Information Disclosure

Missing authorization enforcement in Craft CMS versions 5.7.0 through 5.10.12 allows authenticated control panel users to query volume metadata for asset repositories they are not permitted to access. The AssetsController::actionMoveInfo method accepts POST requests with arbitrary folderIds and returns asset count and total storage size without verifying the requesting user's volume permissions, violating the principle of least privilege within Craft's multi-volume access model. No public exploit code exists at time of analysis and the vulnerability is absent from CISA KEV; the CVSS 4.0 score of 5.3 with PR:L accurately reflects that an authenticated session is required.

Unauthenticated information disclosure in MasterStudy LMS WordPress Plugin before 3.7.46 exposes learning statistics for any registered user without authorization. The plugin's student statistics endpoint performs no access control check, allowing any remote attacker to retrieve course counts, accumulated points, certificates, quiz totals, and assignment totals for arbitrary user accounts. A publicly available exploit exists per WPScan, and the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or user interaction is required.

Unauthenticated information disclosure in MasterStudy LMS WordPress Plugin before 3.7.46 exposes the titles and IDs of an author's unpublished courses - including draft, pending, and private posts - through an unprotected REST API endpoint. The affected route performs no access control check and applies no publication-status filter, meaning any unauthenticated network request can enumerate course content that site owners intended to keep hidden. A publicly available proof-of-concept exists per the WPScan advisory; no active exploitation has been confirmed in CISA KEV at time of analysis.

Unauthenticated information disclosure in MasterStudy LMS WordPress Plugin (all versions before 3.7.46) exposes per-student course enrollment and learning progress data to any remote attacker without credentials. The plugin fails to perform an authorization check before returning student-specific data, allowing enumeration of any registered user's enrolled courses and progress metrics. A publicly available exploit exists via WPScan; no active exploitation (KEV) has been confirmed, and the CVSS 5.3 score accurately reflects limited confidentiality impact.

FormLayer WordPress plugin before version 1.0.9 discloses full form configuration data to unauthenticated users through its public submission handler, which performs no authorization check before returning stored settings. Notification recipient email addresses, confirmation redirect targets, and third-party integration credentials are exposed for all forms - including unpublished drafts invisible to end users. A public exploit exists via WPScan, and a vendor patch is available at version 1.0.9.

Rank Math SEO WordPress plugin versions before 1.0.277.1 exposes the full content of password-protected posts to unauthenticated users via publicly generated SEO metadata. The plugin fails to enforce WordPress's native post-password gate before extracting post content for use in meta tags and structured data, making protected content readable by anyone who can access the SEO output. A publicly available proof-of-concept is documented by WPScan; a vendor patch (1.0.277.1) is available.

Unauthenticated information disclosure in the Ultimate Member WordPress plugin (all versions before 2.13.0) exposes the content of comments still awaiting moderation and activity from private user profiles to any anonymous visitor. The plugin's profile activity endpoint fails to verify both comment approval status and profile privacy settings before returning data, meaning moderated/private content is served as if it were public. A publicly available proof-of-concept exists; no active exploitation has been confirmed via CISA KEV.

Plaintext password disclosure in the Gutentor WordPress page builder plugin (before 4.0.6) allows any authenticated subscriber-level user to retrieve the passwords of password-protected posts via a misconfigured REST API endpoint. The endpoint fails to enforce WordPress's built-in content-access context restrictions, meaning the security model of password-protected posts is completely bypassed for any site user who can authenticate. A publicly available exploit exists per WPScan, and a patched release (4.0.6) is available from the vendor.

Unauthenticated information disclosure in the Solace Extra WordPress plugin before 1.7.0 exposes the full content of non-published Site Builder parts - drafts, pending posts, private pages, and trashed items - to any anonymous visitor via an unprotected AJAX action. The plugin registers an AJAX handler that performs no capability check and no post-status validation, bypassing WordPress's normal access controls entirely. A public proof-of-concept is available through WPScan; the vendor has released version 1.7.0 to close the gap.

Cross-origin data leak in Google Chrome's Skia graphics library (prior to 152.0.7977.75) enables an attacker who has already achieved renderer process compromise to extract cross-origin data via a crafted HTML page. This is a second-stage vulnerability in an exploit chain: it does not enable initial access but amplifies an existing renderer compromise by breaking the Same-Origin Policy boundary. No public exploit code and no CISA KEV listing have been identified at time of analysis, though Google internally rates this 'High' severity - notably elevated above the computed CVSS 3.1 (Low) score.

Information leakage via the MediaCapture component in Google Chrome prior to 152.0.7977.75 enables a remote attacker to exfiltrate sensitive browser-side data by directing a user to a specially crafted HTML page. The flaw (CWE-200) resides in Chrome's implementation of the W3C Media Capture API, which handles camera, microphone, and display-capture device access, and may expose captured media content or associated metadata beyond the intended same-origin boundary. Google has released a fix in the 152.0.7977.75 stable channel update; no public exploit has been identified at time of analysis.

