Information Disclosure

Hard-coded cryptographic keys in Silex Technology SD-330AC and AMC Manager enable attackers to forge firmware updates that administrative users may be tricked into applying via social engineering, allowing arbitrary firmware installation without detection. The vulnerability affects all versions of both products and exploits a fundamental key management flaw (CWE-321). While the CVSS score of 6.5 reflects network accessibility and high integrity impact, real-world exploitation requires user interaction (UI:R) to convince an administrator to install malicious firmware.

Langflow up to version 1.8.3 stores authentication settings in cleartext on disk when processing project creation requests, allowing authenticated remote attackers to read sensitive credentials. The vulnerability exists in the create_project/encrypt_auth_settings function within the Project Creation Endpoint, where the auth_settings parameter bypasses encryption despite the function's intent. Publicly available exploit code exists, and the vendor has not released a patch or responded to disclosure notices.

Langflow up to version 1.8.3 stores API credentials without encryption in the remove_api_keys and has_api_terms functions, allowing remote attackers with high privileges to disclose sensitive credentials through the Flow Using API component. The vulnerability has publicly available exploit code, though real-world exploitation likelihood is constrained by the requirement for high-privilege access; vendor has not responded to disclosure.

Prototype pollution in brikcss merge library versions 1.0 through 1.3.0 enables remote unauthenticated attackers to inject malicious properties into JavaScript Object prototypes via crafted __proto__, constructor.prototype, or prototype arguments, potentially leading to information disclosure, authentication bypass, or denial of service. Publicly available exploit code exists (GitHub PoC from sudo-secure). CVSS 7.3 with network vector and no authentication required. Vendor unresponsive to disclosure attempts.

Hard-coded Amap API key exposure in DjangoBlog allows remote attackers to abuse geolocation services without authentication. DjangoBlog versions up to 2.1.0.0 embed a fixed cryptographic key in owntracks/views.py for Amap API calls, enabling unauthorized API usage with low confidentiality, integrity, and availability impact. Publicly available exploit code exists (POC=YES). EPSS data not provided. Not listed in CISA KEV. Vendor unresponsive to disclosure.

Apache Airflow 3.0.0 through 3.1.x fails to redact secrets stored as nested fields within JSON-formatted variables, allowing authenticated users with variable access to retrieve plaintext sensitive values. This information disclosure vulnerability affects deployments that store credentials or API keys as JSON dictionary structures in Airflow variables. The EPSS score of 0.02% and CVSS 3.7 with high attack complexity reflect limited real-world exploitation likelihood, but the vulnerability poses direct risk to organizations using JSON-structured secrets without additional access controls.

AsyncHttpClient (AHC) library prior to versions 3.0.9 and 2.14.5 leaks Authorization, Proxy-Authorization headers, and plaintext Realm credentials to arbitrary redirect targets when followRedirect(true) is enabled, affecting all Java applications using vulnerable versions. This occurs across domain, scheme, and port changes including HTTPS-to-HTTP downgrades. An attacker controlling a redirect destination via open redirect, DNS rebinding, or MITM can capture Bearer tokens, Basic auth credentials, or any Authorization header value. No public exploit code or active exploitation has been confirmed at analysis time, though the vulnerability is exploitable with high-confidence conditions when redirect following is enabled (CVSS 6.8, network vector, no authentication required).

ChurchCRM versions prior to 7.2.0 leak valid usernames through the public API login endpoint by returning distinguishable HTTP status codes (404 for non-existent users, 401 for valid users with wrong passwords). An unauthenticated attacker can enumerate valid usernames without rate limiting or account lockout restrictions, enabling targeted credential attacks and social engineering. This information disclosure vulnerability affects all ChurchCRM deployments using the vulnerable API endpoint and has been patched in version 7.2.0.

Out-of-bounds read in libgphoto2 versions up to 2.5.33 allows local attackers with physical access to a USB-connected camera to trigger information disclosure or denial of service via malformed PTP protocol data during Samsung Galaxy device enumeration. The vulnerability exists in `ptp_unpack_OI()` which validates buffer boundaries at 48 bytes but subsequently reads up to 56 bytes, exceeding the boundary by 9 bytes. A fix is available in commit 7c7f515bc88c3d0c4098ac965d313518e0ccbe33.

Out-of-bounds read in libgphoto2 versions up to 2.5.33 allows local attackers with physical access to a connected camera to read sensitive memory and potentially cause denial of service via a specially crafted Sony camera device. The vulnerability exists in the Sony-specific PTP packet unpacking function which omits bounds validation present in the standard variant, enabling attackers with direct camera access to trigger information disclosure and minor availability impact.

