IBM Security Verify Directory (Container) versions 10.0.0 through 10.0.0.3 fails to validate uploaded file types, allowing privileged users to upload malicious files that can be distributed to victims for lateral attacks. The vulnerability requires high-privilege credentials but enables integrity compromise and partial availability impact once exploited.
Denial of service in Linux kernel nexthop query handling allows local authenticated attackers to crash the kernel by querying nexthop objects with large Equal-Cost Multi-Path groups via the RTM_GETNEXTHOP netlink message. The vulnerability stems from fixed-size socket buffer allocation that overflows when processing nexthop groups exceeding approximately 512 members, triggering a kernel warning and potential system instability.
Froxlor versions prior to 2.3.6 allow authenticated resellers to bypass domain quota restrictions by attributing newly created domains to arbitrary admins through unvalidated `adminid` parameter input in the `Domains.add()` function. This vulnerability enables quota exhaustion attacks against other administrators and domain creation beyond the attacker's assigned limits, with confirmed patch availability in version 2.3.6.
Stored cross-site scripting (XSS) in Koollab LMS courselet feature allows authenticated users to inject arbitrary JavaScript that executes in the browsers of other users with courselet access, potentially compromising account security and enabling credential theft or malicious actions on behalf of affected users. CVSS 5.4 reflects network delivery, low complexity, and limited confidentiality/integrity impact constrained by required user interaction and authenticated access.
Arbitrary code execution in OpenClaw's OpenShell mirror mode (npm package versions <= 2026.3.24) allows attackers with mirror mode access to plant malicious JavaScript in the sandbox hooks/ directory, which is synced to the host workspace and executed during gateway startup. The GHSA advisory confirms this flaw shipped in production releases and rates it medium severity due to a narrow exploitation chain requiring four concurrent conditions. EPSS is 0.01% (2nd percentile) and SSVC indicates no active exploitation; no CISA KEV listing exists at time of analysis, though technical impact is rated total if successfully exploited. Vendor-released patch is available in v2026.3.28.
Approval integrity bypass in OpenClaw's pnpm dlx command-planning path (all versions up to 2026.4.1) allows a low-privileged local attacker to replace an approved local script between the approval decision and actual execution, running arbitrary code under a still-valid approval plan. The root cause is a TOCTOU flaw (CWE-367): unlike the parallel pnpm exec flow, pnpm dlx did not bind local script operands into the approval plan's mutable-file tracking, leaving the script file unmonitored after approval. No active exploitation is confirmed (EPSS 0.01%, SSVC exploitation: none), though SSVC rates technical impact as total given full C/I/A exposure on the vulnerable system.
Stored Cross-Site Scripting in Gutentor plugin for WordPress up to version 3.5.5 allows authenticated contributors and above to inject malicious scripts into pages via insufficient input sanitization, executing arbitrary JavaScript in the browsers of users who view the compromised pages. The vulnerability requires contributor-level WordPress account access and user interaction (page view), resulting in limited but real risk to website content integrity and user session compromise.
Denial of service in go-ntlmssp (pkg:go/github.com/Azure/go-ntlmssp) versions prior to 0.1.1 allows a malicious HTTP server to crash any Go process that uses ntlmssp.Negotiator as its HTTP transport by returning a crafted NTLM challenge message. The malformed payload triggers a slice out-of-bounds panic - a fatal runtime condition in Go - causing complete process termination. No active exploitation is confirmed (not in CISA KEV), no public exploit code has been identified, and EPSS at 0.06% (18th percentile) reflects very low opportunistic exploitation probability at time of analysis.
Privilege escalation in OpenClaw's chat.send gateway endpoint allows write-scoped API callers to bypass authorization controls and persist admin-only verboseLevel session overrides via the /verbose parameter. All OpenClaw npm package versions up to and including 2026.3.24 are affected; the vendor-released fix is version 2026.3.28. No public exploit code has been identified at time of analysis, and CISA SSVC assessment confirms no active exploitation with only partial technical impact, aligning with an EPSS score in the 14th percentile.
n8n-mcp v2.47.10 and earlier in HTTP transport mode logs sensitive authentication credentials and request metadata regardless of authentication outcome, allowing disclosure of bearer tokens, API keys, and JSON-RPC payloads to any system with access to server logs. While access control correctly rejects unauthenticated requests with 401 responses, the sensitive data from those rejected requests is persisted in logs before authentication is enforced, creating an information disclosure vulnerability (CWE-532) with CVSS 5.3 (low confidentiality impact). No public exploit code or active exploitation is documented; patch is available in v2.47.11.