Address bar spoofing in Google Chrome on Android prior to version 152.0.7977.75 allows an unauthenticated remote attacker to deceive users about their true browsing origin by triggering fullscreen mode via a crafted HTML page. The flaw (CWE-451: UI Misrepresentation of Critical Information) causes the address bar to be suppressed or misrepresented during fullscreen transitions, creating a reliable phishing surface on Android devices. Google has released a fix in Chrome 152.0.7977.75; no public exploit code has been identified and CISA SSVC rates exploitation as none at time of analysis.

Confused deputy vulnerability in Chrome's CredentialProvider component on Windows allows a remote attacker who has already established renderer process compromise to leak sensitive credential information via a crafted HTML page. Affected versions are Chrome for Windows prior to 152.0.7977.75. Google rates this Low severity internally, though the CVSS Confidentiality impact is scored High due to the potential for credential disclosure; the AC:H vector reflects the significant prerequisite of prior renderer compromise. No public exploit code or CISA KEV listing has been identified at time of analysis.

CVE-2026-80220 is attributed to Ubuntu but carries no description, CVSS score, CWE classification, or technical details in the available intelligence data. Without a vulnerability description or affected component, no characterization of attacker capability, impact type, or affected user population is possible. Security teams should monitor Ubuntu Security Notices directly at ubuntu.com/security/notices for authoritative details as they become available.

CVE-2026-16658 is attributed to Ubuntu (vendor source) but carries no available description, CVSS score, CWE classification, or reference data at time of analysis. The affected component, attack vector, and impact are entirely unknown from the provided intelligence. No meaningful characterization of attacker capability or defender exposure can be made without additional disclosure from Canonical or NVD.

Unauthenticated information disclosure in WWBN AVideo through 30.0 exposes sensitive configuration data via the MobileManager plugin's getConfiguration endpoint. Any remote attacker can issue a GET request to plugin/MobileManager/getConfiguration.json.php without credentials and receive TLS private key file paths, socket configuration details, platform version, and debug flags. While the direct confidentiality impact is limited (file paths and config metadata rather than key material itself), the leaked data provides meaningful reconnaissance for follow-on attacks targeting the installation. No public exploit or CISA KEV listing is identified at time of analysis.

Path traversal in WWBN AVideo's unauthenticated `get_api_login_code` API endpoint enables remote attackers to delete arbitrary `.log` files and enumerate filesystem paths by injecting directory traversal sequences into the `code` parameter. All versions covered by CPE `cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*` are affected, with exploitation requiring no authentication or user interaction. The primary security consequence is destruction of audit trails and access logs, which undermines incident detection and forensic response capabilities; no public exploit code has been identified at time of analysis.

Out-of-bounds read in the HPE AOS-CX network operating system allows adjacent unauthenticated attackers to disclose sensitive OS memory contents by sending a specially crafted packet. The flaw requires no credentials and no user interaction, but is constrained to same-segment network access (AV:A), limiting exposure to attackers who have already achieved a foothold on the target network or VLAN. This is one of several vulnerabilities disclosed in HPE advisory HPESBNW05134, which also covers more severe unauthenticated adjacent RCE issues (CVE-2026-73782, CVSS 8.8) and network-reachable RCE (CVE-2026-73749, CVSS 9.8) in the same product line - those higher-severity siblings should be prioritized alongside this finding. No public exploit has been identified at time of analysis.

Information disclosure in HPE AOS-CX exposes sensitive API endpoint data to a remote unauthenticated attacker who can achieve a man-in-the-middle position on the network path. Intercepted data could include credentials, session tokens, or configuration material usable to further compromise the affected switch or pivot into managed network infrastructure. This CVE is part of a broader HPE advisory (hpesbnw05134) covering at least four additional AOS-CX vulnerabilities; no public exploit code and no CISA KEV listing have been identified.

Cleartext exposure of sensitive information in HPE Networking Fabric Composer's management interface can be triggered by an authenticated administrator, potentially revealing credentials or configuration data for downstream network services. The vulnerability requires both administrative privileges and high attack complexity (CVSS 2.2, AV:N/AC:H/PR:H), meaning realistic exploitability is limited to insiders or attackers who have already fully compromised an admin account. Successful exploitation could enable lateral movement into network services managed by Fabric Composer. No public exploit code or CISA KEV listing has been identified.

Unauthenticated remote information disclosure in HPE Networking Fabric Composer exposes cleartext data through the web-based management interface to network-positioned attackers. Exploitation demands high attack complexity (CVSS AC:H), constraining real-world risk despite the network-accessible, no-authentication vector. The vendor advisory identifies remediation; no public exploit code or CISA KEV listing has been identified, though the disclosed data could enable secondary compromise of dependent network infrastructure.

Cleartext exposure of sensitive information in the HPE Networking Fabric Composer API allows a local attacker holding administrative credentials to retrieve secrets that the system is expected to protect in encrypted form. The vulnerability is constrained to local access with high privileges already obtained, yielding a CVSS 3.1 score of 4.4 (Medium). No public exploit code or active exploitation has been identified at time of analysis; the advisory originates from HPE itself, suggesting proactive disclosure rather than incident response.

