Path traversal in eiceblue spire-doc-mcp-server 1.0.0 allows remote unauthenticated attackers to escape the intended document directory by supplying crafted sequences in the `document_name` argument to the `get_doc_path` function in `src/spire_doc_mcp/api/base.py`. A public exploit exists and SSVC confirms the attack is automatable with partial technical impact across confidentiality, integrity, and availability. No vendor patch is available - the project has not responded to the coordinated disclosure filed via GitHub issue.
Path traversal in duartium papers-mcp-server allows remote unauthenticated attackers to access arbitrary files on the server by manipulating the topic argument in the search_papers function. The vulnerability affects commit 9ceb3812a6458ba7922ca24a7406f8807bc55598 and is publicly exploitable with proof-of-concept code available; the vendor has been notified via issue report but has not yet responded.
SQL injection in dubydu sqlite-mcp up to version 0.1.0 allows remote attackers to manipulate the output_filename parameter in the extract_to_json function, enabling arbitrary SQL command execution. The vulnerability has publicly available exploit code and affects all default installations without authentication requirements.
XML External Entity (XXE) injection in GRASSMARLIN v3.2.1 allows authenticated local users to extract sensitive information through crafted session data that exploits insufficient XML parser hardening. The vulnerability has a CVSS score of 5.5 with local attack vector and high confidentiality impact, affecting users with login credentials on systems running the affected version.
Path traversal in DV0x creative-ad-agent server component (up to commit 751b9e5146604dc65049bd0f62dcbdad6212f8a3) allows remote unauthenticated attackers to read arbitrary files via manipulation of req.params arguments in server/sdk-server.ts. Public exploit code is available. CVSS 5.5 reflects low confidentiality impact with network-accessible attack vector and no authentication requirement.
Stored XSS in PhpSpreadsheet's HTML writer (Writer/Html.php) allows an attacker who can supply a crafted XLSX file to inject arbitrary HTML into rendered output, executing JavaScript in victims' browsers. The root cause is a faulty identity-check gate at line ~1592 that skips htmlspecialchars() whenever a custom number format transforms cell data - a condition trivially triggered by adding any literal character (even a trailing space) to a format code containing the @ text placeholder. A detailed proof-of-concept is publicly available in the GitHub Security Advisory; the vulnerability is confirmed in PhpSpreadsheet versions across the 2.x, 3.x, and 4.x/5.x release lines, with patches released in 2.1.16, 2.4.5, 3.10.5, and 5.7.0. No active exploitation has been confirmed (not in CISA KEV), and the 0.03% EPSS score reflects low opportunistic exploitation probability at this time.
OpenClaw before version 2026.3.31 allows local authenticated users with user interaction to bypass exec allowlist restrictions via shell initialization file options (--rcfile, --init-file, --startup-file), enabling them to load attacker-controlled initialization files and achieve high-impact unauthorized access to confined resources. Exploitation requires local access, low privileges, user interaction, and specific timing conditions, but bypasses a critical security control intended to restrict executable trust.
Cross-Site Scripting (XSS) via malicious SVG upload in FUEL CMS v1.5.2 and earlier allows low-privileged authenticated users to execute arbitrary JavaScript in the context of other users' browsers through the asset upload functionality. The vulnerability stems from inadequate sanitization of SVG file contents during upload, enabling attackers with valid credentials to craft weaponized SVG files that execute when viewed by administrators or other site visitors. No active exploitation in CISA KEV confirmed; CVSS 5.4 reflects moderate impact with user interaction requirement.
Penetration Testing engineers at Amazon have discovered a flaw where the camera system fails to properly handle data supplied in certain requests, causing a service disruption. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity.
Booking Package plugin for WordPress up to version 1.7.06 allows unauthenticated attackers to manipulate booking prices via the intentForStripe() function, which accepts unsanitized $_POST['amount'] values and passes them directly to the Stripe PaymentIntent API without validation. The vulnerability is compounded by commented-out code in CreditCard.php that would normally enforce server-calculated pricing, enabling attackers to complete bookings at arbitrary prices (e.g., $0.01 instead of $500.00) with no authentication required. This is a confirmed price manipulation vulnerability with no active KEV exploitation reported but represents significant financial fraud risk.
OpenTelemetry's Zipkin exporter for .NET allows unauthenticated remote attackers to trigger denial of service by sending spans with high-cardinality remote endpoint attributes, causing unbounded memory growth in the remote endpoint cache and eventual process degradation. CVSS 5.3 (network-accessible, low complexity). Patch available from vendor; no active exploitation identified.
