Memory leak regression in Wasmtime 37.0.0 and 37.0.1 causes permanent host-process memory exhaustion when C/C++ embeddings use `externref` or `anyref` WebAssembly reference types. The refactoring from `ManuallyRooted<T>` to `OwnedRooted<T>` introduced three distinct defects - a no-op typo in `wasmtime_val_unroot`, unreleased return values from host-defined callbacks, and missing C++ destructors - that collectively prevent GC roots from ever being freed, even after the WebAssembly store is destroyed. No public exploit confirmed in CISA KEV; a proof-of-concept is publicly available, but EPSS at 0.18% (7th percentile) and SSVC exploitation status of none indicate minimal active threat.
Reflected cross-site scripting in SourceCodester Class and Exam Timetabling System 1.0 allows remote unauthenticated attackers to inject arbitrary JavaScript into the browsers of users who interact with a crafted URL targeting the `day` parameter of /exam.php. A publicly available proof-of-concept exploit exists on GitHub (AlbaDove/cve issue #7), confirming exploitability, though no active exploitation has been confirmed in CISA KEV. The CVSS 4.0 base score of 2.1 and EPSS of 0.36% (28th percentile) together indicate low real-world exploitation probability, consistent with SSVC's finding that the attack is not automatable and technical impact is only partial.
Path traversal in GoClaw 3.13.3-beta.3 allows authenticated remote attackers to read or write files outside the intended workspace directory by manipulating the path argument to the `writeFile` function in the ACP ToolBridge Workspace Handler (`internal/providers/acp/tool_bridge.go`). A proof-of-concept exploit has been publicly disclosed via a GitHub issue, lowering the bar for exploitation. No CISA KEV listing indicates active widespread exploitation has not been confirmed at time of analysis.
Server-side request forgery in louisho5 picobot up to version 0.2.0 allows authenticated remote attackers to manipulate the url argument of the WebTool.Execute function in internal/agent/tools/web.go, causing the server to issue arbitrary HTTP requests to internal or external targets. The vulnerability carries a CVSS 4.0 score of 5.3 with low-privilege authentication required and has publicly available exploit code disclosed via a GitHub issue report. The upstream project has not responded to the responsible disclosure, meaning no patch is available at time of analysis.
Server-side request forgery in GoClaw 3.13.3-beta.3 enables authenticated remote attackers to manipulate the `output.video_url` parameter within the `bytePlusDownloadVideo` function, coercing the server into issuing HTTP requests to attacker-controlled destinations including internal network resources. The flaw resides in `internal/tools/create_video_byteplus.go` at the invoke endpoint. A proof-of-concept exploit has been publicly disclosed via GitHub issue #1199; however, no CISA KEV listing confirms mass active exploitation, and the CVSS 4.0 score of 2.1 reflects the low-privilege authentication barrier and limited per-request impact scope.
SQL injection in itsourcecode Electronic Judging System 1.0 exposes the admin panel endpoint /intrams/admin/add_judges.php to database manipulation via the unsanitized `fname` parameter. Authenticated remote attackers can craft malicious input to read, alter, or potentially enumerate backend database contents. A publicly available proof-of-concept exploit exists on GitHub, though the vulnerability is not listed in CISA KEV and carries a CVSS 4.0 base score of 2.1 (Low), reflecting the authenticated access prerequisite and limited-scope CIA impact.
Prototype pollution in compromise (spencermountain/compromise) through version 14.15.1 exposes all JavaScript applications using the library to Object.prototype contamination via the nlp.extend() Public Root API. A low-privileged remote attacker who can supply a crafted plugin argument containing __proto__, constructor, or prototype keys can inject properties into the global Object.prototype, producing partial confidentiality, integrity, and availability impact across the Node.js runtime. A public exploit exists via GitHub issue #1208, a vendor patch has been released (commit b4644ab7), and no CISA KEV listing has been confirmed at time of analysis.