Cache poisoning in @astrojs/node versions 9.4.4 and earlier allows unauthenticated remote attackers to poison CDN caches by sending malformed if-match headers to static asset endpoints, causing the server to return 500 errors with immutable one-year cache directives instead of the correct 412 Precondition Failed response. This vulnerability affects all subsequent requests to poisoned assets until the cache expires, breaking application functionality for legitimate users. The vulnerability is not actively exploited in the wild, but proof-of-concept exploitation is straightforward and requires only a single crafted HTTP request.
Kirby CMS's REST API allows authenticated users with the `pages.create` permission to immediately publish pages by overriding the `isDraft` flag, bypassing the separate `pages.changeStatus` authorization check. This affects all 4.x releases before 4.9.0 and 5.x releases from 5.0.0 through 5.3.x, and is exploitable only by authenticated users in deployments where the two permissions are intentionally split. No public exploit code has been identified and EPSS sits at 0.03% (9th percentile), consistent with the SSVC assessment of no known active exploitation; the vulnerability is nevertheless a real workflow integrity bypass for editorial CMS environments.
LangSmith Client SDKs in JavaScript (prior to 0.5.19) and Python (prior to 0.7.31) fail to apply output redaction controls to streaming token events, allowing sensitive LLM-generated content to leak into LangSmith platform storage despite hideOutputs/hide_outputs being enabled. Unauthenticated remote attackers can intercept or access unredacted streamed tokens if they gain visibility into run events, bypassing the intended confidentiality controls.
Information disclosure in OpenClaw (npm) before 2026.4.2 allows low-privilege authenticated Gateway clients to recover host filesystem paths and deployment metadata that should be restricted to admin-scoped sessions. The Gateway `connect` success (`hello-ok`) snapshot unconditionally included `configPath`, `stateDir`, and `authMode` fields for all authenticated clients regardless of scope, exposing server-side deployment topology. No active exploitation has been identified (EPSS 0.03%, 8th percentile; no CISA KEV listing), but the disclosed paths materially assist host fingerprinting and can lower the cost of subsequent chained attacks against the gateway infrastructure.
Session visibility bypass in OpenClaw (npm) versions through 2026.3.28 permits authenticated agents to read session metadata beyond their authorized scope by invoking session_status outside a sandboxed context. The visibility guard in session-status-tool.ts was conditionally applied only for sandboxed invocations or session-ID-resolved lookups, leaving unsandboxed callers entirely ungated against the tools.sessions.visibility policy. The maintainer triaged this as a same-agent session-policy bypass rather than a host-boundary breach; no public exploit exists and SSVC/EPSS signals indicate no active exploitation pressure.
Improper authorization in OpenClaw's paired-device pairing management (npm package, versions before 2026.4.20) allows authenticated paired devices with limited `operator.pairing` scope to enumerate global pairing state and approve or reject pending device requests belonging to other devices within the same gateway scope. This is a same-gateway, authenticated privilege escalation bug - not a remote unauthenticated issue. No public exploit code exists and CISA has not listed this in KEV; SSVC assesses exploitation as none and technical impact as partial, consistent with the low EPSS score of 0.03%.
Uncontrolled memory allocation in OpenTelemetry dotnet's propagation header parsing exposes .NET applications to denial of service. OpenTelemetry.Api versions 0.5.0-beta.2 through 1.15.2 and OpenTelemetry.Extensions.Propagators versions 1.3.1 through 1.15.2 contain BaggagePropagator, B3Propagator, and JaegerPropagator implementations that eagerly allocate intermediate arrays before enforcing size limits, allowing malformed headers with excessive delimiter characters to trigger disproportionate memory consumption. No active exploitation is confirmed (not in CISA KEV), EPSS is extremely low at 0.02%, and a vendor-released patch exists at version 1.15.3.
