLAINTEXT credential-exposure path is theoretically severe for any deployment relying on that method.

Signature-verification bypass in the Net::OAuth Perl module before 0.33 lets a remote attacker forge valid OAuth requests for any consumer key and token by dictating which algorithm the Service Provider uses to check their signature. Because verify() resolves the signature-method class from the attacker-supplied signature_method parameter and offers no way to pin an expected method, a provider deployed on RSA-SHA1 (which holds only the consumer's public key) can be tricked into validating an HMAC-SHA1 signature against a placeholder/guessable consumer_secret. No public exploit has been identified at time of analysis and EPSS is low (0.11%), but the flaw is unauthenticated and network-reachable (CVSS 9.8).

Unauthenticated path traversal in the Simple File List WordPress plugin (versions through 6.3.11) exposes an unvalidated file-move endpoint accessible without authentication, enabling arbitrary server file reads and displacement of critical WordPress files outside the web root. Remote attackers can exfiltrate sensitive data such as wp-config.php database credentials and secret keys, and can displace core WordPress files to cause site failure or enable site takeover. No public exploit code has been identified at time of analysis, but the CISA SSVC framework rates the attack as automatable with no privileges required, elevating real-world risk despite a low current EPSS score.

Missing capability checks in the Advanced File Manager WordPress plugin (before 5.4.13) allow any authenticated user holding administrator-delegated file-manager access - as low as Subscriber - to read arbitrary server files including wp-config.php and to overwrite existing non-PHP files, creating a direct path to full WordPress site compromise. The CVSS 8.5 score with a scope-changed vector reflects the severity of that impact, while AC:H captures the critical prerequisite: an administrator must explicitly grant file-manager access to low-privileged roles before exploitation is possible. No public exploit has been identified at time of analysis, and a vendor patch is available in version 5.4.13.

Path containment bypass in FreeBSD's unlinkat(2) and funlinkat(2) syscalls allows a local low-privileged process to delete files outside its intended directory scope. The kernel validates AT_RESOLVE_BENEATH but silently discards it before handing off to the path resolution layer, making the flag a no-op security guarantee. Applications using this flag as a sandbox boundary for file deletion operations are exposed to unintended tree traversal, with impact on both filesystem integrity and availability. No public exploit code and no CISA KEV listing have been identified; EPSS is 0.13% (3rd percentile), indicating low observed exploitation probability.

Local privilege escalation in FreeBSD's execve(2) syscall allows an unprivileged local user to gain full root-level control by exploiting a TOCTOU race condition (CWE-367) in SUID binary execution. During the narrow window between virtual address space installation and credential elevation, the kernel's procfs permission check still evaluates the original (unprivileged) credentials, allowing a racing process to write to the target's memory via /proc/[pid]/mem or linprocfs. Confirmed affected versions span FreeBSD 14.3, 14.4, 15.0, and 15.1; EPSS is low at 0.12% (2nd percentile), no KEV listing, and no public exploit identified at time of analysis, though the primitives for this class of attack are well-understood.

Reference count underflow in FreeBSD's jail subsystem allows an unprivileged local user to double-free a prison structure, yielding two distinct impact paths: on the jail host, this reliably causes an immediate kernel panic, while a user already running inside a jail may be able to exploit the freed structure while still in use to escape the jail and elevate privileges to the host. Affected releases are FreeBSD 15.0-RELEASE before patch level 11 and FreeBSD 15.1-RELEASE before patch level 1, per FreeBSD Security Advisory SA-26:38. EPSS is currently 0.16% (5th percentile) and SSVC classifies exploitation as 'none', suggesting no observed in-the-wild activity, but SSVC technical impact is rated 'total', reflecting the severity of the jail-escape scenario.

Man-in-the-middle exposure in LINE's Armeria (armeria-xds module) versions prior to 1.41.0, where TLS peer (certificate) verification on xDS-managed upstream connections can be silently disabled, causing the client to trust unauthenticated or spoofed upstreams. Any attacker positioned on the network path between an armeria-xds client and its xDS-configured upstream service can intercept, read, and tamper with traffic that operators believe is protected by TLS. Reported by LY-Corporation; no public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Non-constant-time password hash comparison in Relay's authentication layer exposes a timing side-channel that allows credential inference via statistical analysis of response latencies. Attackers who can issue repeated authentication requests and measure response timing with sufficient precision can progressively reconstruct valid hashes or credentials byte-by-byte. No KEV listing exists and no public exploit has been identified at time of analysis, though timing oracle attacks of this class are well-understood with established methodology and tooling.

Unvalidated protocol forwarding in Streambert's open-external IPC handler (src/ipc/downloads.js) allows a compromised renderer to pass arbitrary URIs - including file: and OS-registered custom schemes - directly to shell.openExternal, enabling local file access, invocation of system protocol handlers, and potential script execution on the host OS. All Streambert versions prior to 2.6.0 are affected. No public exploit identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.

Sandbox escape in Streambert Desktop App (all versions prior to 2.6.0) allows a compromised renderer process to pass an arbitrary local file path - including executables, scripts, or OS shortcuts - to Electron's shell.openPath, causing the host OS to launch the file with the StreamBERT main process's privileges. The vulnerable IPC handler open-path-at-time in src/ipc/player.js accepted renderer-supplied filePath values with no type checking, extension filtering, or real-path validation, making the fallback to shell.openPath an unrestricted local code-execution primitive. No CISA KEV listing and no public exploit code have been identified at time of analysis; the patch and fix commit are publicly available on GitHub.

