Deprecated DNS printing functions in glibc 2.2 and later fail to validate RDATA content length for LOC, CERT, TKEY, and TSIG record types, enabling an attacker who can supply a crafted DNS response to crash affected applications or leak uninitialized memory. The affected functions - ns_printrrf, ns_printrr, and fp_nquery - are explicitly debug-only utilities outside the standard DNS resolver code path, and have been formally deprecated since glibc 2.34, substantially limiting real-world exposure. No public exploits or active exploitation have been identified (SSVC Exploitation: none; EPSS: 0.04%), and a vendor patch is available via the glibc project and Red Hat advisory RHSA-2026:12740.
Authenticated attackers can read vault documentation from unauthorized vaults in Devolutions Server 2026.1.14.0 and earlier by sending a crafted API request that bypasses authorization checks on the vault documentation feature. The flaw stems from CWE-862 (Missing Authorization), where the server fails to verify that the requesting user has permission to access documentation tied to a specific vault. EPSS is 0.03% (8th percentile) and SSVC reports no known exploitation, indicating this is currently a theoretical risk with no observed active use.
Fiber v3 cache middleware's default KeyGenerator discards the query string entirely, keying responses solely on the request path, which causes requests to distinct URIs such as /?id=1 and /?id=2 to share a single cache slot. Any network-accessible application using default configuration on query-variant endpoints will serve the first cached response to all subsequent callers regardless of their query parameters, creating a cache poisoning-like information disclosure and integrity corruption scenario. A working proof-of-concept is embedded in the GHSA advisory and an existing test case in the repository confirms the behavior; SSVC rates exploitation as automatable, though EPSS remains very low at 0.03% with no CISA KEV listing, indicating no observed mass exploitation as of analysis time.
Out-of-bounds read in Apache Thrift C++ JSON deserialization allows remote attackers to leak sensitive information and trigger denial of service via malformed JSON payloads. Affects Apache Thrift versions prior to 0.23.0. The vulnerability has low exploitation probability (EPSS 0.02%) and is not currently listed in CISA KEV, suggesting limited real-world weaponization despite network-accessible attack vector.
KDE KCoreAddons before version 6.25 contains an improper neutralization of special elements vulnerability in the KShell::quoteArgs() function that fails to safely escape metacharacters and control characters, allowing local attackers with user interaction to inject arbitrary shell commands or terminal control sequences when user input is passed to shell execution contexts. Applications using this method to quote arguments for security-critical operations are affected; exploitation requires local access and user interaction but can achieve arbitrary code execution with user privileges.
KDE Dolphin before 25.12.3 allows sandboxed applications (running under Flatpak or AppArmor confinement) to bypass sandbox restrictions and open arbitrary files outside their containment boundary through the FileManager1 D-Bus protocol implementation. An attacker controlling a sandboxed application can exploit this to access sensitive files or execute scripts with user interaction, circumventing the intended isolation model.
Stored cross-site scripting (XSS) in the Woostify WordPress plugin through version 2.5.0 allows authenticated attackers with Contributor-level access and above to inject arbitrary JavaScript into pages via unsanitized href attributes in the bundled Lity.js lightbox library. The injected scripts execute in the browsers of any user visiting the compromised page, enabling account takeover, credential theft, and malware distribution. No public exploit code has been identified at the time of analysis, but the vulnerability requires only low complexity network access with authenticated credentials.
Stored Cross-Site Scripting in Social Post Embed plugin for WordPress up to version 2.0.1 allows authenticated attackers with Contributor-level access to inject arbitrary JavaScript into page content via the Threads embed handler due to insufficient input sanitization and output escaping. Injected scripts execute when any user views the affected page, enabling session hijacking, credential theft, or malware distribution from trusted WordPress sites. No public exploit code or active exploitation has been identified at the time of analysis.
Stored Cross-Site Scripting in Timeline Blocks for Gutenberg WordPress plugin through version 1.1.10 allows authenticated contributors and above to inject arbitrary JavaScript via the 'titleTag' attribute of the timeline-blocks/tb-timeline-blocks block, executing malicious scripts whenever any user views the affected page. The vulnerability stems from insufficient input sanitization and output escaping on user-supplied block attributes. Exploitation requires WordPress contributor-level access or higher and affects all versions up to 1.1.10.
Stored cross-site scripting in WPC Smart Messages for WooCommerce plugin through version 4.2.8 allows authenticated attackers with contributor-level access to inject arbitrary JavaScript via the 'text' attribute of the wpcsm_text_rotator shortcode, resulting in execution whenever users view affected pages. The vulnerability stems from insufficient input sanitization and output escaping. No active exploitation confirmed; patch available in version 4.2.9.
