Path traversal in Casdoor's Local File System storage provider allows authenticated administrators to write arbitrary files to the filesystem by bypassing path sanitization in the storage sandbox. An attacker with administrative privileges can exploit insufficient input validation to create or overwrite files anywhere on the host system. EPSS score of 0.03% indicates minimal real-world exploitation probability despite the moderate CVSS 5.9 score, suggesting the vulnerability requires both authenticated access and administrative privileges that significantly limit practical attack surface.
Authentication bypass in OpenClaw's BlueBubbles webhook handler allows remote attackers to send crafted webhook requests without credentials. The handleBlueBubblesWebhookRequest function in extensions/bluebubbles/src/monitor.ts incorrectly exempts localhost requests from authentication, enabling IP spoofing attacks to bypass security controls. Exploit code is publicly available on GitHub. Patch released in version 2026.2.12 (commit a6653be). CVSS 7.3 reflects network-accessible unauthenticated attack with low complexity affecting confidentiality, integrity, and availability.
Authentication bypass in Inkeep Agents 0.58.14 allows remote unauthenticated attackers to circumvent authentication controls via alternate channel manipulation in the runAuth middleware. The vulnerability exists in the createDevContext function of agents-api/src/middleware/runAuth.ts, enabling unauthorized access to protected resources with low impact to confidentiality, integrity, and availability. Publicly available exploit code exists (GitHub issue #3024), and the vendor has not yet responded to the vulnerability report, meaning no patch is currently available.
Denial of service in aiwaves-cn agents up to commit e8c4e3c2d19739d3dff59e577d1c97090cc15f59 allows remote unauthenticated attackers to exhaust server resources via the recall_relevant_memories_to_working_memory function in cheshire_cat_core component, causing service unavailability. Publicly available exploit code exists (CWE-400: Uncontrolled Resource Consumption). With an CVSS score of 5.3 and EPSS exploitation probability rated 'P', this represents a moderate-severity availability threat suitable for prioritization in resource-constrained environments.
VectifyAI PageIndex up to commit f50e52975313c6716c02b20a119577a1929decba allows remote unauthenticated denial-of-service attacks through an infinite loop vulnerability in the PDF Table of Contents handler. The toc_transformer function in pageindex/page_index.py can be triggered remotely without authentication, causing the application to hang and become unresponsive. Public exploit code is available, increasing real-world attack likelihood.
Bitwarden Server prior to v2026.4.1 allows any authenticated user to write ciphers (encrypted credentials) into arbitrary organizations via the POST /ciphers/import-organization endpoint by submitting an empty collections array, bypassing authorization checks. This missing authorization vulnerability (CWE-862) affects all authenticated users regardless of organization membership, enabling them to inject malicious credentials or pivot across organizations. Publicly available exploit code exists, and the vendor has released patched version 2026.4.1.
Path traversal in Audiobookshelf's podcast creation endpoint allows attackers to write files outside the intended library directory by supplying a crafted file path. Affected versions are all releases prior to 2.32.2 (per CVE) or 2.33.2 (per EUVD - see confidence notes), with the vulnerable code located in server/controllers/PodcastController.js. No public exploit code has been identified and CISA KEV has not flagged active exploitation, but SSVC marks the attack as automatable, meaning scripted mass-scanning is feasible once a reliable exploit exists.
Reflected HTML injection in MantisBT's tag update page (tag_update_page.php) arises from the application echoing the HTTP Referer header into an HTML hidden input without proper escaping. All versions through 2.28.1 are affected. In the most exploitable scenario, an attacker poisons a caching proxy by submitting a crafted Referer value, causing downstream users who receive the cached response to execute attacker-controlled JavaScript - a web-cache-deception-style XSS path. No public exploit identified at time of analysis, though SSVC classifies exploitation status as poc; EPSS is low at 0.04% (14th percentile).
