Spring AI fails to properly isolate conversation contexts when user-supplied input is passed directly as conversationId to VectorStoreChatMemoryAdvisor, allowing remote unauthenticated attackers to inject filter logic that exfiltrates sensitive data from other users' chat histories, including secrets and credentials. Exploitation requires moderately complex attack construction (AC:H) but no user interaction, affecting only applications with the specific vulnerable configuration pattern.
Cross-channel local file exfiltration in OpenClaw (npm package, all versions before 2026.4.8) allows an attacker with low-privilege access to craft malicious shared reply MEDIA path references that cause a separate channel to resolve and expose local file contents as trusted generated media. The root cause (CWE-73) is improper neutralization of path references in shared reply MEDIA URIs: OpenClaw accepts these references without enforcing a trust origin check, effectively treating attacker-controlled paths as internally generated content. No public exploit code has been identified and CISA has not listed this in KEV, but the high confidentiality impact on the vulnerable system (VC:H in the CVSS 4.0 vector) and the arbitrary local-file-read capability make patching a priority for any affected deployment.
Cryptographic signature verification bypass in Elastic Package Registry versions 0.1.0 through 1.37.0 allows an adversary-in-the-middle, or an attacker with influence over a self-hosted registry's served content, to substitute tampered packages that are accepted without triggering integrity check failures. The flaw (CWE-347) undermines supply-chain integrity for organizations running self-hosted registry instances. No active exploitation is confirmed (SSVC: exploitation none; EPSS 0.02%), but the high integrity impact and zero-privilege-required vector make patching to 1.38.0 a priority for self-hosted deployments.
OpenClaw before version 2026.3.31 accepts arbitrary tailnet peers as DNS authorities due to improper validation in its wide-area discovery mechanism, enabling attackers positioned within the same tailnet with CA-trusted endpoint access to manipulate DNS resolution and exfiltrate operator credentials. The vulnerability requires adjacent network access, high attack complexity, and user interaction, but results in high confidentiality impact through credential theft. No active exploitation has been publicly confirmed at the time of analysis.
Remote code execution in OpenClaw (npm) before version 2026.4.8 is achievable by injecting malicious build tool environment variables - specifically HGRCPATH, CARGO_BUILD_RUSTC_WRAPPER, RUSTC_WRAPPER, and MAKEFLAGS - which were absent from the application's exec environment denylist. Because OpenClaw is a user-controlled local assistant, an attacker with the ability to set environment variables on the host can influence exec commands invoked by the tool and achieve arbitrary code execution. No public exploit code has been identified at time of analysis, and SSVC signals indicate no current exploitation activity, but the integrity impact (VI:H) is significant when exploitation conditions are met.
Git environment variable injection in OpenClaw (npm) before 2026.4.8 allows a local low-privileged attacker to redirect git operations by setting GIT_DIR and related plumbing variables in the process environment prior to host exec calls. The root cause is an incomplete denylist (CWE-184) that strips some but not all dangerous environment variables before shelling out. No public exploit or active exploitation has been identified at time of analysis; EPSS of 0.01% (3rd percentile) and SSVC exploitation status of 'none' corroborate low near-term exploitation likelihood.
OpenClaw before version 2026.3.31 allows local authenticated attackers to redirect Python package-index traffic by injecting malicious URLs through unsanitized PIP_INDEX_URL and UV_INDEX_URL environment variables, enabling interception or manipulation of package management operations. The vulnerability requires local access and authentication but can result in high integrity impact through compromised package delivery. No active exploitation has been publicly confirmed, but the attack surface is direct and the remediation is straightforward.
OpenClaw before 2026.3.31 allows authenticated users with approved host-exec requests to execute arbitrary code during build processes by overriding compiler binary environment variables (CC, CXX, CARGO_BUILD_RUSTC, CMAKE_C_COMPILER) through an incomplete host-env-security-policy.json configuration. The vulnerability requires local access and prior authentication to an OpenClaw instance, but enables full code execution with inherited privileges during compilation. No public exploit code has been identified at time of analysis.
Command injection in eiliyaabedini's aider-mcp MCP server allows remote, unauthenticated attackers to execute arbitrary OS commands by supplying malicious shell metacharacters in the `working_dir` or `editable_files` arguments to the `code_with_ai` function in `aider_mcp.py`. A public proof-of-concept has been disclosed (SSVC: poc; CVSS 4.0 threat metric E:P), and SSVC classifies the vulnerability as automatable with partial technical impact. No patch exists - the project maintainer was notified via GitHub issue but has not responded, leaving all rolling-release deployments through commit 667b914301aada695aab0e46d1fb3a7d5e32c8af unprotected.