Local information disclosure in HPE Networking Fabric Composer allows an authenticated low-privileged operator user with local system access to read sensitive OS-level data, potentially enabling privilege escalation on the affected host. The vulnerability resides in the underlying operating system layer exposed through Fabric Composer's operator access model, and is constrained by both a local attack vector and high complexity requirement. No public exploit code has been identified and this entry does not appear in the CISA KEV catalog.

Unauthenticated file read in HPE Networking Fabric Composer's web-based management interface exposes a subset of system files to remote attackers without requiring any credentials. The vulnerability is confined to files within a specific affected directory rather than offering arbitrary filesystem access, yielding a limited confidentiality impact consistent with the CVSS 5.3 (C:L) score. No active exploitation (KEV) or public proof-of-concept has been identified at time of analysis, and no EPSS signal is provided in available intelligence.

Authenticated privilege escalation in HPE Networking Fabric Composer's API allows low-privilege operator users to read limited information and make limited configuration changes beyond their authorized scope. The flaw affects all tracked versions per CPE data and requires only a valid low-privilege account to exploit - no special configuration or user interaction is needed. No public exploit code and no CISA KEV listing are present at time of analysis, keeping real-world risk moderate despite network accessibility.

Local information disclosure in HPE Networking Fabric Composer exposes sensitive operating-system-level data to authenticated low-privilege operator users with local system access. The CVSS Scope:Changed metric reflects that the leaked data crosses from the Fabric Composer application boundary into the underlying host OS, and HPE warns the recovered information could enable further unauthorized access to the affected system and interconnected infrastructure. No public exploit is identified at time of analysis; exploitation requires both a valid low-privilege credential and local system access, materially constraining the realistic threat population.

Unauthenticated information disclosure in HPE Networking Fabric Composer's API endpoint exposes internal service and workflow details to remote attackers under high-complexity conditions. The vulnerability requires user interaction per the CVSS vector (UI:R), which is atypical for an API endpoint flaw, suggesting a specific trigger mechanism or chained condition not fully described in the advisory. Impact is limited to low confidentiality exposure, though HPE's own advisory frames it as a stepping stone that increases risk when chained with other vulnerabilities. No public exploit or KEV listing identified at time of analysis.

Timing side-channel exposure in phpseclib's pure-PHP X25519 scalar multiplication allows a local observer to recover a reused 251-bit clamped private key. Data-dependent conditional modular reductions in PrimeField/Integer.php cause per-step timing and libgmp call-count variation during the Montgomery ladder, leaking scalar bits when the same private key is used across multiple operations. Only applications using a long-lived or reused X25519 private key on the pure-PHP code path are at risk; phpseclib's standard SSH ephemeral key exchange is explicitly unaffected. Vendor-released patches exist in versions 3.0.57 and 4.0.1; no public exploit has been identified at time of analysis.

NoSQL injection in Kibana exposes unauthorized Elasticsearch data to authenticated low-privilege users who can submit crafted query input. The flaw, classified as CWE-943 (Improper Neutralization of Special Elements in Data Query Logic / CAPEC-676), allows manipulation of backend NoSQL query logic to return records outside the user's authorized data scope. Elastic has released fixed versions 9.4.5 and 9.5.1 per ESA-2026-168; no public exploit or CISA KEV listing has been identified at time of analysis.

Kibana's missing server-side authorization check (CWE-862) allows any authenticated user holding only minimal Elasticsearch privileges to bypass Kibana feature authorization and Space access controls, reading Fleet deployment metadata from the default Kibana space without having been granted that permission. The flaw is rooted in an absent authorization gate on Fleet API paths rather than a misconfiguration, meaning the control is simply not enforced rather than configured incorrectly. Elastic has self-reported the issue and released fixes in versions 9.4.6 and 9.5.1 per advisory ESA-2026-149; no public exploit code or active exploitation (CISA KEV) has been identified.

Missing authorization on an internal Kibana APM integration function exposes APM server credentials to any authenticated Kibana user. The affected endpoint was designed for APM or Fleet administrators but lacked the corresponding role-based access control check, allowing lower-privileged authenticated users to retrieve secrets that govern access to the APM backend. No public exploit code or CISA KEV listing exists at time of analysis; however, the straightforward exploitation path and high confidentiality impact from credential exposure make this a meaningful lateral-movement risk in Elastic Stack deployments.

HTTP Request Smuggling in Elasticsearch allows a network attacker to intercept confidential HTTP responses intended for other authenticated users when Elasticsearch is deployed behind certain proxy configurations. The vulnerability (CWE-444, CAPEC-33) arises from inconsistent HTTP request boundary interpretation between the intermediary proxy and Elasticsearch, enabling response queue poisoning that leaks data across user sessions. Vendor-released patches 8.19.20, 9.4.5, and 9.5.1 are available per ESA-2026-141; no public exploit code or CISA KEV listing has been identified at time of analysis.