Link-following vulnerability in louisho5 picobot up to version 0.2.0 allows a remote, low-privileged attacker to traverse outside the intended workspace directory via the CreateSkill and GetSkill functions in the filesystem handler. The root cause is improper symlink resolution (CWE-59) in internal/agent/tools/filesystem.go, enabling potential unauthorized file read and write operations on the host filesystem. A public exploit exists as a GitHub issue report; no vendor patch has been released and the project maintainer has not yet responded to the disclosure.
Server-side request forgery in zhayujie CowAgent's Vision Tool allows authenticated remote attackers to make the server issue arbitrary HTTP requests to internal network resources. The vulnerability exists in the Vision._download_to_data_url / _build_image_content function in agent/tools/vision/vision.py, where the image argument is passed to an HTTP fetch without URL validation, enabling access to private RFC1918 addresses, loopback interfaces, and other non-public infrastructure. A publicly available proof-of-concept exploit exists (GitHub issue #2878), and a vendor-released patch (version 2.1.2) is available.
Information disclosure in nextlevelbuilder GoClaw up to version 3.13.3-beta.3 allows remote low-privileged attackers to extract sensitive data by manipulating the `args.targetUrl` argument passed to the `handleNavigate` function in `pkg/browser/tool.go`. A public proof-of-concept exploit exists and is referenced via GitHub issue #1207, elevating the practical risk beyond the moderate CVSS 4.0 score of 5.3. No confirmed patched release has been identified at the time of analysis, leaving all known versions of the product exposed.
GoClaw 3.11.3 by nextlevelbuilder exposes an incomplete blacklist bypass in the ExecApprovalManager.CheckCommand function, allowing authenticated low-privilege remote attackers to circumvent command approval controls enforced in internal/tools/exec_approval.go. The bypass can yield limited confidentiality, integrity, and availability impacts consistent with the information-disclosure tag and the VC:L/VI:L/VA:L CVSS 4.0 impact metrics. No public exploit identified at time of analysis is incorrect here - a public proof-of-concept exploit exists per the referenced GitHub issue, lowering the technical bar for abuse.
Server-side request forgery in mosaxiv clawlet up to version 0.2.10 enables authenticated remote attackers to manipulate the webFetch tool function to issue arbitrary HTTP requests from the server, potentially reaching internal services, cloud metadata endpoints, or other network resources not directly accessible to the attacker. A publicly available proof-of-concept exploit was disclosed via GitHub issue #14, making real-world exploitation more accessible. Critically, the upstream maintainer closed the issue as 'not planned,' meaning no vendor-released patch is forthcoming and the vulnerability will remain permanently unaddressed in the existing codebase.
Cross-site scripting in code-projects Online Job Portal 1.0 allows a remote, low-privileged attacker to inject malicious JavaScript via the /Admin/DetailJob.php endpoint, which executes in the browser of any user who views the affected page. The CVSS 4.0 vector (PR:L/UI:P) confirms that exploitation requires an authenticated session and passive victim interaction, constraining but not eliminating real-world risk. A public proof-of-concept has been disclosed on GitHub; no patch from the vendor has been identified at time of analysis.
Path traversal in DedeCMS 5.7.118's Album Publishing Feature allows remote attackers with administrative credentials to read or write files outside the intended extraction directory by manipulating the `filename` argument passed to the `ExtractFile` function in `include/zip.class.php`. A public proof-of-concept exploit has been released on GitHub, lowering the skill bar for exploitation, though no active exploitation has been confirmed in the CISA KEV catalog. The CVSS 4.0 score of 5.1 with PR:H reflects the high privilege requirement, which materially limits the exposed attack surface to authenticated admin-level sessions.
OS command injection in louisho5 picobot up to version 0.2.0 allows local low-privileged attackers to execute arbitrary operating system commands through the ExecTool.Execute function in internal/agent/tools/exec.go. A publicly available proof-of-concept exploit exists (GitHub issue #43), elevating practical risk despite the moderate CVSS 4.0 score of 4.8. No patch has been issued as the project maintainer has not responded to responsible disclosure, leaving all known deployments persistently exposed.