Out-of-bounds read in libgphoto2 versions up to 2.5.33 allows physical attackers to disclose sensitive memory and cause denial of service via a malicious PTP (Picture Transfer Protocol) device. The vulnerability exists in the Sony-specific DPD unpacking function, which fails to validate buffer boundaries before reading an enumeration count, enabling attackers with direct device access to craft responses that trigger the out-of-bounds read. Patch is available via upstream commit 3b9f9696be76ae51dca983d9dd8ce586a2561845.

Sentry kernel prior to version 0.4.7 allows tasks with DEV or IO capabilities to manipulate another task's IRQ line via the __sys_int_* syscall family, enabling denial of service and covert information channels between privileged tasks and external systems. The vulnerability affects embedded systems using Sentry micro-kernel versions before 0.4.7, and no public exploit code has been identified at time of analysis, though the fix is vendor-released and publicly available.

libgphoto2 versions up to 2.5.33 leak memory in the Sony camera property descriptor parser when processing secondary enumeration lists from 2024+ Sony cameras, causing denial of service through resource exhaustion on systems with repeated camera enumeration or property descriptor parsing. The vulnerability requires physical access to a Sony camera or crafted USB device communication, affecting users who interact with affected Sony camera models via libgphoto2. Vendor-released patch: version 2.5.34 and later.

Out-of-bounds read in libgphoto2 versions up to 2.5.33 in the PTP protocol parser allows information disclosure and potential denial of service when processing specially crafted camera responses. The vulnerability exists in ptp_unpack_DPV() where UINT128 and INT128 cases advance the buffer offset by 16 bytes without verifying sufficient buffer remains available, potentially exposing adjacent memory. Exploitation requires physical access to connect a malicious camera device (AV:P), but no special authentication or user interaction is needed once connected. No public exploit code identified at time of analysis.

Out-of-bounds read in libgphoto2 versions up to 2.5.33 allows local attackers with physical access to a connected camera to read sensitive information from process memory or cause denial of service via malformed EOS event data. Two functions in ptp-pack.c lack length validation, enabling unbounded buffer reads when processing camera events. The vulnerability requires physical device access and is not remotely exploitable, with no public exploit code identified at time of analysis.

Denial of service in graphql-go versions 15.31.4 and below allows remote unauthenticated attackers to trigger excessive CPU consumption during GraphQL query validation by submitting queries with thousands of repeated identical fields, exploiting O(n²) complexity in the OverlappingFieldsCanBeMerged validation rule. The vulnerability bypasses existing QueryDepth and QueryComplexity mitigations. Vendor-released patch: version 15.31.5.

DNN (DotNetNuke) 10.0.0 through 10.2.1 installations use an identical Host GUID across all new deployments, enabling attackers to impersonate the host administrator account and gain unauthorized access to sensitive CMS functionality. This affects only fresh installations-upgrades from 9.x retain unique identifiers. The vulnerability requires network access to exploit but no authentication or user interaction, and is patched in version 10.2.2.

OpenFGA 0.1.4 through 1.13.1 discloses preshared API authentication keys in plaintext HTML responses from the unauthenticated /playground endpoint when configured with preshared-key authentication. Remote attackers on accessible networks can retrieve credentials without authentication, compromising authorization service security. The vulnerability requires non-default configuration (preshared auth enabled, playground accessible beyond localhost), limiting but not eliminating real-world risk.

Claude Code prior to version 2.1.75 on Windows allows low-privileged local users to execute arbitrary code by placing a malicious configuration file in an unprotected shared directory (C:\ProgramData\ClaudeCode\managed-settings.json). The vulnerability exploits the default writability of ProgramData to non-administrative users and the absence of directory ownership validation, enabling privilege escalation or lateral impact when a victim user subsequently launches the application. This requires local system access and user interaction (launching Claude Code), limiting real-world impact to shared multi-user systems.

Anviz CX2 Lite and CX7 devices transmit administrative sessions over unencrypted HTTP, allowing on-path attackers to intercept and steal credentials and session tokens without authentication or user interaction beyond the legitimate admin connecting to the device. This breaks confidentiality of administrative access, enabling complete device compromise. CVSS 6.5 reflects the high confidentiality impact but lack of authentication barrier; exploitation is straightforward given network access to the device.

Information disclosure in Firebird 3.x client library when connecting to Firebird 4+ servers allows local authenticated users to leak sensitive data through incorrect XSQLDA field length values. The vulnerability requires both the FB3 client library and an FB4+ server in the deployment. No active exploitation confirmed (not in CISA KEV), but CVSS 7.9 with scope change (S:C) indicates potential cross-boundary impact. Remediation requires upgrading the client library to Firebird 4.0.0 or higher.

