Merge PACS 7.0 contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized actions by crafting malicious HTML forms targeting the merge-viewer endpoint. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
SysGauge 4.5.18 contains a buffer overflow vulnerability in the proxy configuration handler that allows local attackers to cause a denial of service by supplying an oversized string. Rated medium severity (CVSS 6.9), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
librsvg2-bin 2.40.13 contains a buffer overflow vulnerability that allows local attackers to cause a denial of service by processing malformed SVG files. Rated medium severity (CVSS 6.9), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
PDFunite 0.41.0 contains a buffer overflow vulnerability that allows local attackers to crash the application by processing malformed PDF files during merge operations. Rated medium severity (CVSS 6.9), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
OS command injection in BurtTheCoder mcp-dnstwist through version 1.0.4 allows remote attackers to execute arbitrary operating system commands by manipulating the domain argument passed to the fuzz_domain function in the MCP Interface. Publicly available exploit code exists (hosted on GitHub), and SSVC classifies this as automatable with a poc-level exploitation status. No vendor patch has been released, as the project maintainer has not responded to the coordinated disclosure filed via GitHub issue.
OS command injection in PolarVista xcode-mcp-server 1.0.0 allows remote unauthenticated attackers to execute arbitrary system commands via crafted MCP requests to the build_project or run_tests functions. The vulnerability stems from insufficient input validation in src/index.ts when processing Request parameters. A publicly available exploit code exists (GitHub), and the vendor has not responded to early vulnerability disclosure attempts, leaving users without an official patch. EPSS data not available, but public exploit combined with network-accessible attack vector (CVSS AV:N/AC:L/PR:N) indicates elevated real-world risk for exposed instances.
Path traversal in geekgod382 filesystem-mcp-server 1.0.0 allows unauthenticated remote attackers to read or write files outside the server's intended allowed directories by supplying path sequences that bypass the flawed `is_path_allowed()` check in `server.py`. Both `read_file_tool` and `write_file_tool` are affected, enabling arbitrary file exfiltration or overwrite on the host. A public exploit POC exists on GitHub; SSVC rates this as automatable with partial technical impact, though EPSS at 0.05% (16th percentile) reflects the product's niche deployment footprint rather than low exploitability. No CISA KEV listing. Vendor-released patch v1.1.0 is available.
Path traversal in fatbobman mail-mcp-bridge versions 1.3.0 through 1.3.3 exposes arbitrary filesystem paths to remote unauthenticated attackers via unsanitized `message_ids` arguments in the MCP server's attachment management functions. The vulnerable code in `cleanup_attachments.py` and `extract_attachments.py` directly concatenated email Message-ID values onto a base filesystem path without validation, allowing sequences such as `../../etc` to escape the intended attachment directory. A public exploit exists (GitHub issue #2), SSVC rates the attack as automatable, and vendor-released fix version 1.3.4 is available.
Path traversal in NousResearch hermes-agent 0.8.0 exposes arbitrary server-side files to unauthenticated remote attackers through the WeChat Work (WeCom) platform adapter component. The vulnerability resides in gateway/platforms/wecom.py and is limited to confidentiality impact (VC:L), with no integrity or availability consequence. A public proof-of-concept exists per GitHub issue reference, though EPSS of 0.05% (15th percentile) and SSVC's 'Automatable: no' designation indicate constrained real-world exploitation risk; no CISA KEV listing has been confirmed.
Path traversal in BioinfoMCP's Upload Endpoint allows remote unauthenticated attackers to read or write files outside the intended directory by manipulating the Name argument in the Upload function (bioinfo_mcp_platform/app.py). The affected product is florensiawidjaja's BioinfoMCP at or before commit 7ada7918b9e515604d3c0ae264d3a9af10bf6e54, a bioinformatics platform using continuous rolling releases. A public exploit exists via GitHub issue report, and SSVC classifies the attack as automatable with partial technical impact; however, EPSS remains very low at 0.05% (14th percentile), consistent with an obscure research tool rather than widespread enterprise software. No vendor patch or response has been issued as of the time of this analysis.