Null pointer dereference in open62541's client library (versions up to 1.5.5) allows a remote OPC UA server to crash a connecting client by returning a malformed Server_NamespaceArray during session establishment, causing denial of service. The flaw is client-side only - server deployments are unaffected - and exploitation requires the attacker to control or impersonate a server the vulnerable client connects to, making practical exploitation high-complexity. A proof-of-concept exists as a GitHub issue report; no public exploit is confirmed as weaponized and the vulnerability is not listed in CISA KEV.
Information disclosure in Microsoft Office (Microsoft 365 Apps, Office 2016/2019, Office LTSC 2021/2024, and Office for Mac) via an out-of-bounds read (CWE-125) lets an attacker leak sensitive memory contents when a victim opens a maliciously crafted document. The CVSS 3.1 base score is 7.1 (AV:L/AC:L/PR:N/UI:R), reflecting local exploitation that requires user interaction but no prior authentication. Microsoft is the reporting source and has published a fix; there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Limited sensitive information disclosure in Adobe Commerce, Magento Open Source, Adobe Commerce B2B, and the Adobe Commerce Webhooks Plugin enables unauthenticated remote attackers to obtain restricted data under high-complexity conditions. The CWE-200 flaw requires no user interaction but exploitation depends on factors outside attacker control - such as race conditions or specific environmental state - sharply constraining practical exploitation. No active exploitation is confirmed: SSVC rates exploitation as none, EPSS stands at 0.57% (43rd percentile), and the vulnerability is absent from the CISA KEV catalog; Adobe has released July 2026 security patches across all affected product lines via APSB26-73.
Prototype pollution in @feathersjs/commons _.merge allows remote attackers to corrupt Object.prototype for the lifetime of a Node.js process by submitting JSON-parsed input containing a __proto__, constructor, or prototype key. The CVSS 3.7 (Low) rating reflects genuine low real-world risk: no first-party @feathersjs/* package routes untrusted input through this specific utility, meaning exploitation is gated on a downstream plugin or custom application code doing so. EPSS is 0.39% (31st percentile) and no public exploit or CISA KEV listing exists, consistent with the vendor's own assessment that scope of real-world risk is limited.
User account enumeration in SAP HANA Extended Application Services Classic Model (XSC) user self-service tools allows unauthenticated remote attackers to identify valid usernames and email addresses by crafting requests that elicit distinguishable server responses. The CWE-204 root cause - observable response discrepancy - means the application behaves differently for valid versus invalid accounts, leaking account existence without requiring credentials. CVSS scores this at 3.7 (AV:N/AC:H) reflecting network accessibility tempered by high attack complexity; no public exploit code or CISA KEV listing has been identified at time of analysis.
Stored XSS in FacturaScripts (<= 2026.1) allows an authenticated attacker to execute arbitrary JavaScript in any victim's browser via the variant-picker or subaccount-picker modals. The flaw exists in `WidgetVariante::renderVariantList` and `WidgetSubcuenta::renderSubaccountList`, which embed `Tools::noHtml`-encoded field values directly into JavaScript string literals inside HTML `onclick` attributes - a pattern the browser defeats by HTML-decoding attribute values before the script engine parses them, converting `'` back to a literal apostrophe. A publicly confirmed proof-of-concept was verified on 2026-05-01; no patch has been released. This is a missed instance of the same anti-pattern corrected in three sister classes by commits `40bc701` and `8586b97`.
Out-of-bounds read in Microsoft Office (including 365 Apps for Enterprise, Office 2016/2019, LTSC 2021/2024 on Windows and macOS, and SharePoint Server 2016/2019/Subscription Edition) allows a local attacker to disclose limited memory contents when a victim opens a specially crafted document. The CVSS 3.3 Low score, EPSS of 0.51% (40th percentile), SSVC exploitation status of 'none,' and absence from CISA KEV collectively place this vulnerability at low real-world priority despite its broad product footprint. No public exploit or proof-of-concept code has been identified at time of analysis.
Windows Win32K in Windows 11 (versions 24H2, 25H2, 26H1) and Windows Server 2025 leaks sensitive information to local authenticated attackers through an information disclosure flaw classified as CWE-200. The vulnerability requires only low-privilege local access and yields partial confidentiality impact with no integrity or availability consequences, consistent with the CVSS 3.3 Low rating. No public exploit identified at time of analysis, and CISA SSVC assessment confirms no known exploitation, non-automatable attack pattern, and only partial technical impact - making this a low real-world priority outside multi-tenant or shared-access environments.