Memory exhaustion vulnerability in the OpenClaw npm package (all versions before 2026.4.8) allows authenticated network-accessible attackers to trigger denial of service by submitting crafted base64-encoded input to multiple affected decode paths, each of which allocates memory before enforcing decoded-size limits. The vendor explicitly scopes this vulnerability to OpenClaw's trust model as a user-controlled local assistant, not a multi-tenant service boundary, which meaningfully narrows real-world attack surface. No public exploit exists, CISA has not added this to KEV, and EPSS of 0.04% (11th percentile) confirms negligible exploitation activity at time of analysis.
Insecure deserialization in Cista v0.15 and below allows remote unauthenticated attackers to leak stack and heap addresses through reference tampering in the cista::raw namespace, potentially defeating ASLR protections. The vulnerability arises from insufficient validation of pointer-like objects during deserialization, enabling attackers to observe deserialized values and extract memory layout information for subsequent exploitation.
OpenClaw versions 2026.2.14 through 2026.3.24 fail to enforce guild and channel policy gates on Discord button and component interactions, allowing authenticated users to trigger privileged component actions from contexts where those actions should be blocked. The vulnerability bypasses channel policy enforcement via policy gate inconsistency, enabling privilege escalation within Discord servers where OpenClaw is deployed.
OpenClaw before version 2026.3.31 allows authenticated remote attackers to bypass sender allowlist filters when retrieving MS Teams thread history via Microsoft Graph API, enabling access to messages that should be restricted by security policies. The vulnerability affects organizations using OpenClaw's Teams integration and has been patched as of the specified version.
Stack overflow in Apache Thrift c_glib dispatch mechanism allows remote attackers to trigger denial of service via crafted network requests. The vulnerability affects Apache Thrift versions prior to 0.23.0 and requires no authentication or user interaction, resulting in application crashes or service unavailability. Patch is available from the vendor.
Unauthorized modification of the immutable `nick` (username) field in FacturaScripts allows any authenticated user to rename any account - including the Administrator - by intercepting a POST request to `/EditUser` and altering the `nick` form-data parameter before it reaches the backend. The backend performs no server-side validation of immutability or caller privilege, relying solely on UI-layer controls that are trivially bypassed with a proxy. A public proof-of-concept exists demonstrating the full attack; no vendor-released patch has been identified at time of analysis, leaving all deployments on affected versions exposed.
OpenClaw before version 2026.3.31 fails to block plugin installation when security scans detect threats, allowing authenticated users to install malicious plugins by ignoring visible scan warnings. The vulnerability requires user interaction (UI:P) and authenticated access (PR:L), but enables installation of untrusted code with moderate integrity impact when exploited.
Server-side request forgery in OpenClaw's QQ Bot Extension (npm package, all versions before 2026.4.8) allows authenticated users to route media fetch requests through unprotected endpoints, bypassing the configured SSRF guard and allowlist policies. Internal network resources - including metadata services and private APIs - are reachable via the subsequent-system scope change even though the OpenClaw host itself sustains no direct confidentiality impact. No public exploit code or active exploitation has been identified; EPSS stands at 0.03% and SSVC categorizes exploitation status as none.
Account lockout abuse in Ercom Cryptobox allows any authenticated user to deny another user access by sending a specially crafted request that triggers the platform's lockout mechanism. Specific versions in the 4.37-4.40 range are confirmed affected per ENISA EUVD-2026-26070, and the vendor has released a patch. No active exploitation is confirmed - EPSS stands at 0.04% (13th percentile) and CISA SSVC marks exploitation status as none, placing this firmly in the category of a real but low-urgency availability risk.
Server-side request forgery bypass in OpenClaw (npm) before 2026.4.8 allows authenticated users to reach private internal network targets by exploiting a race condition in Playwright redirect handling. Strict SSRF checks implemented via DNS pinning can be circumvented when request-time navigation occurs during a redirect, allowing traversal to otherwise-blocked private addresses. The GHSA advisory explicitly scopes this to OpenClaw's user-controlled local assistant trust model, not a multi-tenant service boundary. No public exploit code exists and SSVC indicates exploitation status as none at time of analysis.
SSRF policy bypass in OpenClaw (npm) versions before 2026.4.8 allows low-privilege authenticated users to exploit browser interaction-triggered navigations that circumvent the application's DNS-pinning SSRF guards. The bypass is specific to the TRUSTED_ENV_PROXY execution mode, activated when proxy environment variables are present, causing the fetch guard to skip hostname resolution policy enforcement and permitting requests to restricted internal resources. No active exploitation is confirmed by CISA KEV; EPSS is 0.03% (7th percentile) and SSVC exploitation status is none, though the subsequent-system confidentiality impact is rated high.
