Stored cross-site scripting in the Frontend Admin by DynamiApps WordPress plugin (all versions before 3.29.9) allows unauthenticated visitors to permanently inject executable script content into site storage by exploiting a double-encoding sanitization bypass. The flaw arises because the plugin re-decodes HTML entities after sanitization, resurrecting neutralized tags; the live payload is then rendered without escaping on front-end display surfaces and fires in the browser of any authenticated user — including site administrators — who later views the affected page. A publicly available proof-of-concept exists; while no active exploitation is confirmed in CISA KEV, the unauthenticated attack surface and admin-session-hijacking potential make this a meaningful priority for WordPress operators running this plugin.
Arbitrary file read in Thumbor prior to 7.8.0 allows unauthenticated remote attackers to read any file accessible to the thumbor process by supplying percent-encoded path traversal sequences via the watermark or frame filter parameters. The root cause is a decode-after-check flaw in file_loader: the security boundary check runs on the raw encoded path (%2e%2e is treated as a literal directory name and passes the abspath/startswith guard), then unquote() is called afterward, converting %2e%2e into real .. segments that the OS then resolves outside FILE_LOADER_ROOT_PATH. A public proof-of-concept exploit is included in the GitHub Security Advisory (GHSA-cj54-hpcc-gj6h); no active exploitation has been confirmed by CISA KEV at time of analysis.
Server-side request forgery bypass in the dssrf npm SSRF-protection library (versions <= 1.0.4) allows internal resource access when Node.js is configured with an external DNS resolver such as 1.1.1.1. The is_url_safe() function relies solely on dns.resolve4 and dns.resolve6 to check whether a hostname resolves to an internal IP; when an external resolver returns NXDOMAIN for 'localhost' (which it cannot authoritatively answer), no addresses are returned and no fallback to dns.lookup occurs, causing the library to incorrectly classify localhost as safe. publicly available exploit code exists, demonstrated via a published proof-of-concept in the GitHub advisory GHSA-5846-7qm3-r52j.
SQL injection in the Kirki WordPress plugin before version 6.0.13 enables unauthenticated remote attackers to read arbitrary data from the underlying WordPress database by injecting malicious SQL through an unsanitized request parameter. The CVSS vector scores this 8.6 with a scope change reflecting potential access to the database tier beyond the web application boundary, with high confidentiality impact but no integrity or availability impact - consistent with a read-only injection primitive. A public proof-of-concept exploit exists per WPScan, though the EPSS score of 0.18% (7th percentile) indicates low observed exploitation probability relative to the theoretical severity, and the vulnerability has not been added to the CISA KEV catalog.
Server-side request forgery in Thumbor prior to 7.8.0 allows unauthenticated remote attackers to bypass the ALLOWED_SOURCES hostname allowlist - the service's primary SSRF defense - and cause Thumbor to fetch images from arbitrary hosts, including internal network resources. The bypass exploits Python's regex engine treating unescaped dots as wildcards: an allowlist entry of 's.glbimg.com' silently matches attacker-controlled hostnames like 'sXglbimgYcom'. Because ALLOW_UNSAFE_URL defaults to True and all official documentation examples use plain-string patterns, the preconditions for exploitation match the default deployment profile. No public KEV listing, but a vendor-confirmed proof-of-concept is embedded in GitHub security advisory GHSA-6x26-6r6f-m537.
Server crash in LightFTP 2.3.1 is remotely triggerable by unauthenticated attackers exploiting a TOCTOU race condition in the ABRT cleanup path, enabling denial-of-service without credentials. The flaw arises because WorkerThreadId is re-checked outside the MTLock mutex between worker_thread_cleanup() and pthread_join(), allowing a racing new connection to cause pthread_join() to operate on an invalid thread ID. No active exploitation is confirmed (not in CISA KEV), though a related case study for CVE-2024-11144 - a prior incomplete fix of this same flaw - exists in the zeroscience/tuktam repository.