Out-of-bounds read in Microsoft Office exposes a limited portion of process memory to a local attacker when a user opens a specially crafted document. Affected products span Office 2016 through LTSC 2024 on both Windows and macOS, with impact confined to low-severity information disclosure and no integrity or availability consequence. No public exploit code exists and CISA has not listed this in KEV; SSVC confirms exploitation status as none and the vulnerability is assessed as non-automatable, collectively placing this in the lowest real-world risk tier despite broad product coverage.
Windows Kernel information disclosure across a broad range of Microsoft Windows 10, Windows 11, and Windows Server editions allows a locally authenticated low-privileged attacker to read sensitive kernel memory contents they are not authorized to access. The flaw is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) and is confined to local exploitation with no integrity or availability impact. No public exploit code or active exploitation has been identified at time of analysis, and Microsoft has released patches addressing the issue across all affected version branches per EUVD-2026-43865.
Information disclosure in Microsoft Office (Microsoft 365 Apps, Office 2016/2019, Office LTSC 2021/2024, and Office for Mac) arises from an out-of-bounds read (CWE-125) that lets an attacker who convinces a victim to open a crafted file read memory beyond an intended buffer boundary. Exploitation is local and requires user interaction, and there is no public exploit identified at time of analysis and no CISA KEV listing. Disclosed memory can leak sensitive data such as heap contents or pointer addresses useful for defeating ASLR in a follow-on exploit chain.
Information disclosure in Windows Print Spooler Components exposes memory contents to locally authenticated attackers via an out-of-bounds read (CWE-125). The flaw affects a sweeping range of Windows releases from Server 2012 through Windows 11 26H1 and Server 2025, making the affected surface extremely broad. Microsoft has released patched builds and the SSVC assessment confirms no observed exploitation, with EPSS at 0.31% (22nd percentile) corroborating a low immediate threat posture; however, Print Spooler's historical exploitation history (PrintNightmare family) warrants prompt patching given attacker familiarity with the component.
Heap-based buffer overflow in Microsoft Office Excel triggers a local information disclosure when a target user opens a maliciously crafted document. Affecting Excel 2016 through Office LTSC 2024 and Microsoft 365 Apps for Enterprise on both Windows and macOS, the vulnerability yields only limited confidentiality impact (C:L) with no integrity or availability consequence, placing it in the Low severity tier at CVSS 3.3. No public exploit code exists and no active exploitation has been confirmed - CISA's SSVC framework rates exploitation as none, automatable as no, and technical impact as partial, consistent with the low EPSS probability of 0.27% (19th percentile).
Devolutions Server 2026.1.22.0 and 2026.2.11.0 exposes Azure Key Vault client secrets in cleartext within Recovery Kit response files, defeating an explicit 'exclude sensitive data' option that administrators rely on. Any party who obtains a copy of the generated response file can trivially read the credential without any decryption or tooling. No public exploit code exists and the vulnerability is not in CISA KEV; however, because successful exploitation yields a reusable cloud credential, the downstream blast radius in Azure environments substantially exceeds what the 3.3 CVSS base score suggests. A vendor-released patch is available.
Horizontal privilege escalation in Easy!Appointments prior to 1.6.0 permits any authenticated provider to inject appointments into a peer provider's calendar or reassign existing appointments across provider boundaries by supplying an arbitrary `id_users_provider` value to the `store` and `update` API endpoints. The asymmetry is stark: the `search` endpoint correctly enforces provider-scoped filtering, confirming the isolation boundary was intentionally designed - making this an incomplete implementation rather than a missing feature. An additional write-before-crash defect on the `store` path means the unauthorized database row is silently persisted even when the attacker receives an HTTP error response. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis.