Unauthenticated information disclosure in Oracle Helidon 4.5.0's Imperative Web Server component exposes complete application data to remote network attackers via HTTP. Tagged as an authentication bypass, the flaw allows any unauthenticated actor with network access to read critical or all Helidon-accessible data without any privileges or user interaction. No patch version has been independently confirmed beyond the Oracle CPU August 2026 advisory, and no active exploitation has been identified at time of analysis.

Unauthenticated confidentiality breach in Oracle Helidon 3.2.18's Imperative Web Server component exposes all accessible data to remote attackers over HTTP. Tagged as an authentication bypass, this flaw requires no credentials, no user interaction, and no special network positioning - any attacker with HTTP access to a vulnerable instance can read critical application data. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and zero-authentication requirement make this straightforward to exploit opportunistically.

Unauthenticated remote data exposure in Oracle Helidon 3.2.18's Imperative Web Server component allows network attackers to bypass authentication and gain complete access to data served by the application via HTTP. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no credentials, user interaction, or special access are required, and Oracle's own advisory characterizes the vulnerability as 'easily exploitable.' No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis, but the authentication bypass nature paired with a High confidentiality impact warrants prompt remediation.

Authentication bypass in Oracle Hyperion Financial Management 11.2.25.0.000 allows unauthenticated, network-adjacent attackers to fully read and manipulate sensitive financial consolidation data without any credentials. The affected component is HFM's Security subsystem, and exploitation requires only adjacency to the physical or logical network segment hosting the application - no user interaction or privileges needed. No public exploit code and no CISA KEV listing exist at time of analysis, though the low attack complexity makes this straightforward to exploit for any attacker achieving network adjacency.

Unauthorized data disclosure in Oracle Hyperion Financial Management 11.2.25.0.000 allows low-privileged network attackers to bypass security controls and gain complete access to sensitive financial data via HTTP. Tagged as an Authentication Bypass in EUVD-2026-61889, the flaw carries a CVSS scope change indicator meaning successful exploitation can extend confidentiality impacts to additional Oracle Hyperion products sharing the same environment. No public exploit code or CISA KEV listing has been identified at time of analysis, though Oracle's own designation of this as 'easily exploitable' and the low attack complexity are meaningful risk signals for organizations running this financial consolidation platform.

Oracle Unified Directory (OUD) versions 12.2.1.4.0 and 14.1.2.1.0 expose a network-accessible LDAP authorization bypass that enables a low-privileged authenticated attacker to gain unauthorized access to critical or complete directory data. Intelligence sources tag this as an authentication bypass in the OUD Core component, with confirmed scope change impact on additional Oracle Fusion Middleware products consuming OUD identity data. No active exploitation confirmed at time of analysis and no public exploit code has been identified; however, the low attack complexity and network accessibility make this a credible priority for Oracle Fusion Middleware environments.

Full server takeover in Oracle WebLogic Server Core component is achievable by unauthenticated remote attackers via the T3 and IIOP protocols, affecting versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Successful exploitation yields complete compromise of confidentiality, integrity, and availability of the targeted server instance. No public exploit has been identified at time of analysis, and exploitation is constrained by high attack complexity; however, WebLogic's T3/IIOP surface has a well-established history of critical deserialization exploits that warrants prioritized patching.

Oracle Outside In Technology 8.5.8 is susceptible to a local exploitation path that results in complete system takeover, affecting all three security pillars - confidentiality, integrity, and availability. The attack requires an unauthenticated adversary with logon access to the host infrastructure and human interaction from a separate user to trigger the vulnerable code path, placing this in the category of local privilege-escalation or malicious-file-processing attacks. No public exploit has been identified at time of analysis, but the severity of the impact (full takeover) and low attack complexity warrant prioritized patching per the Oracle CPU August 2026 advisory.

Full system takeover is possible in Oracle Outside In Technology 8.5.8 via a locally-delivered malicious document that exploits a flaw in the Outside In Core parsing component. An unauthenticated attacker who can induce a local user to open or process a crafted file can achieve complete compromise of confidentiality, integrity, and availability on the host. No public exploit has been identified at time of analysis, but the low attack complexity and broad CIA impact make this a credible priority for Oracle enterprise environments.

Unauthenticated remote data exposure in Oracle Hyperion Infrastructure Technology version 11.2.25.0.000 allows any network-accessible attacker to read critical or all data managed by the platform via HTTP, without any credentials or user interaction. The Lifecycle Management component contains an authentication bypass (per vendor tags) that collapses access controls entirely, exposing sensitive enterprise performance management data. No public exploit or CISA KEV listing is confirmed at time of analysis, but the low-complexity, zero-privilege CVSS vector indicates straightforward exploitability for any attacker with network reach.

Credential and 2FA-secret disclosure in the Froxlor hosting control panel (versions before 2.3.8) lets an authenticated API caller retrieve password hashes and Base32 TOTP seeds through the Customers, Admins, and Ftps API commands. The affected get()/listing() endpoints run full-row queries (SELECT *) and return the raw rows via $this->response(...) without stripping the password, type_2fa, or data_2fa fields. A detailed proof-of-concept exists (curl calls plus a Python TOTP-code generator); there is no public exploit identified as being used in active attacks and the issue is not in CISA KEV.

Elevation of privileges in Dell Alienware Command Center (AWCC) versions prior to 6.14.20.0 allows a low-privileged local user to gain higher system access by exploiting a Least Privilege Violation (CWE-272). The application operates with or invokes components carrying excessive privileges, which a local attacker can abuse through an interaction-dependent trigger to achieve full confidentiality, integrity, and availability impact on the affected host. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the full C:H/I:H/A:H triad indicates complete system compromise potential if the privilege boundary is crossed successfully.

