Missing authentication on the MQTT broker embedded in Phoenix Contact CHARX SEC electric-vehicle charging controllers allows a remote attacker who can reach the broker to take full control of the device. Because the broker enforces no authentication and relies solely on an external firewall for protection, any actor able to route to the MQTT service can issue broker commands leading to complete compromise. Rated CVSS 4.0 9.3 (critical); no public exploit identified at time of analysis and it is not listed in CISA KEV.
Stored cross-site scripting in OpenClaw Dashboard v3.0.0 lets an unauthenticated remote attacker seed a malicious payload simply by submitting a crafted username in a failed login attempt, which the audit log stores verbatim. When an administrator later opens the notification panel, the log entry is rendered through innerHTML under a permissive CSP that permits inline event handlers, executing the payload in the admin's authenticated session and enabling full account takeover. No public exploit was identified at time of analysis, though a dedicated write-up advisory exists; the CVSS 4.0 base score is 9.3 (Critical), reflecting the account-takeover impact.
Unauthenticated firmware implantation in Phoenix Contact CHARX SEC-3000/3050/3100/3150 EV charging controllers allows a remote attacker to push a modified firmware image to the basemodule because the update routine only checks a CRC32 checksum and performs no cryptographic signature verification (CWE-347). A successful upload yields full system compromise of the controller. No public exploit has been identified at time of analysis, but the flaw is network-reachable with no authentication and a vendor patch (v1.9.1) is available.
Reflected cross-site scripting in the administrative console login page of IBM Tivoli System Automation Application Manager 4.1 (a component that also involves IBM WebSphere Application Server) allows a remote attacker to inject and execute arbitrary script in an administrator's browser session. The CVSS 3.1 vector (AV:N/PR:N/UI:R, scope-changed) yields a high 9.3 base score, but exploitation requires tricking an authenticated console user into loading a crafted URL. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; a vendor patch is available.
Cross-tenant code injection and data disclosure in Activepieces (the open-source AI workflow automation platform) before 0.84.0 allows an authenticated flow author to escape their Code-piece sandbox and reach the read-write cached flow and code files of other tenants sharing the same worker. By abusing an unsanitized path segment, an attacker can read embedded secrets and data from co-tenants and overwrite cached code so that it executes under a victim tenant's identity on their next flow run. Publicly available intelligence shows no public exploit identified at time of analysis and no CISA KEV listing, but the vendor-confirmed fix and the broad impact (VC:H/VI:H plus subsequent-system SC:H/SI:H) make this a high-priority multi-tenant isolation failure.
Unauthenticated remote code execution in Gladinet CentreStack before 17.5 stems from a hardcoded cryptographic key (a static SysNumber used as entropy for AccessTicket.Encrypt/Decrypt across all installations), letting attackers forge valid x-glad-auth headers, invoke privileged endpoints like acquiretenantbackuptoken, and escalate to a domain administrator IdentityTicket for full server takeover. Reported by VulnCheck and carrying a CVSS 4.0 base of 9.3, it is remotely exploitable against default configurations with no authentication or user interaction. No public exploit code or CISA KEV listing is confirmed in the provided data, so at time of analysis there is no public exploit identified.
Discretionary access control bypass in Google Chrome desktop before 151.0.7922.72 lets an adversary in a privileged network position defeat a cryptographic protection and manipulate protected traffic. The flaw stems from a cryptographic weakness (CWE-325) rather than a memory-safety bug, and Google rates the Chromium severity High. No public exploit has been identified, EPSS is low (0.19%), and it is not on CISA KEV, but SSVC scores Technical Impact as total and Automatable as yes.
Authentication bypass via JWT assertion replay in malach-it Boruta (an Elixir OAuth 2.0/OpenID Connect provider) from 2.3.0 before 2.3.7 lets an attacker who captures any previously valid client assertion re-authenticate as that OAuth client indefinitely, because the token endpoint never checks the assertion's expiry. An attacker who harvests a signed client_secret_jwt or private_key_jwt assertion from logs, proxies, or browser tooling can mint access tokens carrying the victim client's privileges. No public exploit identified at time of analysis, though the fix commits and regression tests publicly demonstrate both the flawed and corrected behavior.
Account takeover in osTicket (the open-source support ticketing system) before v1.17.8 and v1.18.4 stems from an inverted logic check (CWE-640) in the password-reset token validation routine, where the expiry check runs only when the token's timestamp lookup fails - so any token with a valid timestamp bypasses expiration entirely. An attacker who obtains a valid reset token can replay it after it should have expired to hijack the associated account. Rated CVSS 4.0 9.1 (Critical); no public exploit identified at time of analysis and not listed in CISA KEV.
Authentication bypass in Outstatic CMS versions 2.1.9 and earlier lets an unauthenticated remote attacker forge valid administrative session tokens because the application ships a hardcoded JWT signing secret that is used whenever the OST_TOKEN_SECRET environment variable is left unset. Since the fallback secret is published in the project's public source repository, any attacker can self-sign a JWT granting arbitrary identity and full admin permissions with no credentials. There is no public exploit identified at time of analysis, but the technique is trivial and requires only the publicly-visible secret.
Memory disclosure and denial of service in SQLite 3.41 arise from a use-after-free in the btree module's shared-cache lock management, where a BtLock structure is freed but never unlinked from its linked list. Applications that enable SQLite shared-cache mode can have subsequent list traversals read freed memory, leaking sensitive process memory (CVSS C:H) or crashing the process (A:H). No public exploit identified at time of analysis, and SSVC lists exploitation status as none, though the flaw is assessed as automatable.
Arbitrary file write in Apache Kyuubi (1.7.0 through 1.11.1) lets a remote attacker abuse the REST batch multipart upload endpoint, which trusts the client-supplied filename, to plant controlled content anywhere the server process can write. Because the server never sanitizes path traversal sequences (../) in the multipart filename, an attacker can escape the intended upload directory and overwrite or create files subject only to filesystem permissions. EPSS is low (0.28%, 21st percentile) and there is no public exploit identified at time of analysis, but the primitive is powerful and the fix is available in 1.12.0.