Improper authentication in MCPHub up to version 0.9.10 allows remote attackers to bypass authentication on the SSE connection handler. No active exploitation has been reported in CISA KEV, but public exploit code is available. EPSS 0.20% indicates low likelihood of widespread exploitation despite the public PoC.
SQL injection in Tipray Data Leakage Prevention System 1.0 via the sort parameter in findDeptPage.do allows remote unauthenticated attackers to execute arbitrary SQL commands. A public exploit is available, and the vendor has not responded to the disclosure. EPSS score is low (0.03%) suggesting limited exploitation interest despite ease of exploitation.
Hard-coded password vulnerability in Zytec Dalian Zhuoyun Technology Central Authentication Service version 3 allows remote unauthenticated attackers to bypass authentication for the Git endpoint via a crafted Authorization header. Publicly available exploit code exists, but no patch has been released and the vendor has not responded. Despite a moderate CVSS base score, the EPSS probability is low (0.05%) and there is no evidence of active exploitation in CISA KEV.