Symlink following in cPanel's Nova plugin (Cpanel::Nova::Connector) allows any authenticated cPanel user to redirect a root-executed chmod to arbitrary filesystem paths by placing a symlink at a user-controlled legacy Nova path within their home directory. Affected are more than a dozen cPanel release trains spanning versions 11.86 through 11.136, plus WP Squared 11.136.x. No public exploit exists and EPSS stands at 0.04%, but CISA's SSVC framework rates the technical impact as total given the potential to set root-level permissions on critical system files, enabling local privilege escalation or denial of service in multi-tenant hosting environments.
Open redirection in Cradle eCommerce login form endpoint allows attackers to redirect authenticated users to arbitrary external URLs via the unvalidated 'returnUrl' parameter, enabling phishing and credential theft attacks. The vulnerability affects the latest demo version and requires user interaction to click a malicious link, but carries low real-world exploitation probability (EPSS 0.04%) and no confirmed active exploitation at time of analysis.
Cross-proxy Digest authentication state leak in curl allows remote attackers to obtain sensitive authentication credentials when curl is used with proxy authentication across multiple proxy hops. The vulnerability affects curl versions from 7.12.0 through 8.19.0 due to improper handling of Digest authentication state between proxies, enabling credential disclosure with network-level access and no authentication requirements. EPSS score of 0.03% suggests low real-world exploitation probability despite the information disclosure impact.
Wagtail's Documents and Images API endpoints expose private collection metadata to any caller who can reach the API, bypassing the CMS's collection-level access controls. Sites running Wagtail < 7.0.7 or Wagtail 7.1.x-7.3.1 with the API feature enabled leak filenames and display names of documents and images that administrators placed in private collections. No active exploitation has been identified (EPSS 0.03%, absent from CISA KEV), but the flaw is automatable against default unauthenticated API configurations, making bulk reconnaissance straightforward for any network-adjacent attacker.
Signature binding bypass in gitsign (versions prior to 0.16.0) allows a crafted malformed git commit to pass `gitsign verify` while git-core resolves it to entirely different, attacker-controlled content. The tool re-encodes commit objects through go-git's `EncodeWithoutSignature` before signature verification rather than verifying raw bytes; for commits with duplicate `tree` headers, go-git silently uses the second tree while git-core uses the first, creating a parsing divergence that an attacker can exploit to replay any existing legitimate signature over a new commit pointing to malicious content - without possessing any signing key. A detailed proof-of-concept is publicly available; no active exploitation is confirmed in CISA KEV, and EPSS sits at 0.02% (5th percentile), reflecting the high attack complexity required.
curl versions 7.14.0 through 8.19.0 leak netrc credentials when reusing proxy connections, allowing authenticated local attackers to obtain sensitive authentication data via connection pooling that ignores credential requirements. CVSS 5.3 reflects high confidentiality impact but requires low-privilege authentication and high attack complexity; EPSS 0.02% indicates minimal real-world exploitation probability despite broad version coverage. No public exploit code identified at time of analysis.
Same-site Cross-Site Request Forgery (CSRF) in RedwoodSDK server actions allows attackers controlling same-site origins to invoke arbitrary server actions with victim session cookies in versions 1.0.0-beta.50 through 1.2.2. The vulnerability stems from missing origin validation despite HTTP method enforcement, enabling attackers to trigger state-changing operations through subdomain takeover, sibling-application XSS, or local development vectors. Vendor-released patch version 1.2.3 enforces Origin/Host matching validation. CVSS 5.3 reflects high integrity impact (UI:R) but constrained attack complexity (AC:H) and no information disclosure.
SSE field injection in eventsource-encoder below 1.0.2 allows an attacker who controls the `event` or `id` field values to inject line terminators into the serialized Server-Sent Events stream, forging additional SSE fields or entirely synthetic browser events. A working proof of concept is publicly documented in the GitHub Security Advisory GHSA-m9g3-3g99-mhpx, demonstrating that a crafted `event` value can cause the browser to receive a forged `admin`-typed event with attacker-chosen payload. No public exploit infrastructure has been identified and EPSS sits at the 1st percentile, reflecting the narrow application pattern required for exploitation.
OCSP stapling validation bypass in curl 8.17.0-8.19.0 allows remote attackers to obtain sensitive certificate validation information when curl uses Apple SecTrust for TLS connections, potentially enabling man-in-the-middle attacks by bypassing server certificate revocation checks.
