Stored cross-site scripting (XSS) in Koollab LMS courselet feature allows authenticated users to inject arbitrary JavaScript that executes in the browsers of other users with courselet access, potentially compromising account security and enabling credential theft or malicious actions on behalf of affected users. CVSS 5.4 reflects network delivery, low complexity, and limited confidentiality/integrity impact constrained by required user interaction and authenticated access.
Arbitrary code execution in OpenClaw's OpenShell mirror mode (npm package versions <= 2026.3.24) allows attackers with mirror mode access to plant malicious JavaScript in the sandbox hooks/ directory, which is synced to the host workspace and executed during gateway startup. The GHSA advisory confirms this flaw shipped in production releases and rates it medium severity due to a narrow exploitation chain requiring four concurrent conditions. EPSS is 0.01% (2nd percentile) and SSVC indicates no active exploitation; no CISA KEV listing exists at time of analysis, though technical impact is rated total if successfully exploited. Vendor-released patch is available in v2026.3.28.
Approval integrity bypass in OpenClaw's pnpm dlx command-planning path (all versions up to 2026.4.1) allows a low-privileged local attacker to replace an approved local script between the approval decision and actual execution, running arbitrary code under a still-valid approval plan. The root cause is a TOCTOU flaw (CWE-367): unlike the parallel pnpm exec flow, pnpm dlx did not bind local script operands into the approval plan's mutable-file tracking, leaving the script file unmonitored after approval. No active exploitation is confirmed (EPSS 0.01%, SSVC exploitation: none), though SSVC rates technical impact as total given full C/I/A exposure on the vulnerable system.
Stored Cross-Site Scripting in Gutentor plugin for WordPress up to version 3.5.5 allows authenticated contributors and above to inject malicious scripts into pages via insufficient input sanitization, executing arbitrary JavaScript in the browsers of users who view the compromised pages. The vulnerability requires contributor-level WordPress account access and user interaction (page view), resulting in limited but real risk to website content integrity and user session compromise.
Denial of service in go-ntlmssp (pkg:go/github.com/Azure/go-ntlmssp) versions prior to 0.1.1 allows a malicious HTTP server to crash any Go process that uses ntlmssp.Negotiator as its HTTP transport by returning a crafted NTLM challenge message. The malformed payload triggers a slice out-of-bounds panic - a fatal runtime condition in Go - causing complete process termination. No active exploitation is confirmed (not in CISA KEV), no public exploit code has been identified, and EPSS at 0.06% (18th percentile) reflects very low opportunistic exploitation probability at time of analysis.
Privilege escalation in OpenClaw's chat.send gateway endpoint allows write-scoped API callers to bypass authorization controls and persist admin-only verboseLevel session overrides via the /verbose parameter. All OpenClaw npm package versions up to and including 2026.3.24 are affected; the vendor-released fix is version 2026.3.28. No public exploit code has been identified at time of analysis, and CISA SSVC assessment confirms no active exploitation with only partial technical impact, aligning with an EPSS score in the 14th percentile.
n8n-mcp v2.47.10 and earlier in HTTP transport mode logs sensitive authentication credentials and request metadata regardless of authentication outcome, allowing disclosure of bearer tokens, API keys, and JSON-RPC payloads to any system with access to server logs. While access control correctly rejects unauthenticated requests with 401 responses, the sensitive data from those rejected requests is persisted in logs before authentication is enforced, creating an information disclosure vulnerability (CWE-532) with CVSS 5.3 (low confidentiality impact). No public exploit code or active exploitation is documented; patch is available in v2.47.11.
Cache poisoning in @astrojs/node versions 9.4.4 and earlier allows unauthenticated remote attackers to poison CDN caches by sending malformed if-match headers to static asset endpoints, causing the server to return 500 errors with immutable one-year cache directives instead of the correct 412 Precondition Failed response. This vulnerability affects all subsequent requests to poisoned assets until the cache expires, breaking application functionality for legitimate users. The vulnerability is not actively exploited in the wild, but proof-of-concept exploitation is straightforward and requires only a single crafted HTTP request.
Kirby CMS's REST API allows authenticated users with the `pages.create` permission to immediately publish pages by overriding the `isDraft` flag, bypassing the separate `pages.changeStatus` authorization check. This affects all 4.x releases before 4.9.0 and 5.x releases from 5.0.0 through 5.3.x, and is exploitable only by authenticated users in deployments where the two permissions are intentionally split. No public exploit code has been identified and EPSS sits at 0.03% (9th percentile), consistent with the SSVC assessment of no known active exploitation; the vulnerability is nevertheless a real workflow integrity bypass for editorial CMS environments.