Two-factor authentication is completely bypassable in the miniOrange 2FA WordPress plugin before version 6.2.6, enabling an attacker who already holds a victim's password to authenticate as that user - including site administrators - by supplying a self-referential OTP value the plugin incorrectly validates against an attacker-controlled parameter rather than the user's stored secret. All WordPress installations running the affected plugin versions are exposed to full account takeover with no prior plugin privileges required. A publicly available proof-of-concept exists per WPScan; however, EPSS probability stands at 0.19% (9th percentile) and SSVC exploitation status is classified as 'none,' indicating no confirmed mass exploitation at time of analysis.
SQL injection in the Product Feed Manager For WooCommerce WordPress plugin (versions prior to 7.6.1) allows authenticated users holding a Contributor role or higher to execute arbitrary SQL statements against the WordPress database by crafting malicious product-feed custom filter rules. High CVSS impact metrics (C:H, I:H) reflect the potential for full database read and write access, including extraction of user credentials, WooCommerce order records, and site configuration data. A publicly available exploit exists per WPScan, though the EPSS score of 0.16% (5th percentile) suggests active mass exploitation has not materialized; the vulnerability is not listed in CISA KEV at time of analysis.
Privilege escalation to WordPress administrator in Ultimate Member plugin before 2.12.1 permits unauthenticated registrants to self-assign a site-defined role carrying full administrator capabilities, resulting in complete site takeover. The plugin omits administrator-level roles from its registration form role-filter and ships with its post-registration elevation safeguard disabled by default, creating a two-layered failure that exposes affected sites when a custom admin-capable role exists alongside a role-selection field on a live registration form. A publicly available proof-of-concept is confirmed via WPScan; no public exploit identified at time of analysis as actively exploited (not in CISA KEV), and EPSS sits at 0.14%, reflecting the dependency on specific site configuration.
Path traversal file write in the CodeIgniter4 PHP framework prior to 4.7.4 lets remote unauthenticated attackers place uploaded files outside the intended directory whenever an application calls UploadedFile::move() without an explicit second (name) argument. Because the default used the raw client-supplied filename, traversal sequences such as '../../public/shell.php' could drop attacker-controlled content into web-accessible or sensitive locations, potentially enabling code execution on affected sites. No public exploit identified at time of analysis, though the fixing commit ships a regression test that concretely demonstrates the traversal payload.
Remote denial of service in Thumbor's convolution filter (versions <= 7.7.7) allows an attacker to crash the Thumbor worker process with a single crafted HTTP request by passing columns=0 to the filters:convolution() URL parameter. The Python-layer input validation accepts zero via an overly permissive regex (PositiveNumber matches '0'), which propagates to a C extension that performs integer division by zero, triggering SIGFPE and killing the process on x86_64 Linux and macOS Intel. No public exploit identified at time of analysis per KEV, but a fully functional proof-of-concept is documented in the vendor's own GHSA advisory, making exploitation trivially reproducible.
Remote denial of service in Thumbor (pip/thumbor <= 7.7.7) is triggered by passing an unbounded value to the built-in `filters:proportion()` image filter, causing the server to allocate extreme CPU and memory resources during resize operations. The filter executes in the POST_TRANSFORM phase - after request-level MAX_WIDTH/MAX_HEIGHT clamping has already run - making those server-side size guards ineffective as a compensating control. Publicly available exploit code (PoC) exists per the GitHub Security Advisory GHSA-phj3-59pf-cp83; the vulnerability is not currently listed in the CISA KEV catalog.
Denial of service in Thumbor's convolution image filter allows unauthenticated remote attackers to exhaust server processing capacity by submitting a crafted URL. Versions 7.7.7 and earlier contain a regular expression in the convolution filter parser whose subpattern `(A;)*A` causes Python's `re` module to exhibit exponential-time backtracking when the input is malformed (e.g., missing the required trailing column count). A public proof-of-concept is included in the GitHub Security Advisory, and no special configuration is required to trigger the flaw against a default Thumbor deployment. No CISA KEV listing exists at time of analysis, but the trivial exploitation path and public PoC make this a real priority for network-exposed instances.