Path traversal in SolidCAM-GPPL-IDE versions 1.0.0 through 1.0.1 allows an attacker to deliver a malicious GPPL postprocessor file that, when opened in VS Code, probes the victim's filesystem for file existence and leaks Windows NTLM credentials to an attacker-controlled SMB server. The extension's GpplDocumentLinkHandler resolved inc directive paths - including parent-directory traversal sequences (..\..\..) and UNC shares (\\server\share) - through unsanitized File.Exists calls, creating two distinct information disclosure vectors. Publicly available exploit code exists per SSVC classification; exploitation probability is very low (EPSS 0.05%), and the vulnerability is patched in version 1.0.2 released 2026-04-20.
Stored cross-site scripting in MCP Registry's catalogue UI allows any user with a publish token to inject arbitrary event handlers via the `websiteUrl` field by breaking out of an `href` attribute with an unescaped double-quote character. The server-side URL validator accepts quotes and the client-side `escapeHtml` helper fails to encode them in attribute context, enabling attackers to execute JavaScript on the registry.modelcontextprotocol.io origin with access to localStorage, XHR, and auth tokens. Vendor-released patch version 1.7.7 available; actively confirmed via proof-of-concept.
Open redirect vulnerability in Kargo UI OIDC login flow allows unauthenticated remote attackers to redirect users to arbitrary external websites via a malicious redirectTo query parameter. Versions prior to 1.7.10, 1.8.13, 1.9.8, and 1.10.2 are affected. This requires user interaction (clicking a crafted link) but can facilitate phishing attacks by making malicious redirects appear legitimate within the Kargo authentication flow.
Cross-site scripting in wlc command-line client versions prior to 2.0.0 allows authenticated users with high privileges to inject malicious HTML/JavaScript into API responses, which are then embedded unescaped in HTML output. When the HTML output is rendered in a browser, this enables XSS attacks. The vulnerability requires explicit use of the HTML output format (non-default), user interaction to open/view the HTML file, and elevated API credentials, limiting real-world risk despite the network vector.
Availability degradation in Bouncy Castle BC-FJA cryptographic library versions 2.1.0 through 2.1.2 on Linux X86_64 systems with AVX or AVX-512f SIMD extensions affects GCM-128 and GCM-512 operations, allowing local attackers to cause denial of service without authentication. The vulnerability is associated with optimized assembly implementations (gcm128w, gcm512w) and results in availability impact with no confidentiality or integrity compromise. No public exploit code or active exploitation has been identified at time of analysis.
Mass assignment vulnerability in Open WebUI's folder creation endpoint allows authenticated attackers to create folders in other users' accounts by exploiting Pydantic's extra='allow' configuration. An attacker with a valid account can supply an arbitrary user_id in the POST request body, overwriting the server-assigned value and persisting folders under a victim's account without their knowledge. The attacker can use this to plant phishing content, spam folders, or degrade user experience for targeted victims.
External Secrets Operator versions 0.1.0 through 2.4.0 allow authenticated users with ExternalSecret creation permissions to escalate privileges by crafting Service Account token templates that cause the operator to generate long-lived tokens for any service account in the namespace. An attacker can impersonate service accounts without requiring direct TokenRequest or Secret creation permissions, effectively bypassing RBAC controls. The attack requires the attacker already has ExternalSecret creation permissions and the cluster must have service account token generation enabled, limiting the practical scope to already-privileged users seeking lateral privilege expansion within a namespace.
Authenticated administrators in Flarum can read arbitrary files and trigger server-side request forgery via LESS injection in theme color settings. The vulnerability exploits an incomplete patch for CVE-2023-27577 that restricted @import and data-uri() only in the custom_less setting but failed to apply the same restrictions to other LESS config variables such as theme_primary_color and theme_secondary_color. An attacker with admin credentials can inject arbitrary @import directives into compiled forum.css, exposing sensitive files or making outbound HTTP requests to internal networks and cloud metadata endpoints. Vendor-released patches: Flarum 1.8.16 and 2.0.0-rc.1.
Stored XSS in Open WebUI's AccountPending.svelte allows an authenticated admin to inject arbitrary JavaScript into the pending user overlay content, which executes in the browser session of any user holding the 'pending' role. The flaw stems from invoking DOMPurify before rather than after marked.parse(), permitting Markdown link syntax with javascript: URIs to survive sanitization and render as executable HTML via Svelte's {@html} directive. No CISA KEV listing exists, but a proof-of-concept is confirmed by SSVC data; EPSS is low at 0.03% (8th percentile), consistent with the high-privilege prerequisite limiting mass exploitation.
go-git versions prior to 5.18.0 and 6.0.0-alpha.2 leak HTTP authentication credentials when following cross-host redirects during smart-HTTP clone and fetch operations. Remote unauthenticated attackers controlling a redirect target can capture credentials intended for the original repository host. User interaction (initiating a clone/fetch to a malicious or compromised server) is required. Vendor-released patches are available in v5.18.0 and v6.0.0-alpha.2.
