Insecure deserialization in Optimate's neural_magic_training.py script enables remote code execution when loading PyTorch model files. The _load_model() function uses torch.load() without the weights_only=True security parameter, allowing attackers with low privileges to execute arbitrary Python code by providing malicious .pt or .pth files via the --model command-line argument. EPSS indicates low exploitation probability at 0.06% with no active exploitation confirmed.
Arbitrary code execution in Microsoft Excel (and the broader Office family through Microsoft 365 Apps, Office 2019, LTSC 2021/2024, Office for Mac, and Office Online Server) is possible when a user opens a maliciously crafted spreadsheet that triggers a heap-based buffer overflow (CWE-122), running attacker code in the context of the current user. There is no public exploit identified at time of analysis and the EPSS probability is very low (0.06%, 18th percentile), but the technical impact is total (full confidentiality, integrity, and availability loss). Microsoft has released patches; exploitation requires the victim to open a file, so it is a phishing/social-engineering-driven local vulnerability rather than a remotely wormable one.
Local code execution in Microsoft Office Excel (Excel 2016, Office 2019/LTSC 2021/2024, Microsoft 365 Apps, Office for Mac, and Office Online Server) arises from a use-after-free memory corruption flaw that an attacker triggers by convincing a user to open a specially crafted spreadsheet. Successful exploitation yields full compromise of the current user's context (high confidentiality, integrity, and availability impact). There is no public exploit identified at time of analysis, EPSS is very low (0.06%), and CISA SSVC records exploitation status as none, indicating this is a patch-in-cycle issue rather than an active threat.
Local code execution in Microsoft Office (LTSC for Mac 2021/2024 and Office for Android) via a heap-based buffer overflow (CWE-122) that an unauthorized attacker triggers when a victim opens a maliciously crafted document, yielding full confidentiality, integrity, and availability impact in the user's context. Exploitation requires user interaction (UI:R) and local access (AV:L), so weaponization depends on social engineering rather than remote reachability. This is no public exploit identified at time of analysis, with a very low EPSS score of 0.06% and CISA SSVC rating exploitation as 'none', indicating no observed activity despite the 'total' technical impact.
Information disclosure in Microsoft Excel (and the broader Office family - Office 2019, Office LTSC 2021/2024, Office for Mac, Microsoft 365 Apps for Enterprise, and Office Online Server) allows an attacker to read memory beyond an allocated buffer when a victim opens a crafted spreadsheet, potentially leaking sensitive in-process data. Exploitation is local and requires user interaction (opening the malicious file); there is no public exploit identified at time of analysis and CISA SSVC scores exploitation as 'none'. EPSS is very low (0.06%, 18th percentile), indicating negligible observed exploitation activity, though the technical impact is rated 'total'.
Remote code execution in CosyVoice (FunAudioLLM's open-source text-to-speech toolkit) up to commit 6e01309 allows an attacker to run arbitrary Python on a victim's host when the victim loads an attacker-supplied model directory. The flaw stems from calling torch.load() without weights_only=True, so malicious pickle payloads embedded in .pt model files execute during model loading via the web interface. There is no public exploit identified at time of analysis and EPSS is very low (0.05%, 17th percentile), but SSVC rates the technical impact as total.
Local code execution in Microsoft Visual Studio Code before 1.119.1 stems from improper neutralization of script-related HTML tags (basic XSS, CWE-80) rendered within the editor's webview surfaces, letting an attacker who tricks a user into opening crafted content run code in the victim's context. Exploitation requires user interaction (opening a malicious file/workspace) and is reported by Microsoft with a patch available; there is no public exploit identified at time of analysis, and EPSS is negligible at 0.05% (16th percentile).
Local privilege escalation in the Windows Server Data Deduplication feature (dedup.sys / associated services) lets an authenticated low-privileged user corrupt kernel memory to gain SYSTEM-level rights. Reported by Microsoft across Windows Server 2012 R2 through 2025, it carries a CVSS 7.8 and total technical impact per CISA SSVC, but has no public exploit identified at time of analysis and a very low EPSS of 0.04% (13th percentile). It is not listed in CISA KEV and shows no evidence of active exploitation.