Privilege abuse in Kibana's machine learning feature allows any user holding read-only ML access to retrieve data from Elasticsearch indices they are not authorized to see. The flaw (CWE-250) occurs because Kibana executes certain ML read operations under an internal service identity rather than forwarding the requesting user's credentials to Elasticsearch, effectively bypassing Elasticsearch's index-level access controls. Elastic self-disclosed the issue in ESA-2026-135 and released fixes across three active release lines; no public exploit code has been identified.

Authorization bypass in gRPC-Go's xDS RBAC HTTP filter prior to v1.83.1 allows network attackers to evade DENY policies when header matcher names use mixed case. Because gRPC metadata keys are always lowercased at the protocol layer, a DENY rule configured with canonical HTTP capitalization (e.g., `X-Role`, `User-Agent`) never fires, causing the policy to fail open and permit requests it should block. The same case mismatch also enables bypass of gRFC A41 pseudo-header validation (`:Scheme`, `Grpc-Status`) and prevents `Host` from being rewritten to `:authority`. No public exploit is identified at time of analysis; a vendor-confirmed fix ships in v1.83.1.

Uninitialized heap memory disclosure in gvfs's SFTP backend enables a malicious SFTP server to deterministically defeat ASLR on client systems running RHEL 6 through 10. When a user mounts a crafted SFTP share, the read_string() parser allocates a buffer for the FXP_HANDLE response but does not verify that the buffer is fully populated; the client subsequently echoes the uninitialized remainder - containing heap base pointers and the libgio load address - back to the attacker on every subsequent file-handle request. No public exploit has been identified at time of analysis, and the issue does not appear in CISA KEV, but the ASLR bypass it achieves is a high-value precursor for chained memory-corruption attacks against gvfsd-sftp.

Improper privilege management in Cleo Harmony's JWT Refresh Token Handler allows remote unauthenticated attackers to manipulate the Bearer argument on the /api/connections API endpoint, resulting in unauthorized access to connection data and potential privilege escalation. Affected versions span all releases up to and including 5.8.1.10, with a public exploit already available (E:P per CVSS 4.0 supplemental). No active exploitation confirmed in CISA KEV, but the combination of network accessibility, zero-privilege requirement, and public proof-of-concept materially elevates real-world risk.

Unauthenticated enumeration of internal PKI topology is possible in Red Hat Certificate System 9 through an unprotected REST endpoint. Any network-accessible client can issue GET /ca/rest/securityDomain/hosts and receive a structured inventory of all participating CA subsystem hosts, their roles, and security domain membership - without presenting credentials, a client certificate, or a session token. While the direct CVSS impact is rated medium (5.3), the real-world significance lies in enabling precise reconnaissance of internal PKI infrastructure that could facilitate targeted follow-on attacks against specific subsystems. No active exploitation is confirmed and no public exploit code has been identified at time of analysis.

Information disclosure in Firefox for Android's WebExtensions component exposes sensitive browser or cross-origin data to remote attackers who can induce user interaction. Affecting all Firefox for Android versions prior to 155, the flaw is accessible over the network with low complexity but requires a user to interact with attacker-controlled content, gating mass exploitation. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.

Use-after-free in Firefox's DOM Core & HTML component allows network-reachable attackers to achieve limited memory disclosure and DOM integrity impact against users running Firefox below version 155 or Firefox ESR below 153.2. Exploitation requires user interaction - a victim must visit or be redirected to attacker-controlled content - but no authentication or elevated privileges are needed. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; Mozilla has released patched versions addressing the flaw.

Use-after-free memory corruption in Firefox's DOM Core and HTML component allows a remote attacker to achieve limited confidentiality and integrity impact against users running unpatched Firefox versions by directing them to a crafted webpage. All Firefox releases prior to version 155, ESR 140.15, and ESR 153.2 are affected; Mozilla has shipped fixes across all three release channels. No public exploit code or active exploitation has been identified at time of analysis.

Use-after-free in Firefox's Audio/Video media pipeline allows unauthenticated remote attackers - requiring only user interaction - to read or modify limited browser memory content. Affected releases span Firefox stable prior to 155 and both ESR tracks prior to 140.15 and 153.2, covered by three separate Mozilla security advisories (MFSA2026-82, MFSA2026-84, MFSA2026-85). No public exploit code exists at time of analysis and SSVC exploitation status is 'none,' though the CWE-416 class carries inherent escalation risk beyond the partial impact Mozilla scored.

Use-after-free in Firefox's JavaScript garbage collector (GC) component exposes users to partial memory disclosure and corruption when visiting attacker-controlled web pages. Both the standard release line (Firefox 155) and the extended support release (Firefox ESR 153.2) are patched. No public exploit or active exploitation is confirmed; SSVC exploitation status is none and the vulnerability is absent from CISA KEV.

Use-after-free in Firefox's Audio/Video component exposes users running Firefox prior to version 155 and affected ESR branches to potential heap memory disclosure and limited data modification when processing attacker-controlled media. The vulnerability is network-reachable but requires user interaction - visiting a malicious or compromised page that triggers media playback - and carries a CVSS score of 5.4 reflecting bounded C:L/I:L impact with no availability loss. No public exploit code or active exploitation has been identified at time of analysis; SSVC assessment classifies exploitation status as none and the vulnerability as non-automatable.