Verbose error messages in WeGIA versions prior to 3.7.0 expose database-related details through the unauthenticated PHP endpoint `atendido/familiar_docfamiliar.php`, enabling remote attackers to map backend infrastructure and identify further attack vectors. The CVSS 4.0 score of 6.9 reflects network-accessible, zero-authentication exploitation with partial confidentiality impact and no integrity or availability consequence. A proof-of-concept has been identified per SSVC classification, though EPSS sits at just 0.04% (13th percentile), indicating limited broad exploitation interest; no active exploitation has been confirmed via CISA KEV.
pgAdmin 4 before version 9.15 allows unauthenticated attackers to bypass account lockout and perform unbounded password-guessing attacks against INTERNAL authentication accounts by exploiting Flask-Security's default /login endpoint, which does not enforce the locked column that the custom /authenticate/login view relies on for brute-force protection. The vulnerability affects only accounts using pgAdmin's INTERNAL authentication source; LDAP, OAuth2, Kerberos, and Webserver authentication methods are not vulnerable because they do not use local passwords.
Infinite loop denial-of-service in barebox's ext4 directory parser allows an attacker who can supply a crafted filesystem image to permanently hang the boot process of affected embedded devices. Versions prior to 2026.04.0 are affected via CWE-835 (unreachable loop exit) in ext4fs_iterate_dir() when it encounters a directory entry with a direntlen of zero. No public exploit has been identified and CISA has not added this to KEV; however, the impact of a permanently hung bootloader is a complete availability loss for the affected device.
Out-of-bounds read vulnerabilities in barebox's ext4 extent parsing allow an attacker who can supply a malformed ext4 filesystem image - via USB, SD card, or network boot - to crash the bootloader during startup, preventing a device from completing its boot sequence. All barebox versions prior to v2026.04.0 fail to validate the `eh_entries` field in ext4 extent headers against actual buffer capacity in `fs/ext4/ext4_common.c`, enabling heap out-of-bounds reads that can additionally redirect parsing to arbitrary disk offsets. No public exploit has been identified at time of analysis; EPSS (0.01%, 2nd percentile) and SSVC (exploitation: none, automatable: no) both confirm low near-term exploitation probability, though the physical-media attack surface makes this relevant to embedded device supply chain and physical security programs.
Summarize versions through 0.14.1 create daemon configuration files with world-readable permissions, allowing local attackers with user-level access to read bearer tokens and API credentials from ~/.summarize/daemon.json. The vulnerability enables unauthorized daemon access or recovery of sensitive provider API keys through insecure file permissions on Unix-like systems.
Stored Cross-Site Scripting in WeGIA versions prior to 3.7.3 allows authenticated high-privilege users to inject malicious JavaScript into the Processo de Aceitação page that executes when any user accesses the vulnerable endpoint, enabling session hijacking and account takeover. The vulnerability is confined to high-privilege authenticated access (PR:H) with no user interaction required on the victim side, though scope is changed (S:C) indicating cross-context impact. No public exploit code or active exploitation has been identified.
Stored cross-site scripting (XSS) in WeGIA versions prior to 3.7.3 allows authenticated high-privilege users to inject malicious JavaScript into the Etapas de um Processo page, which executes when other users access the page, enabling session hijacking and account takeover. The vulnerability requires high-privilege authentication (PR:H) but affects all users who subsequently visit the injected page, with no public exploit identified at time of analysis.
Insufficient session expiration in Vaultwarden prior to 1.35.5 allows an attacker holding a previously obtained refresh token to maintain persistent vault access even after the legitimate account owner performs security-remediation actions. Operations that rotate the internal security_stamp - including password change, key rotation, KDF change, email change, org admin password reset, and emergency access takeover - fail to invalidate outstanding refresh tokens, leaving stolen sessions alive. A proof-of-concept exists per SSVC data, though EPSS at 0.03% (8th percentile) indicates exploitation remains uncommon and non-automated, consistent with the need for pre-existing token access.