LangSmith Client SDKs in JavaScript (prior to 0.5.19) and Python (prior to 0.7.31) fail to apply output redaction controls to streaming token events, allowing sensitive LLM-generated content to leak into LangSmith platform storage despite hideOutputs/hide_outputs being enabled. Unauthenticated remote attackers can intercept or access unredacted streamed tokens if they gain visibility into run events, bypassing the intended confidentiality controls.
Information disclosure in OpenClaw (npm) before 2026.4.2 allows low-privilege authenticated Gateway clients to recover host filesystem paths and deployment metadata that should be restricted to admin-scoped sessions. The Gateway `connect` success (`hello-ok`) snapshot unconditionally included `configPath`, `stateDir`, and `authMode` fields for all authenticated clients regardless of scope, exposing server-side deployment topology. No active exploitation has been identified (EPSS 0.03%, 8th percentile; no CISA KEV listing), but the disclosed paths materially assist host fingerprinting and can lower the cost of subsequent chained attacks against the gateway infrastructure.
Session visibility bypass in OpenClaw (npm) versions through 2026.3.28 permits authenticated agents to read session metadata beyond their authorized scope by invoking session_status outside a sandboxed context. The visibility guard in session-status-tool.ts was conditionally applied only for sandboxed invocations or session-ID-resolved lookups, leaving unsandboxed callers entirely ungated against the tools.sessions.visibility policy. The maintainer triaged this as a same-agent session-policy bypass rather than a host-boundary breach; no public exploit exists and SSVC/EPSS signals indicate no active exploitation pressure.
Improper authorization in OpenClaw's paired-device pairing management (npm package, versions before 2026.4.20) allows authenticated paired devices with limited `operator.pairing` scope to enumerate global pairing state and approve or reject pending device requests belonging to other devices within the same gateway scope. This is a same-gateway, authenticated privilege escalation bug - not a remote unauthenticated issue. No public exploit code exists and CISA has not listed this in KEV; SSVC assesses exploitation as none and technical impact as partial, consistent with the low EPSS score of 0.03%.
Uncontrolled memory allocation in OpenTelemetry dotnet's propagation header parsing exposes .NET applications to denial of service. OpenTelemetry.Api versions 0.5.0-beta.2 through 1.15.2 and OpenTelemetry.Extensions.Propagators versions 1.3.1 through 1.15.2 contain BaggagePropagator, B3Propagator, and JaegerPropagator implementations that eagerly allocate intermediate arrays before enforcing size limits, allowing malformed headers with excessive delimiter characters to trigger disproportionate memory consumption. No active exploitation is confirmed (not in CISA KEV), EPSS is extremely low at 0.02%, and a vendor-released patch exists at version 1.15.3.
Memory exhaustion in the OpenTelemetry dotnet OTLP exporter (versions 1.13.1 through 1.15.1) enables a denial-of-service condition when an attacker controls the configured telemetry backend or can MitM the export connection. Both the gRPC and HTTP/protobuf transport paths in OtlpGrpcExportClient and OtlpHttpExportClient read the full HTTP error response body into memory without any size cap, allowing an adversary to return an arbitrarily large body and exhaust the process heap. No active exploitation is confirmed (absent from CISA KEV, EPSS 0.01%), and vendor-released patch 1.15.2 is available.
Memory exhaustion via unbounded protobuf allocation in OpenTelemetry.Exporter.OpenTelemetryProtocol (NuGet) affects versions 1.13.1 through 1.15.2 when exporting telemetry over OTLP/gRPC. An attacker controlling the gRPC collector endpoint or intercepting telemetry traffic can return a malformed grpc-status-details-bin trailer on a retryable response, causing the instrumented .NET process to attempt an arbitrarily large byte array allocation and exhaust available memory. No public exploit exists and SSVC confirms no active exploitation; a vendor patch is available in 1.15.3.
OpenClaw versions up to and including 2026.3.24 permit SSRF guard bypass because the IPv6 address classifier in `src/shared/net/ip.ts` and `src/infra/net/ssrf.*` omits four IPv6 special-use ranges, incorrectly treating those addresses as public. Authenticated users with the ability to supply fetch URLs can target internal or non-routable IPv6 services that the guard should block, with potential high confidentiality impact on downstream internal systems (SC:H in CVSS 4.0). No public exploit code or active exploitation has been identified; EPSS stands at 0.04% (12th percentile) and SSVC rates exploitation as none, placing real-world urgency at medium priority pending the available upgrade to 2026.3.28.
SQL injection in CMS ALAYA 7.4.1.4 and earlier allows authenticated administrators to obtain or modify database information through the administrative interface. The vulnerability requires high-privilege access (PR:H) and carries low confidentiality, integrity, and availability impact per CVSS 4.0 scoring. No public exploit code or active exploitation has been identified at time of analysis.