OpenClaw before version 2026.3.31 misclassifies proxied remote requests as loopback connections in the diffs viewer, allowing attackers to bypass the allowRemoteViewer access control restriction. Unauthenticated remote attackers can exploit this authentication bypass by sending specially crafted proxied requests that are incorrectly identified as local traffic, gaining unauthorized access to the diffs viewer functionality. The vulnerability requires network access and specific timing/proximity conditions (per CVSS AT:P vector), but once exploited results in confidentiality impact through unauthorized information disclosure.
Race condition in OpenClaw's shared-secret authentication subsystem allows unauthenticated network attackers to send concurrent async requests that race the per-key rate-limit budget counter on Tailscale-capable paths, bypassing intended throttling protections. All OpenClaw npm versions prior to 2026.4.4 are affected. No public exploit has been identified and SSVC classifies exploitation as none with partial technical impact; EPSS at 0.04% (12th percentile) reflects minimal real-world exploitation interest.
OpenClaw before version 2026.4.2 leaks shared-secret length information through timing side-channel attacks in cryptographic comparison operations. The vulnerability stems from early length-mismatch checks in shared-secret comparison routines that violate constant-time security requirements, allowing remote attackers to measure timing differences and infer secret lengths without authentication. This weakens the cryptographic guarantees of the library's shared-secret handling.
OpenClaw before version 2026.3.31 allows remote attackers to bypass configuration revocation controls by restarting the application, which rehydrates revoked Tlon configuration settings from disk state due to improper handling of empty-array settings during startup migration. An attacker with network access and the ability to trigger application restarts can restore previously revoked authentication or authorization configurations without explicit re-enablement, potentially compromising intended security controls.
Server-side request forgery in NVIDIA NemoClaw's validateEndpointUrl() function allows local attackers with user interaction to supply crafted endpoint URLs targeting the 0.0.0.0/8 address range via blueprint configuration files or CLI flags, leading to information disclosure. The vulnerability affects all versions of NemoClaw and requires local access with user interaction to trigger, limiting exposure to systems where untrusted users can modify configuration or invoke CLI commands.
OpenClaw before version 2026.4.2 allows authenticated attackers to delete arbitrary remote directories during mirror mode synchronization operations by manipulating remoteWorkspaceDir and remoteAgentWorkspaceDir configuration values. An attacker with login credentials can craft malicious OpenShell config paths that cause the mirror sync function to delete unintended remote directory contents before replacing them with uploaded workspace data, resulting in data loss and potential service disruption.
SQL injection in SourceCodester Pizzafy Ecommerce System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the Name parameter in the save_category function at /admin/ajax.php. The vulnerability requires valid administrative credentials but poses moderate confidentiality, integrity, and availability risk. Publicly available exploit code exists and EPSS score of 0.84 indicates high exploitation probability despite the authentication gate.
SQL injection in SourceCodester Pizzafy Ecommerce System 1.0 via the ID parameter in /view_prod.php allows authenticated remote attackers to execute arbitrary SQL queries with low complexity and no user interaction required. The vulnerability has a publicly available exploit and CVSS score of 6.3 reflecting moderate impact on confidentiality, integrity, and availability. Active exploitation is not yet confirmed in CISA KEV, but public proof-of-concept code exists.
SQL injection in SourceCodester Pizzafy Ecommerce System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the ID parameter in the save_order function at /admin/ajax.php?action=save_order, potentially enabling data exfiltration, modification, or deletion. Publicly available exploit code exists and the vulnerability carries a CVSS score of 6.3 with low complexity, indicating moderate real-world risk despite requiring login credentials.
SQL injection in SourceCodester Pizzafy Ecommerce System 1.0 allows authenticated remote attackers to read, modify, or delete database contents through the ID parameter in the category function (pizza/index.php?page=category). The vulnerability has publicly available exploit code and requires valid user authentication to exploit, making it a moderate-risk issue suitable for immediate patching in production environments.
SQL injection in SourceCodester Pizzafy Ecommerce System 1.0 allows authenticated remote attackers to manipulate the ID parameter in the get_cart_items AJAX function (/admin/ajax.php?action=get_cart_items) to execute arbitrary SQL queries and extract, modify, or delete database contents. The vulnerability has a CVSS score of 6.3 with publicly available exploit code, posing moderate risk to affected installations.