Unauthenticated remote information disclosure in SJRC F11 SJ-GPS-PRO drone firmware (build 2019-09-17) exposes sensitive data through the tcp_actions() function over an open TCP service. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms that any network-reachable attacker, requiring no credentials or user interaction, can trigger the vulnerable function and retrieve sensitive device information. No public exploit or CISA KEV listing has been identified at time of analysis, though a researcher GitHub repository linked in references may contain disclosure details or proof-of-concept material.

Uncontrolled decompression in Malcolm's upload-processing pipeline allows any authenticated user with upload permissions to exhaust the shared Docker volume by submitting a single-stream compression bomb (.gz, .bz2, .xz, .lzma, .lz). The flaw in scripts/safe-extract.py is a logic gap: entry-count, nesting-depth, and total-uncompressed-byte guards exist for container formats (zip/tar/rar/7z via libarchive) but are entirely absent for single-stream formats, allowing unbounded expansion. Successful exploitation denies service to all platform users simultaneously by starving OpenSearch, Logstash, Arkime, and Zeek of shared disk. No public exploit or CISA KEV listing has been identified at time of analysis; however, the attack is conceptually trivial once the bypass is known.

Out-of-bounds read with unbounded memory allocation in the surfio Python/C++ library affects all versions prior to 0.0.19, where the Irap ASCII and binary surface-file parsers trust attacker-controllable ncol/nrow size fields in the header without validating them against the actual input length. A remote attacker who can supply a crafted .irap file to an application that parses it - the vendor explicitly rates severity assuming surfio runs in a networked service - can trigger a memory over-read and force allocation of tens of megabytes from a single tiny value, causing information disclosure or denial of service. No public exploit identified at time of analysis; the issue is fixed in 0.0.19.

Tar extraction path traversal in moby/go-archive allows an attacker who controls archive contents to create or overwrite files outside the intended destination directory, undermining container-to-host filesystem boundaries. The affected functions - Unpack, UnpackLayer, Untar, UntarUncompressed, and ApplyLayer - perform lexical path validation but rely on OS-level resolution at operation time, meaning symlinks introduced inside the archive redirect writes to arbitrary paths writable by the extracting process. This flaw propagates through the full Docker ecosystem including Docker Engine, Docker Desktop, Docker CLI, Docker Compose, and Docker Sandboxes; vendor-released patches are available and no public exploit code has been identified at time of analysis.

Absolute path traversal in NVIDIA Triton Inference Server for Linux (versions 0.0 through 26.05) lets remote unauthenticated attackers reference filesystem paths outside intended directories, per NVIDIA's own advisory. NVIDIA states a successful exploit may lead to information disclosure and potentially code execution. No public exploit has been identified at time of analysis, and EPSS is low at 0.41% (34th percentile).

Cache poisoning in Uber Kraken, an open-source peer-to-peer Docker registry, allows malicious peers or on-path attackers to inject attacker-chosen container image layers and manifests into the content-addressable cache. Because agents validate downloaded pieces only with CRC32 checksums - which are trivially forgeable - and never confirm the reassembled blob against its requested SHA-256 digest before commit, substituted content is accepted, re-seeded to the swarm, and executed by other hosts, yielding fleet-wide integrity compromise and downstream code execution. No public exploit identified at time of analysis; the issue is tracked in vendor GitHub issue #638 and a VulnCheck advisory, with a CVSS 4.0 base score of 9.1.

Incorrect privilege assignment in the Berkeley Out-of-Order Machine (BOOM) RISC-V processor implementation - specifically the v3 and v4 Non-Blocking Data TLB (NBDTLB) - allows a local, low-privileged attacker to bypass memory access controls. The flaw arises because the raw mstatus.SUM bit participates in read/write permission decisions without a corresponding validity check on satp.MODE at the use site, meaning the SUM-based access relaxation may apply even when paging is inactive (Bare mode). A proof-of-concept repository is publicly referenced, though no active exploitation (CISA KEV) has been recorded; EPSS sits at 0.21%, consistent with a research-grade target.

Symlink following vulnerability across nine Dell enterprise storage and infrastructure products enables a locally authenticated, low-privileged attacker to elevate their privileges, potentially achieving full system compromise (C:H/I:H/A:H). Affected platforms span Dell AppSync 4.6.0.0, Metro Node 8.0.0, UCC Edge 3.0.1, VxRail 8.0.322, PowerMax 10.3.0, Unity 5.4, PowerFlex Manager 4.5.4, PowerFlex Intelligent Catalog 46.377.00 and 46.382.00, and PowerFlex Rack 4.5.4 and prior. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog at time of analysis, but the breadth of affected Dell enterprise products and the high-impact CVSS metrics make patching a priority for organizations running Dell storage infrastructure.

Cross-dataset authorization bypass in GeoLens prior to 1.2.3 allows unauthenticated network callers and low-privileged authenticated users to read private dataset content - including vector tile geometries, raster pixels, backing-table rows, column schemas, and sampled values - that they have no access to. The root flaw is a consistent pattern across six distinct endpoints: the API authorizes the resource named in the URL but fails to re-authorize a second, caller-influenced dataset reached through a relationship, layer reference, VRT mosaic, or request body. No public exploit has been identified at time of analysis, but the most severe findings require zero authentication, making them trivially exploitable by any network-reachable caller.