The Hotel Booking Management System by arnobt78 (up to commit f8922d0e0f6ac1cc761974c7616f44c2bbc04bea) exposes sensitive information through an unauthenticated network request to the /api/health/detailed endpoint, allowing remote attackers to disclose system details without authentication or user interaction. Publicly available exploit code exists, and the vendor has not responded to disclosure attempts.

Dell PowerProtect Data Domain (DD OS) versions 7.7.1.0-8.5, 8.3.1.0-8.3.1.20 (LTS2025), and 7.13.1.0-7.13.1.50 (LTS2024) leak sensitive information to low-privileged remote attackers. An authenticated user with minimal privileges can access confidential data without authorization, resulting in information disclosure with a CVSS score of 4.3. No active exploitation reported, but the low attack complexity and remote network vector make this a practical vulnerability for attackers within administrative networks.

Sparx Pro Cloud Server 6.0.163 stores user passwords in plaintext when OpenID authentication is configured, allowing remote unauthenticated attackers to extract credentials with network access to the backend database or file system. CVSS 9.3 (Critical) reflects network-accessible plaintext credential exposure. EPSS score of 0.05% (15th percentile) indicates low probability of widespread exploitation despite severity. No active exploitation confirmed (not in CISA KEV), but SSVC classifies as automatable with total technical impact. Vendor has released version 6.1 with fix per change history.

Sparx Systems Pro Cloud Server 6.0.163 exposes database credentials in plaintext to unauthenticated remote attackers through an unprotected information disclosure endpoint. The vulnerability enables attackers to retrieve sensitive system configuration including database passwords without authentication (CVSS:4.0 9.3 Critical, AV:N/PR:N). CISA SSVC classifies this as automatable with total technical impact, though no active exploitation is currently documented (EPSS 0.05%, no KEV listing). Patch available in version 6.1+ per vendor security advisory.

Sparx Enterprise Architect client stores and transmits OAuth2 client secrets in plaintext, allowing local attackers to extract credentials and impersonate the application to obtain unauthorized access tokens. The vulnerability affects at least version 16.1.1627 and potentially earlier versions; local file system access is required to retrieve the exposed secrets, but once obtained, an attacker can perform remote authentication without additional privileges. NCSC-FI reported this vulnerability and it is tracked as EUVD-2025-209512; exploitation likelihood is elevated due to the ease of credential extraction from local storage.

Insufficiently protected credential storage in Dell PowerProtect Data Domain BoostFS client allows local attackers with low privileges to extract stored credentials via local file access under specific race conditions (AC:H). Scope change (S:C) indicates compromised credentials grant access beyond the BoostFS client component itself, potentially to connected Data Domain systems. Dell has released patches for all affected branches (Feature Release 7.7.1.0-8.5, LTS2025 8.3.1.0-8.3.1.20, LTS2024 7.13.1.0-7.13.1.50). EPSS score of 0.01% suggests minimal observed exploitation interest, no CISA KEV listing, and no public POC identified at time of analysis.

DLL hijacking in MobaXterm Home Edition ≤26.1 allows local attackers with low privileges to execute arbitrary code by planting a malicious msimg32.dll in an uncontrolled search path location. Exploitation is complex (CVSS AC:H) but a public POC exists. Mobatek released version 26.2 to address the issue. EPSS data not provided, not listed in CISA KEV, suggesting limited active exploitation despite public proof-of-concept availability.

Server-side request forgery (SSRF) in HashiCorp Vault's PKI engine ACME validation allows unauthenticated remote attackers to send http-01 and tls-alpn-01 challenge requests to local network targets by controlling DNS responses, potentially disclosing sensitive information from internal services. The vulnerability affects Vault Community Edition before 2.0.0 and Vault Enterprise before 1.19.16, 1.20.10, or 1.21.5. HashiCorp has released patched versions; no public exploit code has been identified at the time of analysis.

Vision Helpdesk before 5.7.0 (patched in 5.6.10) allows attackers to read user profiles via modified serialized cookie data to vis_client_id. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.

Out-of-bounds reads in openCryptoki's BER/DER decoding layer expose Linux and AIX systems to cryptographic service disruption and limited memory disclosure across all token backends. All five primitive decoders in the shared asn1.c library lack buffer-length parameters, accepting attacker-controlled BER length fields without validating them against actual buffer boundaries - a condition reachable via PKCS#11 API operations (C_CreateObject, C_UnwrapKey), token file loading from disk, or remote backend channels (ICSF). Proof-of-concept code exists per SSVC classification, though EPSS sits at 0.01% and no confirmed active exploitation (CISA KEV) has been recorded.