Unauthenticated network attackers can elicit Java stack traces from Red Hat IdM's Dogtag CA REST enrollment endpoint (POST /ca/rest/certrequests) by submitting malformed requests, causing HTTP 500 responses that expose internal implementation details under CWE-209. The same error path simultaneously amplifies the CA debug log with large multi-line stack traces, creating a log-fill resource exhaustion vector that drives disk growth and I/O contention on affected RHEL 6 through 10 deployments. No public exploit has been identified at time of analysis, but the attack requires no authentication and low complexity, making it accessible to unskilled opportunistic attackers targeting IdM infrastructure.

Untrusted pointer dereference in Samsung mTower's Secure world entry point allows a Non-Secure world caller to supply pointer values referencing Secure RAM, causing the TEE kernel to dereference those addresses on behalf of the attacker and potentially exposing or corrupting cryptographic material and other Secure world state. All mTower deployments before commit 06994e303637512e39062f3e037c222e8448e57e on ARM Cortex-M TrustZone hardware are affected, spanning both the session-open and invoke-command paths. No public exploit code has been identified and the vulnerability is absent from CISA KEV; however, the security boundary violated - Normal World to Secure World - represents a fundamental TrustZone integrity failure with real confidentiality and integrity consequences that the provided CVSS score significantly understates.

Unauthenticated REST endpoint access in the KiviCare WordPress plugin (before 4.5.5) exposes both a clinic's full patient roster and, critically, the configured payment gateway secret key to any unauthenticated remote attacker. The vulnerability stems from missing authorization checks on specific REST API routes, requiring no credentials or user interaction to exploit. A publicly available proof-of-concept is documented by WPScan, materially lowering the bar for exploitation across any WordPress site running an unpatched version of this clinic management plugin.

Shortcode injection in MW WP Form WordPress plugin (versions before 5.1.5) allows unauthenticated remote attackers to execute any WordPress shortcode registered on the target site. The plugin fails to neutralize shortcode syntax in user-submitted form values before passing those values through WordPress's shortcode processing engine. A publicly available proof-of-concept exists (via WPScan), though exploitation is gated by a non-default site configuration requirement, which suppresses real-world risk despite the network-accessible attack vector.

Web cache poisoning in WP Fastest Cache WordPress plugin before 1.5.1 enables unauthenticated attackers to inject content into the site-wide page cache by exploiting its failure to include tracking-related query parameters in cache key construction. Because the plugin caches responses to URLs containing these parameters under the canonical clean-URL key, an attacker-controlled page render is stored and subsequently served to every visitor of the legitimate URL. A publicly available proof-of-concept exploit exists; no active exploitation confirmed in CISA KEV at time of analysis.

Sensitive field value disclosure in Ash Framework's atomic confirmation validator allows any caller of a vulnerable action to extract a stored sensitive attribute by intentionally submitting a wrong confirmation argument. Versions 2.17.20 through before 3.32.2 of ash-project/ash are affected: when an actor supplies only the confirmation argument and omits the field itself, the atomic `Confirm` validator resolves the mismatch error's `value` through `atomic_ref/2` to the field's current stored database value and returns it in the error payload. No public exploit exists beyond the regression test shipped with the fix commit, and this vulnerability does not appear in the CISA KEV catalog.

Sensitive application data leaks from HTTP 500 responses in ash_typescript versions 0.15.0 through 0.17.x due to an ungated code path that serializes handler return values verbatim using Elixir's inspect/2. Any unauthenticated caller who can trigger a typed-controller route whose handler falls through with a non-conn term - such as {:error, %User{}} - receives the full Elixir struct inspection, potentially including hashed passwords, session tokens, and tenant identifiers, in the JSON error body. No public exploit identified at time of analysis, but the disclosure is trivially reproducible with a standard HTTP client given the right application-layer condition.

Sensitive internal error data - including runtime secrets potentially carried in Ash error vars fields - leaks to unauthenticated network clients in ash_typescript 0.8.0 through 0.17.x when a configured error handler raises a FunctionClauseError on an unmatched error shape. The rescue clause in apply_error_handler/3 was intended as a safety net but fell back to returning the original, unredacted error map rather than a safe generic response, inverting the intended suppress-on-failure semantics. No public exploit code has been identified and there is no CISA KEV listing; a patched release (0.18.0) is available from the Ash Project.

HTTP request smuggling in Node.js's HTTP client module enables forwarding proxies to desynchronize backend connections when request headers exceed the maxHeadersCount or maxHeaderPairs thresholds. When a Node.js-based proxy rebuilds outbound request headers from the visible IncomingMessage properties and pipes the original body over a reused backend connection, framing-critical headers such as Content-Length are silently omitted from the proxy's outbound request while still governing body delivery internally - causing the backend to misparse the request stream. No public exploit has been identified at time of analysis, and exploitation is constrained to specific proxy architectures, which is reflected in the CVSS 3.7 Low score.