Local privilege elevation in Microsoft Office (Microsoft 365 Apps for Enterprise, Office 2019, and Office LTSC 2021/2024) stems from a use-after-free memory corruption flaw (CWE-416) that an already-authorized local attacker can trigger to gain higher privileges on the host. Microsoft has released a patch, and there is no public exploit identified at time of analysis; EPSS is very low (0.04%, 13th percentile) and CISA SSVC records exploitation as none, indicating no observed in-the-wild activity. The CVSS 3.1 base score is 7.8 with total technical impact (C:H/I:H/A:H) once triggered.
Local privilege escalation in the Windows Kernel affects a broad range of Windows Server releases (2012 through 2025, including Server Core installations), where a heap-based buffer overflow (CWE-122) lets an already-authenticated local user corrupt kernel heap memory to gain SYSTEM-level privileges. Microsoft has released patches and rates it CVSS 7.8; there is no public exploit identified at time of analysis, and CISA's SSVC framework marks exploitation as none but technical impact as total. EPSS is very low (0.04%, 13th percentile), consistent with the local-only attack vector that requires prior code execution on the host.
Local privilege escalation in Windows Application Identity (AppID) Subsystem allows low-privileged authenticated users to execute code as SYSTEM via heap buffer overflow. Microsoft has released security patches across Windows 10 (versions 1607-22H2), Windows 11 (versions 22H3-26H1), and Windows Server 2012. CVSS 7.8 score reflects high impact to confidentiality, integrity, and availability. EPSS data not available; no confirmed active exploitation or public POC identified at time of analysis. Requires existing local access with standard user privileges, limiting remote attack surface.
Local privilege escalation in Windows Kernel across Windows 10, Windows 11 (versions 22H3 through 26H1), and Windows Server 2022 allows authenticated local attackers to gain SYSTEM-level privileges through heap corruption. Microsoft has released patches addressing this CWE-122 heap-based buffer overflow. EPSS data not available for risk quantification, and no CISA KEV listing indicates exploitation has not been publicly confirmed, though the vulnerability's low attack complexity (AC:L) and minimal prerequisites (PR:L) make it attractive for post-compromise privilege escalation in targeted attacks.
1-click remote code execution in AntSword before 2.1.16 lets a malicious web server or webshell endpoint execute arbitrary code on the operator's machine by injecting jquery.terminal format codes that the incomplete noxss() filter fails to sanitize. Because AntSword is an Electron-based client, cross-site scripting in the terminal renderer escalates to full RCE in the desktop application. Rated CVSS 8.8; no public exploit is identified at time of analysis, EPSS is only 0.04%, and SSVC records exploitation status as none.
Local privilege escalation in Microsoft's Azure Connected Machine Agent (versions 1.0.0 through 1.62) allows a low-privileged authenticated user on an Azure Arc-enabled machine to gain SYSTEM-level privileges by abusing an improper access control weakness. Microsoft has released a fixed build (1.63) and this is currently classified with no known exploitation (SSVC: none), consistent with an EPSS score of just 0.04%; no public exploit identified at time of analysis. The flaw is tagged as an authentication bypass and carries full technical impact (total) across confidentiality, integrity, and availability.
Local privilege escalation in Microsoft Office Click-To-Run (Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024) allows an authenticated local attacker to elevate privileges due to improper access control in the update/servicing component. A successful attack results in total compromise of confidentiality, integrity, and availability with a scope change beyond the vulnerable component. There is no public exploit identified at time of analysis and EPSS exploitation probability is very low (0.04%, 12th percentile), but the vendor rates technical impact as total.
Local privilege escalation in Microsoft Office Click-To-Run (the servicing/update engine behind Microsoft 365 Apps, Office 2019, and Office LTSC 2021/2024) lets an already-authenticated low-privileged user escalate to higher privileges on the host due to insufficiently granular access control (CWE-1220). The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) shows a scope change with total confidentiality, integrity, and availability impact, meaning a successful attacker crosses a security boundary from the Office servicing context to the wider system. There is no public exploit identified at time of analysis, EPSS is very low (0.04%), and CISA SSVC rates exploitation as 'none', so this is a serious-but-not-actively-exploited local EoP that should be patched on the normal accelerated cycle.