Account takeover in Red Hat Build of Keycloak allows an unauthenticated attacker to abuse the reset-credentials flow in the keycloak-services component to complete a password reset for any user without ever clicking the emailed verification link, letting them directly set new credentials. Because the mandatory email-ownership check can be bypassed, the flaw yields full control of arbitrary accounts (CVSS 9.1). No public exploit identified at time of analysis, and it is not listed in CISA KEV.

AES-GCM nonce reuse in ePA3-Service-OpenSource (all versions prior to 1.3.0) allows a network-positioned attacker to recover plaintext patient health records and forge authenticated VAU protocol messages. The frozen `request_counter` in `VAUProtokoll.py` causes every outgoing message to be encrypted under the same nonce-key pair, breaking AES-GCM's fundamental security guarantee. No public exploit code is confirmed at time of analysis, but the underlying Joux forbidden attack is well-documented in cryptographic literature, and the affected data - Germany's national electronic patient records - carries exceptional regulatory and clinical sensitivity.

TLS certificate verification is globally disabled in fbeta-GmbH's ePA3-Service-OpenSource prior to version 1.3.0, exposing all traffic between the integration service and Germany's electronic patient record system and Konnektor devices to interception by network-positioned attackers. Both the primary TLS layer - via hardcoded `verify=False` in Python requests sessions across two independent modules - and the VAU protocol's application-layer certificate validation are broken simultaneously, eliminating all cryptographic trust anchors with no defense-in-depth fallback. On the Konnektor communication path, an impersonating attacker can additionally capture the client's mutual TLS certificate exchange and observe smartcard operations. No public exploit or CISA KEV listing exists at time of analysis.

TLS/VAU man-in-the-middle in fbeta GmbH's ePA 3.x Integration (ePA3-Service-OpenSource) before 1.3.0 lets an on-path attacker impersonate the VAU server for Germany's electronic patient record (ePA). Because app/vau/VAUProtokoll.py validates the signed_vau_server_pub_keys and AUT_VAU_CertData chain against attacker-suppliable material (a circular trust relationship) and TLS certificate verification is additionally disabled, an attacker between the DiGA backend and the ePA system can negotiate the session keys and read or alter all encrypted VAU traffic, including Medical Information Objects. CVSS 9.1; no public exploit identified at time of analysis, though the upstream fix commit and PR are public.

Excessive ClusterRole permissions on the managed-serviceaccount addon-manager pod in Red Hat Advanced Cluster Management for Kubernetes 2 allow a compromised addon-manager to read secrets across every namespace and approve arbitrary Certificate Signing Requests, resulting in cluster-wide information disclosure and privilege escalation. The CVSS scope-change (S:C) reflects that a single compromised pod can affect the entire Kubernetes cluster, not just the addon namespace. No public exploit code or active exploitation via CISA KEV has been confirmed at time of analysis.

Unvalidated Class.forName() with initialization enabled in RabbitMQ Java Client's JSON-RPC tooling allows a network-positioned attacker to trigger arbitrary static initializers in the victim JVM. Applications using com.rabbitmq:amqp-client before 5.33.0 that employ the JsonRpcClient class are exposed when an attacker can control or spoof the system.describe broker response - either as a co-tenant on a shared broker or via network interception. Successful exploitation achieves code-like effects through static initializer execution and a secondary type-confusion path via mapper.parse, with full confidentiality, integrity, and availability impact on the client process. No public exploit identified at time of analysis, and this CVE is not listed in CISA KEV.

Environment variable inheritance in CodeWhale's js_execution tool prior to version 0.8.64 allows crafted JavaScript payloads to read the full parent process environment via process.env, exposing API keys, cloud credentials, and authentication tokens to the model context. The affected codebase is a Rust TUI AI coding assistant whose Node.js child process spawning failed to sanitize the environment before execution. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor patch is available via GitHub advisory GHSA-h539-c7r8-3xq4.

CSV injection (CWE-1236) in Brainstorm Force SureForms versions ≤ 2.1.1 enables remote unauthenticated attackers to embed spreadsheet formula directives inside user-controlled form field names, which are written unsanitized into CSV exports generated by administrators. When a site admin exports form submissions and opens the resulting file in a vulnerable spreadsheet application such as Microsoft Excel or LibreOffice Calc, the embedded formulas execute in the context of that administrator's workstation. A public proof-of-concept is available on GitHub; however, EPSS sits at 0.34% (27th percentile) and this CVE is not in the CISA KEV catalog, suggesting limited real-world exploitation to date.

Multiple broken object-level authorization flaws in Hoppscotch's GraphQL backend allow any authenticated workspace member to read co-members' private API request history, active session data, authorization headers, stored credentials in environment variables, and application settings - and to mutate or delete victims' history entries without ownership validation. All self-hosted and applicable SaaS deployments running versions prior to 2026.6.0 are affected. No public exploit code or CISA KEV listing has been identified, but the low attack complexity combined with high confidentiality impact makes this a material risk in any multi-user workspace deployment.

Global SSL/TLS certificate verification is silently disabled across all puma web process outbound connections in Mastodon when LDAP authentication is configured with LDAP_TLS_NO_VERIFY=true, enabling man-in-the-middle interception of federation traffic, API callbacks, and media fetches. Affecting versions prior to 4.4.19 and 4.5.0 through 4.5.11, the root cause is a Ruby object mutation defect: calling .tap directly on the shared global OpenSSL::SSL::SSLContext::DEFAULT_PARAMS constant (rather than a .dup copy) permanently sets VERIFY_NONE for the entire puma process lifetime, not just the LDAP connection. No public exploit identified at time of analysis, but the exact one-line fix is visible in the public commit diff, making the vulnerability trivially reproducible.