DLL hijacking in EfficientLab Controlio before v1.3.95 allows local attackers with high privileges to achieve arbitrary code execution by placing a specially crafted DLL in the installation directory, leveraging weak folder permissions and the service's NT AUTHORITY\SYSTEM execution context. Real-world risk is constrained by the high privilege requirement (PR:H) and local-only attack vector; EPSS score of 0.01% and CISA SSVC framework marking exploitation as 'none' and technical impact as 'partial' indicate low current exploitation likelihood despite the RCE tag.
Froxlor versions prior to 2.3.6 fail to validate domain ownership correctly when adding full email sender aliases, allowing authenticated customers to add sender aliases for email addresses on domains belonging to other customers and subsequently send emails as those addresses via Postfix sender_login_maps authorization. The vulnerability stems from an array indexing error in EmailSender::add() that passes the local part of an email address instead of the domain to the ownership validation function, causing the check to pass for non-existent domains. No active exploitation has been confirmed at the time of analysis.
Arbitrary file write vulnerability in IBM Guardium Data Protection 12.1 allows authenticated administrative users to traverse directories and write files to arbitrary locations via specially crafted URLs containing path traversal sequences (/../). The vulnerability requires high-privilege admin credentials and network access but results in integrity compromise without requiring user interaction, making it a post-authentication privilege abuse risk for organizations running this data protection platform.
IBM Guardium Data Protection versions 12.0, 12.1, and 12.2 contain an authentication bypass vulnerability in the access management control panel that allows high-privilege users to circumvent business logic controls and modify access policies without proper authorization constraints. The vulnerability requires administrative credentials to trigger but results in unauthorized privilege escalation or policy modification within the management interface. No public exploit code or active exploitation has been identified at the time of analysis.
Improper privilege management in IBM Guardium Key Lifecycle Manager versions 4.1 through 5.1 allows remote unauthenticated attackers to achieve limited confidentiality and integrity compromise through a network attack requiring high complexity. The vulnerability stems from inadequate access control enforcement that permits elevation of privileges without authentication, affecting a widely deployed enterprise key management solution.
WebKitGTK and WPE WebKit contain an API design flaw that allows untrusted web content to bypass the WebPage::send-request signal handler and perform unapproved network operations including IP connections, DNS lookups, and HTTP requests. The vulnerability affects applications across Red Hat Enterprise Linux 6-9 that rely on this signal to control network access. A remote attacker can trigger these bypassed requests via crafted web content with only user interaction (UI:R), resulting in limited confidentiality impact (C:L) without code execution.
Path traversal in Chainguard melange's `--persist-lint-results` feature allows an attacker who controls the contents of a processed APK to write attacker-influenced JSON files to arbitrary filesystem locations reachable by the melange process. Affected versions span v0.32.0 through v0.43.3; the root cause is that `arch` and `pkgname` values from the APK's `.PKGINFO` control file were used unsanitized in output path construction. No direct code execution is possible, but the write primitive can clobber other JSON artifacts on the build host. No public exploit code exists and CISA KEV does not list this vulnerability.
Broken access control in Navneil Naicker ACF Galerie 4 plugin versions up to 1.4.2 allows authenticated users to modify content they should not have permission to access. The vulnerability stems from missing authorization checks in functionality protected only by authentication level, enabling privilege escalation or unauthorized data modification by low-privileged WordPress users.
Authenticated users in Rocket.Chat versions prior to 8.4.0, 8.3.2, 8.2.2, 8.1.3, 8.0.4, 7.13.6, 7.12.7, 7.11.7, and 7.10.10 can read application engine logs via the /api/apps/logs and /api/apps/:id/logs endpoints due to a typo in permission validation logic. The vulnerability allows authenticated attackers with insufficient privileges to bypass authorization checks and access sensitive logs containing partial information, with no public exploit confirmed at time of analysis.
Sandbox file-operation escape in OpenClaw npm versions <= 2026.3.28 allows a local low-privileged attacker to delete or create files outside the designated workspace root by winning a symlink-rebind race between path validation and filesystem execution in apply_patch, remove, and mkdir operations. The GHSA maintainer triage confirms the scope is narrow - limited to workspace-only mutation operations - and the fix in 2026.3.31 replaces check-then-act enforcement with atomic fd-safe path-within-root helpers. No public exploit exists and SSVC confirms exploitation status as none, placing real-world priority low despite the high integrity impact rating.
Libgcrypt before version 1.12.2 contains a bounds-check vulnerability in Dilithium signing operations where writes to a static array lack proper bounds validation, potentially causing memory corruption and integrity loss. The vulnerability affects local attackers with non-privileged access on systems running vulnerable versions 1.12.0 and 1.12.1. While the vulnerability does not involve attacker-controlled data in the array writes themselves, the missing bounds check creates an integrity and availability risk through uncontrolled memory modification.