Detection bypass in picklescan versions prior to 0.0.29 allows attackers to smuggle arbitrary code execution payloads through malicious pickle files by leveraging idlelib.autocomplete.AutoComplete.fetch_completions inside the __reduce__ method. Because the scanner does not flag this built-in Python function as dangerous, victims who rely on picklescan to vet PyTorch models or other pickle artifacts will load attacker-controlled code under pickle.load(). Publicly available exploit code exists (in the GHSA advisory), though no active in-the-wild exploitation has been reported.
Detection bypass in picklescan before 0.0.28 allows attackers to embed malicious torch.jit.unsupported_tensor_ops.execWrapper calls in pickle files that evade the scanner and execute arbitrary code when later loaded via pickle.load(). Publicly available exploit code exists in the GHSA advisory, and the flaw directly undermines the security guarantee picklescan is meant to provide for PyTorch model files. No CISA KEV listing and no EPSS data are provided, but the scanner bypass nature makes this a meaningful supply-chain risk for ML pipelines.
Detection bypass in picklescan before 0.0.33 allows attackers to smuggle arbitrary code through malicious pickle files by abusing numpy.f2py.crackfortran.myeval in a __reduce__ method, which the scanner fails to flag as dangerous. Any ML pipeline or model-hosting workflow that trusts picklescan's verdict before calling pickle.load() will execute attacker-controlled commands; publicly available exploit code exists in the GHSA advisory, and the CVSS 4.0 score of 7.6 reflects high confidentiality and integrity impact contingent on user interaction.
Detection bypass in picklescan prior to 0.0.29 allows attackers to smuggle remote code execution payloads through pickle files that the scanner incorrectly classifies as safe. The library fails to flag the built-in profile.Profile.runctx function when used in a __reduce__ method, so a downstream pickle.load() of the scanned file executes arbitrary Python. Publicly available exploit code exists in the GHSA-6vqj-c2q5-j97w advisory, though no active exploitation has been reported.
Denial of service in OpenLink Virtuoso OpenSource v7.2.11 allows remote unauthenticated attackers to crash the database server by submitting crafted SQL statements that trigger a fault in the sqlo_strip_in_join query-optimization component. The CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N) reflects network-reachable, no-auth exploitation with high availability impact and no confidentiality or integrity loss. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
An issue in the sqlo_place_dt_set component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
Denial of service in OpenLink Virtuoso (open-source edition) v7.2.11 allows attackers to crash the database server by submitting crafted SQL statements that mishandle the internal st_compare comparison routine. The flaw affects availability only (CVSS A:H, no confidentiality or integrity impact) and carries a 7.5 base score; EPSS is low (0.15%, 5th percentile) with no public exploit identified at time of analysis and no CISA KEV listing. Despite the CWE-89 (SQL Injection) classification, the reported effect is a service crash rather than data manipulation or extraction.
Denial of service in OpenLink Virtuoso Open Source Edition 7.2.11 lets attackers crash the database server by submitting crafted SQL statements that reach the time_t_to_dt date/time conversion routine. The defect is availability-only (no data exposure or integrity loss) and is tracked publicly via GitHub issue #1233; it carries a CVSS 3.1 base score of 7.5 but a low EPSS of 0.15% (4th percentile), and there is no public exploit identified at time of analysis and no evidence of active exploitation.
Denial of service in OpenLink Virtuoso Open Source Edition 7.2.11 lets attackers crash the database server by submitting crafted SQL statements that trigger a fault in the sqlo_natural_join_cond query-optimizer component. The flaw carries no confidentiality or integrity impact but fully degrades availability (CVSS 7.5, A:H). There is no public exploit identified at time of analysis and EPSS is low (0.15%), indicating limited near-term exploitation likelihood; only a GitHub issue documenting the defect is published.
Denial of service in OpenLink Virtuoso Open-Source Edition 7.2.11 lets attackers crash the database server by submitting crafted SQL statements that mishandle the sqlo_key_part_best query-optimizer routine. The flaw carries no confidentiality or integrity impact (availability-only, CVSS 7.5) and there is no public exploit identified at time of analysis; EPSS is low at 0.15% (4th percentile), and it is not listed in CISA KEV. The only public reference is the upstream GitHub issue (#1222) tracking the crash.