Sensitive PII and citizen identifier (BSN) exposure in Valtimo's inbox module affects versions 13.0.0.RELEASE through 13.21.x, where InboxHandlingService logs full inbox message content at INFO level, making case details and personal data readable by anyone with application log access or the Valtimo admin role. The vulnerability requires high-privilege access (CVSS PR:H), confining realistic risk to insider threats or compromised admin accounts rather than external attackers. No public exploit exists and no active exploitation has been observed (EPSS 0.03%, SSVC exploitation: none); however, GDPR and privacy compliance implications are significant given BSN citizen identifiers may be exposed.

Local privilege escalation in the AMD Platform Configuration Blob (APCB) SMM driver, shipped in AGESA firmware across nearly the entire modern AMD EPYC, Ryzen, Threadripper, and Instinct MI300 line, lets a Ring 0 attacker escalate into System Management Mode (SMM) and potentially run arbitrary code below the operating system. The flaw stems from the SMM driver improperly invoking UEFI boot services, and AMD-reported it with a CVSS 4.0 base of 7.1; there is no public exploit identified at time of analysis and EPSS is negligible at 0.01%. Because SMM code runs at a higher trust level than the OS kernel, successful exploitation can undermine firmware integrity and any SMM-based security guarantees.

Missing lock check in the AMD Platform Security Processor (PSP) across multiple EPYC server CPU generations enables a locally privileged attacker to potentially compromise guest VM confidentiality, undermining AMD SEV-based isolation guarantees. Multiple series are confirmed affected - EPYC 7003, 8004, 9004, 9005, and all corresponding Embedded variants - with firmware patches now available for each. No public exploit code exists and CISA SSVC rates exploitation as 'none' with partial technical impact, consistent with the 0.01% EPSS score (2nd percentile), making this a targeted risk primarily relevant to cloud and virtualization providers relying on AMD SEV for tenant isolation.

Insuffient checks of the RMP on host buffer access in IOMMU may allow an attacker with privileges and a compromised HV to trigger an out of bounds condition without RMP checks resulting in a. Rated medium severity (CVSS 5.6).

Credential exposure in Dell PowerScale OneFS affects all versions prior to 9.12.0.0, where sensitive authentication material is inadvertently written to log files readable by low-privileged local users. A locally authenticated attacker who triggers the relevant logging path and can read the resulting log files may extract credentials belonging to other users, then authenticate as those accounts to operate at the victim's privilege level. No public exploit code exists (EPSS 0.01%, SSVC exploitation: none), positioning this as a post-compromise lateral movement or privilege escalation risk rather than an initial access vector.

Hash flooding denial-of-service in libexpat before 2.7.6 stems from the existing SipHash-based collision protection consuming only 4-8 bytes of salt entropy (constrained by the width of `unsigned long`) when the SipHash implementation supports a full 16-byte key - reducing the effective salt space and enabling a knowledgeable attacker to craft XML documents with deliberately colliding element or attribute names. All libexpat versions from 0 through 2.7.5 are affected per CPE cpe:2.3:a:libexpat_project:libexpat. No active exploitation has been confirmed (no CISA KEV listing), EPSS sits at 0.01% (2nd percentile), and SSVC designates exploitation as none and the flaw as non-automatable, placing real-world urgency firmly in the low tier.

OAuth2 credential theft in Sparx Enterprise Architect 16.1.1627 is possible because the client fails to validate the 'aud' (audience) claim of tokens received during OpenID Connect authentication, allowing a local attacker to capture credentials intended for a different relying party. An attacker with low-privileged local access who can position themselves in the OAuth2 exchange - when a victim user is actively authenticating - can obtain high-value OAuth2 credentials and gain access to protected resources. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; EPSS is 0.02% and SSVC exploitation status is 'none'.

ONLYOFFICE DocumentServer before 9.3.0 contains an untrusted pointer dereference vulnerability in XLS file processing that enables authenticated remote attackers to leak sensitive memory and bypass ASLR protections. The vulnerability affects XLS conversion workflows through multiple vectors including pictFmla.cbBufInCtlStm manipulation, allowing information disclosure without requiring user interaction. CVSS 5.0 reflects moderate risk given network accessibility and the authentication barrier, though the scope change to CVSS:C indicates potential cross-boundary impact.

ONLYOFFICE DesktopEditors versions before 9.3.0 allow local attackers to perform arbitrary file operations with SYSTEM privileges via the update service, resulting in denial of service through resource exhaustion or file manipulation. The vulnerability requires local access and operates without user interaction, making it a significant privilege-escalation risk in multi-user or compromised-account scenarios.