Race condition in the Linux kernel nvme-pci driver's nvme_poll_irqdisable() function causes an unbalanced IRQ enable/disable pair that crashes the kernel with a warning. Affected kernels from 5.7 through multiple stable branches are vulnerable when running PCIe NVMe storage with MSI-X interrupts: a concurrent NVMe device reset can change the IRQ vector between the disable_irq() and enable_irq() calls, making the kernel operate on different IRQ numbers. No public exploit identified at time of analysis and EPSS of 0.02% confirm this is a reliability/stability concern patched in kernel stable releases 6.1.167, 6.6.130, 6.12.78, 6.18.19, 6.19.9, and 7.0.
Race condition in the Linux kernel cgroup subsystem's task iterator exposes local low-privileged users to a denial-of-service condition when task migration and cgroup iteration execute concurrently. The cgroup infrastructure fails to advance active css_task_iters before a task is unlinked from cset->tasks during migration, allowing iterators to reference the wrong linked list and silently skip tasks - or in worst-case scenarios, cause css_task_iter_advance() to crash or loop infinitely on the destination css_set. No public exploit identified at time of analysis; EPSS of 0.02% at the 7th percentile reflects extremely low observed exploitation probability and aligns with the narrow race window required.
Race condition in the Linux kernel's yurex USB driver probe function allows a local low-privileged attacker to cause a denial of service by triggering a timing window between URB submission and bbu member initialization. Affected are all kernel versions from the initial commit through the stable branch fix points (patched in 5.10.253, 5.15.203, 6.1.167, 6.6.130, 6.12.78, 6.18.19, 6.19.9, and 7.0). No public exploit exists and the issue is not listed in CISA KEV; EPSS of 0.02% (7th percentile) reflects negligible widespread exploitation probability.
Race condition in the Linux kernel's USB RNDIS gadget function driver (f_rndis) allows a local low-privileged attacker to crash the kernel by concurrently manipulating class/subclass/protocol configfs attributes without mutex protection. Identified during code inspection - not observed in active exploitation - this vulnerability affects multiple stable kernel branches from 4.14 through 7.0-rc3, with patches released across all maintained stable series. With an EPSS of 0.02% (7th percentile), no public exploit, and no CISA KEV listing, real-world risk is low but meaningful on embedded or IoT devices using Linux as a USB RNDIS peripheral.
Kernel panic triggered by a race condition in the UFS Host Controller Driver (ufshcd) during system suspend affects Linux systems using Universal Flash Storage hardware where UFSHCD_CAP_CLK_GATING is not supported. The flaw allows a local low-privileged user - or automated power management - to crash the kernel by triggering a suspend sequence while ufshcd_rtc_work() is concurrently executing, producing an ARM64 asynchronous SError interrupt that halts the system. No public exploit code exists and no active exploitation has been identified; with an EPSS of 0.02% this is a low-probability but confirmed-availability-destroying defect patched across multiple stable kernel branches.
OS command injection in Vim's ':find' tab-completion mechanism allows an attacker who controls a file's contents to execute arbitrary shell commands under the victim's user account, by exploiting the missing P_SECURE flag on the 'path' option prior to version 9.2.0435. Because 'path' lacked this flag, a file modeline could inject backtick-wrapped shell commands that Vim silently executed during file-name completion. No active exploitation has been confirmed (SSVC: Exploitation none, EPSS 0.04%), and the vendor-released patch is available in Vim 9.2.0435.
OS command injection in Vim's netrw plugin prior to version 9.2.0383 allows arbitrary shell command execution at the privilege level of the Vim process when a user is induced to open a crafted sftp:// or file:// URL. The root cause is a two-part failure: the temporary file suffix extracted from the remote filename was not restricted to safe characters, and the resulting tmpfile path was passed unescaped to shell command construction in netrw#os#Execute(). No public exploit has been identified at time of analysis and SSVC confirms no observed exploitation, but the commit diff includes a regression test that demonstrates the injection path directly.
n8n-MCP prior to version 2.47.13 logs sensitive credential material from authenticated MCP tool-call requests when running in HTTP transport mode, allowing disclosure of bearer tokens, OAuth credentials, API keys, and webhook authentication headers to any system with access to server logs. The vulnerability requires valid authentication (AUTH_TOKEN) and affects deployments where logs are collected, forwarded to external systems, or viewable outside the request trust boundary; no public exploit code has been identified.