User enumeration via observable timing discrepancy in HCL BigFix Platform allows a low-privileged remote attacker to infer the existence of valid usernames by carefully measuring and comparing authentication response times. Affected versions span the 10.0 and 11.0 release branches. No public exploit code has been identified and CISA has not added this to the KEV catalog; exploitation probability is extremely low at 0.15% EPSS (5th percentile).
Improper authorization in Devolutions Server's secure messages deletion endpoint exposes an Insecure Direct Object Reference (IDOR) flaw allowing any authenticated user to permanently delete secure messages belonging to other users simply by supplying a target message identifier. Affected versions are 2026.2.11 and 2026.1.22; patched releases 2026.1.23 and 2026.2.12 are available per the vendor advisory. No public exploit identified at time of analysis, and the low CVSS score of 3.1 reflects constrained impact (integrity only, no data disclosure) paired with high attack complexity.
OAuth provider rebinding in Easy!Appointments prior to version 1.6.0 allows any authenticated backend user - including low-privilege secretary and provider roles - to silently hijack a peer provider's Google Calendar integration by supplying an arbitrary provider_id to the OAuth initiation endpoint. The attacker completes a legitimate Google OAuth flow with their own Google account, which the application then binds to the victim provider's database row without verifying ownership. From that point forward, every appointment on the victim's schedule syncs to the attacker's Google Calendar, leaking customer names and email addresses as attendee data. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Insufficient session expiration in Adobe ColdFusion 2023 (through Update 21) and 2025 (through Update 10) allows a high-privileged authenticated attacker to reuse sessions that should have been invalidated, bypassing security controls to gain unauthorized write access. The CVSS score of 2.7 reflects the significant constraint of PR:H - the attacker must already hold high-level ColdFusion credentials. SSVC classification of exploitation:none and an EPSS of 0.35% (28th percentile) confirm no active exploitation or public exploit code at time of analysis.
Server-side request forgery in Easy!Appointments prior to 1.6.0 allows authenticated backend users - admins, providers, or secretaries - to probe internal network hosts by supplying arbitrary URLs to the CalDAV synchronization endpoint. The Guzzle HTTP client in `Caldav.php:60` forwards a REPORT request to the caller-supplied `caldav_url` without validating the scheme or destination host, enabling access to loopback, RFC1918, and link-local addresses on the deployment network. The SSRF is semi-blind, returning up to approximately 120 bytes of upstream response body through the exception path; no public exploit has been identified, exploitation requires an active backend account, and version 1.6.0 resolves the issue.
Stored XSS in Easy!Appointments versions prior to 1.6.0 allows an authenticated administrator to inject arbitrary HTML or JavaScript into the 'booking disabled' message field via the booking settings rich-text editor. The unsanitized value is rendered directly to every unauthenticated visitor who opens the public booking page while booking is disabled, crossing a scope boundary from admin context to anonymous public users. No public exploit has been identified at time of analysis; CVSS rates this 2.6 (Low) driven by the administrator-level privilege requirement, though the persistent cross-scope impact on all public visitors is a meaningful secondary risk factor.
Prototype pollution in Tamagui's updateConfig function allows authenticated remote attackers to inject arbitrary properties into the JavaScript Object prototype, affecting all versions through 2.3.0. The flaw in code/core/web/src/config.ts permitted passing '__proto__' as the key argument to updateConfig, causing Object.assign to merge attacker-controlled values directly onto Object.prototype. No public exploitation (KEV) is confirmed, but proof-of-concept exploit code exists per SSVC assessment; EPSS at 0.34% (26th percentile) reflects limited observed exploitation interest at time of analysis.
The payment withdrawal approval endpoint in xianyu-auto-reply executes state-changing financial approval actions in response to HTTP GET requests, violating the HTTP safe-method contract and enabling unintended approvals through automated link-prefetching clients. Any low-privileged authenticated user possessing a valid review token can approve withdrawal requests by issuing a GET to /api/v1/payment/withdraw/review?action=approve, and more critically, email clients or mail-security gateways that automatically prefetch URLs can trigger approvals silently when an administrator receives a notification email. A proof-of-concept has been publicly disclosed per CVSS 4.0 E:P; no CISA KEV listing or confirmed active exploitation was identified at time of analysis.