Memory exhaustion in the OpenTelemetry dotnet OTLP exporter (versions 1.13.1 through 1.15.1) enables a denial-of-service condition when an attacker controls the configured telemetry backend or can MitM the export connection. Both the gRPC and HTTP/protobuf transport paths in OtlpGrpcExportClient and OtlpHttpExportClient read the full HTTP error response body into memory without any size cap, allowing an adversary to return an arbitrarily large body and exhaust the process heap. No active exploitation is confirmed (absent from CISA KEV, EPSS 0.01%), and vendor-released patch 1.15.2 is available.
Memory exhaustion via unbounded protobuf allocation in OpenTelemetry.Exporter.OpenTelemetryProtocol (NuGet) affects versions 1.13.1 through 1.15.2 when exporting telemetry over OTLP/gRPC. An attacker controlling the gRPC collector endpoint or intercepting telemetry traffic can return a malformed grpc-status-details-bin trailer on a retryable response, causing the instrumented .NET process to attempt an arbitrarily large byte array allocation and exhaust available memory. No public exploit exists and SSVC confirms no active exploitation; a vendor patch is available in 1.15.3.
OpenClaw versions up to and including 2026.3.24 permit SSRF guard bypass because the IPv6 address classifier in `src/shared/net/ip.ts` and `src/infra/net/ssrf.*` omits four IPv6 special-use ranges, incorrectly treating those addresses as public. Authenticated users with the ability to supply fetch URLs can target internal or non-routable IPv6 services that the guard should block, with potential high confidentiality impact on downstream internal systems (SC:H in CVSS 4.0). No public exploit code or active exploitation has been identified; EPSS stands at 0.04% (12th percentile) and SSVC rates exploitation as none, placing real-world urgency at medium priority pending the available upgrade to 2026.3.28.
SQL injection in CMS ALAYA 7.4.1.4 and earlier allows authenticated administrators to obtain or modify database information through the administrative interface. The vulnerability requires high-privilege access (PR:H) and carries low confidentiality, integrity, and availability impact per CVSS 4.0 scoring. No public exploit code or active exploitation has been identified at time of analysis.
DLL hijacking in EfficientLab Controlio before v1.3.95 allows local attackers with high privileges to achieve arbitrary code execution by placing a specially crafted DLL in the installation directory, leveraging weak folder permissions and the service's NT AUTHORITY\SYSTEM execution context. Real-world risk is constrained by the high privilege requirement (PR:H) and local-only attack vector; EPSS score of 0.01% and CISA SSVC framework marking exploitation as 'none' and technical impact as 'partial' indicate low current exploitation likelihood despite the RCE tag.
Froxlor versions prior to 2.3.6 fail to validate domain ownership correctly when adding full email sender aliases, allowing authenticated customers to add sender aliases for email addresses on domains belonging to other customers and subsequently send emails as those addresses via Postfix sender_login_maps authorization. The vulnerability stems from an array indexing error in EmailSender::add() that passes the local part of an email address instead of the domain to the ownership validation function, causing the check to pass for non-existent domains. No active exploitation has been confirmed at the time of analysis.
Arbitrary file write vulnerability in IBM Guardium Data Protection 12.1 allows authenticated administrative users to traverse directories and write files to arbitrary locations via specially crafted URLs containing path traversal sequences (/../). The vulnerability requires high-privilege admin credentials and network access but results in integrity compromise without requiring user interaction, making it a post-authentication privilege abuse risk for organizations running this data protection platform.
IBM Guardium Data Protection versions 12.0, 12.1, and 12.2 contain an authentication bypass vulnerability in the access management control panel that allows high-privilege users to circumvent business logic controls and modify access policies without proper authorization constraints. The vulnerability requires administrative credentials to trigger but results in unauthorized privilege escalation or policy modification within the management interface. No public exploit code or active exploitation has been identified at the time of analysis.
Improper privilege management in IBM Guardium Key Lifecycle Manager versions 4.1 through 5.1 allows remote unauthenticated attackers to achieve limited confidentiality and integrity compromise through a network attack requiring high complexity. The vulnerability stems from inadequate access control enforcement that permits elevation of privileges without authentication, affecting a widely deployed enterprise key management solution.