Command injection in dvladimirov MCP up to version 0.1.0 allows remote unauthenticated attackers to execute arbitrary system commands via manipulation of the repo_url or pattern arguments in the GitSearchRequest function of mcp_server.py. The vulnerability has a publicly available exploit and CVSS 6.9 score indicating moderate severity with network-accessible attack vector and low complexity, though the vendor has not responded to the early disclosure.
Path traversal in elinsky's execution-system-mcp 0.1.0 allows remote unauthenticated attackers to escape the intended directory boundary by manipulating the `context` argument passed to the `_get_context_file_path` function via the `add_action` tool, enabling read and potential write access to arbitrary files on the host filesystem. A public proof-of-concept exploit is confirmed (GitHub issue #1, VulDB 359972), and SSVC classifies the attack as automatable with partial technical impact. Despite EPSS at 0.08% reflecting the product's obscurity, the no-auth network-exploitable attack surface means any exposed instance faces meaningful risk.
Path traversal in eiceblue spire-pdf-mcp-server 0.1.1 allows unauthenticated remote attackers to escape the intended PDF directory by supplying crafted traversal sequences in the filepath argument to the get_pdf_path function, enabling unauthorized read and write access to arbitrary files on the host. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms zero-barrier remote exploitation with no authentication or special conditions, and a published exploit is confirmed (E:P). No vendor patch is available; the project maintainer has not responded to the responsible disclosure filed in GitHub issue #1.
Path traversal in eiceblue spire-doc-mcp-server 1.0.0 allows remote unauthenticated attackers to escape the intended document directory by supplying crafted sequences in the `document_name` argument to the `get_doc_path` function in `src/spire_doc_mcp/api/base.py`. A public exploit exists and SSVC confirms the attack is automatable with partial technical impact across confidentiality, integrity, and availability. No vendor patch is available - the project has not responded to the coordinated disclosure filed via GitHub issue.
Path traversal in duartium papers-mcp-server allows remote unauthenticated attackers to access arbitrary files on the server by manipulating the topic argument in the search_papers function. The vulnerability affects commit 9ceb3812a6458ba7922ca24a7406f8807bc55598 and is publicly exploitable with proof-of-concept code available; the vendor has been notified via issue report but has not yet responded.
SQL injection in dubydu sqlite-mcp up to version 0.1.0 allows remote attackers to manipulate the output_filename parameter in the extract_to_json function, enabling arbitrary SQL command execution. The vulnerability has publicly available exploit code and affects all default installations without authentication requirements.
XML External Entity (XXE) injection in GRASSMARLIN v3.2.1 allows authenticated local users to extract sensitive information through crafted session data that exploits insufficient XML parser hardening. The vulnerability has a CVSS score of 5.5 with local attack vector and high confidentiality impact, affecting users with login credentials on systems running the affected version.
Path traversal in DV0x creative-ad-agent server component (up to commit 751b9e5146604dc65049bd0f62dcbdad6212f8a3) allows remote unauthenticated attackers to read arbitrary files via manipulation of req.params arguments in server/sdk-server.ts. Public exploit code is available. CVSS 5.5 reflects low confidentiality impact with network-accessible attack vector and no authentication requirement.
Stored XSS in PhpSpreadsheet's HTML writer (Writer/Html.php) allows an attacker who can supply a crafted XLSX file to inject arbitrary HTML into rendered output, executing JavaScript in victims' browsers. The root cause is a faulty identity-check gate at line ~1592 that skips htmlspecialchars() whenever a custom number format transforms cell data - a condition trivially triggered by adding any literal character (even a trailing space) to a format code containing the @ text placeholder. A detailed proof-of-concept is publicly available in the GitHub Security Advisory; the vulnerability is confirmed in PhpSpreadsheet versions across the 2.x, 3.x, and 4.x/5.x release lines, with patches released in 2.1.16, 2.4.5, 3.10.5, and 5.7.0. No active exploitation has been confirmed (not in CISA KEV), and the 0.03% EPSS score reflects low opportunistic exploitation probability at this time.
OpenClaw before version 2026.3.31 allows local authenticated users with user interaction to bypass exec allowlist restrictions via shell initialization file options (--rcfile, --init-file, --startup-file), enabling them to load attacker-controlled initialization files and achieve high-impact unauthorized access to confined resources. Exploitation requires local access, low privileges, user interaction, and specific timing conditions, but bypasses a critical security control intended to restrict executable trust.