Server-side request forgery in mosaxiv clawlet up to version 0.2.10 allows remote attackers to manipulate the server into issuing arbitrary HTTP requests by supplying a crafted URL to the web_fetch function in tools/tool_web_fetch.go via the IPv4 Handler. The CVSS 4.0 score of 2.1 reflects limited practical impact, constrained further by a user-interaction requirement (UI:P) and low CIA impact metrics. Publicly available exploit code exists (E:P per CVSS 4.0 supplemental vector), and the upstream maintainer has closed the tracking issue as 'not planned', meaning no official fix will be released.
Server-side request forgery in mastergo-magic-mcp up to version 0.2.0 allows network-adjacent attackers who influence the `url` argument of the `mcp__getComponentLink` tool to cause the MCP server to issue arbitrary outbound HTTP requests to internal or external destinations. A publicly available proof-of-concept exploit has been published via GitHub issue #89, and the vendor has not yet responded to the coordinated disclosure. The CVSS 4.0 score of 2.1 with E:P reflects a low-impact, user-interaction-dependent scenario that SSVC independently classifies as non-automatable with only partial technical impact.
Prototype pollution in kofrasa mingo up to version 7.2.1 allows low-privileged remote attackers to corrupt JavaScript Object.prototype by supplying `__proto__` as a field selector in `$set`, `updateOne`, or `updateMany` operations, injecting arbitrary properties into all objects within the Node.js process. Proof-of-concept exploit code exists (CVSS 4.0 E:P), and successful exploitation can cascade to application-wide privilege logic bypass, information disclosure, or denial of service depending on how the host application relies on inherited object properties. Vendor-released patch version 7.2.2 is confirmed available.
Prototype pollution in svg.js (svgdotjs) up to version 3.2.5 allows a remote low-privileged attacker to inject arbitrary properties into JavaScript's shared Object.prototype via the EventTarget.on function of the npm package API. Depending on how consuming applications perform property lookups, this can lead to information disclosure, logic bypass, or integrity violations across the entire JavaScript runtime. No vendor patch exists - the maintainer has not responded to the responsible disclosure - and a proof-of-concept exists (CVSS E:P), though no confirmed active exploitation appears in CISA KEV.
Protection mechanism failure in mosaxiv clawlet up to version 0.2.10 allows remote attackers to bypass the exec Safety Guard, undermining the tool's core command-execution restriction logic. The vulnerability resides in the `guardExecCommand` function within `tools/tool_exec.go`, where insufficient enforcement of protection controls permits manipulation that should otherwise be blocked. Passive user interaction is required (CVSS 4.0 UI:P), and a public proof-of-concept exploit has been released; however, the vendor has closed the tracking GitHub issue as 'not planned', indicating no patch is forthcoming.
Buffer overflow in SUSE Virtual Machine Driver Pack allows a local attacker with registry modification rights to corrupt driver integrity. Affected are all versions of the pack before upstream commit e7a602ec232756ead019bdf19d6d3b9d010cc94b, targeting virtualized guest environments running SUSE's paravirtual drivers. No public exploit exists and the vendor explicitly states no feasible exploitation path is currently known; no public exploit identified at time of analysis.
Path traversal in mastergo-magic-mcp (versions 0.1 through 0.2.0) allows a locally authenticated low-privilege user to read and write arbitrary files by supplying a crafted filePath argument to the mcp__C2d component's execute function in src/tools/get-c2d.ts. A public proof-of-concept exploit has been released, though the attack surface is constrained to local access, limiting widespread exploitation. No vendor patch is available - the maintainer has not responded to the GitHub issue disclosure.
Path traversal in mastergo-magic-mcp versions up to 0.2.0 allows local low-privileged attackers to read and write files outside the intended working directory by supplying manipulated path sequences via the `rootPath` argument of the `mcp__getComponentGenerator` component's `execute` function. A public proof-of-concept exploit has been disclosed (CVSS 4.0 E:P), and the vendor has not responded to the issue report, leaving no patch available at time of analysis. No public exploitation (CISA KEV) has been confirmed, and the local-only attack vector significantly constrains the realistic threat surface.