Path traversal in Crabbox <0.9.0 allows local attackers to delete or overwrite arbitrary files via malicious .crabbox.yaml configuration. When a user executes Crabbox commands with a crafted workspace configuration containing directory traversal sequences (e.g., '../../../'), the Islo provider performs rm -rf and mkdir -p on attacker-controlled paths outside /workspace. Patch available in v0.9.0 (commit 6b07193). No KEV listing or public POC identified, but exploitation requires only user interaction (opening/running a malicious project), not authentication or special privileges.
Path traversal in tookie-osint (all versions prior to 4.1fix) allows an attacker who controls the tool's username input to redirect scan output files to arbitrary filesystem paths accessible to the invoking user. The write_txt, write_csv, and write_json helpers in modules/modules.py construct output filenames via unsanitized f-string interpolation of the -u CLI flag or lines from a -U batch usernames file, enabling directory-separator sequences to escape the intended output directory. A proof-of-concept exists per SSVC assessment; however, EPSS sits at 0.01% (3rd percentile) and the vulnerability is absent from the CISA KEV catalog, consistent with the niche footprint of this tool and the local execution prerequisite.
Improper privilege management in Dell ECS 3.8.1.0-3.8.1.7 and ObjectScale prior to 4.3.0.0 allows high-privileged local attackers to escalate privileges and gain full system access, affecting confidentiality, integrity, and availability. No public exploit code or active exploitation has been identified at the time of analysis.
Command injection in GPT-Pilot's Executor.run() method enables arbitrary shell command execution through the interactive command confirmation workflow, affecting all versions through commit 0819827ce20346ef5f25b3fe29293cb448840565 (2025-09-03). An actor with access to the confirmation prompt - locally or via a network-exposed deployment - can substitute malicious shell commands that are passed unsanitized to asyncio.create_subprocess_shell(), executing with the full privileges of the GPT-Pilot process. No active exploitation has been confirmed (not in CISA KEV), and EPSS at 0.14% (33rd percentile) reflects low current exploitation activity, though the RCE impact class warrants attention in multi-user or network-exposed deployments.
Broken authorization logic across two sequential sharing API calls in Outline collaborative documentation (prior to 1.7.0) allows any authenticated low-privilege user to publish arbitrary documents as publicly accessible shares, exposing content to unauthenticated users without possessing legitimate share rights over the target document. The flaw exploits a permission gap in shares.create (which skips share-permission validation when published=false) combined with a disjunctive OR policy in shares.update that can be satisfied by unrelated collection-level share permissions. No public exploit code repository has been identified in the provided references, though SSVC classifies exploitation evidence at POC level; the vulnerability is not listed in CISA KEV, and EPSS sits at 0.04% (12th percentile), indicating low current real-world exploitation.
Streamlink versions 8.3.0 and earlier allow arbitrary local file read via unvalidated URI schemes in HLS and DASH parsers. A remote attacker hosting a malicious `.m3u8` or `.mpd` manifest can trick streamlink clients into reading local files (such as SSH keys, AWS credentials, or `/etc/passwd`) and writing their contents to the output stream. Requires user interaction (clicking/running streamlink against attacker-controlled playlist), but no authentication needed. CVSS 6.5 reflects the information disclosure risk; affected deployments with automated processing or cloud sync pose material exfiltration risk.
Information leakage in Apple operating systems allows remote attackers to extract sensitive data by crafting and hosting malicious websites that users visit. The vulnerability affects iOS 18.7.8 and earlier, iPadOS 18.7.8 and earlier, macOS Sequoia 15.7.6 and earlier, macOS Sonoma 14.8.6 and earlier, macOS Tahoe 26.4 and earlier, tvOS 26.4 and earlier, visionOS 26.4 and earlier, and watchOS 26.4 and earlier. Exploitation requires user interaction (UI:R) to visit a malicious website but does not require authentication, with an EPSS score of 0.03 percent indicating low real-world exploitation probability despite the information disclosure impact.