Local privilege escalation in Microsoft Dynamics 365 Business Central (2024 Release Wave 2 through 2026 Release Wave 1) lets an already-authenticated, low-privileged user elevate to higher privileges on the host through a weak authentication mechanism (CWE-1390). Successful exploitation yields total compromise of confidentiality, integrity, and availability of the affected instance. There is no public exploit identified at time of analysis, and CISA SSVC rates exploitation as 'none' with an EPSS of just 0.04% (12th percentile), indicating low near-term exploitation likelihood.
Privilege escalation in Turboard FOR-S allows remote unauthenticated attackers to gain elevated access by exploiting incorrect authorization checks, requiring only user interaction. The vulnerability affects versions 7.01.2026 through 17.02.2026, with fix available in version 18.02.2026. Turkish national CERT (TR-CERT) reported this authorization bypass vulnerability (CWE-863), which enables attackers to compromise confidentiality, integrity, and availability of the affected business intelligence platform.
Authorization bypass in BAPSİS web application enables unauthenticated remote attackers to exploit trusted identifiers through user-controlled keys when victims interact with crafted requests. ABIS Technology's BAPSİS platform (versions before v.202604152042) contains a CWE-639 flaw where authorization checks rely on client-controlled key values, allowing attackers to manipulate trust relationships and gain unauthorized access with high impact to confidentiality, integrity, and availability. TR-CERT published advisory but no public exploit code identified at time of analysis, with CVSS 8.8 reflecting network-exploitable attack requiring only user interaction.
Local privilege escalation in the Windows Remote Desktop component (CWE-122 heap-based buffer overflow) allows an authenticated low-privileged user to gain SYSTEM-level control across virtually all supported Windows client and server releases, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. Microsoft has released patches; there is no public exploit identified at time of analysis and EPSS exploitation probability is very low (0.04%), consistent with CISA SSVC rating exploitation as 'none'. The flaw is a serious defense-in-depth concern because it grants total confidentiality, integrity, and availability impact once a foothold exists, but it is not remotely reachable and requires prior local access.
Authenticated code execution on Nomad client hosts is possible in HashiCorp Nomad and Nomad Enterprise 1.10.0 through versions prior to 2.0.1 via a path traversal flaw in the dynamic host volume feature. A submitter with volume-creation privileges can escape the intended volume directory and write to or execute code in arbitrary locations on the client node's filesystem, gaining code execution outside the intended sandbox. This flaw is not in CISA KEV and has no public exploit identified at time of analysis; EPSS probability is low at 0.03%.
Local privilege escalation in the Windows Kernel affects Windows 11 (24H2, 25H2, 26H1) and Windows Server 2025, where an untrusted pointer dereference (CWE-822) lets an already-authenticated local attacker execute code with SYSTEM-level privileges. Microsoft has released a patch, and no public exploit is identified at time of analysis; EPSS exploitation probability is very low (0.03%) and the flaw is not on CISA KEV. Despite the 'Information Disclosure' tag applied in vendor metadata, the CVSS vector and description describe a privilege-elevation primitive with total confidentiality, integrity, and availability impact on the affected host.
Remote code execution in Fortinet FortiOS 7.2.0-7.2.11, 7.4.0-7.4.8, and 7.6.0-7.6.3 enables authenticated attackers to execute arbitrary code via malformed network packets. The out-of-bounds write vulnerability (CWE-787) affects FortiOS firewall appliances and requires only low-privilege credentials to exploit over the network. Fortinet published advisory FG-IR-26-123 confirming the vulnerability. No CISA KEV listing or public exploit code identified at time of analysis, though the straightforward network attack vector (AV:N/AC:L) suggests moderate weaponization potential once details emerge.
Local privilege escalation in the Win32K GRFX (graphics) subsystem of Microsoft Windows allows an authenticated, low-privileged user to execute arbitrary code in the kernel context via a heap-based buffer overflow. All currently supported Windows client and server releases (Windows 10 1607 through Windows 11 26H1, Windows Server 2012 through 2025) are affected. There is no public exploit identified at time of analysis, and EPSS probability is very low (0.02%), but the total technical impact and low exploitation barrier make it a meaningful patch-priority for endpoint hardening.
Memory corruption in Mozilla Firefox versions prior to 150.0.3 stems from a JIT (Just-In-Time) compiler miscompilation in the JavaScript engine, allowing remote attackers to trigger high-impact compromise of confidentiality, integrity, and availability when a user visits a malicious web page. The flaw carries a CVSS score of 8.8 and requires user interaction (loading attacker-controlled JavaScript), but no authentication. There is no public exploit identified at time of analysis, though a GitHub repository referenced from NVD suggests early proof-of-concept research, and EPSS scores the exploitation probability at only 0.02% despite the high CVSS severity.