Path traversal in ezequiroga/mcp-bases `search_papers` function allows unauthenticated remote attackers to read and potentially write files outside the intended directory by supplying crafted `../` sequences in the `topic` argument to research_server.py. Two specific commits (357ca19 and c630b8a) are confirmed affected; the project's rolling release model means no versioned fix exists and the maintainer had not responded to disclosure at time of reporting. A public proof-of-concept exploit is available via GitHub, and SSVC rates exploitation as automatable with partial technical impact - a notable combination despite the low EPSS of 0.05%.
Server-side request forgery in Algovate xhs-mcp 0.8.11 allows remote unauthenticated attackers to manipulate the `media_paths` argument of the `xhs_publish_content` MCP function, causing the server to issue arbitrary HTTP requests on behalf of the attacker. A public proof-of-concept exploit exists (GitHub issue tracker), and SSVC classifies this as automatable with partial technical impact. No vendor patch has been released and the vendor has not responded to the responsible disclosure report, leaving deployments without an official fix.
Path traversal in mcpo-simple-server 0.2.0 and earlier enables unauthenticated remote attackers to delete arbitrary files via the delete_shared_prompt function. The vulnerability affects the prompt_manager module's base_manager.py file, where improper validation of the 'detail' parameter allows directory traversal sequences. A public proof-of-concept exploit exists (GitHub issue #4), making this an immediate threat to internet-exposed instances. EPSS data not available, but the combination of network exploitability (AV:N), no authentication required (PR:N), and public POC significantly elevates real-world risk despite moderate CVSS 7.3 score. Vendor has not responded to early disclosure.
Path traversal in geldata gel-mcp 0.1.0 allows remote unauthenticated attackers to read arbitrary files via manipulation of the rule_name argument in the list_rules and fetch_rule functions. The vulnerability has a CVSS score of 5.3 (Low confidentiality impact) with network accessibility and no authentication requirements. Public exploit code exists and the vendor has not responded to early disclosure.
VideoFlow Digital Video Protection DVP 2.10 contains an authenticated remote code execution vulnerability that allows authenticated attackers to execute arbitrary system commands by exploiting a. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
MyBB Recent threads 17.0 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts by creating threads with crafted subject lines. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
PackageManagerService on Samsung Mobile Devices running Android 14, 15, and 16 allows local attackers without elevated privileges to bypass application installation restrictions by exploiting insufficient verification of data authenticity. The affected component fails to adequately validate the integrity of data governing app installation policies, enabling unauthorized modification of those restrictions on unpatched devices. No public exploit code has been identified and SSVC rates exploitation as none, but the impact is significant in enterprise MDM and parental-control deployments where installation restrictions are an active security control.
Admidio's OIDC SSO module (versions ≤ 5.0.8) ships stub placeholder implementations for both token introspection and token revocation that unconditionally return success responses without performing any validation, enabling any attacker to fabricate a bearer token and gain unauthorized access to all resource servers federated through Admidio as their OIDC provider. The introspection handler in `src/SSO/Service/OIDCService.php` (lines 604-619) is marked `// TODO_RK` and bypasses all three mandatory RFC 7662 requirements - resource server authentication, token database validation, and returning `active:false` for invalid tokens. A public proof-of-concept using simple curl commands is included in the GitHub Security Advisory GHSA-9xx5-cv6j-x533; no CISA KEV listing exists and EPSS sits at 0.04%, reflecting the product's niche footprint rather than low attack difficulty.
Local denial-of-service in Netskope Client's Endpoint DLP Module on Windows allows an unprivileged local user to crash the operating system via a kernel-level out-of-bounds read in a driver, producing a Blue-Screen-of-Death. Exploitation requires the Endpoint DLP module to be active in the client configuration, limiting the exposed population to deployments where that feature is intentionally enabled. No public exploit code exists and no active exploitation has been identified; EPSS is 0.01% and SSVC rates exploitation as none, consistent with the local-only attack vector.
