Authorization bypass in AgentGPT through 1.0.0 allows authenticated attackers to hijack other users' agent runs by supplying an arbitrary run_id in the request body, exploiting missing ownership validation in the AgentCRUD.create_task and validate_task_count functions. Successful exploitation enables task history corruption, exhaustion of per-run LLM loop budgets, and financial damage by driving API costs against the victim's account. A public proof-of-concept exists per VulnCheck reporting; no CISA KEV listing is present, and the low CVSS 4.0 score of 2.3 reflects the high attack complexity and constrained integrity/availability impact.
OS command injection in localstack serverless-localstack up to version 1.4.0 allows a local low-privileged attacker to execute arbitrary operating system commands by manipulating the `custom.localstack.docker.compose_file` configuration argument processed by the Configuration Handler in `src/index.js`. A publicly available proof-of-concept exploit exists via GitHub issue #303, elevating practical risk beyond the moderate CVSS 4.0 base score of 4.8. No vendor patch has been released, as the project maintainer has not responded to the responsible disclosure reported through an issue report.
DNSSEC validation is bypassed in PowerDNS Recursor when wildcard-synthesized answers are CNAME or DNAME record types, allowing an attacker positioned to inject forged DNS responses to circumvent cryptographic integrity guarantees. Wildcard expansion proofs - the NSEC or NSEC3 records that DNSSEC uses to prove a wildcard match is legitimate - are accepted by the recursor without verifying their signatures in this specific code path. No public exploit code has been identified at time of analysis, and EPSS data was not provided; however, the bypass of DNSSEC undermines a core trust mechanism used by resolvers to reject forged DNS data.
TTL capping bypass in PowerDNS Recursor enables ghost domain NS record injection when a slow authoritative server response arrives after the cached NS entry has already expired. Specifically, the proactive background refresh mechanism fails to cap TTLs on NS record responses when no live cache entry exists at response time, allowing attacker-controlled TTL values to persist uncapped in the recursor's cache. No active exploitation has been identified (no CISA KEV listing), no public exploit code exists, and the CVSS score of 3.7 reflects the constrained, timing-dependent nature of this attack.
XML injection in Qt's QDom serialization component (versions 4.0.0 through 6.11) allows untrusted text passed to comment, CDATA, and processing-instruction nodes to break out of those structures and inject arbitrary XML markup into serialized output, because the default InvalidDataPolicy (AcceptInvalidChars) does not escape node terminators such as '-->', ']]>', or '?>'. The CVSS 4.0 score of 2.9 reflects an attack timing prerequisite (AT:P) - only applications that actively pass attacker-controlled content through QDom serialization are exploitable; the Qt library itself is not a standalone attack surface. No public exploit is identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog, though the CVSS 4.0 threat metric E:P suggests proof-of-concept code may exist.
Path traversal in the Kubernetes Java client library's copyDirectoryFromPod function allows a compromised pod to write files to arbitrary locations on the local machine of a high-privileged operator performing copy operations. The vulnerability is only reachable when enableTarCompressing is set to false, and requires both an attacker-controlled pod and an operator actively running a copy command. With a CVSS score of 2.7 (PR:H, UI:R), no public exploit, and no CISA KEV listing, this is a narrow but credible lateral-movement vector in DevOps and CI/CD operator workflows rather than a broadly exploitable flaw.
DOMPurify's IN_PLACE sanitization mode silently bypasses XSS filtering when processing DOM elements sourced from a different JavaScript window context (e.g., an iframe's contentDocument), returning the unsanitized element - payloads intact - to the calling application. The private _isNode() function's instanceof check fails for foreign-realm nodes because prototype chains belong to distinct window objects, causing DOMPurify to misidentify the input, disable IN_PLACE mode silently, and pass through unfiltered content. The vendor has explicitly declined to issue a fix, categorizing this as outside DOMPurify's threat model, leaving all versions through 3.3.3 permanently exposed without a vendor-supplied remediation path.
Privilege escalation in OWASP DefectDojo 2.59.0 exposes authenticated non-superusers to flip the is_staff flag on any account - including their own - through the UserSerializer in the v2 API, bypassing DefectDojo's role-based access controls and granting Django admin access. Version 2.59.0 was an accidental release and has been pulled; patched releases 2.58.3 and 3.0.0 exist. Publicly available exploit code is acknowledged (CVSS 4.0 E:P), and no special preconditions beyond a valid authenticated session with delegated user-management permissions are required.
OS command injection in the @publint/pack component of publint (up to v0.1.4) allows a local attacker who controls the packageManager input to execute arbitrary shell commands via unsanitized string interpolation passed to child_process.exec. The affected functions packAsJson and pack in src/node/pack.js and src/node/pack-as-json.js construct shell command strings by concatenating the packageManager variable directly into template literals before passing them to util.promisify(cp.exec). A proof-of-concept exploit is publicly available (CVSS 4.0 E:P), though the maintainer explicitly states exploitation requires untrusted input usage, which is outside the package's intended use case and not confirmed actively exploited in the wild.
OS command injection in the release-it conventional-changelog plugin (up to v11.0.1) allows a local low-privileged user to execute arbitrary operating system commands by supplying a crafted value for the infile argument to the writeChangelog function in index.js. The vulnerability has been publicly disclosed through a GitHub issue report, and exploit code is available. No patch has been released at time of analysis, as the project maintainer had not responded to the responsible disclosure.
OS command injection in bahmutov/find-cypress-specs versions through 1.54.12 allows a local attacker with limited privileges to execute arbitrary shell commands by supplying a crafted value to the --branch argument, which is passed unsanitized to shell.exec in src/index.js. The vulnerability is constrained to local execution and carries low impact across confidentiality, integrity, and availability per the CVSS 4.0 vector. A public proof-of-concept exists and the vendor has not responded to the coordinated disclosure report filed via GitHub issue #423; no patch has been released at time of analysis.