Cross-site request forgery in ChurchCRM's UserEditor.php (versions prior to 7.3.2) lets an unauthenticated attacker forge account-management requests that execute with an authenticated administrator's session. Because the endpoint processes user creation and permission changes from $_POST parameters with no CSRF token, a victim admin who visits a malicious page can be tricked into silently promoting a low-privilege user to administrator or minting a new admin backdoor account. Publicly available exploit code exists (SSVC: poc) but the flaw is not in CISA KEV, and EPSS is very low (0.02%, 4th percentile), indicating no evidence of widespread exploitation.
Sandbox escape in Apple macOS (Sonoma before 14.8.7, Sequoia before 15.7.7, Tahoe before 26.2) allows a sandboxed application to break out of the App Sandbox and gain broader access to the system, achieving a scope change with total confidentiality, integrity, and availability impact. Apple addressed the underlying access-control weakness with additional sandbox restrictions. There is no public exploit identified at time of analysis, and the EPSS exploitation probability is very low (0.01%).
SQL injection in Ivanti Endpoint Manager web console enables authenticated remote attackers to execute arbitrary code on the server. Affects all versions prior to 2024 SU6. Attack requires only low-privilege authenticated access (CVSS PR:L) with low complexity (AC:L), making exploitation straightforward for any authenticated user. Ivanti has released patched version 2024 SU6 per vendor advisory dated May 2026. No CISA KEV listing or public exploit code identified at time of analysis, indicating exploitation not yet confirmed in the wild despite high severity score.
Remote code execution in SPIP versions before 4.4.14 lets authenticated users of the private space (backend) run arbitrary PHP in the web server context, bypassing SPIP's built-in security screen ("anti-intrusion") protections. The flaw is a CWE-94 code injection reported by VulnCheck and carries a CVSS 4.0 base score of 8.7; a vendor patch is available, though there is no public exploit identified at time of analysis and EPSS estimates only a 0.20% 30-day exploitation probability.
Heap out-of-bounds read and subsequent heap corruption in the Linux kernel's in-kernel SMB server (ksmbd) lets an authenticated remote SMB client with directory-creation rights corrupt kernel memory through the ACL inheritance path. By writing a crafted DACL whose SID carries an inflated num_subauth field and then creating child entries, an attacker can crash the kernel (DoS) or potentially escalate to kernel code execution. No public exploit identified at time of analysis; EPSS is low (0.18%, 39th percentile) and the flaw is not in CISA KEV, so exploitation is not confirmed in the wild.
Arbitrary file system read and write in Adobe Commerce (Magento) versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier lets an authenticated administrator escape the intended restricted directory via path traversal, reading or writing files anywhere the web application user has access. Because scope is changed (S:C), the impact can extend beyond the vulnerable component. No public exploit identified at time of analysis, and EPSS is low (0.09%, 26th percentile), consistent with the high-privilege prerequisite.
Out-of-bounds memory write in MongoDB Server's time-series collection feature enables arbitrary code execution by authenticated users with database write privileges. Affects all active release branches (5.0 through 8.3) when exploiting field-name-to-index mapping inconsistencies in the time-series bucket catalog. EPSS score of 0.06% (20th percentile) suggests low widespread exploitation probability despite high CVSS 8.7, but requires authentication and database privileges, limiting attack surface to insider threats or compromised application credentials. No public exploit code or CISA KEV listing identified at time of analysis.
Arbitrary file write in the esm.sh module CDN server (versions ≤ 137) lets remote unauthenticated attackers write attacker-controlled content to any path the server process can write to, and by overwriting binaries or scripts, escalate to remote code execution with the server's privileges. The flaw lives in the legacy router (legacy_router.go), which concatenates URL-encoded path segments into a storage key without sanitization before calling buildStorage.Put. A detailed, reproducible exploit walkthrough is published in the vendor GHSA advisory, so publicly available exploit code exists; EPSS is low (0.06%, 20th percentile) and the CVE is not on CISA KEV.
