Information disclosure in perwendel Spark (SparkJava) up to version 2.9.4 via symlink following in the staticFiles.externalLocation method allows remote attackers with low privileges to read arbitrary files from the server. Publicly available exploit code exists, but no active exploitation or CISA KEV listing has been confirmed. The project maintainer has not yet responded to the issue report.
Information disclosure in mf-yang openclaw-cn up to version 0.2.1 allows remote authenticated attackers with low privileges to leak sensitive data by supplying a crafted URL to the scheme handler. Public exploit code is available, though no active exploitation has been confirmed by CISA KEV.
Server-side request forgery in openclaw-cn up to version 0.2.1 via the Browser Control HTTP API enables authenticated remote attackers to manipulate server-side requests, potentially accessing internal resources. Public exploit code is available in the project's GitHub issue tracker, but no active exploitation has been confirmed through CISA KEV. The vulnerability affects deployments where the browser control API is exposed, requiring low-privilege access to exploit.
Improper authorization in nanocoai NanoClaw's add_mcp_server endpoint allows authenticated attackers with low privileges to bypass access controls and perform unauthorized actions, such as adding MCP servers without proper authorization. Versions up to and including 2.0.64 are affected, and publicly available exploit code exists. A vendor patch is available via commit e5b928783d5c485637565eb07d2967922dfbf8d8.
Improper authorization in NanoClaw's MCP Server Approval component allows local attackers to bypass security controls by manipulating the createChatSdkBridge.setup function. The vulnerability affects all versions up to 2.0.64, and a public exploit is available, although no active exploitation or CISA KEV inclusion has been confirmed.
SimpleX Gateway authorization bypass in NousResearch hermes-agent 2026.6.5 allows an established SimpleX contact to authorize themselves to the agent by renaming their own profile display name to a value already present in the SIMPLEX_ALLOWED_USERS allowlist. The gateway's allowlist check matched the contact's self-asserted, remote-controlled profile name (source.user_name) alongside the numeric contactId, so any contact who guesses or knows an allowlisted display name can be treated as trusted without holding the real identity. Exploitation requires the SimpleX platform adapter to be enabled, an allowlist configured with human display names rather than numeric contactIds, a pre-existing contact relationship, and knowledge of an allowlisted name (remote, high complexity, authenticated per PR:L); publicly available exploit code exists and EPSS is only 0.23% (14th percentile), with no CISA KEV listing and no confirmed in-the-wild exploitation. Impact is limited to unauthorized authorization into the agent, not code execution.