Sensitive WooCommerce order and product data is exposed to authenticated subscribers in the 'Print Barcode Labels for your WooCommerce products/orders' WordPress plugin versions 4.0.0 and below, developed by ukr_solution. The flaw (CWE-201) allows low-privilege authenticated users - those holding only a subscriber role - to retrieve data beyond their authorized scope, yielding a High confidentiality impact per CVSS. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.

Revoked API token enforcement is absent in QuantumNous new-api up to 1.0.0-rc.15, allowing a holder of a disabled token to query read-only endpoints such as /api/usage/token/ and retrieve usage log data. The root cause (CWE-613, Insufficient Session Expiration) lies in the TokenAuthReadOnly middleware in middleware/auth.go, which skipped the disabled-token status check entirely before the patch. A public POC is available; no active exploitation is confirmed in CISA KEV, and the CVSS 4.0 score of 2.1 reflects the narrow, low-impact attack surface.

Address bar spoofing in Firefox for iOS lets a malicious webpage stall a popup's cross-origin navigation after the browser internally commits it, causing the address bar to display the intended destination's origin while the popup continues rendering attacker-controlled content. All Firefox for iOS releases prior to 155.0 are affected; the fix shipped in version 155.0 per Mozilla advisory MFSA2026-81. No public exploit has been identified and CISA SSVC confirms exploitation status as none, but the phishing potential is realistic given the deceptive UI state.

Improper access control in dibo-software diboot 3.8.0 allows authenticated remote attackers to bypass tenant isolation by manipulating the tenantId parameter in the Tenant Administrator Management API at /admin/. An attacker with low-privileged access to one tenant can read and modify data belonging to other tenants, breaking the multi-tenant security boundary. A public proof-of-concept exploit exists, and the vendor has not responded to disclosure, leaving users without an official patch.

Information disclosure in extension.vn 2FA Authenticator Extension 1.0.0.2 for Chrome exposes stored TOTP secrets via an unvalidated external message listener. The Background Service Worker's `chrome.runtime.onMessageExternal.addListener` handler fails to verify the `sender.id` field, meaning any other locally-installed Chrome extension can send a crafted message and receive TOTP seeds in response. A public proof-of-concept exploit exists; exploitation is constrained to local access with low-privilege conditions per the CVSS 4.0 vector (AV:L/PR:L), and no active exploitation has been confirmed.

Information disclosure in vidIQ Vision for YouTube Extension 3.199.0 on Chrome exposes YouTube video frame captures to any web page able to send crafted postMessage events. The extension's window.addEventListener handler processes incoming messages without validating the sender origin, allowing a remotely-hosted malicious page to exfiltrate frame capture data by manipulating the vidiqEvent argument. No patch is available - the vendor has explicitly stated they do not accept vulnerability submissions and operate no bug bounty program - and a public proof-of-concept exploit is available on GitHub.

HCL Connections exposes sensitive information to unauthorized users through improper handling of request data, classified under CWE-359 (Exposure of Private Personal Information to an Unauthorized Actor). The vulnerability affects all tracked versions per the wildcard CPE and is exploitable over the network, though high attack complexity (AC:H) and required user interaction (UI:R) substantially constrain real-world exploitability. No public exploit code or active exploitation has been identified at the time of analysis, and the CVSS score of 3.1 reflects the limited confidentiality impact and constrained attack prerequisites.

Cleartext password storage in sambitraj's Student Management System exposes user credentials to privileged attackers who can access the database or application backend. The flaw resides in aca.sql within the Password Handler component, where passwords are persisted without hashing or encryption. A proof-of-concept has been publicly disclosed via a GitHub issue, though exploitation requires high-privilege access, keeping real-world risk low despite the sensitive nature of the exposed data.

Default credentials hardcoded in the aca.sql database initialization file of sambitraj's Student-Management-System expose unauthenticated remote attackers to authentication bypass using publicly known passwords across all commits through 56ba287f. The project's GitHub issue tracker hosts a public proof-of-concept, and the maintainer has not responded to the disclosure, leaving no remediated release available. The limited deployment footprint (a niche student-facing open-source project) constrains aggregate real-world impact despite the trivial exploitability of default credentials.

Session cookie exposure in sambitraj's Student-Management-System allows attackers to steal session tokens via client-side JavaScript due to the absence of the HttpOnly flag in the `session_start` function. All commits up to 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5 are affected, and no vendor patch exists as the maintainer has not responded to the responsible disclosure. A publicly available proof-of-concept exists, though exploitation requires high attack complexity and a co-present XSS vector to materialize as a session hijack.

Double-free memory corruption in Valkey 9.1.0's Module Timer Subsystem allows a high-privileged remote attacker to crash the server by triggering a self-stopping timer callback pattern. The moduleTimerHandler function in src/module.c frees the timer object both inside the callback (via ValkeyModule_StopTimer) and again after callback return, causing a double-free. A public proof-of-concept has been disclosed via GitHub, though the CVSS 4.0 score of 1.9 reflects that exploitation requires high-privilege module control, severely constraining real-world impact to low-severity availability disruption.