Unauthenticated Local File Inclusion in the Restaurant Menu by MotoPress WordPress plugin (versions ≤ 2.4.11) exposes WordPress deployments to arbitrary local file disclosure and potential remote code execution via PHP file-inclusion chains. The CVSS vector (AV:N/AC:H/PR:N/UI:N) confirms network exploitation requires no authentication or user interaction, though the high-complexity rating indicates specific server-side conditions or path knowledge are needed to reliably trigger the flaw. No confirmed active exploitation appears in CISA KEV and no public exploit code has been identified at time of analysis.

Broken authentication in MWB HubSpot for WooCommerce versions 1.6.7 and earlier allows subscriber-level authenticated WordPress users to bypass access controls and invoke functionality reserved for higher-privileged roles. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H) places the primary impact on availability (High), with limited integrity impact and no confirmed confidentiality exposure - notable given the 'Information Disclosure' tag applied by Patchstack, which is not reconciled by the official scoring. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.

Broken authentication in the Popup by Supsystic WordPress plugin (versions <= 1.13.0) lets remote unauthenticated attackers bypass authentication controls to tamper with plugin state, per the CVSS 3.1 vector (I:H/A:H). Reported by Patchstack with a CVSS base score of 9.1; no public exploit is identified at time of analysis and it is not listed in CISA KEV. Note the vendor tag labels it 'Information Disclosure' even though the CVSS vector sets C:N, a discrepancy defenders should verify.

Remote File Inclusion in the Easy Google Maps WordPress plugin (versions below 1.14.2) by Supsystic exposes unauthenticated remote attackers to include arbitrary external files into the server-side execution context with no credentials or user interaction required. The CVSS scope change (S:C) indicates impact extends beyond the plugin itself to the broader WordPress installation, enabling limited confidentiality and integrity compromise. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the zero-prerequisite attack surface makes this a meaningful priority for any site running the affected plugin.

Broken authentication in SupportCandy WordPress plugin versions up to and including 3.5.1 allows unauthenticated remote attackers to bypass access controls and invoke privileged plugin functionality without credentials. The vulnerability, rooted in CWE-266 (Incorrect Privilege Assignment), exposes customer support ticket data - potentially including personally identifiable information - to any external party with network access to the site. No public exploit code or CISA KEV listing has been identified at time of analysis, though the zero-authentication, low-complexity attack path makes exploitation trivial against any unpatched installation.

Unauthenticated broken authentication (CWE-288) in the Ezoic WordPress plugin versions 2.22.11 and earlier allows remote attackers to bypass authentication via an alternate path or channel, resulting in high confidentiality impact. The CVSS vector (AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:N) confirms network-based exploitation requiring no credentials, no user interaction, and low attack complexity, consistent with the 'Information Disclosure' tag applied by Patchstack. No public exploit or CISA KEV listing has been identified at time of analysis.

Sensitive data exposure in the Duitku Payment Gateway WordPress plugin (versions up to and including 2.11.14) allows unauthenticated remote attackers to retrieve sensitive information without any credentials or user interaction. The vulnerability, classified under CWE-497, stems from the plugin failing to restrict access to system or operational data that should be shielded from public consumers. Reported by Patchstack, this flaw carries a CVSS 7.5 High rating driven entirely by confidentiality impact, with no public exploit or CISA KEV listing identified at time of analysis.

Local File Inclusion in the Theme Test Drive WordPress plugin (versions <= 2.9.1) enables unauthenticated network-based attackers to supply arbitrary file paths to the theme preview mechanism, potentially exposing sensitive server files such as wp-config.php and - under certain server configurations - escalating to remote code execution via log poisoning or similar chaining techniques. The vulnerability is classified under CWE-98 (PHP File Inclusion) with a CVSS 8.1 score reflecting no authentication requirement but elevated attack complexity. No public exploit code or CISA KEV listing has been identified at time of analysis.

Remote Local File Inclusion in Vavo Core WordPress plugin versions 2.3.0 and earlier enables unauthenticated network-based attackers to include arbitrary local files from the server filesystem. Affecting WordPress installations running the spabrice-developed plugin, exploitation can expose highly sensitive files such as wp-config.php, leading to database credential theft and potential full site compromise. No public exploit has been identified at time of analysis, though the CVSS 8.1 score with High impact across all three dimensions signals significant severity if the preconditions for exploitation are met.

Cross-origin information disclosure in Mozilla Firefox's CSS Parsing and Computation component allows a malicious web page to bypass site isolation and read data it should not have access to, affecting Firefox before 154 and Firefox ESR before 153.1. The flaw is remotely reachable over the network with no privileges required per the supplied CVSS vector, though realistic exploitation hinges on a victim loading attacker-controlled web content. There is no public exploit identified at time of analysis, and EPSS is very low (0.15%, 5th percentile), indicating no observed weaponization.

Site isolation bypass in Mozilla Firefox's Audio/Video Web Codecs component allows remote attackers to perform cross-origin data access, potentially reading or modifying content belonging to other origins within the browser. Rooted in CWE-346 (Origin Validation Error), the flaw affects all Firefox releases prior to 154 and all ESR releases prior to 153.1. No public exploit identified at time of analysis, and an EPSS score of 0.15% (5th percentile) signals low current exploitation probability despite the high CVSS base score of 8.1.