SQL injection in code-projects Coaching Management System 1.0 allows authenticated remote attackers to manipulate the complaintreply parameter in the POST handler at /cims/modules/admin/reply.php, leading to unauthorized database access and potential data exfiltration or modification. CVSS score of 6.3 reflects low confidentiality, integrity, and availability impact with network vector and low attack complexity. Public exploit code is available, and the vulnerability requires valid user authentication to trigger.
Reflected XSS in School Management System (by mahmoudai1) allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by embedding a malicious payload in the `type` parameter of register.php, which is reflected without sanitization. The attack requires social engineering to deliver a crafted URL to a target (UI:R per CVSS), and a proof-of-concept exploit is publicly available per SSVC classification and a dedicated CVE PoC repository. EPSS is extremely low (0.01%, 3rd percentile), indicating negligible opportunistic exploitation observed in the wild despite the POC's existence, and the vulnerability is not listed in CISA KEV.
Spring AI versions 1.0.0-1.0.5 and 1.1.0-1.1.4 expose ONNX machine learning models to unauthorized disclosure when the application runs in shared hosting environments, allowing local users with limited system access to read sensitive model files and potentially reverse-engineer proprietary ML logic. The vulnerability stems from insecure temporary file handling (CWE-377) that fails to restrict file permissions on extracted model artifacts. Authentication requirements are minimal-only local system access is needed-making this a significant risk in multi-tenant cloud platforms and shared servers.
Server-side request forgery (SSRF) in o2oa up to version 10.0 allows authenticated remote attackers to manipulate the fileUrl parameter in the FileAction component to trigger arbitrary HTTP requests from the server. The vulnerability requires authenticated access (PR:L) but can facilitate attacks against internal services, exfiltrate sensitive data, or pivot to backend systems. Publicly available exploit code exists, and the vendor has not yet responded to early notification.
SQL injection in JeecgBoot up to version 3.9.1 allows authenticated remote attackers to execute arbitrary SQL commands through the loadDict endpoint by manipulating the keyword parameter in the SqlInjectionUtil function. The vulnerability has a CVSS score of 6.3 with network-accessible attack vector, and publicly available exploit code exists; patch availability is confirmed via GitHub commit a9c8e8eb1185751c4c3c68d2a53f3dadee9edc6b.
OpenClaw versions 2026.2.6 through 2026.3.24 allow authenticated remote attackers to read arbitrary files outside configured sandbox boundaries via path traversal in the Feishu extension's resolveUploadInput function during upload_image operations. The vulnerability bypasses file-system sandbox restrictions through improper path resolution, enabling confidentiality compromise of sensitive data accessible to the application process.
Privilege escalation in OpenClaw's gateway plugin HTTP authentication mechanism allows an authenticated user with operator.read scope to gain unauthorized operator.write runtime access. The gateway auth route incorrectly widens identity-bearing read-scoped requests into write permissions, bypassing the intended authorization boundary. No active exploitation has been identified (CISA KEV absent), and the vendor has confirmed a patch in version 2026.4.8 of the npm package.
Filesystem policy bypass in OpenClaw's Feishu docx upload pipeline (upload_file and upload_image endpoints) enables authenticated users to read local files outside the intended workspace-only boundary via path traversal. All npm versions of openclaw prior to 2026.4.8 are affected; this is explicitly an incomplete fix of a prior advisory (GHSA-qf48-qfv4-jjm9), indicating the original control was partially circumvented. No active exploitation has been identified - SSVC rates exploitation as none, EPSS sits at 0.04% (12th percentile), and the vulnerability is absent from CISA KEV - with a vendor-confirmed patch available at version 2026.4.8.
Unrestricted file upload vulnerability in code-projects Online Music Site 1.0 allows authenticated high-privilege administrators to upload arbitrary files via the txtimage parameter in AdminUpdateAlbum.php, potentially leading to remote code execution. The vulnerability is network-accessible, has publicly available exploit code, and requires high-level administrative credentials to exploit, limiting attack surface primarily to insider threats or compromised admin accounts.
Stored cross-site scripting (XSS) in code-projects Coaching Management System 1.0 allows authenticated remote attackers to inject malicious scripts via the Complaint parameter in the complaint form page (/cims/modules/student/complaint.php), affecting users who view injected content. CVSS 5.1 reflects low confidentiality impact and limited integrity impact requiring user interaction; publicly available exploit code exists, confirming practical exploitability.