Direct remote access to an unprotected SQL database backup file in code-projects Simple Inventory System 1.0 allows unauthenticated attackers to retrieve the full contents of the inventory database without any credentials or user interaction. The file inventorymanagement.sql is stored within the web-accessible directory and is directly downloadable via HTTP. A publicly documented proof-of-concept on GitHub confirms trivial exploitability of this exposure.

Tenant hijacking and request degradation in AshPhoenix (ash_phoenix 2.1.26 through 2.3.24) allows unauthenticated remote clients to force an Ash multi-tenant application to resolve an arbitrary tenant by supplying a crafted HTTP Host header. The root cause is that AshPhoenix.Helpers.get_subdomain/2 interpolated the configured root domain verbatim into a regex pattern, causing domain dots to act as any-character wildcards and the match to be applied unanchored and globally - so Host: foo.exampleXcom.attacker.net satisfied a rule intended to match only subdomains of example.com, returning foo as the tenant. A separate case-sensitivity flaw allowed TENANT.EXAMPLE.COM to bypass the allowlist check entirely. No CISA KEV listing and no public proof-of-concept have been identified at time of analysis, but exploitation requires no authentication and no special tooling.

Sensitive form parameters leak into server logs, crash reports, and the Phoenix development error page in ash_phoenix versions 1.2.17 through 2.3.24, where AshPhoenix.Form.Auto embeds the complete raw submitted param map verbatim into exception messages when a union sub-form receives an unrecognized _union_type value. Because the exception is raised inside library code rather than Phoenix's controller layer, the standard :filter_parameters configuration cannot redact the exposure-any field co-submitted with the union form field, including passwords and tokens, appears in plaintext in the raised message. No public exploit has been identified at time of analysis, but any user capable of submitting a form with a union field can deliberately trigger the leak regardless of intent.

Out-of-bounds read in Kamailio's IMS AVP handler exposes telecom infrastructure to remote memory disclosure and potential service disruption. The `get_4bytes()` function across five IMS modules - `ims_auth`, `ims_icscf`, `ims_registrar_scscf`, `ims_charging`, and `ims_ocs` - fails to validate that Diameter AVP data buffers contain at least 4 bytes before reading, allowing a remote attacker with low-privilege Diameter interface access to trigger the flaw via a crafted malformed message. Publicly available exploit code exists per GitHub issue #4816, and the vendor has confirmed that the 5.5.0 branch is end-of-life and will receive no further security updates, compounding risk for operators running that release.

Uncontrolled recursion in BBEdit's Java Language Module (versions through 15.5.5) allows a remote attacker to crash or hang the editor by delivering a specially crafted Java source file that a user then opens. The root cause is CWE-674: the Java parser lacks depth-limiting guards, enabling deeply nested constructs to exhaust the call stack and produce a denial-of-service against the editor process. No active exploitation has been recorded and no public proof-of-concept exploit code is known; the issue was surfaced through fuzzing research by Cipher Security Labs, and Bare Bones Software has released a fix in BBEdit 16.0.

Unfiltered exception serialization in ash_ai 0.6.0-0.x leaks internal application details - database schema, raw SQL fragments, policy module names - to authenticated chat users via the LLM conversation stream. AshAi.ToolLoop and AshAi.Tools used Elixir's Exception.message/1 verbatim to encode any raised tool exception into the tool-result payload, which the language model then relayed to the requesting user. Any authenticated user able to steer tool arguments into a code path that raises an exception could extract sensitive internal reconnaissance data; ash_ai 1.0.0 closes the gap by routing all tool exceptions through a safe formatter. No public exploit code and no CISA KEV listing have been identified at time of analysis.

Improper authorization in LogNet's grpc-spring-boot-starter affects annotation processing logic in versions up to 5.2.0, allowing authenticated remote attackers with low privileges to bypass access controls under high-complexity conditions. The vulnerability stems from CWE-266 (Incorrect Privilege Assignment) in the component responsible for processing security annotations on gRPC service endpoints. A proof-of-concept exploit has been publicly disclosed; no vendor patch is available as the project has not yet responded to the responsible disclosure report.

Insufficient data prevents meaningful synthesis of CVE-2026-63109. The only confirmed intelligence signal is a vendor report attributed to Ubuntu, with no description, CVSS score, CWE classification, or version information available at time of analysis. No impact, affected component, or attack scenario can be characterized from the provided data.

CVE-2026-18054 is associated with the Ubuntu platform per vendor reporting, but no description, CVSS score, CWE classification, or technical details are available in the provided data. Without a vulnerability description, the affected component, impact, and exploitation conditions cannot be determined. A meaningful security assessment is not possible from the supplied intelligence.

CVE-2026-61406 is reported by Ubuntu with no public description, CVSS score, CWE classification, or affected version data available at time of analysis. The nature, impact, and exploitability of this vulnerability cannot be characterized from the provided intelligence. Security teams should monitor Ubuntu Security Notices (USN) and the Ubuntu CVE tracker for forthcoming disclosure.

CVE-2026-50624 has no publicly available description, CVSS score, CWE classification, or reference data at time of analysis. The only available metadata is a reporter tag of 'vendor:ubuntu', indicating Ubuntu as the reporting source. No meaningful impact, affected component, or attack vector can be determined from the supplied data.