Remote code execution in DeskTime Time Tracking App before version 1.3.674 via improper TLS certificate validation allows network-positioned attackers to serve malicious executables during application updates without requiring user interaction. The vulnerability exploits the update mechanism's failure to properly validate TLS certificates, enabling an attacker in a man-in-the-middle position to achieve user-level code execution. EPSS score of 0.02% suggests low real-world exploitation probability despite RCE severity, likely due to the requirement for network positioning and the attack's reliance on coinciding update requests.
PhpSpreadsheet's HTML Writer exposes a stored cross-site scripting vulnerability across all major supported version branches through 5.6.0, triggered when spreadsheet cells use custom number formats combining the `@` text placeholder with quoted literal strings (e.g., `@ "items"`). An attacker who can supply a crafted XLSX file to an application that renders it as HTML can inject arbitrary HTML and JavaScript that executes in the browser of any user viewing the output. A functional proof-of-concept is publicly documented in GitHub security advisory GHSA-6wpp-88cp-7q68; however, the vulnerability is not in CISA KEV and EPSS sits at 0.01%, reflecting targeted rather than widespread exploitation at this time.
Remote command execution in mpGabinet 23.12.19 and below allows authenticated database administrators or unauthenticated attackers (via chained exploitation of CVE-2026-40550 and CVE-2026-40551) to achieve system command execution by manipulating attachment storage paths in the database to reference attacker-controlled resources that execute when users open the files. The vulnerability requires direct database access and user interaction to trigger execution, but becomes unauthenticated when chained with companion CVE vulnerabilities that grant database and application access.
OpenShift Container Platform build system allows authenticated users with the edit ClusterRole to inject arbitrary environment variables into docker-build containers via the buildconfigs/instantiate API, enabling information disclosure attacks such as build traffic interception through LD_PRELOAD or http_proxy manipulation. This represents an incomplete remediation of a prior vulnerability, affecting confidentiality of sensitive build data with CVSS 4.3 (network-accessible, low complexity, authenticated). No public exploit code or active exploitation has been confirmed at the time of analysis.
Out-of-bounds memory read in Google Chrome's ANGLE graphics layer on Windows exposes partial process memory to remote attackers through a crafted HTML page. Affected versions are all Chrome releases prior to 147.0.7727.138 on Windows; the ANGLE subsystem's integer overflow is the root cause. No public exploit code exists and no active exploitation is confirmed; EPSS at 0.01% and SSVC exploitation status of 'none' place this firmly in the low-urgency tier despite its network reachability.
Spring gRPC 1.0.0 through 1.0.2 inherits authenticated user identity on gRPC worker threads after access denial, allowing a subsequent unauthenticated request on the same thread to gain escalated permissions. The vulnerability requires an authenticated attacker with prior knowledge of thread reuse patterns and affects only configurations where both authenticated and unauthenticated requests share gRPC worker threads. A patch is available in version 1.0.3.
Spring gRPC versions 1.0.0 through 1.0.2 leak sensitive authentication failure details in gRPC status descriptions to unauthenticated remote callers, enabling reconnaissance for follow-up attacks. The vulnerability exposes raw server-side AuthenticationException messages without sanitization, providing attackers with information about authentication mechanisms and potential weaknesses. This low-severity information disclosure (CVSS 3.7) requires high attack complexity but affects default configurations.
Site isolation bypass in Google Chrome's Compositing component (versions prior to 147.0.7727.138) enables a remote attacker who has already achieved renderer process compromise to escape the cross-origin security boundary via a crafted HTML page. This is a second-stage attack primitive - it does not stand alone but extends an existing renderer exploit into a partial policy bypass, potentially leaking cross-origin content. No public exploit code has been identified and EPSS is extremely low at 0.02%, yet Chromium's internal rating of High reflects the strategic value of site isolation escapes in chained browser exploit scenarios.
Cross-origin data leakage in Google Chrome's MHTML implementation exposes sensitive data from other browser origins to a malicious extension. Versions prior to 147.0.7727.138 are affected; exploitation requires convincing the target user to install an attacker-controlled Chrome Extension that triggers a race condition in MHTML processing. No public exploit code has been identified and CISA SSVC confirms no exploitation at time of analysis, placing real-world risk significantly below what the product's ubiquity might suggest.