Weak session token generation in Schneider Electric industrial protection relays and energy management systems allows remote attackers to hijack authenticated user sessions via network-based prediction attacks. Affects 36 product variants across Easergy MiCOM P30/P40/C264, PowerLogic P5/P7/T-series, EcoStruxure Power Automation/Operation platforms, and iPMFLS systems. CVSS 8.7 reflects high confidentiality and integrity impact with user interaction required. No active exploitation confirmed (not in CISA KEV), but authentication bypass via session prediction enables privilege escalation in critical infrastructure environments. EPSS data not provided - risk assessment relies on CVSS vector and operational technology context.
Remote code execution in Code Runner MCP Server (all versions) allows an unauthenticated attacker with adjacent-network access to run arbitrary commands when the server is launched with the --transport http option, which exposes an unauthenticated /mcp JSON-RPC endpoint on port 3088. Invoking the run-code tool passes attacker-supplied source to child_process.exec(), yielding code execution as the user running the server. This is a design-level missing-authentication flaw (CWE-306) with no public exploit identified at time of analysis; EPSS is low (0.05%) and it is not on CISA KEV.
Sandbox escape in Heym's custom Python tool executor (versions before 0.0.21) allows authenticated workflow authors to break out of the restricted execution environment using Python object-graph introspection, recover the unrestricted __import__ function, and load blocked modules such as os and subprocess. Once free of the sandbox, an attacker executes arbitrary host commands as the backend service user and reads inherited environment variables holding database credentials and encryption keys. Publicly available exploit code exists (SSVC 'poc'), though the EPSS probability is very low at 0.04% and it is not listed in CISA KEV.
Privilege elevation in Microsoft Dynamics 365 Customer Insights allows an already-authenticated network attacker to gain higher privileges than their assigned role should permit, owing to improper privilege management (CWE-269). The flaw carries a CVSS 3.1 base score of 7.7 with a scope change, meaning the impact crosses the initial security boundary into other components. There is no public exploit identified at time of analysis, EPSS is very low (0.04%), and CISA's SSVC assessment records no known exploitation, but a vendor patch is available.
Spoofing in Microsoft Office (Office LTSC for Mac 2021/2024 and Excel/Word for Android) lets an attacker with local access bypass access-control checks (CWE-284) to misrepresent content or its origin to a user. Microsoft has issued a patch; there is no public exploit identified at time of analysis and EPSS is very low (0.04%, 13th percentile), so this is a low-likelihood but high-technical-impact issue.
Heap buffer over-read in pam_authnft allows remote denial-of-service via crafted netlink messages. pam_authnft < 0.2.0-alpha contains a CWE-125 buffer over-read in the peer_lookup_tcp function when parsing NETLINK_SOCK_DIAG replies, allowing unauthenticated network attackers to trigger crashes by sending malformed netlink diagnostic messages that bypass message-size validation. This PAM module binds nftables firewall rules to authenticated sessions, so exploitation disrupts authentication infrastructure. Vendor-released patch: 0.2.0-alpha (GitHub PR #10). No public exploit identified at time of analysis.
Denial-of-service via memory exhaustion affects UltraJSON (ujson) versions 5.12.0 and earlier, where the ujson.dump() function fails to release (Py_DECREF) the serialized JSON string object when the target file-like object's write() method raises an exception. Each failed write leaks the full serialized payload, so an attacker who can repeatedly trigger write failures - for example by disconnecting mid-response from a web server that streams JSON via ujson.dump() - can drive linear, unbounded memory growth. A proof-of-concept exists in the vendor advisory (GHSA-c38f-wx89-p2xg), but there is no public exploit identified as weaponized and no active exploitation; EPSS is very low at 0.04% (12th percentile).
Code injection in protobufjs-cli's pbjs static generator allows attackers who control protocol buffer schemas to inject malicious JavaScript code into generated output files. The vulnerability affects npm packages protobufjs-cli versions ≤1.2.0 and 2.0.0-2.0.1, with patches released in versions 1.2.1 and 2.0.2. Exploitation requires low complexity with authenticated network access and user interaction (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C), achieving high confidentiality and integrity impact but no availability impact. No CISA KEV listing or public exploit code identified at time of analysis, though GitHub advisory confirms the vulnerability with released patches.