Insecure HTTP response header configuration in Eaton Intelligent Power Protector (IPP) software enables attackers to perform web-based attacks including information disclosure and content modification. The vulnerability requires network access, unusual attack complexity, and user interaction (CVSS AV:N/AC:H/PR:N/UI:R), affecting all versions of IPP software prior to the patched release. No public exploit code or active exploitation has been identified at time of analysis.

Eaton Intelligent Power Protector (IPP) software uses insecure cookie configuration that allows network attackers to intercept session cookies via man-in-the-middle attack when high-privilege users interact with the application. CVSS 5.7 reflects the requirement for high privileges and user interaction, combined with high confidentiality and integrity impact. Eaton has released a patched version available on their download center.

In Wago Smart Designer in versions up to 2.33.1 a low privileged remote attacker may enumerate projects and usernames through iterative requests to an specific endpoint. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Eaton Intelligent Power Protector (IPP) software allows brute-force credential attacks against the web interface login page due to missing rate-limiting controls, enabling remote attackers to enumerate valid credentials and gain unauthorized access without authentication. CVSS 6.5 reflects moderate confidentiality and integrity impact via network access. Eaton has released a patched version available from their download center.

In products of the MSE6 product-family by Festo a remote authenticated, low privileged attacker could use functions of undocumented test mode which could lead to a complete loss of confidentiality,. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

UDP Console in Arcserve allows information disclosure when an administrator configures the activation server hostname to an arbitrary or malicious URL, causing the product to unintentionally communicate with and leak data to the attacker-controlled domain. The vulnerability requires user interaction (configuring a malicious hostname) and affects all versions of Arcserve UDP Console, with CVSS 6.3 (network-accessible, low complexity) indicating moderate real-world risk. No active exploitation or public proof-of-concept has been identified at the time of analysis.

Untrusted DLL search path vulnerability in Yubico libfido2 before 1.17.0, python-fido2 before 2.2.0, and yubikey-manager before 5.9.1 allows local attackers to achieve privilege escalation or code execution by placing a malicious DLL in a directory searched before the legitimate library location. The vulnerability requires local access and high complexity conditions but affects three widely-used FIDO2 authentication libraries; no public exploit code identified at time of analysis.

Authorization policy bypass in Istio service mesh due to incorrect handling of dots (.) as regular expression metacharacters in service account names. In affected versions 1.25.0–1.27.8, 1.28.0–1.28.5, and 1.29.0–1.29.1, the `serviceAccounts` and `notServiceAccounts` fields in AuthorizationPolicy misinterpret dots, causing an ALLOW rule for e.g. `cert-manager.io` to also match `cert-manager-io` and similar variants, while a DENY rule fails to block them. An authenticated attacker with low privileges can exploit this to gain unauthorized access or bypass restrictions. No active exploitation or public proof-of-concept has been identified; EPSS indicates very low exploitation probability (0.03%). Patches are available.

Information disclosure in ApostropheCMS 4.28.0 and earlier allows unauthenticated attackers to extract distinct field values via the choices and counts REST API query parameters, bypassing publicApiProjection restrictions. The vulnerability exposes sensitive schema field values, including those protected by viewPermission, and a proof-of-concept exploit exists, though no active exploitation is confirmed.

Information disclosure in ApostropheCMS 4.28.0 and earlier allows unauthenticated attackers to bypass admin-configured field restrictions on the piece-type REST API, exposing sensitive content such as internal notes or draft metadata. Public exploit code is available, though the EPSS score (0.09%) indicates low current exploitation probability; no active exploitation has been confirmed.

Information disclosure in Pyroscope enables unauthenticated remote attackers to extract the Tencent Cloud Object Storage (COS) secret_key from the API if the database is configured with the Tencent COS storage backend. Fixed versions are 1.15.2, 1.16.1, and all 1.17.x releases. No active exploitation or public exploit code has been identified at this time.

User enumeration via a timing side channel in ApostropheCMS versions 4.28.0 and prior allows unauthenticated attackers to identify valid usernames and emails. The password reset endpoint fails to normalize response time when a valid user is found, enabling an attacker to distinguish valid accounts from invalid ones by repeatedly probing the endpoint. This can facilitate credential stuffing and targeted phishing against instances that have explicitly enabled the password reset feature.

Information disclosure in Google Chrome prior to version 147.0.7727.101 allows a remote attacker to obtain sensitive information from process memory by enticing a user to open a crafted file. The vulnerability, rated Medium severity by Chrome, resides in the Skia graphics library and is not currently listed in CISA KEV, with a low EPSS exploitation probability (0.03%). A patch is available from Google.