Path traversal in SonicWall SonicOS enables authenticated attackers on adjacent networks to access services that are normally restricted to privileged system internals. Affecting multiple SonicOS branches (6.x, 7.0.x, 7.3.x, 8.x), successful exploitation can result in high availability impact alongside limited confidentiality and integrity gains, per the CVSS impact metrics. No public exploit code has been identified and CISA SSVC confirms exploitation status as none, with EPSS at 0.01% (2nd percentile), indicating negligible in-the-wild exploitation pressure at time of analysis.
Local privilege escalation in Acronis DeviceLock DLP on Windows (all builds before 9.0.93212) is achievable via DLL hijacking, granting an attacker full confidentiality, integrity, and availability impact over the affected system. Exploitation requires a low-privileged local account, high attack complexity, and user interaction - all factors that meaningfully constrain real-world exploitability despite the severe potential impact. No public exploit code and no active exploitation have been identified at time of analysis; EPSS at 0.01% (3rd percentile) and SSVC Exploitation status of 'none' both confirm negligible mass-exploitation probability.
CKAN fails to validate SMTP server certificates, allowing attackers to spoof the configured mail server with any certificate including self-signed ones and intercept SMTP credentials and email content via man-in-the-middle attack. Versions below 2.10.10 and 2.11.0 through 2.11.4 are affected. Vendor-released patches are available in CKAN 2.10.10 and 2.11.5.
Cockpit CMS versions 2.13.5 and earlier allow authenticated attackers to write files to arbitrary locations within the uploads directory or overwrite assets via directory traversal in the Buckets component. The vulnerability requires valid user authentication and does not impact confidentiality, but enables integrity compromise through malicious file placement or asset replacement. A proof-of-concept exists, though the SSVC framework rates automatable exploitation as unlikely, suggesting manual attack steps are required.
Stack-based buffer overflow in wazuh-remoted's print_hex_string() function exposes Wazuh 4.8.0 through 4.14.3 to unauthenticated remote exploitation via TCP/1514, reachable before any agent authentication logic executes. The overflow stems from a C signed-char sign-extension defect where bytes ≥ 0x80 are rendered as 8-character hex strings instead of 2, overflowing a fixed 2049-byte stack buffer; a secondary unauthenticated path independently enables remote log amplification capable of exhausting disk and I/O on the monitoring host. No public exploit has been confirmed as actively exploited (not in CISA KEV), though SSVC assesses a proof-of-concept exists and the attack is automatable at scale.
Wazuh's server API brute-force protection on POST /security/user/authenticate is bypassable via concurrent request flooding in versions 4.0.0 through 4.14.3, allowing unauthenticated remote attackers to submit substantially more credential guesses than the configured max_login_attempts policy (default: 50) permits. The race condition in the IP-block enforcement logic processes parallel HTTP bursts before the counter triggers a block, effectively multiplying password guessing capacity - for example, processing 100 attempts where only 50 should be permitted. No public exploit is confirmed in KEV, but SSVC classifies exploitation status as POC and automatable, while EPSS at 0.05% (14th percentile) indicates limited observed in-the-wild activity. Vendor-released patch version 4.14.4 resolves the issue.
Path traversal in Admidio ecard_preview.php allows authenticated users to read arbitrary server files including database credentials by bypassing filename validation on the ecard_template POST parameter. An authenticated attacker can supply path traversal payloads such as ../config.php to read adm_my_files/config.php containing unencrypted database host, username, and password, or traverse further to access system files. Exploitation requires only a regular member account with no special privileges, making this a high-impact vulnerability accessible to any registered user.
Heap buffer underwrite vulnerabilities in Wazuh Manager's remoted component allow an authenticated agent to corrupt the manager process heap, causing denial of service and potential code execution. Wazuh versions 4.0.0 through 4.14.3 are affected across all platforms where the manager role is deployed. A public proof-of-concept exists per SSVC data, though EPSS remains very low at 0.04% (12th percentile) and the vulnerability has not been confirmed as actively exploited in CISA KEV, suggesting exploitation is feasible but has not yet reached widespread use.