Information disclosure in Firefox's Form Autofill component exposes sensitive personal data stored by the browser to unauthorized actors via a network-accessible, unauthenticated attack path scored CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/C:H). All Firefox versions prior to 154 and Firefox ESR versions prior to 153.1 are affected, with Mozilla issuing four separate security advisories (mfsa2026-74, mfsa2026-77, mfsa2026-78, mfsa2026-80) across release channels. No public exploit or CISA KEV listing has been identified at time of analysis, and the EPSS exploitation probability stands at 0.14% (4th percentile).

Information disclosure via a side-channel in Mozilla Firefox's Web Audio component allows remote, unauthenticated attackers to infer sensitive data that should be isolated between origins by measuring observable timing or behavioral discrepancies. The flaw affects Firefox before 154 and Firefox ESR before 153.1 and is fixed in those releases; no public exploit has been identified and EPSS is low (0.14%, 4th percentile), indicating no evidence of active exploitation.

Information disclosure via the WebRTC component in Mozilla Firefox allows network-accessible attackers to exfiltrate sensitive browser data due to improper restriction of rendered UI layers (CWE-1021). All Firefox releases prior to version 154 and all Firefox ESR releases prior to version 153.1 are affected across all platforms listed under CPE cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*. The CVSS base score is 7.5 with high confidentiality impact; SSVC confirms automatable exploitation, though no active exploitation has been confirmed in CISA KEV and no public exploit code has been identified at time of analysis.

Side-channel information disclosure in Firefox's Storage: Cache API (CWE-203) allows remote unauthenticated attackers to infer sensitive cached data through observable timing discrepancies between cache hits and misses. All Firefox versions prior to 154 and Firefox ESR versions prior to 153.1 are affected per Mozilla advisories mfsa2026-74 through mfsa2026-80. No public exploit code or CISA KEV listing has been identified at time of analysis, but the high confidentiality impact rating and broad Firefox deployment footprint make patching a near-term priority.

Use-after-free in Mozilla Firefox's JavaScript garbage collector (GC) component enables remote code execution when a victim visits a malicious webpage. All Firefox versions prior to 154 and Firefox ESR versions prior to 153.1 are affected across multiple product lines, as indicated by four separate Mozilla Security Advisories (MFSA2026-74, -77, -78, -80). No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the high CVSS score of 8.8 with full C/I/A impact and low attack complexity demands prompt patching.

Sandbox escape in the Remote Settings Client component of Mozilla Firefox lets attacker-controlled code break out of the isolated content process and reach the more privileged parent process, and was resolved in Firefox 154. The flaw is classed as a protection-mechanism failure (CWE-693) and carries a maximal CVSS 3.1 base score of 10.0 with a changed scope, reflecting cross-boundary impact. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, so this is a high-severity but not yet actively-exploited issue.

Use-after-free memory corruption in Firefox's Layout: Text and Fonts component allows a remote unauthenticated attacker to achieve high-confidence confidentiality, integrity, and availability impact by luring a user to visit a malicious web page. The vulnerability spans the main Firefox release channel and all three active ESR branches (115.x, 140.x, 153.x), indicating broad exposure across enterprise and consumer deployments. No public exploit or active exploitation has been identified at time of analysis, but the network-accessible, low-complexity nature of this flaw and the breadth of MFSA advisories (mfsa2026-74 through mfsa2026-80) signal a high-priority patching target.

Site isolation bypass in Mozilla Firefox's Networking: Cookies component allows remote, unauthenticated attackers to read and manipulate cookies across origins when a victim visits a malicious page, scoring CVSS 8.1 (High) due to high confidentiality and integrity impact. The flaw, rooted in CWE-346 (Origin Validation Error), undermines a core browser security boundary that separates per-site cookie access. Vendor-released patches are available in Firefox 154, Firefox ESR 140.14, and Firefox ESR 153.1; no public exploit or CISA KEV listing is identified at time of analysis.

Memory corruption via a use-after-free in Firefox's DOM: Core & HTML component allows a remote attacker to trigger dangling-pointer reuse in the browser engine, potentially leading to arbitrary code execution within the content process. All Firefox and Firefox ESR users on versions prior to Firefox 154, ESR 140.14, and ESR 153.1 are affected. No public exploit identified at time of analysis, and EPSS is low (0.16%, 5th percentile), consistent with a freshly patched browser bug with no observed weaponization.

Memory corruption via a use-after-free in Firefox's Graphics: ImageLib component allows a remote attacker to potentially execute code or disclose memory contents when a victim renders attacker-controlled image data. All Firefox channels are affected up to the fixed builds (Firefox 154 and ESR 115.39, 140.14, 153.1). No public exploit identified at time of analysis, and EPSS is low (0.20%, 10th percentile), indicating no observed weaponization despite the high CVSS score.

Memory corruption in Mozilla Firefox's Graphics: Text component (CWE-416 use-after-free) can be triggered by malicious web content, potentially leading to remote code execution or information disclosure in the browser process. All Firefox users on pre-fix builds are affected until updated to Firefox 154 or the corresponding ESR releases (115.39, 140.14, 153.1). There is no public exploit identified at time of analysis, and EPSS exploitation probability is low (0.16%, 6th percentile).

Memory-corruption via a use-after-free in Firefox's JavaScript WebAssembly engine allows a remote attacker to corrupt heap memory and potentially achieve arbitrary code execution or information disclosure when a victim loads attacker-controlled content. All Firefox versions prior to Firefox 154, Firefox ESR 140.14, and Firefox ESR 153.1 are affected. There is no public exploit identified at time of analysis, KEV does not list it as actively exploited, and EPSS is low (0.16%), so this is a high-severity but not yet demonstrably-exploited flaw.