Memory corruption in Apple's WebKit web content processing engine causes an unexpected process crash (denial-of-service) across iOS, iPadOS, macOS, tvOS, visionOS, and watchOS when a victim processes attacker-controlled web content. The CVSS vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H confirms network-reachable, unauthenticated exploitation limited to availability impact within the affected process - no code execution or data exfiltration is indicated. No public exploit code has been identified at time of analysis, and EPSS scoring at 0.03% (10th percentile) combined with SSVC Exploitation status of 'none' signal low current exploitation pressure.
Authenticated users with download permissions in Audiobookshelf prior to 2.32.2 can download files from libraries they do not have access to by directly specifying item IDs in the GET /api/libraries/:id/download endpoint, bypassing library access controls. An attacker with valid credentials and access to any single library can exfiltrate complete file contents from restricted libraries, including those explicitly denied to them.
HTTP::Tiny versions before 0.093 for Perl fail to validate carriage return and line feed (CRLF) characters in HTTP request lines and header values, allowing attackers who control input URLs or headers to inject additional HTTP headers and smuggle requests to upstream servers. Remote unauthenticated attackers can exploit this via crafted URLs passed to webhook or URL fetch endpoints, achieving limited information disclosure and integrity compromise. EPSS score of 0.03% (percentile 7%) indicates low practical exploitation probability despite network-vector accessibility.
Improper authorization in Open WebUI versions up to 0.8.5 allows authenticated users to modify messages in standard channels by exploiting a read-permission check that should require write permission. The vulnerability affects the POST /api/v1/channels/{channel_id}/messages/{message_id}/update endpoint when access_control is set to None, enabling message tampering without ownership verification. Patch available in version 0.8.6.
Memory corruption in Apple operating systems allows remote attackers to trigger unexpected app termination or corrupt process memory by delivering a maliciously crafted media file to users, requiring user interaction to open the file. Affects iOS/iPadOS 26.4 and earlier, macOS Sequoia 15.7.6 and earlier, macOS Sonoma 14.8.6 and earlier, macOS Tahoe 26.4 and earlier, tvOS 26.4 and earlier, visionOS 26.4 and earlier, and watchOS 26.4 and earlier. No public exploit identified at time of analysis; vendor-released patches are available across all affected platforms.
Out-of-bounds write in Apple operating systems allows network-based unauthenticated attackers to corrupt kernel memory or cause denial of service without user interaction. The vulnerability affects iOS, iPadOS, macOS, tvOS, visionOS, and watchOS across multiple versions. Apple has released patches for all affected platforms, though the extremely low EPSS score (0.02%) suggests real-world exploitation risk is minimal despite the network attack vector.
KQL injection in kafka-sink-azure-kusto Kafka Connect plugin prior to 5.2.3 allows authenticated administrators with Kafka Connect configuration permissions to inject arbitrary KQL management commands by embedding metacharacters in the kusto.tables.topics.mapping configuration fields (db, table, mapping, format). An attacker with connector configuration privileges could enumerate or modify schemas, tamper with ingestion mappings, or alter streaming and retention policies on the target Azure Data Explorer database using the connector's service principal credentials. The vulnerability is fixed in version 5.2.3 and has not been observed in active exploitation at the time of this analysis.
Out-of-bounds read (CWE-125) in Apple's file parsing subsystem causes unexpected application termination across all major Apple platforms when a maliciously crafted file is processed. Affected platforms include iOS/iPadOS, macOS Tahoe, tvOS, visionOS, and watchOS - all prior to their respective 26.5 releases. The impact is limited to availability (denial of service via app crash); no confidentiality or integrity impact is indicated. No public exploit code exists and no active exploitation has been confirmed: EPSS stands at 0.02% (6th percentile) and CISA has not added this to KEV.
Denial of service in Apple macOS prior to version 26.5 allows remote attackers to crash Safari via maliciously crafted web content that triggers a use-after-free memory condition. The vulnerability requires user interaction (opening a malicious webpage) but no authentication, affecting all macOS versions before 26.5. EPSS exploitation probability is very low at 0.02%, suggesting limited real-world attack incentive despite the crash capability.