WP User Frontend plugin for WordPress (versions through 4.3.1) exposes a Missing Authorization flaw that allows unauthenticated remote attackers to exploit incorrectly configured access control security levels, resulting in limited integrity and availability impact. Reported by Patchstack and tagged as an authentication bypass, the vulnerability stems from the plugin's failure to verify user authorization before permitting certain privileged actions on WordPress frontends. No active exploitation has been confirmed (not in CISA KEV) and EPSS probability is very low at 0.04%, though SSVC classifies it as automatable - meaning exploitation, once scripted, requires no manual interaction per target.
Unsafe deserialization in Jenkins Matrix Authorization Strategy Plugin versions 2.0-beta-1 through 3.2.9 allows an authenticated user with Item/Configure permission to instantiate arbitrary Java classes from the Jenkins classpath by specifying class names in job configuration. The vulnerability arises because the plugin invokes parameterless constructors of user-specified classes when deserializing inheritance strategies without type restriction. No public exploit is identified at time of analysis, and SSVC signals exploitation as none, but the real-world impact depends on the richness of the Jenkins classpath - gadget classes available in that environment determine the attacker's effective reach.
Disk exhaustion via undeleted temp files in Spring WebFlux multipart processing affects all actively maintained Spring Framework branches, allowing an authenticated remote attacker to consume available disk space on the host. Affected branches span 5.3.x, 6.1.x, 6.2.x, and 7.0.x, with fixed releases available for all. No public exploit exists and EPSS sits at the 9th percentile, but the network-accessible attack surface and potential for cascading host-level impact make this a meaningful availability risk for any Spring WebFlux deployment that handles multipart uploads.
Admidio inventory module allows any authenticated user to permanently delete inventory items and modify associated data by bypassing authorization checks present only in the UI layer. The backend handlers for item_delete, item_retire, item_reinstate, and picture operations validate CSRF tokens but never verify the requesting user is an inventory administrator, enabling destructive operations on any item visible to the user. This affects Admidio versions through 5.0.8, and no active exploitation has been reported at the time of analysis.
n8n Chat Trigger's Hosted Chat feature fails to verify WebSocket connection authorization on the /chat endpoint, allowing unauthenticated remote attackers to hijack workflow executions in waiting state by obtaining the execution ID, intercept intended user prompts, and submit arbitrary input to influence downstream workflow behavior. This affects instances configured with authentication set to None. Vendor-released patches: versions 1.123.32, 2.17.4, and 2.18.1. No public exploit code identified at time of analysis.
Arbitrary file write via symlink following in Dell/Alienware Purchased Apps (versions prior to 1.1.31.0) allows a local low-privileged attacker to redirect application file operations to unintended targets, potentially overwriting sensitive system files and causing integrity or availability damage. The high attack complexity (AC:H) indicates a race condition or precise timing requirement, limiting opportunistic exploitation. No active exploitation has been identified - SSVC assessment rates exploitation as none and the vulnerability is absent from CISA KEV - though successful exploitation could yield significant local impact.
Stored Cross-Site Scripting in WP Meteor Website Speed Optimization Addon for WordPress (all versions through 3.4.16) allows unauthenticated attackers to permanently inject arbitrary JavaScript into pages via the WPMETEOR[N]WPMETEOR placeholder processed by the frontend_rewrite function. The injected script executes in the browser of any user who subsequently visits the compromised page, enabling session hijacking, credential theft, or malicious redirects. No active exploitation is confirmed (SSVC: none; EPSS 0.07%, 21st percentile), though unauthenticated stored XSS with a scope change carries meaningful real-world risk on publicly accessible WordPress sites.
Reflected cross-site scripting (XSS) in Admidio's msg_window.php endpoint allows unauthenticated attackers to execute arbitrary JavaScript in any user's browser by exploiting incomplete output encoding. The vulnerability chains htmlspecialchars() (which does not encode square brackets) with a subsequent Language::prepareTextPlaceholders() call that converts brackets to angle brackets, producing executable HTML markup. Publicly available proof-of-concept demonstrates the attack requires only victim click (no authentication), and Admidio sets no Content-Security-Policy headers to block inline script execution.