OpenClaw before version 2026.3.31 allows authenticated attackers to read arbitrary host files through improper validation in the appendLocalMediaParentRoots function, enabling exfiltration of credentials and sensitive data. The vulnerability permits model-initiated file access by exploiting a self-whitelisting mechanism that fails to properly validate media parent directory paths. Authentication is required, but the flaw affects confidentiality with a CVSS score of 6.0.
SQL injection in SourceCodester Pizzafy Ecommerce System 1.0 allows authenticated remote attackers to execute arbitrary SQL commands via the ID parameter in the delete_category function (/admin/ajax.php?action=delete_category). The vulnerability requires high-privilege authentication but enables limited confidentiality and integrity impact. Publicly available exploit code exists, elevating real-world risk despite the moderate CVSS score of 5.1.
SQL injection in SourceCodester Pharmacy Sales and Inventory System 1.0 allows authenticated high-privilege attackers to manipulate the ID parameter in the delete_expired function via /ajax.php?action=delete_expired, enabling remote database query manipulation with confidentiality, integrity, and availability impact. Publicly available exploit code exists and the vulnerability has been documented by VulDB.
Spring AI fails to properly isolate conversation contexts when user-supplied input is passed directly as conversationId to VectorStoreChatMemoryAdvisor, allowing remote unauthenticated attackers to inject filter logic that exfiltrates sensitive data from other users' chat histories, including secrets and credentials. Exploitation requires moderately complex attack construction (AC:H) but no user interaction, affecting only applications with the specific vulnerable configuration pattern.
Stored/reflected cross-site scripting in SourceCodester Pizzafy Ecommerce System 1.0 allows an authenticated administrator to inject arbitrary JavaScript via the Name parameter at /admin/ajax.php?action=save_menu, which executes in the browser of any user who subsequently loads the manipulated menu. A public proof-of-concept is documented in a researcher-submitted PDF on GitHub, though no active exploitation has been confirmed and EPSS sits at 0.03% (9th percentile). The CVSS 4.0 score of 1.9 correctly reflects the high privilege bar and required user interaction, making this a low-priority, researcher-reported finding with minimal real-world risk in typical deployments.
Cross-channel local file exfiltration in OpenClaw (npm package, all versions before 2026.4.8) allows an attacker with low-privilege access to craft malicious shared reply MEDIA path references that cause a separate channel to resolve and expose local file contents as trusted generated media. The root cause (CWE-73) is improper neutralization of path references in shared reply MEDIA URIs: OpenClaw accepts these references without enforcing a trust origin check, effectively treating attacker-controlled paths as internally generated content. No public exploit code has been identified and CISA has not listed this in KEV, but the high confidentiality impact on the vulnerable system (VC:H in the CVSS 4.0 vector) and the arbitrary local-file-read capability make patching a priority for any affected deployment.
Cryptographic signature verification bypass in Elastic Package Registry versions 0.1.0 through 1.37.0 allows an adversary-in-the-middle, or an attacker with influence over a self-hosted registry's served content, to substitute tampered packages that are accepted without triggering integrity check failures. The flaw (CWE-347) undermines supply-chain integrity for organizations running self-hosted registry instances. No active exploitation is confirmed (SSVC: exploitation none; EPSS 0.02%), but the high integrity impact and zero-privilege-required vector make patching to 1.38.0 a priority for self-hosted deployments.
Out-of-bounds read in Artifex MuPDF up to version 1.28.0 within the CFF Index Handler's fz_subset_cff_for_gids function allows local attackers with low privileges to disclose sensitive information from application memory. The vulnerability requires local access and low privilege level but can be triggered without user interaction; publicly available exploit code exists and the vulnerability remains unpatched as of the last vendor response.
OpenClaw before version 2026.3.31 accepts arbitrary tailnet peers as DNS authorities due to improper validation in its wide-area discovery mechanism, enabling attackers positioned within the same tailnet with CA-trusted endpoint access to manipulate DNS resolution and exfiltrate operator credentials. The vulnerability requires adjacent network access, high attack complexity, and user interaction, but results in high confidentiality impact through credential theft. No active exploitation has been publicly confirmed at the time of analysis.
Cross-site scripting (XSS) in SourceCodester Pizzafy Ecommerce System 1.0 allows authenticated high-privilege administrators to inject malicious scripts via the Name parameter in the /admin/index.php?page=save_settings endpoint, exploited when an admin visits a crafted link. The vulnerability requires high privilege level (admin) and user interaction (UI:P), limiting but not eliminating real-world risk in environments with untrusted admins or admin account compromise. Publicly available exploit code exists.