Denial of service in OpenLink Virtuoso Open Source Edition 7.2.11 lets attackers crash the database engine by submitting crafted SQL statements that mishandle the internal t_set_push routine. The flaw carries availability-only impact (CVSS 7.5, A:H) with no confidentiality or integrity loss. EPSS is low (0.15%, 4th percentile), there is no public exploit identified at time of analysis, and it is not listed in CISA KEV - so risk is theoretical rather than actively exploited.
Denial of service in OpenLink Virtuoso OpenSource v7.2.11 allows remote attackers to crash the database server by submitting crafted SQL statements that trigger a fault in the sqlo_try_in_loop SQL optimizer component. No public exploit identified at time of analysis, though SSVC indicates a proof-of-concept exists in the referenced GitHub issue. The flaw is tagged as SQLi-class (CWE-89) but the demonstrated impact is availability-only, with no confidentiality or integrity loss per the CVSS vector.
Denial of service in OpenLink Virtuoso OpenSource v7.2.11 allows remote attackers to crash the database server by submitting crafted SQL statements that trigger a fault in the sslr_qst_get component. The flaw is classified under CWE-89 (SQL injection class) but the documented impact is availability-only with no confidentiality or integrity loss per the CVSS vector. No public exploit identified at time of analysis, and the issue is tracked only via an upstream GitHub issue (#1229) rather than a tagged fixed release.
Denial of service in OpenLink Virtuoso OpenSource v7.2.11 allows remote attackers to crash the database server by submitting specially crafted SQL statements that trigger a flaw in the sqlo_untry query-optimization component. The CVSS 7.5 score reflects unauthenticated network exploitability with high availability impact, but no public exploit identified at time of analysis and the issue is currently tracked only as an upstream GitHub issue without a released fix.
Denial of service in OpenLink Virtuoso Open Source Edition v7.2.11 allows remote attackers to crash the database engine by submitting crafted SQL statements that mishandle column predicate processing inside the sqlo_tb_col_preds query optimizer component. CVSS 7.5 reflects high availability impact with no authentication required, though no public exploit identified at time of analysis and the issue is tracked only as an upstream GitHub bug report.
Symlink following in pwnlift's Blazor upload handler permits arbitrary file write with elevated system privileges when the application is deployed in a privileged (root or high-privilege) context. All pwnlift releases before commit d7a95449d9ee1ea09ec1529286685f6187afbbed are affected through the upload component in Components/Pages/Home.razor. No public exploit has been identified at time of analysis; an upstream fix is available via the referenced GitHub commit.
Firmware verification bypass in Caliptra Core Runtime Firmware versions 2.0.0 through 2.0.1 and 2.1.0 allows an attacker with high privileges to load unverified MCU firmware during a hitless update. The flaw resides in the ActivateFirmwareCmd::activate_fw module, where an incorrect check of a function return value causes the Root-of-Trust to skip authentication of the Microcontroller Unit firmware image. No public exploit identified at time of analysis, and the issue was responsibly disclosed by the Caliptra project itself.
Privilege escalation in Gogs self-hosted Git service (versions < 0.14.3) allows write-level repository collaborators to perform admin-only operations via three API endpoints (PATCH /issue-tracker, PATCH /wiki, POST /mirror-sync) that are incorrectly gated by reqRepoWriter() instead of reqRepoAdmin(). Authenticated collaborators can inject attacker-controlled external tracker/wiki URLs to redirect repository visitors to phishing sites, disable native features, or trigger mirror syncs. No public exploit identified at time of analysis, though a detailed proof-of-concept appears in the GitHub Security Advisory.
Improper authorization in Gogs (self-hosted Git service) versions before 0.14.3 lets a read-only user write to repositories they should only be able to fetch from. The Git Smart HTTP handler derives the access policy from the client-supplied ?service= query parameter rather than the actual RPC path, so a POST to /repo.git/git-receive-pack carrying ?service=git-upload-pack is authorized as a read while the receive-pack (push) code path still executes. A working PoC is published in the GHSA advisory, so publicly available exploit code exists; it is not listed in CISA KEV and no active exploitation has been reported.