Site isolation bypass in Firefox's Graphics: CanvasWebGL component allows a malicious web page to leak cross-origin data through the browser's graphics subsystem. All Firefox releases prior to version 154 are affected, along with ESR branches fixed in 115.39, 140.14, and 153.1. No public exploit code or active exploitation has been confirmed; EPSS places this in the 6th percentile, suggesting widespread automated exploitation is currently unlikely despite the High CVSS score.

Arbitrary file read in ArcadeDB's OpenCypher LOAD CSV FROM clause allows any authenticated user with read query privileges to exfiltrate arbitrary server-side files. All versions prior to 26.8.1 are affected, as confirmed by the vendor's GitHub security advisory GHSA-hfp5-6gcp-8c75. An attacker issuing a crafted LOAD CSV FROM 'file:///etc/shadow' statement receives the file contents directly in the query response, exposing credentials, private keys, and configuration data readable by the server process - no public exploit or CISA KEV listing has been identified at time of analysis.

Arbitrary file read in ArcadeDB before version 26.8.1 allows authenticated users holding trigger creation privileges to escape the GraalVM JavaScript sandbox and read any file accessible to the ArcadeDB server process on the underlying host. The sandbox allowlist enforces package name restrictions via unescaped regular expressions, which an attacker can craft to match unintended Java class names and instantiate ZipFile or JarFile to open arbitrary filesystem paths. No public exploit has been identified at time of analysis; however, the vendor-confirmed patch to 26.8.1 should be applied promptly given the high confidentiality impact and the sensitivity of files typically reachable by a database server process.

Broken API-key scope enforcement in the Grav CMS API plugin (getgrav/grav-plugin-api) before 1.0.14 lets an authenticated holder of a restricted, scoped API key read authorize-gated administrative UI metadata that their scope should forbid. Because userPassesAuthorize() checks the underlying account's super-admin flag and ACL grants instead of the presenting key's declared scopes, a low-privilege key minted on a privileged account inherits the account's full authorization, exposing sidebar/menubar/widget item definitions and users-list columns, row-actions, and filter-tabs. No public exploit identified at time of analysis; impact is information disclosure only, and the published CVSS 4.0 9.3 appears materially overstated versus the described effect.

Digest authentication credential replay in http4k-security-digest exposes all URLs within an authentication realm to unauthorized access when an attacker can obtain any valid Digest credential for that realm. The library's `DigestAuthProvider.verify` method never passed the actual request URI into its validation logic, meaning the `uri` field in a client's `Authorization: Digest` header was never compared against the URL actually being requested - a direct violation of the per-request binding mandated by RFC 7616. The flaw has been present since the `DigestAuthProvider` was introduced in 2021 (commit 8a52b615b1); no public exploit code has been identified and no CISA KEV listing is present at time of analysis.

Unbounded gzip decompression in http4k's `ServerFilters.GZip` and `RequestFilters.GunZip` filters allows any unauthenticated remote client to exhaust JVM heap memory by sending a small (kilobyte-scale) gzip-encoded request body that decompresses to gigabytes - a classic compression bomb attack. All http4k servers using these filters across the v4.x, v5.x, and v6.x lines are affected; the flaw was silently present for approximately 9 years (since commit 2618fe08f9, 2017-08-01). No public exploit code or CISA KEV listing is identified at time of analysis, though the attack technique is trivially constructable from publicly documented zip-bomb methodology.

Cross-user credential disclosure in Onyx (open-source AI platform) lets any low-privileged BASIC_ACCESS user retrieve another user's OAuth Authorization header via the GET /api/mcp/servers and GET /api/mcp/servers/persona/{persona_id} MCP endpoints. Per-user OAuth tokens were incorrectly persisted into a shared admin MCPConnectionConfig row and then echoed back through auth_template.headers to unrelated callers, leaking bearer tokens for downstream MCP services. Affects versions prior to 3.1.10, 3.2.14, and 4.0.0; no public exploit identified at time of analysis and it is not listed in CISA KEV, but a vendor patch and detailed fix commits are available.

Out-of-bounds memory read in Deskflow clients prior to continuous build 1.26.0.299 allows a network-reachable malicious server to crash the connected client or disclose up to four bytes of client process memory at an attacker-controlled relative offset. The flaw lives in ServerProxy::setOptions(), where crafted kMsgDSetOptions (DSOP) option values corrupt m_modifierTranslationTable indexes that translateKey() and translateModifierMask() then use to index static seven-row lookup arrays beyond their valid bounds. No active exploitation has been confirmed by CISA KEV and no public exploit code has been identified at time of analysis, but the attack requires no authentication and no client-side user interaction beyond an established server connection.

Out-of-bounds read in Deskflow's client-side `ServerProxy::setOptions()` allows a malicious Deskflow server to crash any connected client by sending an odd-length DSOP options vector during the handshake sequence. Affected releases span from 1.17.0 through all continuous builds before 1.26.0.296, covering the full client codebase across five source files. No active exploitation is listed in CISA KEV and no public exploit code has been identified, though the crash is deterministic and the CVSS C:L component reflects marginal heap/stack memory disclosure from the out-of-bounds read.

Authentication bypass in MemOS (MemTensor), a memory operating system for LLMs and AI agents, lets an unauthenticated remote attacker impersonate a trusted internal principal with full 'all' scopes. When AUTH_ENABLED=true but the undocumented INTERNAL_SERVICE_SECRET variable is left unset, a null-versus-null comparison in the internal-request check fails open, exposing admin API-key management and all data endpoints. Rated CVSS 4.0 9.3 (critical) by VulnCheck; no public exploit identified at time of analysis, though the flaw is trivially reproducible from the disclosed source.