Stored cross-site scripting (XSS) in SourceCodester Pharmacy Sales and Inventory System 1.0 allows authenticated remote attackers with high privileges to inject malicious scripts via the Name parameter in the supplier management function (/index.php?page=supplier), affecting users who view the poisoned supplier records. The vulnerability requires user interaction (clicking a malicious link) and has CVSS 4.8 with publicly available proof-of-concept code, though it is limited to high-privileged users (PR:H) and causes only integrity impact (VI:L) without confidentiality or availability compromise.
Remote code execution in OpenClaw (npm) before version 2026.4.8 is achievable by injecting malicious build tool environment variables - specifically HGRCPATH, CARGO_BUILD_RUSTC_WRAPPER, RUSTC_WRAPPER, and MAKEFLAGS - which were absent from the application's exec environment denylist. Because OpenClaw is a user-controlled local assistant, an attacker with the ability to set environment variables on the host can influence exec commands invoked by the tool and achieve arbitrary code execution. No public exploit code has been identified at time of analysis, and SSVC signals indicate no current exploitation activity, but the integrity impact (VI:H) is significant when exploitation conditions are met.
Git environment variable injection in OpenClaw (npm) before 2026.4.8 allows a local low-privileged attacker to redirect git operations by setting GIT_DIR and related plumbing variables in the process environment prior to host exec calls. The root cause is an incomplete denylist (CWE-184) that strips some but not all dangerous environment variables before shelling out. No public exploit or active exploitation has been identified at time of analysis; EPSS of 0.01% (3rd percentile) and SSVC exploitation status of 'none' corroborate low near-term exploitation likelihood.
OpenClaw before version 2026.3.31 allows local authenticated attackers to redirect Python package-index traffic by injecting malicious URLs through unsanitized PIP_INDEX_URL and UV_INDEX_URL environment variables, enabling interception or manipulation of package management operations. The vulnerability requires local access and authentication but can result in high integrity impact through compromised package delivery. No active exploitation has been publicly confirmed, but the attack surface is direct and the remediation is straightforward.
OpenClaw before 2026.3.31 allows authenticated users with approved host-exec requests to execute arbitrary code during build processes by overriding compiler binary environment variables (CC, CXX, CARGO_BUILD_RUSTC, CMAKE_C_COMPILER) through an incomplete host-env-security-policy.json configuration. The vulnerability requires local access and prior authentication to an OpenClaw instance, but enables full code execution with inherited privileges during compilation. No public exploit code has been identified at time of analysis.
Command injection in eiliyaabedini's aider-mcp MCP server allows remote, unauthenticated attackers to execute arbitrary OS commands by supplying malicious shell metacharacters in the `working_dir` or `editable_files` arguments to the `code_with_ai` function in `aider_mcp.py`. A public proof-of-concept has been disclosed (SSVC: poc; CVSS 4.0 threat metric E:P), and SSVC classifies the vulnerability as automatable with partial technical impact. No patch exists - the project maintainer was notified via GitHub issue but has not responded, leaving all rolling-release deployments through commit 667b914301aada695aab0e46d1fb3a7d5e32c8af unprotected.
Command injection in dvladimirov MCP up to version 0.1.0 allows remote unauthenticated attackers to execute arbitrary system commands via manipulation of the repo_url or pattern arguments in the GitSearchRequest function of mcp_server.py. The vulnerability has a publicly available exploit and CVSS 6.9 score indicating moderate severity with network-accessible attack vector and low complexity, though the vendor has not responded to the early disclosure.
Path traversal in elinsky's execution-system-mcp 0.1.0 allows remote unauthenticated attackers to escape the intended directory boundary by manipulating the `context` argument passed to the `_get_context_file_path` function via the `add_action` tool, enabling read and potential write access to arbitrary files on the host filesystem. A public proof-of-concept exploit is confirmed (GitHub issue #1, VulDB 359972), and SSVC classifies the attack as automatable with partial technical impact. Despite EPSS at 0.08% reflecting the product's obscurity, the no-auth network-exploitable attack surface means any exposed instance faces meaningful risk.
Path traversal in eiceblue spire-pdf-mcp-server 0.1.1 allows unauthenticated remote attackers to escape the intended PDF directory by supplying crafted traversal sequences in the filepath argument to the get_pdf_path function, enabling unauthorized read and write access to arbitrary files on the host. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms zero-barrier remote exploitation with no authentication or special conditions, and a published exploit is confirmed (E:P). No vendor patch is available; the project maintainer has not responded to the responsible disclosure filed in GitHub issue #1.