Web content processing across all major Apple platforms is vulnerable to a memory mismanagement flaw (CWE-119) that causes an unexpected process crash when a user visits or renders attacker-controlled web content. Affected platforms include iOS/iPadOS, macOS Tahoe, tvOS, visionOS, and watchOS - all versions prior to the 26.5 release line. The impact is limited to availability (A:H), with no confidentiality or integrity exposure per the CVSS vector, and no active exploitation is confirmed - EPSS sits at 0.02% (5th percentile) and SSVC rates exploitation as none, making this a moderate-priority patch rather than an emergency response item.
Private information disclosure in Apple macOS allows a locally installed app to access sensitive data belonging to the user or other processes via an improper state management flaw. Affected are all macOS Sonoma releases prior to 14.8.7, all macOS Sequoia releases prior to 15.7.7, and all macOS Tahoe releases prior to 26.5. No active exploitation has been identified (not in CISA KEV), and the EPSS score of 0.02% (4th percentile) reflects a low probability of near-term opportunistic exploitation.
Apache Airflow Elasticsearch provider writes embedded credentials from the `[elasticsearch] host` configuration URL directly into task logs, allowing any user with task-log read permissions to harvest backend authentication credentials. The vulnerability affects Apache Airflow Providers Elasticsearch versions before 6.5.3 and has been patched by stripping userinfo from the host URL before logging. EPSS exploitation probability is low (0.02%, percentile 4%), indicating limited real-world exploitation despite the sensitive nature of credential exposure.
Apache Airflow Providers OpenSearch versions before 1.9.1 leak backend credentials in task logs when the OpenSearch connection host URL embeds credentials in the format `https://user:password@server:9200`. Any user with task-log read permission can extract these credentials from log output. The vulnerability is confirmed patched in version 1.9.1 and later, with an EPSS score of 0.02% indicating low real-world exploitation probability despite the moderate CVSS score.
Safari on Apple platforms crashes when processing maliciously crafted web content due to a use-after-free vulnerability in memory management, resulting in denial of service. Affects iOS and iPadOS below 26.5, macOS Tahoe below 26.5, tvOS below 26.5, visionOS below 26.5, and watchOS below 26.5. Exploitation requires user interaction to visit a malicious webpage but does not allow code execution or information disclosure.
WebDyne::Session versions through 2.075 for Perl generate cryptographically weak session identifiers using MD5 hashing seeded with Perl's predictable rand() function, allowing attackers to forge valid session IDs and gain unauthorized access to systems. The vulnerability affects all versions from 0 through 2.075 and stems from reliance on a 32-bit-seeded random number generator unsuitable for cryptographic purposes, making session hijacking feasible without authentication.
Stored XSS in WeGIA's employee profile module affects all versions prior to 3.7.0, enabling persistent JavaScript injection via the Description (Descrição) field at the funcionario/profile_funcionario.php endpoint. Any party able to edit that field can plant a payload that executes silently in every subsequent visitor's browser - including administrators - enabling session hijacking and privileged action execution. A proof-of-concept exists per SSVC assessment; however, no CISA KEV listing and an EPSS of 0.05% (15th percentile) indicate no observed widespread exploitation at time of analysis.
WSO2 Identity Server in multi-organization deployments fails to validate organization context during adaptive authentication flow execution, allowing privileged users in one organization to trigger authentication logic on other organizations. An attacker with adaptive authentication configuration privileges can exploit this context validation gap to bypass authorization boundaries, escalate privileges, and gain unauthorized access to user accounts and resources across organizational boundaries.
Integer overflow in jq's bytecode VM data stack allocation tracking allows local attackers to corrupt heap memory and achieve arbitrary code execution or denial of service by crafting deeply nested JSON generator expressions that exceed ~1 GiB stack size. Affected versions: jq 1.8.1 and earlier. The vulnerability requires local file access and user interaction to trigger malicious jq expressions, but carries high impact potential due to memory corruption exploitability.