Cross-Site Scripting (XSS) via malicious SVG upload in FUEL CMS v1.5.2 and earlier allows low-privileged authenticated users to execute arbitrary JavaScript in the context of other users' browsers through the asset upload functionality. The vulnerability stems from inadequate sanitization of SVG file contents during upload, enabling attackers with valid credentials to craft weaponized SVG files that execute when viewed by administrators or other site visitors. No active exploitation in CISA KEV confirmed; CVSS 5.4 reflects moderate impact with user interaction requirement.
Penetration Testing engineers at Amazon have discovered a flaw where the camera system fails to properly handle data supplied in certain requests, causing a service disruption. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity.
Booking Package plugin for WordPress up to version 1.7.06 allows unauthenticated attackers to manipulate booking prices via the intentForStripe() function, which accepts unsanitized $_POST['amount'] values and passes them directly to the Stripe PaymentIntent API without validation. The vulnerability is compounded by commented-out code in CreditCard.php that would normally enforce server-calculated pricing, enabling attackers to complete bookings at arbitrary prices (e.g., $0.01 instead of $500.00) with no authentication required. This is a confirmed price manipulation vulnerability with no active KEV exploitation reported but represents significant financial fraud risk.
OpenTelemetry's Zipkin exporter for .NET allows unauthenticated remote attackers to trigger denial of service by sending spans with high-cardinality remote endpoint attributes, causing unbounded memory growth in the remote endpoint cache and eventual process degradation. CVSS 5.3 (network-accessible, low complexity). Patch available from vendor; no active exploitation identified.
Memory exhaustion vulnerability in the OpenClaw npm package (all versions before 2026.4.8) allows authenticated network-accessible attackers to trigger denial of service by submitting crafted base64-encoded input to multiple affected decode paths, each of which allocates memory before enforcing decoded-size limits. The vendor explicitly scopes this vulnerability to OpenClaw's trust model as a user-controlled local assistant, not a multi-tenant service boundary, which meaningfully narrows real-world attack surface. No public exploit exists, CISA has not added this to KEV, and EPSS of 0.04% (11th percentile) confirms negligible exploitation activity at time of analysis.
Insecure deserialization in Cista v0.15 and below allows remote unauthenticated attackers to leak stack and heap addresses through reference tampering in the cista::raw namespace, potentially defeating ASLR protections. The vulnerability arises from insufficient validation of pointer-like objects during deserialization, enabling attackers to observe deserialized values and extract memory layout information for subsequent exploitation.
OpenClaw versions 2026.2.14 through 2026.3.24 fail to enforce guild and channel policy gates on Discord button and component interactions, allowing authenticated users to trigger privileged component actions from contexts where those actions should be blocked. The vulnerability bypasses channel policy enforcement via policy gate inconsistency, enabling privilege escalation within Discord servers where OpenClaw is deployed.
OpenClaw before version 2026.3.31 allows authenticated remote attackers to bypass sender allowlist filters when retrieving MS Teams thread history via Microsoft Graph API, enabling access to messages that should be restricted by security policies. The vulnerability affects organizations using OpenClaw's Teams integration and has been patched as of the specified version.
Stack overflow in Apache Thrift c_glib dispatch mechanism allows remote attackers to trigger denial of service via crafted network requests. The vulnerability affects Apache Thrift versions prior to 0.23.0 and requires no authentication or user interaction, resulting in application crashes or service unavailability. Patch is available from the vendor.
Unauthorized modification of the immutable `nick` (username) field in FacturaScripts allows any authenticated user to rename any account - including the Administrator - by intercepting a POST request to `/EditUser` and altering the `nick` form-data parameter before it reaches the backend. The backend performs no server-side validation of immutability or caller privilege, relying solely on UI-layer controls that are trivially bypassed with a proxy. A public proof-of-concept exists demonstrating the full attack; no vendor-released patch has been identified at time of analysis, leaving all deployments on affected versions exposed.
OpenClaw before version 2026.3.31 fails to block plugin installation when security scans detect threats, allowing authenticated users to install malicious plugins by ignoring visible scan warnings. The vulnerability requires user interaction (UI:P) and authenticated access (PR:L), but enables installation of untrusted code with moderate integrity impact when exploited.
Server-side request forgery in OpenClaw's QQ Bot Extension (npm package, all versions before 2026.4.8) allows authenticated users to route media fetch requests through unprotected endpoints, bypassing the configured SSRF guard and allowlist policies. Internal network resources - including metadata services and private APIs - are reachable via the subsequent-system scope change even though the OpenClaw host itself sustains no direct confidentiality impact. No public exploit code or active exploitation has been identified; EPSS stands at 0.03% and SSVC categorizes exploitation status as none.