GIMP is vulnerable to a heap buffer over-read in the icns_slurp() function when processing malicious ICNS image files, potentially leading to application crashes or information disclosure. An attacker must trick a local user into opening a specially crafted file, with no known public exploit or active exploitation at this time. A vendor patch is available from Red Hat for affected RHEL distributions.

Cross-tenant information disclosure and deletion in Grafana allows a high-privilege authenticated user to read and permanently delete legacy correlation records belonging to

Server-Side Request Forgery in Weblate's project-level machine translation configuration allows an authenticated project administrator to probe internal network services and read partial responses. Any user holding the per-project 'Administration' role (which grants project.edit permission) can supply a crafted URL as a machine translation service endpoint; during validation Weblate issues an outbound HTTP request to that URL and reflects up to 200 characters of the response body in the resulting error message. All Weblate deployments running versions prior to 5.17 are affected; no public exploit code exists and no active exploitation has been confirmed at time of analysis.

Arbitrary file download in Cisco Unity Connection allows authenticated, remote attackers with administrative credentials to exfiltrate system files via crafted HTTPS requests. The flaw stems from improper input sanitization (CWE-23) in the web-based management interface. No active exploitation or public proof-of-concept is known, and EPSS (0.08%) indicates low exploitation likelihood, making this a moderate priority for patching in environments where the management interface is already adequately protected.

File disclosure vulnerability in Cisco Unity Connection's web-based management interface allows authenticated attackers with administrative credentials to download arbitrary files via crafted HTTPS requests. The flaw stems from improper sanitization of user input leading to relative path

Account management inconsistencies in Splunk Enterprise and Splunk Cloud Platform allow users with the high-privilege 'edit_user' capability to create specially crafted usernames containing null bytes or non-UTF-8 percent-encoded bytes. This can lead to improper storage of usernames, resulting in inability to edit or delete affected users. No active exploitation has been identified and the EPSS score is very low (0.04%), indicating minimal real-world risk.

Information disclosure in Grafana Alerting allows users with the 'Contact Point Writer' role (part of Editor role) to extract redacted credentials from third-party integrations. By editing a contact point's endpoint URL to an attacker-controlled server and invoking the test function, redacted settings such as Slack tokens are sent to the attacker. Affected versions are Grafana Alerting 8.0.0 through 12.3.0; no public exploit or active exploitation identified, and the EPSS score is very low (0.04%).

2-3 sentence plain-language synthesis. Not copy description. Start with impact, product, etc. Mention actively exploited? KEV? None. POC? Not mentioned, so

Arbitrary file write with elevated privileges in Lenovo Software Fix installer allows local authenticated users to overwrite system files during installation. Affected versions before 7.5.5.19. No public exploitation reported, EPSS low (0.01%), and SSVC

Arbitrary file write with elevated privileges exists in Lenovo Diagnostics and HardwareScanAddin components of Lenovo Vantage. A local authenticated user can overwrite files during installation or hardware scan, posing integrity and availability risks. No active exploitation or public exploits have been identified (EPSS 0.01%), and a vendor patch is available.

Mattermost versions 10.11.x through 10.11.12, 11.3.x through 11.3.2, 11.4.x through 11.4.2, and 11.5.0 fail to enforce atomic consumption of guest magic link tokens, allowing unauthenticated attackers to establish multiple concurrent authenticated sessions from a single valid magic link. This enables unauthorized access and potential information disclosure without requiring additional credentials or user interaction beyond intercepting or obtaining the link.

Signature verification bypass in Bouncy Castle BC-JAVA (bcpkix module versions 1.49-1.83) allows remote unauthenticated attackers to forge cryptographic signatures by submitting empty signature sequences that are incorrectly accepted as valid by the draft CompositeVerifier implementation. This critical flaw (CVSS 4.0: 10.0) enables complete subversion of digital signature trust chains, potentially allowing authentication bypass, code signing forgery, and man-in-the-middle attacks against Java ap

GOST CTR block cipher in Bouncy Castle BC-JAVA processes only the first 255 blocks correctly, causing silent data corruption in encryption/decryption operations for longer messages. Affects BC-JAVA versions 1.59 through 1.83, with fix available in version 1.84. Local attack vector (CVSS AV:L) with critical CVSS 9.4 score reflects potential for both confidentiality and integrity compromise when applications process GOST-encrypted data streams exceeding 255 blocks (~4KB). No KEV listing or public

HCL AION allows local attackers with high privileges to explore internal filesystem structures through certain system behaviors, potentially disclosing information about the underlying environment that could facilitate further targeted attacks. The vulnerability requires local access, high privileges, and user interaction to trigger, with a CVSS score of 2.9 reflecting low immediate risk. No public exploit code or active exploitation has been identified.