WebKitGTK and WPE WebKit contain an API design flaw that allows untrusted web content to bypass the WebPage::send-request signal handler and perform unapproved network operations including IP connections, DNS lookups, and HTTP requests. The vulnerability affects applications across Red Hat Enterprise Linux 6-9 that rely on this signal to control network access. A remote attacker can trigger these bypassed requests via crafted web content with only user interaction (UI:R), resulting in limited confidentiality impact (C:L) without code execution.
Path traversal in Chainguard melange's `--persist-lint-results` feature allows an attacker who controls the contents of a processed APK to write attacker-influenced JSON files to arbitrary filesystem locations reachable by the melange process. Affected versions span v0.32.0 through v0.43.3; the root cause is that `arch` and `pkgname` values from the APK's `.PKGINFO` control file were used unsanitized in output path construction. No direct code execution is possible, but the write primitive can clobber other JSON artifacts on the build host. No public exploit code exists and CISA KEV does not list this vulnerability.
Broken access control in Navneil Naicker ACF Galerie 4 plugin versions up to 1.4.2 allows authenticated users to modify content they should not have permission to access. The vulnerability stems from missing authorization checks in functionality protected only by authentication level, enabling privilege escalation or unauthorized data modification by low-privileged WordPress users.
Authenticated users in Rocket.Chat versions prior to 8.4.0, 8.3.2, 8.2.2, 8.1.3, 8.0.4, 7.13.6, 7.12.7, 7.11.7, and 7.10.10 can read application engine logs via the /api/apps/logs and /api/apps/:id/logs endpoints due to a typo in permission validation logic. The vulnerability allows authenticated attackers with insufficient privileges to bypass authorization checks and access sensitive logs containing partial information, with no public exploit confirmed at time of analysis.
Sandbox file-operation escape in OpenClaw npm versions <= 2026.3.28 allows a local low-privileged attacker to delete or create files outside the designated workspace root by winning a symlink-rebind race between path validation and filesystem execution in apply_patch, remove, and mkdir operations. The GHSA maintainer triage confirms the scope is narrow - limited to workspace-only mutation operations - and the fix in 2026.3.31 replaces check-then-act enforcement with atomic fd-safe path-within-root helpers. No public exploit exists and SSVC confirms exploitation status as none, placing real-world priority low despite the high integrity impact rating.
Libgcrypt before version 1.12.2 contains a bounds-check vulnerability in Dilithium signing operations where writes to a static array lack proper bounds validation, potentially causing memory corruption and integrity loss. The vulnerability affects local attackers with non-privileged access on systems running vulnerable versions 1.12.0 and 1.12.1. While the vulnerability does not involve attacker-controlled data in the array writes themselves, the missing bounds check creates an integrity and availability risk through uncontrolled memory modification.
HTTP request smuggling in libsoup's header parsing enables unauthenticated remote attackers to inject malformed requests containing multiple conflicting Content-Length headers, potentially bypassing security controls or poisoning shared connection state in two-tier deployments. The flaw resides in soup_message_headers_append_common() within libsoup/soup-message-headers.c, which blindly appends header values without validating for duplicate or contradictory Content-Length fields - a direct violation of RFC 7230. No active exploitation has been confirmed (not in CISA KEV), EPSS stands at 0.03% (8th percentile), and SSVC rates exploitation as none with partial technical impact, placing this firmly in the low-urgency tier despite its network-accessible attack vector.
IBM Guardium Data Protection 12.0 through 12.2 contains a security misconfiguration in the user access control panel that allows high-privilege administrators to modify integrity settings without proper authorization constraints. The vulnerability is remotely accessible and requires existing administrative credentials, resulting in limited integrity impact with no confidentiality or availability effect. CVSS score of 2.7 reflects the low risk profile due to required administrative authentication and minimal scope of impact.
UUID library versions before 14.0.0 make unexpected writes to external output buffers when generating UUID versions 3, 5, or 6, potentially corrupting adjacent memory. UUID version 4, the most commonly deployed variant, is unaffected. The vulnerability requires local access and non-default buffer configuration to exploit, resulting in integrity compromise rather than code execution or availability impact.
OpenClaw's gateway `device.token.rotate` method rotates device credentials without disconnecting live WebSocket sessions authenticated under the old token, leaving a post-compromise revocation gap in all npm `openclaw` releases up to and including 2026.3.28. An attacker who has already obtained valid device credentials and established an active WebSocket connection can maintain unauthorized gateway access indefinitely after an operator rotates the token - effectively nullifying the revocation action. No public exploit exists and CISA SSVC rates exploitation as none with partial technical impact; the low CVSS 4.0 score of 2.3 and EPSS of 0.03% (7th percentile) confirm this as a low-priority, post-compromise control gap rather than an initial access vector.