Reflected cross-site scripting in WSO2 Identity Server's authentication endpoint allows remote unauthenticated attackers to inject arbitrary JavaScript into victims' browsers by luring them to click a crafted URL. Versions 7.1.0 prior to 7.1.0.28 are confirmed affected; a vendor patch is available. While the attack can enable browser redirection, UI manipulation, and theft of browser-accessible data, the explicit use of the httpOnly flag on session cookies prevents session hijacking, partially constraining real-world impact. No public exploit code or active exploitation has been identified at time of analysis, and EPSS places exploitation probability at 0.03%.
Stored cross-site scripting in OpenNebula v6.10.0.1 allows an attacker to persist a malicious payload inside the virtual network template parameter, which then executes in the browser of any user who views the affected template. The Changed scope (S:C) in the CVSS vector confirms the injected script runs in the victim's browsing context, enabling session theft, credential harvesting, or UI redressing against platform administrators. A public proof-of-concept is confirmed by SSVC data; exploitation is not confirmed in CISA KEV, and the EPSS score of 0.03% (8th percentile) indicates low observed exploitation activity despite the POC's existence.
Stored cross-site scripting in OpenNebula 6.10.0.1 allows attackers to inject persistent malicious scripts via the user information parameter, which subsequently execute in the browsers of any user who views the affected content. The scope change in the CVSS vector (S:C) reflects that execution escapes the application's trust boundary into victims' browser sessions, enabling session hijacking or unauthorized UI actions. A proof-of-concept is publicly available on GitHub (SSVC confirms exploitation status as poc), though EPSS at 0.03% (8th percentile) and SSVC's non-automatable classification indicate this has not seen broad opportunistic exploitation.
Reflected cross-site scripting in OpenNebula 6.10.0.1 allows unauthenticated remote attackers to inject arbitrary JavaScript into the zone attribute parameter of the web management interface, executing in the security context of a victim user's browser session upon interaction. A public proof-of-concept exploit exists on GitHub, confirmed by SSVC classification of 'poc'. EPSS probability sits at 0.03% (8th percentile), indicating low observed exploitation activity, and the vulnerability is not listed in the CISA KEV catalog.
Cross-site scripting in OpenNebula v6.10.0.1's custom authenticator driver enables unauthenticated remote attackers to inject arbitrary JavaScript or HTML into victims' browsers via a crafted payload delivered through the authentication interface. A public proof-of-concept exploit exists (SSVC exploitation: poc, GitHub PoC referenced), though EPSS at 0.03% indicates minimal current exploitation activity and CISA KEV listing is absent. Because the vulnerable component is the authenticator driver - the portal login surface - successful exploitation could facilitate session token theft or credential phishing targeting cloud administrators, making impact disproportionate to the Medium CVSS score in privileged-user scenarios.
Heap buffer overflow in FreeRTOS-Plus-TCP's IPv6 Router Advertisement parser allows an unauthenticated adjacent network actor to corrupt device memory by sending a crafted RA packet containing an oversized prefix length field exceeding the 128-bit maximum valid for IPv6. Affected versions span two branches: 4.0.0-4.2.5 and 4.3.0-4.4.0, with fixes released as V4.2.6 and V4.4.1 respectively. No public exploit code has been identified, EPSS stands at 0.01% (3rd percentile), and SSVC confirms no active exploitation - making this a patch-priority issue rather than an emergency response.
CKAN versions 2.10.0 through 2.10.9 and 2.11.0 through 2.11.4 allow unauthenticated requests to permanently disable CSRF protection on endpoints for the lifetime of the server process by triggering a state mutation in the flask-wtf CSRFProtect middleware. Combined with cross-site scripting, an attacker can exploit this to perform authenticated actions using other users' credentials. The vulnerability affects network-accessible CKAN instances with default configurations and has CVSS 6.1 with user interaction required.
Stored XSS in the beets music library web UI (versions prior to 2.10.0) allows arbitrary JavaScript execution in a victim's browser when metadata fields such as title, lyrics, or comments contain attacker-controlled HTML payloads. The flaw stems from Underscore.js raw template interpolation (`<%= ... %>`) feeding untrusted metadata directly into jQuery's `.html()` DOM insertion method in `beetsplug/web/static/beets.js`. No active exploitation is confirmed - SSVC rates exploitation as none and EPSS sits at 0.05% (14th percentile) - but the attack is persistent once metadata is poisoned and does not require repeated attacker access.