Remote attackers can manipulate payment amounts in Stripe and PayPal transactions through the MetForm Pro WordPress plugin by submitting arbitrary values in the 'mf-calculation' field, bypassing price validation. Versions up to 3.9.7 are affected; the plugin fails to recompute or validate user-submitted calculation fields against configured form prices, allowing unauthenticated attackers to reduce or alter payment amounts on vulnerable forms. No active exploitation has been publicly confirmed, though the attack requires minimal complexity and produces direct financial impact.

Avada (Fusion) Builder plugin for WordPress up to version 3.15.1 allows authenticated Subscriber-level users and above to access protected post metadata through the Dynamic Data feature's `post_custom_field` parameter due to insufficient validation of underscore-prefixed metadata keys. The `fusion_get_post_custom_field()` function fails to enforce metadata access controls, enabling disclosure of sensitive metadata that should be restricted. No public exploit code or active exploitation has been confirmed at the time of analysis.

Denial of service in Nordic Semiconductor IronSide SE for n

Adobe FrameMaker 2022.8 and earlier suffers from uninitialized pointer access that leaks sensitive memory contents to local attackers. The vulnerability requires user interaction-a victim must open a specially crafted file-but once triggered, it bypasses memory protections and exposes confidential data without requiring authentication or modifying files. CVSS 5.5 reflects moderate severity (local attack vector, high confidentiality impact) with no public exploit identified at time of analysis.

Adobe FrameMaker 2022.8 and earlier allows arbitrary file system read through improper input validation when a user opens a malicious file, enabling attackers to access sensitive data on the victim's system. The vulnerability requires user interaction and is classified as information disclosure with a CVSS score of 6.3. No active exploitation or public exploit code has been identified at the time of analysis.

SpiceDB information disclosure vulnerability in startup logging allows high-privileged local attackers to obtain plaintext database passwords. When SpiceDB initializes at info log level, the startup configuration log message exposes the complete datastore DSN string containing unmasked credentials in the DatastoreConfig.URI field. Patch version 1.51.1 available; CVSS 6.0 reflects high confidentiality impact mitigated by high privilege requirement and local-only attack vector.

OAuth2 Proxy versions 7.11.0 through 7.15.1 fail to clear the session cookie when rendering the sign-in page due to a regression, allowing authenticated users to remain logged in even after attempting to log out via the sign-in page. On shared workstations, a subsequent user could hijack the previous user's authenticated session without additional credentials. This affects only deployments using the sign-in page as part of logout flow; organizations with dedicated logout endpoints are unaffected. The vulnerability carries a low CVSS score of 3.5 (physical attack vector required) but poses meaningful risk in shared-access environments.

October CMS versions prior to 3.7.14 and 4.1.10 allow authenticated editors to disclose sensitive environment variables through PHP's parse_ini_string() interpolation syntax in page settings fields. An attacker with Editor access can inject patterns like ${APP_KEY} or ${DB_PASSWORD} into CMS configuration fields, causing the server to resolve and expose database passwords, AWS credentials, and application keys, potentially enabling database compromise or session forgery. The vulnerability is limited to installations with cms.safe_mode enabled; CVSS 4.9 reflects high confidentiality impact but requires elevated privileges (PR:H) to exploit.

FlashArray Purity applies snapshot retention policies with timing deviations from configured schedules, allowing authenticated administrators to inadvertently trigger premature or delayed data lifecycle actions. This affects FlashArray versions 5.0.0 through 6.10.0, impacting data retention integrity and compliance posture. The vulnerability requires high administrative privileges to exploit and results in integrity compromise of snapshot management operations.

Windows Snipping Tool leaks sensitive information to unauthenticated network attackers via user interaction, enabling spoofing attacks. The vulnerability affects Windows 10 (versions 1607, 1809, 21H2, 22H2) and Windows 11 (versions 22H3, 23H2, 24H2, 25H2, 26H1), as well as Windows Server 2012 through 2025. Microsoft has released patches for all affected versions; exploitation requires user interaction but no specialized technical knowledge.

Windows Shell information disclosure vulnerability (CVE-2026-32151) allows authenticated network attackers to read sensitive data without authorization. The vulnerability affects Windows 10 versions 1607-22H2, Windows 11 versions 22H3-26H1, Windows Server 2012-2025, and associated Server Core installations. Microsoft has released vendor patches for all affected versions; exploitation requires valid credentials and network access but no user interaction.