Cross-tenant data exposure in FOSSBilling 0.7.2 and earlier lets authenticated client users retrieve transaction and order records belonging to other clients by abusing SQL operator precedence in list-endpoint search queries. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV, but the low complexity and low-privilege requirement make it a meaningful confidentiality risk for multi-tenant deployments. The flaw was remediated in version 0.8.0 released 2026-05-28.
Cross-tenant information disclosure in Gogs (self-hosted Git service) before 0.14.3 lets any user with write access to a single repository read the byte-for-byte contents of Git LFS objects belonging to private repositories they cannot otherwise access. Because LFS storage is content-addressed by OID alone while authorization is tracked per-repo, an attacker who learns a victim object's OID can bind it to their own repo via the upload endpoint - which skips hash verification on the dedupe path - and then download the original private bytes. The GHSA advisory publishes a complete working proof-of-concept; there is no evidence of active in-the-wild exploitation.
Cross-session information disclosure in HKUDS OpenHarness ohmo gateway allows admitted remote senders to invoke /resume and /summary slash commands, which were incorrectly registered with remote_invocable=True by default, to enumerate and load arbitrary saved session snapshots by ID. Successful exploitation exposes another user's private prompts, credentials, tool outputs, and file paths exchanged through shared gateway channels (e.g. Slack threads). No public exploit identified at time of analysis, but a vendor patch and detailed test cases (PR #276) make the issue easy to weaponize.
Denial of service in dhcpcd through version 10.3.2 allows an adjacent-network attacker to exhaust memory in the daemon by repeatedly sending crafted IPv6 Router Advertisements with zero-lifetime Route Information options. The unfreed allocations in routeinfo_findalloc() accumulate linearly until the daemon crashes, disrupting DHCP client functionality on the affected host. No public exploit identified at time of analysis, but the upstream fix (commit 708b4a5) is available.
Location spoofing in the Home Assistant Android companion app prior to 2026.5.3 allows any co-installed application - even one with zero runtime permissions - to forge the device's reported GPS position by broadcasting a crafted Google Play Services LocationResult to an unprotected exported BroadcastReceiver. The forged coordinates are forwarded to the user's Home Assistant server as the device's real location, defeating Android's developer-mode Mock Location gate and enabling abuse of zone-based automations such as unlocking doors, disarming alarms, or opening garages. No public exploit identified at time of analysis, and the issue is patched in 2026.5.3 by unexporting LocationSensorManager and introducing a thin RequestAccurateLocationReceiver proxy that drops attacker-supplied extras.
Privilege escalation in NanoClaw before 2.1.17 lets remote attackers with a valid questionId approve or reject privileged actions (such as package installation) by submitting crafted approval response payloads. The handleApprovalsResponse function dispatches sensitive handlers without verifying the responder holds an owner/admin role, turning approval callbacks into an authorization bypass. Publicly available exploit code exists via the upstream patch diff, but no active exploitation is currently confirmed.
Authorization bypass in Pega Platform versions 8.3.0 through Infinity 25.1.2 allows authenticated users to access additional data they should not be permitted to view by submitting crafted URLs. The flaw is a CWE-639 authorization key manipulation issue affecting Pega Infinity deployments, with no public exploit identified at time of analysis and high confidentiality impact per the vendor-provided CVSS 4.0 vector.
Arbitrary file disclosure in Grav CMS versions prior to 2.0.0-beta.2 allows authenticated admin-panel users to read sensitive server files via XML External Entity (XXE) injection in SVG upload processing. The flaw stems from simplexml_load_string() being called without entity-loader protections, enabling exfiltration of credentials, configuration, and environment secrets. No public exploit identified at time of analysis, though the GHSA advisory includes a working proof-of-concept payload.
Arbitrary file exfiltration in OctoPrint versions through 1.11.7 and 2.0.0rc1-rc2 allows authenticated users with the FILE_UPLOAD permission to move any host file readable by the OctoPrint process into the upload folder, where it can then be downloaded. This is an incomplete-fix recurrence of CVE-2025-48067; reserved internal form fields can still be smuggled to Flask via query parameters or Tornado/Werkzeug parser differentials. No public exploit identified at time of analysis, and patches are available in 1.11.8 and 2.0.0rc3.