Onyx versions before 3.0.9, 3.1.6, and 3.2.6 permit authenticated users to terminate any other user's active chat session via the POST /chat/stop-chat-session/{chat_session_id} endpoint without verifying session ownership. An attacker with valid credentials can interrupt another user's LLM generation mid-stream by supplying a known session UUID, causing denial of service to targeted chat sessions. Vendor-released patches are available, and no public exploit code or active exploitation has been identified at time of analysis.
Nil-pointer dereference in free5GC's Unified Data Repository (UDR) v4.2.1 allows an OAuth2-authenticated network attacker to repeatedly panic the `amf-subscriptions` DELETE handler, forcing HTTP 500 responses and elevated CPU and log overhead on each request. The flaw stems from a missing `return` after the subscription-not-found branch in `RemoveAmfSubscriptionsInfoProcedure`, causing the handler to dereference a nil map entry even when it has already set a 404 problem-details response. No public exploit is in CISA KEV, but a full end-to-end proof-of-concept is embedded in GHSA-4rqf-grm6-vf75 and was validated against the official Docker compose lab, making exploitation straightforward for any holder of a valid `nudr-dr` token.
Improper permission enforcement in Wagtail CMS allows authenticated low-privilege users to access the page history report for pages they lack edit rights on, resulting in potential disclosure of sensitive revision content. Affected versions are pip/wagtail prior to 7.0.7 and 7.1 through below 7.3.2. No public exploit code exists and no active exploitation has been identified; EPSS of 0.03% (7th percentile) and CISA SSVC classification of 'Exploitation: none' confirm this as a low-priority disclosure issue limited to the authenticated CMS user population.
Open WebUI versions up to 0.8.12 allow authenticated users to enumerate members of private standard channels via the GET /api/v1/channels/{id}/members endpoint, which lacks access control checks present on other channel endpoints. An attacker who knows a private channel's UUID can retrieve the full list of members including their names, emails, roles, and profile images, enabling targeted social engineering and organizational structure reconnaissance. The vulnerability is fixed in version 0.9.0.
Open WebUI versions up to 0.8.12 allow authenticated users to enumerate all knowledge bases across the instance via an incomplete access control allowlist in the retrieval collection validation function. The `_validate_collection_access` function only enforces ownership checks for collections matching `user-memory-*` and `file-*` patterns, allowing any authenticated user to directly query the system-level `knowledge-bases` meta-collection and retrieve the IDs, names, and descriptions of every knowledge base regardless of ownership. This information disclosure vulnerability serves as an enabler for subsequent attacks including knowledge base destruction and content injection, transforming these attacks from theoretically exploitable (requiring random UUID guessing) to trivially exploitable (UUIDs enumerable). CVSS score 4.3 (network-accessible, low privilege required, low confidentiality impact). Patched in version 0.9.0.
Bugsink versions 2.1.2 and earlier contain a webhook URL validation bypass (SSRF) where malformed URLs with backslashes and @ symbols pass validation checks but are interpreted differently by Python's urllib parser versus the requests HTTP client, allowing attackers with webhook configuration access to direct outbound POST requests to blocked hosts including loopback and private addresses. The vulnerability is narrower than full SSRF because requests do not follow redirects, the request shape is constrained by URL normalization, and this only affects webhook integrations, not arbitrary outbound proxying.
The text-to-speech endpoint in AnythingLLM prior to v1.12.1 exposes an Insecure Direct Object Reference (IDOR) allowing any authenticated workspace member to retrieve audio renderings of another user's private chat responses by supplying a foreign chatId. The route validated workspace membership but omitted per-row ownership enforcement, making lateral access within a shared workspace trivial for a low-privileged attacker. No active exploitation is confirmed (absent from CISA KEV), though SSVC classifies exploitation as poc-level, and EPSS is negligible at 0.01%, consistent with a targeted rather than opportunistic threat.
Kimai versions 2.32.0 through 2.55.x allow System-Admin users with invoice template upload permission to read arbitrary files from the PHP server via malicious PDF invoice templates. The vulnerability exploits mPDF's SetAssociatedFiles() function combined with unsanitized Twig template rendering to access any file readable by the PHP worker process and embed it within generated PDF invoices. No public exploit code or active exploitation has been identified; patch available in version 2.56.0.
Open redirect vulnerability in MCP Registry TrailingSlashMiddleware allows remote attackers to craft protocol-relative URLs that bypass path validation, redirecting users from the trusted registry domain to attacker-controlled sites. Affected versions 1.1.0 through 1.7.4 are vulnerable; vendor-released patch available in version 1.7.5. No public exploit code exists at time of analysis, but the vulnerability is trivially exploitable via simple HTTP requests without authentication.