Authentication bypass in OpenClaw before version 2026.4.22 allows unauthenticated attackers to read sensitive bootstrap and configuration metadata from the Control UI config endpoint when Gateway authentication is enabled. The vulnerability exposes internal bootstrap information and configuration fields intended only for authenticated Control UI sessions via an unprotected HTTP GET request to the `/__openclaw/control-ui-config.json` endpoint, with no user interaction required.
CRLF injection in cowlib's SSE encoder allows an attacker who supplies field values - id, event, data, or comment - containing bare carriage-return (\r) characters to split and forge arbitrary SSE events on receiving clients. Affected are all cowlib deployments from version 2.6.0 used to stream SSE to browser EventSource clients or other SSE consumers that dispatch on event.type or render event.data into the DOM, where the impact is equivalent to stored XSS. No active exploitation is confirmed (not in CISA KEV), EPSS is 0.04% (14th percentile), and SSVC rates automatable as 'no', indicating this is a targeted rather than mass-exploitable flaw; however, applications that echo user-controlled data through SSE fields face meaningful client-side integrity risk.
XML parsers in CPython's xml.parsers.expat and xml.etree.ElementTree modules use insufficient entropy for Expat hash-flooding protection, allowing crafted XML documents to trigger algorithmic complexity attacks (hash flooding) that degrade parser performance. Remote attackers can exploit this with complex XML payloads to cause denial of service. Mitigation requires both updating libexpat to 2.8.0 or later and applying the CPython patch, as confirmed by Python Software Foundation security advisory.
OpenClaw before version 2026.4.15 allows arbitrary local file read via the webchat audio embedding helper, which fails to enforce local media root containment checks. Attackers who can influence agent or tool-produced ReplyPayload.mediaUrl parameters can resolve absolute local paths or file:// URLs, read audio-like files, and embed them base64-encoded into webchat responses. The vulnerability is narrow in scope-files must be readable by the gateway process, have audio-like extensions, and fit within the webchat audio size cap-but crosses the security boundary between model/tool output and host filesystem access. No public exploit code or active exploitation has been identified, though the vulnerability is confirmed by vendor advisory.
docuFORM Managed Print Service Client 11.11c allows authenticated remote attackers to upload arbitrary files via the pmupdate.php endpoint, enabling potential remote code execution or system compromise. The vulnerability requires valid user credentials (PR:L per CVSS) but no user interaction, and affects confidentiality, integrity, and availability. No public exploit code or active exploitation has been confirmed at time of analysis.
Role-based access control bypass in WSO2 API Manager 3.x allows authenticated users with the 'Internal/Everyone' role to invoke Gateway and Internal Service APIs without proper permission enforcement, enabling unauthorized operations on sensitive REST API endpoints. The vulnerability affects multiple WSO2 products including API Control Plane, Universal Gateway, and Traffic Manager. CVSS 6.3 (network-accessible, low complexity, requires valid user credentials) indicates moderate severity with clear lateral privilege escalation potential in multi-tenant environments.
OpenClaw before 2026.4.20 allows attackers to bypass the hooks.allowRequestSessionKey opt-in restriction via template-rendered session keys in hook mappings, circumventing webhook routing isolation controls. The vulnerability enables externally influenced session keys to be rendered through templated hook mappings even when the opt-in is disabled, affecting webhook routing isolation but not enabling host execution. Vendor-released patch available (version 2026.4.20); no public exploit code identified at time of analysis.
OpenClaw before version 2026.4.20 fails to preserve untrusted labels on webhook-triggered cron agent output, allowing events to be recorded as trusted system events instead of untrusted events. This trust-labeling issue can strengthen prompt-injection attacks by rendering attacker-controlled webhook data as legitimate system events, though it does not directly bypass authentication, tool policy, or sandboxing controls.
Buffer overflow in Apple operating systems allows local unauthenticated users to cause unexpected system termination or read kernel memory without requiring user interaction. The vulnerability affects iOS, iPadOS, macOS, tvOS, visionOS, and watchOS across multiple versions, with exploitation limited to local access. Vendor-released patches are available for all affected platforms, and EPSS scoring of 0.03% indicates exploitation remains unlikely despite the local attack vector.