Broken access control in OpnForm's editable-submission feature lets unauthenticated attackers derive any submission's secret because the Hashids library is used with an empty default salt over sequential database row IDs. Since the hash of a sequential integer becomes trivially predictable, an attacker can enumerate submissions to read other respondents' full answer data via the submission-fetch endpoint or overwrite existing submissions through the answer endpoint. Reported by VulnCheck and patched in v2.0.2; there is no public exploit identified at time of analysis, but the flaw is remotely and trivially reproducible against affected default installs.

Privilege escalation in Stirling-PDF before 2.9.0 allows any authenticated ROLE_USER to obtain the privileged STIRLING-PDF-BACKEND-API-USER internal service account API key through the pipeline subrequest mechanism, then impersonate that account to bypass rate limits and query sensitive monitoring endpoints such as /api/v1/info/requests/all and /api/v1/info/load/all. The root cause is PipelineProcessor.java injecting the static internal service account key into pipeline subrequests rather than the requesting user's own key, making it retrievable via /api/v1/user/get-api-key. No public exploit or CISA KEV listing exists at time of analysis; vendor-released patch v2.9.0 resolves the issue.

Out-of-bounds heap read in TIER IV Nebula's Vlp32Decoder::unpack() function through version 1.2.0 enables unauthenticated remote attackers to inject fabricated LiDAR point data into autonomous vehicle perception pipelines by sending short malformed UDP datagrams to the Velodyne sensor port. Unlike other Nebula sensor drivers, the VLP-32 UDP listener enforces no sender-address restrictions, making any network-reachable host a valid attacker origin without spoofing. Fabricated points derived from adjacent heap memory contents are silently published into downstream PointCloud2 messages consumed by Autoware nodes, creating a sensor-integrity risk with direct safety implications; no public exploit code and no CISA KEV listing are identified at time of analysis.

Stack memory disclosure in COVESA Open1722 through version 0.9.2 exposes approximately 18 KB of live process stack memory onto the CAN bus, reachable by any node on that bus. An unauthenticated remote attacker sends a crafted UDP datagram bearing a matching AVTP stream ID; integer truncation in acf-can-listener.c converts avtp_to_can()'s -1 error return to 255 in a uint8_t variable, driving the write loop 255 times over a 15-slot stack array and emitting roughly 240 CAN frames of raw stack contents. No public exploit identified at time of analysis and no CISA KEV listing is present, but the vulnerability mechanism is fully described in the VulnCheck advisory, lowering the barrier to reproduction.

Out-of-bounds heap read in Belledonne Communications bcg729 through 1.1.2 allows unauthenticated network-adjacent attackers to crash the media process or silently corrupt G.729 comfort-noise generation by delivering a single zero-length SID RTP payload. The root cause is an integer underflow in uint8_t arithmetic inside decodeSIDframe() that causes the function to unconditionally attempt reading 11 bytes from a zero-byte heap buffer, resulting in media process termination or consumption of adjacent heap memory as LP filter reflection coefficients. No public exploit identified at time of analysis, but the trigger condition - one malformed RTP packet - represents a trivially low technical barrier for any attacker already on the RTP session path.

Quadratic CPU consumption in sqlparse versions prior to 0.6.0 allows unauthenticated remote denial-of-service via crafted deeply-nested SQL payloads submitted to any application calling sqlparse.parse(), sqlparse.format(), or sqlparse.split(). A ~2KB malicious input with 500-2000 nesting levels can consume approximately 10 seconds of CPU per request - a ~5000x amplification ratio - before depth or token limits raise a SQLParseError. No active exploitation is confirmed in CISA KEV, though the GHSA advisory includes a detailed proof-of-concept demonstrating the attack; CVSS 4.0 rates availability impact as High (8.7) with no authentication required.

Tamper protection bypass in BeyondTrust Endpoint Privilege Management (EPM) for Windows allows local high-privileged users to circumvent agent protection controls by exploiting a flaw in how protections are applied to a support utility process. Affected versions are all EPM Windows Deployment releases prior to 26.1.2, per EUVD-2026-60270 and BeyondTrust advisory BT26-04. No public exploit has been identified and this is not in CISA KEV, but the high confidentiality, integrity, and availability impact on the vulnerable system makes this a meaningful concern for any organization relying on EPM as a core endpoint security control.

Local privilege escalation in Zephyr RTOS (versions 4.0.0-4.4.1 with CONFIG_USERSPACE enabled) allows an unprivileged user-mode thread to execute arbitrary code in kernel supervisor mode by supplying forged struct device pointers with attacker-controlled API function tables to the flash_copy() system call. The syscall verifier z_vrfy_flash_copy() validated the output buffer but omitted the K_SYSCALL_DRIVER_FLASH object validation for src_dev and dst_dev that every sibling flash syscall enforces - a unique gap in the trust boundary that the kernel implementation blindly dereferences in supervisor context. No public exploit or active exploitation has been identified at time of analysis; a vendor-released patch is confirmed in commit 1b1ecdc4 and available in Zephyr 4.4.2.

Unauthenticated database backup disclosure in JetBrains YouTrack before 2025.3.156085, 2026.1.13913, and 2026.2.18112 allows a remote attacker to abuse a shared draft signature to download full database backups without any credentials. Because backups typically contain issue data, user records, and secrets, this is a high-impact confidentiality exposure. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, but the CVSS 9.1 rating and trivial network exploitability make it a priority patch.