Improper resource identifier control in Xuxueli xxl-job versions 3.3.0 through 3.3.2 exposes execution log entries to unauthorized disclosure via logId parameter manipulation in the admin Execution Log Handler. The commit diff reveals that `JobGroupPermissionUtil.validJobGroupPermission` was commented out in `JobLogController.java`, effectively removing the job-group-level access boundary and enabling IDOR-style cross-boundary log reads. A public proof-of-concept exploit exists per SSVC (Exploitation: poc), though a CVSS 4.0 score of 2.9 and EPSS of 0.05% (16th percentile) reflect that high attack complexity and limited confidentiality impact constrain real-world risk; no active exploitation is confirmed in CISA KEV.
Hard-coded cryptographic key exposure in Xuxueli xxl-job's OpenAPI endpoint (versions 3.3.0-3.3.2) allows remote attackers to authenticate to the admin scheduling API using a known default token (`default_token`) without supplying legitimate credentials. A proof-of-concept exploit has been publicly disclosed via the upstream GitHub issue tracker (SSVC: poc), though CVSS AC:H and SSVC's non-automatable rating indicate mass exploitation is constrained - only deployments retaining the default token configuration are exposed. No confirmed active exploitation (not in CISA KEV) and a low EPSS of 0.04% (14th percentile) suggest targeted rather than opportunistic risk.
Authentication bypass in OpenClaw (npm package, all versions before 2026.4.8) allows low-privileged attackers to exploit a stale JavaScript closure - resolvedAuth - that is not refreshed after a gateway configuration reload, causing newly accepted connections to authenticate against outdated auth state. The CVSS 4.0 score is 2.3 with EPSS at 0.05% (16th percentile), reflecting low real-world exploitation probability; no active exploitation is confirmed and no CISA KEV listing exists. The vendor's own advisory explicitly scopes the issue to OpenClaw's user-controlled local assistant trust model and explicitly excludes multi-tenant service boundaries, sharply limiting blast radius.
Cross-channel allowlist write bypass in OpenClaw before 2026.4.8 allows an authorized but non-owner sender to modify the /allowlist endpoint of channels they do not own, violating the product's intended authorization model. The flaw is classified under CWE-863 (Incorrect Authorization) and is explicitly scoped by the vendor to OpenClaw's single-user local assistant trust model - the advisory excludes multi-tenant service boundaries. With a CVSS 4.0 score of 2.3, EPSS of 0.05% at the 16th percentile, SSVC exploitation status of none, and no public exploit code identified at time of analysis, this is a low-priority integrity-only issue warranting a normal patch cycle rather than emergency response.
OpenClaw before version 2026.3.31 contains a sender allowlist bypass vulnerability allowing remote attackers to access restricted messages by exploiting quoted, root, and thread context message retrieval mechanisms. The vulnerability affects default configurations and requires user interaction (CVSS UI:P), making it a moderate-risk authentication bypass that undermines message access controls.
OpenClaw versions 2026.2.19 before 2026.3.31 allow authenticated attackers to suppress legitimate webhook events across different accounts in multi-tenant deployments by exploiting improper cache isolation in the Zalo webhook replay-deduplication mechanism. An attacker with control of one authenticated Zalo webhook path can match event_name and message_id parameters to suppress events on victim accounts, causing denial of service to webhook processing. No public exploit code or active exploitation has been identified, though the vulnerability requires valid authentication and incremental exploitation (AT:P), limiting immediate risk.
Disk exhaustion via unbounded Tlon media downloads affects OpenClaw versions up to and including 2026.3.28, where the Tlon extension bypasses the shared media runtime's file size cap (6 MB per file), per-message image count limit (8 images), and cleanup controls. An authenticated attacker with a valid Tlon account can craft posts containing large numbers of oversized image URLs, causing the OpenClaw instance to write unbounded media to local storage until disk space is exhausted. No active exploitation is confirmed (not in CISA KEV), EPSS is 0.04% (11th percentile), and SSVC classifies exploitation as none - vendor-released patch version 2026.3.31 resolves the issue.
OpenClaw before version 2026.3.31 allows authenticated attackers to bypass webhook replay protection through overly broad cache keying, enabling delivery of duplicate webhook messages to unintended sibling targets when the same messageId is reused. The vulnerability exploits insufficient scope isolation in the webhook replay cache deduplication mechanism, allowing message replay across organizational boundaries within a single authentication context.