OpenClaw's Discord integration (npm package, versions <= 2026.3.28) exposes an authorization bypass where authenticated Discord users invoke slash commands or trigger autocomplete in group DM channels outside the configured allowlist, circumventing the `dm.groupChannels` restriction in both the command dispatch and autocomplete paths. The impact is bounded: exploitation requires an already-authorized Discord user and a deployment with group DM allowlisting actively configured, limiting the trust boundary crossed to channel-level access rather than a broader privilege escalation. EPSS is 0.03% (7th percentile) and SSVC classifies exploitation as none; no public exploit code exists and the issue is not in CISA KEV.
Scope enforcement bypass in OpenClaw's Control UI assistant-media route allows authenticated trusted-proxy callers lacking the `operator.read` scope to read protected assistant-media files and metadata. Affected versions are all OpenClaw npm releases before 2026.4.20; deployments not using trusted-proxy authentication mode are unaffected. No active exploitation is confirmed (absent from CISA KEV), EPSS is 0.03% (7th percentile), and SSVC rates exploitation as none with only partial technical impact, making this a low-urgency patch cycle item.
Cross-site request forgery in OpenClaw's HTTP operator endpoints affects deployments running in trusted-proxy mode, allowing unauthenticated remote attackers to perform unauthorized actions by tricking an authenticated browser user into triggering a forged request. Affected versions are all OpenClaw npm releases up to and including 2026.3.28; the vulnerability is fully patched in 2026.3.31 released 2026-03-31. No public exploit code exists and CISA has not added this to the KEV catalog; EPSS sits at 0.01% (3rd percentile), consistent with SSVC exploitation status of 'none' - real-world risk is low and narrowly scoped to identity-bearing trusted-proxy browser deployments.
Incorrect channel type routing in OpenClaw's Discord extension (versions up to 2026.3.28) allows authenticated Group DM participants to bypass Group DM policy enforcement by exploiting a logic error that treats Group DMs as regular Direct Messages. The flaw in `extensions/discord/src/monitor/agent-components-helpers.ts` causes the `isDirectMessage` flag to be set based solely on the absence of a guild ID, which is also true for Group DM channels, causing all Group DM-specific authorization checks (the `groupEnabled` toggle and channel allowlist) to be silently skipped. No public exploit exists, this vulnerability is not in the CISA KEV catalog, and EPSS at 0.01% (2nd percentile) reflects negligible exploitation interest.
SSRF via redirect-following in the @astrojs/cloudflare integration's `image-binding-transform` endpoint allows remote attackers to bypass the `image.domains` and `image.remotePatterns` domain allowlist by exploiting an open redirect on an already-permitted domain. The root cause is a single missing `{ redirect: 'manual' }` option on line 28 of `image-binding-transform.ts` - an inconsistency that was correctly applied in all three other image fetch paths in the same codebase. This is an incomplete fix for the prior HIGH-rated GHSA-qpr4-c339-7vq8, and a public proof-of-concept is confirmed in advisory GHSA-88gm-j2wx-58h6.
Reliance on reverse DNS resolution in ericc-ch copilot-api up to version 0.7.0 allows authenticated remote attackers to manipulate the Host header in the /token endpoint, leading to information disclosure. The vulnerability affects the Header Handler component and has been publicly disclosed with exploit code available; the vendor did not respond to early disclosure notification.
Environment variable leakage in OpenClaw (npm package, versions ≤2026.3.28) occurs because SSH-based sandbox backends pass the full unsanitized Node.js `process.env` object to SSH child processes, potentially exposing secrets such as API keys or credentials stored in the parent process environment. Exploitation is gated behind two non-default prerequisites: the SSH-based sandbox backend must be in use, and SSH environment variable forwarding must be enabled in the host's SSH daemon configuration. No active exploitation or public exploit code has been identified; EPSS sits at 0.01% (1st percentile) and SSVC rates exploitation as none, consistent with the vendor's own triage of this as a narrow, low-severity issue.