CVE-2026-61405 has been reported via Ubuntu's vendor security channel, but no description, CVSS score, CWE classification, or supporting intelligence is available at time of analysis. The affected package, vulnerability class, and impact cannot be determined from the provided data. Security teams should consult Ubuntu Security Notices (USN) directly for authoritative details before making triage decisions.

Insufficient data prevents meaningful synthesis for CVE-2026-17516. The only available signal is a vendor report attributed to Ubuntu, with no description, CVSS score, CWE, affected versions, or references provided. No impact, attack vector, or affected component can be determined from the supplied input.

CVE-2026-16288 is reported by Ubuntu but carries no public description, CVSS score, vector, or CWE at time of analysis. The vulnerability's nature, affected component, and impact are entirely unconfirmed. No meaningful synthesis is possible without a description or scoring data; treat this record as a placeholder pending vendor disclosure.

CVE-2026-63321 has been reported via Ubuntu's vendor channel, but no description, CVSS score, CWE classification, or technical detail is available in the provided intelligence data. The affected component, vulnerability class, and impact cannot be characterized with the current dataset. Security teams should query Ubuntu's security tracker directly for authoritative details before making prioritization decisions.

CVE-2026-61404 was reported by Ubuntu but carries no published description, CVSS score, vector, or CWE classification at the time of this analysis. The affected component, vulnerability class, and attacker capabilities cannot be determined from available data. No meaningful impact assessment is possible until Ubuntu publishes a security advisory.

CVE-2026-61476 is reported by Ubuntu with no description, CVSS score, vector, or CWE available at time of analysis. Affected component, vulnerability class, and impact cannot be determined from the provided data. No meaningful synthesis is possible until Ubuntu publishes a security advisory.

CVE-2026-15264 is reported by the Ubuntu vendor source but carries no description, CVSS score, CWE classification, or reference links at time of analysis. No meaningful synthesis of impact, affected component, or attacker capability is possible from the available data. Security teams should treat this as an uncharacterized disclosure pending vendor publication of a full advisory.

CVE-2026-63320 has no publicly available description, CVSS score, or CWE classification at time of analysis. The sole intelligence signal is a vendor report attributed to Ubuntu. Without a description, affected version range, or impact details, no meaningful impact statement can be made - this record should be treated as pending NVD enrichment.

CVE-2026-58581 has been reported through Ubuntu's vendor channel, but no description, CVSS score, vector, or CWE data is available at time of analysis. The affected product, vulnerability class, and impact cannot be characterized without a description. No exploitation status, patch information, or affected version range can be determined from the supplied intelligence.

Insufficient data exists to characterize CVE-2026-63323 meaningfully. The CVE record contains no description, no CVSS score, no CWE, and no references beyond a single vendor:ubuntu tag. The affected product, vulnerability class, and impact are all unknown at this time. Security teams should treat this as an unresolved record and monitor NVD and Ubuntu Security Notices (USN) for updates.

CVE-2026-65928 has no available description, CVSS score, CWE classification, or affected version data at time of analysis. The sole intelligence signal is a vendor attribution to Ubuntu. No meaningful impact, attack vector, or affected population can be determined from the provided data. Security teams should monitor for NVD publication and Ubuntu Security Notices (USN) before making prioritization decisions.

CVE-2026-63322 has been reported by Ubuntu's security team, but no description, CVSS score, CWE classification, or exploit intelligence is publicly available at time of analysis. The vulnerability's impact, affected component, and exploitability cannot be determined from current data. Security teams should monitor the Ubuntu Security Notices portal and USN advisories for disclosure.

CVE-2026-63110 is reported by Ubuntu but carries no description, CVSS score, vector, or CWE in the available intelligence data, making meaningful impact assessment impossible at this time. The sole attribution signal is 'vendor:ubuntu', indicating Ubuntu has acknowledged or reported this identifier, but the affected component, vulnerability class, and exploitability are entirely unknown. Security teams should monitor Ubuntu Security Notices (USN) and the NVD entry for this CVE until authoritative details are published.

CVE-2026-81497 is an Ubuntu-reported security update with no substantive technical detail available in the current data set. The description contains only the phrase 'security update,' which provides no insight into the affected component, vulnerability class, or impact. No CVSS score, CWE, CPE strings, EPSS data, KEV status, or references were supplied, making meaningful risk characterization impossible at this time.

CVE-2026-65929 is reported by Ubuntu with no description, CVSS data, CWE classification, or affected package information available at this time. The vulnerability cannot be characterized beyond its association with the Ubuntu vendor source. Security teams should monitor Ubuntu Security Notices (USN) and the NVD entry for this CVE as data becomes available.

CVE-2026-81496 is documented only as a 'security update' by the Ubuntu vendor source, with no description, CVSS score, CWE classification, or reference links provided in the available intelligence. The affected component, impact class, and exploitation conditions cannot be determined from the current data. No meaningful characterization of attacker capability or victim exposure is possible without additional vendor disclosure.