Escalation of privilege in Intel Endpoint Management Assistant (EMA) software before version 1.14.5 allows an unauthenticated adversary on an adjacent network to gain elevated privileges on the vulnerable host, fully compromising its confidentiality, integrity, and availability. The flaw stems from improper input validation in a Ring 3 user-application component and carries a CVSS 4.0 base score of 8.7 (High). There is no public exploit identified at time of analysis, exploitation is not observed per CISA SSVC (Exploitation: none), and EPSS is very low at 0.03%.
Escalation of privilege in Intel's Slim Bootloader UEFI firmware allows a privileged local adversary to trigger an integer overflow (CWE-190) and execute code within the firmware/boot context. Exploitation requires existing high privileges and local access with a specific attack requirement present, but a successful attack fully compromises confidentiality, integrity, and availability of both the vulnerable firmware and the subsequent system. There is no public exploit identified at time of analysis and EPSS probability is negligible (0.01%), consistent with SSVC exploitation status of 'none'.
Stored cross-site scripting in Adobe Commerce (Magento) lets a low-privileged authenticated user persist malicious JavaScript into vulnerable form fields, which then executes in the browser of any victim who later views the affected page. Because scope is changed, the injected script can escalate to takeover of the victim's account or session, including higher-privileged admin sessions. No public exploit identified at time of analysis, and EPSS is negligible (0.01%, 2nd percentile), indicating low near-term mass-exploitation likelihood.
Vertical privilege escalation in Wiki.js before 2.5.313 lets an account-management moderator promote themselves to full site administrator through the users.update GraphQL mutation. Because the resolver applies a caller-supplied groups array to the database with no ownership or group-ID validation, any user holding the manage:users permission can set groups:[1] on their own account and, after re-authentication, receive a JWT carrying manage:system. SSVC rates technical impact as total; publicly available advisory exists (GHSA-cq3g-mwrg-v2rv) but no public exploit code and no active exploitation, with EPSS at a low 0.04%.
Blind SQL injection in Xpro Elementor Addons allows authenticated attackers to extract sensitive database contents including user credentials and site configurations. The vulnerability affects WordPress sites running plugin versions up to 1.5.1 and requires only low-privileged authenticated access (CVSS PR:L) with no user interaction. EPSS data not available, but the low attack complexity (AC:L) combined with changed scope (S:C) indicates potential for cross-boundary impact beyond the vulnerable plugin. No active exploitation confirmed in CISA KEV at time of analysis.
Blind SQL injection in APIExperts Square for WooCommerce (WooSquare) plugin versions up to 4.7.1 allows authenticated attackers with low-level privileges to extract sensitive database contents including customer data, order information, and potentially administrative credentials. The vulnerability enables scope escalation from the WordPress application context to the underlying database layer (S:C in CVSS vector), representing a significant data breach risk for WooCommerce stores. Reported by Patchstack, a WordPress vulnerability intelligence provider. No active exploitation confirmed in CISA KEV at time of analysis.
Blind SQL injection in Views for WPForms WordPress plugin (versions ≤3.4.6) allows authenticated low-privilege attackers with network access to extract sensitive database contents. The vulnerability enables cross-scope compromise with high confidentiality impact and limited availability disruption. Patchstack reported this SQLi flaw; no public exploit identified at time of analysis. EPSS data not available, suggesting lower immediate exploitation probability, though the low attack complexity (AC:L) makes exploitation straightforward once authenticated access is obtained.
Blind SQL injection in Ninja Forms Views plugin (versions ≤3.3.2) allows authenticated attackers with low-level privileges to extract sensitive database information via specially crafted queries. The vulnerability carries an 8.5 CVSS score with scope change, enabling attackers to access data beyond the plugin's normal authorization boundaries. Reported by Patchstack with detailed vendor advisory available, though no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Server-Side Request Forgery in Nginx UI (0xJacky/nginx-ui) version 2.3.4 and earlier lets any authenticated user coerce the server into making requests to arbitrary internal destinations. By reading the shared node_secret from GET /api/settings, registering a malicious cluster node via POST /api/nodes, and then setting the X-Node-ID header, an attacker makes the Proxy middleware forward requests to attacker-chosen addresses such as 127.0.0.1, internal networks, or cloud metadata endpoints. Publicly available exploit code exists and the flaw can be chained with a separate njs code-injection advisory to reach full RCE, though EPSS remains very low (0.03%, 8th percentile) and it is not listed in CISA KEV.