Account lockout abuse in Ercom Cryptobox allows any authenticated user to deny another user access by sending a specially crafted request that triggers the platform's lockout mechanism. Specific versions in the 4.37-4.40 range are confirmed affected per ENISA EUVD-2026-26070, and the vendor has released a patch. No active exploitation is confirmed - EPSS stands at 0.04% (13th percentile) and CISA SSVC marks exploitation status as none, placing this firmly in the category of a real but low-urgency availability risk.
Server-side request forgery bypass in OpenClaw (npm) before 2026.4.8 allows authenticated users to reach private internal network targets by exploiting a race condition in Playwright redirect handling. Strict SSRF checks implemented via DNS pinning can be circumvented when request-time navigation occurs during a redirect, allowing traversal to otherwise-blocked private addresses. The GHSA advisory explicitly scopes this to OpenClaw's user-controlled local assistant trust model, not a multi-tenant service boundary. No public exploit code exists and SSVC indicates exploitation status as none at time of analysis.
SSRF policy bypass in OpenClaw (npm) versions before 2026.4.8 allows low-privilege authenticated users to exploit browser interaction-triggered navigations that circumvent the application's DNS-pinning SSRF guards. The bypass is specific to the TRUSTED_ENV_PROXY execution mode, activated when proxy environment variables are present, causing the fetch guard to skip hostname resolution policy enforcement and permitting requests to restricted internal resources. No active exploitation is confirmed by CISA KEV; EPSS is 0.03% (7th percentile) and SSVC exploitation status is none, though the subsequent-system confidentiality impact is rated high.
Remote code execution in DeskTime Time Tracking App before version 1.3.674 via improper TLS certificate validation allows network-positioned attackers to serve malicious executables during application updates without requiring user interaction. The vulnerability exploits the update mechanism's failure to properly validate TLS certificates, enabling an attacker in a man-in-the-middle position to achieve user-level code execution. EPSS score of 0.02% suggests low real-world exploitation probability despite RCE severity, likely due to the requirement for network positioning and the attack's reliance on coinciding update requests.
PhpSpreadsheet's HTML Writer exposes a stored cross-site scripting vulnerability across all major supported version branches through 5.6.0, triggered when spreadsheet cells use custom number formats combining the `@` text placeholder with quoted literal strings (e.g., `@ "items"`). An attacker who can supply a crafted XLSX file to an application that renders it as HTML can inject arbitrary HTML and JavaScript that executes in the browser of any user viewing the output. A functional proof-of-concept is publicly documented in GitHub security advisory GHSA-6wpp-88cp-7q68; however, the vulnerability is not in CISA KEV and EPSS sits at 0.01%, reflecting targeted rather than widespread exploitation at this time.
Remote command execution in mpGabinet 23.12.19 and below allows authenticated database administrators or unauthenticated attackers (via chained exploitation of CVE-2026-40550 and CVE-2026-40551) to achieve system command execution by manipulating attachment storage paths in the database to reference attacker-controlled resources that execute when users open the files. The vulnerability requires direct database access and user interaction to trigger execution, but becomes unauthenticated when chained with companion CVE vulnerabilities that grant database and application access.
OpenShift Container Platform build system allows authenticated users with the edit ClusterRole to inject arbitrary environment variables into docker-build containers via the buildconfigs/instantiate API, enabling information disclosure attacks such as build traffic interception through LD_PRELOAD or http_proxy manipulation. This represents an incomplete remediation of a prior vulnerability, affecting confidentiality of sensitive build data with CVSS 4.3 (network-accessible, low complexity, authenticated). No public exploit code or active exploitation has been confirmed at the time of analysis.
Out-of-bounds memory read in Google Chrome's ANGLE graphics layer on Windows exposes partial process memory to remote attackers through a crafted HTML page. Affected versions are all Chrome releases prior to 147.0.7727.138 on Windows; the ANGLE subsystem's integer overflow is the root cause. No public exploit code exists and no active exploitation is confirmed; EPSS at 0.01% and SSVC exploitation status of 'none' place this firmly in the low-urgency tier despite its network reachability.
Spring gRPC 1.0.0 through 1.0.2 inherits authenticated user identity on gRPC worker threads after access denial, allowing a subsequent unauthenticated request on the same thread to gain escalated permissions. The vulnerability requires an authenticated attacker with prior knowledge of thread reuse patterns and affects only configurations where both authenticated and unauthenticated requests share gRPC worker threads. A patch is available in version 1.0.3.