Prototype pollution in the velocityjs npm package (Velocity.js <= 2.1.5) lets an attacker who controls template content poison Object.prototype through the #set directive, enabling denial of service and, depending on server-side gadgets, remote code execution. The flaw stems from unvalidated path-key assignment in /src/compile/set.ts, which writes attacker-supplied keys directly onto the target object. Publicly available exploit code exists (a working PoC is published in the GHSA advisory); there is no evidence of active exploitation, and the EPSS score is very low at 0.08% (23rd percentile).
Stack-based buffer overflow in PgBouncer before 1.25.2 lets a malicious or impersonated PostgreSQL backend corrupt the pooler's memory during SCRAM authentication. Because the SCRAM code ignores the truncation return value of strlcat() while assembling the client-final-message, a backend that replies with an over-long SCRAM server-final-message nonce overruns a stack buffer, enabling a crash and potentially code execution in the PgBouncer process. There is no public exploit identified at time of analysis, it is not in CISA KEV, and EPSS is very low (0.02%), but SSVC rates the technical impact as total.
Unauthenticated remote access to GitLab API operations via gitlab-mcp-server's SSE transport allows attackers to execute all 86 exposed GitLab management tools-including repository deletion, file modification, and configuration changes-using the operator's Personal Access Token. When configured with USE_SSE=true (a documented feature), the Node.js server binds to 0.0.0.0 with wildcard CORS headers, enabling both network-adjacent attackers and malicious web pages to invoke destructive operations without credentials. Public exploit code demonstrates the attack path from initial SSE connection through authenticated GitLab API calls. Patch version 0.6.0 addresses the authentication bypass per GitHub advisory GHSA-8jr5-6gvj-rfpf.