Insecure Direct Object Reference (IDOR) in n8n's public API variables endpoint allows authenticated users with variable:list API key scope to read project variables from any project regardless of membership by manipulating the projectId query parameter. The API handler bypassed project membership authorization checks present in the enterprise service layer, enabling cross-project secret disclosure. This affects only licensed enterprise or team deployments with multiple projects and variables feature enabled. Vendor-released patches: versions 1.123.32, 2.17.4, and 2.18.1.
Denial of service via crafted ICMPv6 Router Advertisement in FreeRTOS-Plus-TCP affects embedded devices running versions 4.0.0-4.2.5 and 4.3.0-4.4.0, crashing the device when a truncated PREFIX_INFORMATION option triggers an out-of-bounds read in the IPv6 RA parser. An adjacent-network attacker with no privileges or user interaction can repeatedly crash affected IoT/embedded devices, causing persistent availability loss. No active exploitation has been confirmed (not in CISA KEV) and EPSS sits at 0.01% (3rd percentile), but vendor-confirmed patches exist for both affected branches.
Integer underflow in FreeRTOS-Plus-TCP's ICMP and ICMPv6 echo reply handlers enables an adjacent network attacker to crash any affected embedded or IoT device that has outgoing ping support enabled. The flaw spans two active release branches - 4.0.0 through 4.2.5 and 4.3.0 through 4.4.0 - and can trigger a heap out-of-bounds read of up to approximately 65KB, resulting in device denial of service. No public exploit has been identified and EPSS sits at 0.01% (3rd percentile), but the impact on resource-constrained embedded devices can be severe given their limited fault tolerance.
Unbounded HTTP response buffering in OpenTelemetry.Resources.Azure (NuGet, versions ≤ 1.15.0-beta.1) allows an attacker who controls or can MitM the Azure VM Instance Metadata Service endpoint at http://169.254.169.254 to cause heap exhaustion and crash the consuming .NET process via OutOfMemoryException. The AzureVmMetaDataRequestor class calls HttpClient.GetStringAsync() with no response-size limit, meaning an adversarial IMDS response of arbitrary size is fully buffered into managed memory before deserialization. No public exploit exists and EPSS is 0.04%, but the DoS impact is process-terminating if the MitM prerequisite can be satisfied.
Stored XSS in StellarWP's Image Widget WordPress plugin (all versions through 4.4.11) allows a high-privileged attacker to plant persistent malicious JavaScript into widget configuration fields, which then executes in the browsers of any visitor loading pages that render the widget. The CVSS scope-change indicator (S:C) confirms the payload crosses from the admin backend into the victim's browser context. No public exploit code or active exploitation has been observed; EPSS at 0.03% (9th percentile) and SSVC exploitation status of 'none' indicate negligible current threat activity.
Roadiz OpenID Connect authentication fails to store and validate the nonce parameter, allowing attackers to replay valid ID tokens or inject tokens from compromised identity providers to impersonate users. The package generates a nonce during authorization request initiation but never validates the returned nonce claim in the ID token, violating OIDC Core 1.0 specification requirements. Publicly available proof-of-concept demonstrates token replay within the token's validity window, affecting all Roadiz applications using the roadiz/openid package versions before 2.7.18, 2.6.31, 2.5.45, or 2.3.43.
SQL injection in EyouCMS versions 1.7.0 through 1.7.9 allows remote unauthenticated attackers to manipulate database queries by passing malicious input via the sort_asc argument to the GetSortData function in application/common.php. A public proof-of-concept has been disclosed on Gitee, and SSVC classifies the attack as automatable with partial technical impact, though EPSS remains very low at 0.03% (8th percentile), indicating limited observed mass exploitation. No vendor patch exists - the project was notified via responsible disclosure but has not responded, leaving all 1.7.x deployments exposed.