OpenClaw, an npm-distributed local AI assistant, fails to terminate existing WebSocket sessions when the shared gateway token is rotated, allowing a party who previously obtained a shared token to maintain persistent WebSocket access even after that token has been revoked through rotation. All releases prior to 2026.4.8 are affected. The CVSS 4.0 score of 2.3 with AT:P reflects specific conditions required - a pre-existing authenticated session plus a concurrent rotation event - and no public exploit code exists; CISA SSVC classifies exploitation status as none, consistent with the 0.03% EPSS score.
OpenClaw before version 2026.3.31 allows authenticated attackers to bypass authorization controls on Discord voice channels through exploitation of stale-role validation gaps and improper channel name validation, enabling unauthorized access to restricted voice channels that should be protected by member and channel allowlists. The vulnerability requires valid Discord credentials but enables privilege escalation within voice channel access controls. No public exploit code has been identified at the time of analysis.
OpenClaw before version 2026.3.31 contains an access control bypass in its Discord voice manager that allows authenticated attackers to send voice ingress requests before channel allowlist authorization checks are enforced, gaining unauthorized access to restricted voice channels. The vulnerability exploits a race condition or authorization sequencing flaw in the voice channel access control mechanism, affecting deployments with member-level access restrictions.
OpenClaw before version 2026.3.31 fails to properly validate message senders in Matrix thread root and reply context handling, allowing remote unauthenticated attackers to bypass sender allowlists and access filtered messages. The vulnerability requires user interaction and has low attack complexity, but impact is limited to information disclosure of message context that should have been restricted by access controls.
Server-side request forgery in Xuxueli xxl-job 3.3.0-3.3.2 allows an authenticated admin-panel user to supply arbitrary URLs in the `addressList` parameter of the manual job trigger endpoint, causing the server to issue outbound HTTP requests to attacker-specified internal or external destinations. The vulnerability is publicly disclosed with exploit code available, but the project maintainer formally disputes its severity, asserting the trigger endpoint is protected by login and role-based access control, and rejected the fix PR. No patched release exists; EPSS at 0.04% and absence from CISA KEV indicate minimal observed in-the-wild exploitation.
Reflected cross-site scripting (XSS) in SourceCodester Pharmacy Sales and Inventory System 1.0 allows remote attackers to inject malicious scripts via manipulation of the ID parameter in the /index.php?page=types endpoint. User interaction is required for exploitation, and publicly available exploit code exists, though the vulnerability carries limited impact (integrity only, no confidentiality or availability compromise) with a CVSS score of 5.3.
Stored or reflected cross-site scripting (XSS) in SourceCodester Safety Anger Pad 1.0 allows remote unauthenticated attackers to inject malicious scripts via the angerDisplay parameter, potentially compromising user sessions and stealing sensitive data. The vulnerability requires user interaction (UI:R per CVSS) but has publicly available exploit code and a moderate CVSS score of 4.3, making it a practical attack vector for credential harvesting or malware distribution.
OpenClaw before version 2026.4.2 improperly trusts local-network pages in its iOS A2UI bridge, allowing attackers to inject unauthorized agent.request commands by serving malicious content from local-network or tailnet hosts. This can pollute session state and consume user budget without authentication, though exploitation requires user interaction and proximity to the target network.
GNU nano creates the ~/.local directory with world-writable permissions (0777) on first use of XDG data storage features when the directory does not exist, allowing local attackers in systems with relaxed umasks (such as containers, CI/CD runners, or environments with umask 000) to write attacker-controlled files into the victim's XDG directory hierarchy via a race condition. The vulnerability affects nano versions before 9.0 and carries a CVSS score of 2.1 with CISA SSVC assessment indicating partial technical impact but no known public exploitation.
Path traversal in elie's mcp-project 0.1.0 exposes local filesystem paths through the `search_papers` function in `research_server.py`, where the unsanitized `topic` argument can be manipulated to traverse directory boundaries. The vulnerability produces partial confidentiality, integrity, and availability impact (VC:L/VI:L/VA:L) and is confined to local attack scenarios. A public proof-of-concept exists per SSVC and VulDB reporting, though EPSS places exploitation probability at 0.02% (4th percentile) and SSVC confirms the attack is not automatable - indicating low real-world threat despite POC availability.
SQL injection in SourceCodester Pharmacy Sales and Inventory System 1.0 allows authenticated remote attackers to execute arbitrary SQL commands via the ID parameter in the save_expired function of /ajax.php. The vulnerability affects an administrative interface endpoint and has publicly available exploit code. CVSS 5.1 reflects low confidentiality, integrity, and availability impact despite network accessibility due to high-privilege requirement (PR:H).