Windows File Explorer exposes sensitive information to authenticated local users with low privileges, allowing them to read confidential data without modification or service disruption. This affects multiple Windows 10 and Windows 11 versions, as well as Windows Server 2012 through 2025. Microsoft has released patches addressing the information disclosure vector; exploitation requires local system access and valid user credentials.

Windows File Explorer information disclosure vulnerability in Windows 10 and Windows 11 allows authenticated local attackers to read sensitive files through a flaw in access control validation. CVSS 5.5 indicates moderate risk with confidentiality impact but no integrity or availability compromise. Patch available from Microsoft; no public exploit code or active exploitation confirmed at time of analysis.

Out-of-bounds read in Windows GDI allows local unauthenticated attackers to disclose sensitive information with user interaction. The vulnerability affects Windows 10 versions 1607, 1809, 21H2, and 22H2, all Windows 11 versions from 22H3 through 26H1, and Windows Server 2012 through 2025. No public exploit code or active exploitation has been confirmed; a vendor patch is available.

Type confusion in Windows COM component allows authenticated local attackers to read sensitive information from memory. The vulnerability affects Windows 10 (versions 1809, 21H2, 22H2), Windows 11 (versions 22H3 through 26H1), and Windows Server 2019/2022/2025 across multiple installation types. An attacker with local user privileges can exploit improper type handling in COM to disclose confidential data without modifying or disrupting system availability. Microsoft has released patches addressing this information disclosure risk.

Windows Recovery Environment Agent improperly stores sensitive information without adequate removal, allowing physical attackers to extract confidential data and bypass security features. The vulnerability affects Windows 10 versions 1607-22H2, Windows 11 versions 22H3-26H1, Windows Server 2016-2025, and Server Core installations across multiple builds. Microsoft has released vendor patches to remediate the information disclosure.

Improper link resolution in Windows UPnP (upnp.dll) allows authenticated local attackers to disclose sensitive information through symlink following. The vulnerability affects Windows 10 versions 1607-22H2, Windows 11 versions 22H3-26H1, and Windows Server 2012-2025. With local access and standard user privileges, an attacker can read files outside their normal access scope via crafted UPnP operations. Patch available from Microsoft; no public exploit code or active exploitation confirmed at tim

Out-of-bounds read in Microsoft Office Word enables local information disclosure when a user opens a malicious document, affecting Microsoft 365 Apps for Enterprise and Office LTSC for Mac 2021/2024. The vulnerability requires user interaction (document opening) but does not require elevated privileges, with a CVSS score of 6.1 reflecting moderate severity. Microsoft has released patches addressing this issue across affected product lines.

Windows Kernel logs sensitive information that authenticated local users can read, enabling information disclosure on Windows 10 (versions 21H2, 22H2), Windows 11 (versions 22H3, 23H2, 24H2, 25H2, 26H1), Windows Server 2022, and Windows Server 2025. An attacker with local user privileges can access kernel log files to retrieve confidential data such as credentials, cryptographic material, or system secrets. Microsoft has released patches addressing this log injection vulnerability; no public exploit code or active exploitation has been confirmed.

Windows Kernel logs sensitive information that can be read by local authenticated users, allowing information disclosure on Windows 10 and Windows 11 systems across multiple versions as well as Windows Server 2012 through 2025. The vulnerability requires local access and valid user credentials (privilege level L) but results in high confidentiality impact. Microsoft has released patches for all affected versions.

Windows Kernel logs sensitive information that authenticated local users can read, enabling information disclosure on Windows 10 (versions 1809, 21H2, 22H2), Windows 11 (versions 22H3, 23H2, 24H2, 25H2, 26H1), Windows Server 2019, 2022, and 2025. An authorized local attacker with user-level privileges can access kernel log files to retrieve confidential data without elevated rights or user interaction. Microsoft has released patches addressing this CWE-532 insertion-of-sensitive-information vulnerability with specific build fixes across all affected editions.

Windows Remote Procedure Call (RPC) discloses sensitive information to local authenticated users in Windows 10, Windows 11, and Windows Server 2016-2025. An authorized attacker with local access and limited privileges can read confidential data without user interaction, affecting multiple Windows editions across a 9-year product span. Patch availability confirmed from Microsoft; no active exploitation reported.

Windows File Explorer information disclosure vulnerability in Windows 10 and Windows 11 allows authenticated local users to access sensitive information without authorization. The vulnerability affects multiple Windows 10 versions (1607, 1809, 21H2, 22H2), Windows 11 versions (22H3 through 26H1), and Windows Server 2016 through 2025. Microsoft has released patches addressing this CWE-200 information exposure flaw, with no evidence of active exploitation at the time of analysis.