Remote code execution in REDAXO CMS versions 5.18.2 through 5.21.0 is reachable by authenticated backend users with media upload permissions via a multi-segment filename bypass (e.g., shell.php.any.jpg) that defeats the extension blocklist in rex_mediapool::isAllowedExtension. The flaw is a confirmed regression introduced in PR #6213 (February 2025), which replaced a historically correct str_contains guard with weaker str_ends_with logic, reintroducing a double-extension attack class that the codebase had explicitly defended against since 2018. Exploitation additionally requires the target server to run a multi-extension PHP handler (Apache mod_mime AddHandler or unanchored FilesMatch); no public exploit or CISA KEV listing has been identified at time of analysis, and the vendor-released fix is available in version 5.21.1.
PHP Object Injection in the Kirki WordPress plugin before 6.0.13 enables a two-stage attack where unauthenticated users store malicious serialized PHP objects, which are then deserialized when an administrator reviews the stored data in the WordPress admin panel. With a suitable gadget chain present on the site - from another installed plugin or an outdated WordPress core - this can escalate to full remote code execution on the hosting server. A publicly available proof-of-concept exists per WPScan, though EPSS remains low (0.22%, 13th percentile) and CISA has not listed this in KEV, suggesting no confirmed widespread in-the-wild exploitation at time of analysis.
Security filter bypass in fast-uri (before versions 4.1.2, 3.1.5, and 2.4.4) enables unauthenticated remote attackers to circumvent host-based access controls - including SSRF filters, allowlists, and redirect validators - by submitting URLs that use backslash-based authority introducers. The parser inconsistency between fast-uri and Node.js's native WHATWG URL handler causes the same crafted URL to resolve to different hosts in each parser, allowing attackers to steer downstream requests to unintended destinations. No public exploit is identified at time of analysis and this CVE does not appear in CISA KEV, though the CVSS 7.5 High rating with AV:N/AC:L/PR:N/UI:N reflects straightforward remote exploitability wherever the vulnerable application pattern exists.
GiveWP WordPress plugin before 4.16.3 exposes sensitive donor privacy data through an unauthenticated REST API endpoint that returns recurring-donation records without access controls. Any unauthenticated remote party can enumerate donor names and subscription details for donors who explicitly chose to give anonymously, directly violating donor privacy expectations. A publicly available exploit exists per WPScan reporting, though EPSS sits at the 5th percentile, suggesting limited opportunistic exploitation at time of analysis. No active exploitation is confirmed via CISA KEV.
Sensitive information disclosure in the Demi WordPress plugin before 0.0.7 lets unauthenticated attackers retrieve full-site backup archives that the plugin writes to a publicly reachable path under a predictable filename with no access control. Because these archives contain the complete site database - including WordPress user password hashes - an attacker can crack or replay credentials to escalate toward administrative takeover. A public exploit exists (WPScan) and a fixed release (0.0.7) is available; EPSS was not supplied but the CVSS is 7.5 (High) and it is not on CISA KEV.
Unauthenticated information disclosure in the Geeky Bot WordPress plugin (all versions before 1.2.8) permits any remote, unauthenticated user to retrieve chat-history session metadata - including WordPress usernames, user IDs, and timestamps - by invoking an unprotected AJAX endpoint. Reported by WPScan with a publicly available proof-of-concept, this flaw provides attackers with a ready-made user enumeration primitive against any publicly reachable WordPress site running the affected plugin. CISA KEV listing is absent and EPSS sits at 0.14% (4th percentile), indicating limited current mass-exploitation, but the POC lowers the barrier for targeted attacks significantly.
Unauthenticated file upload and arbitrary ticket attachment in JS Help Desk WordPress plugin (all versions before 3.1.4) stems from a complete absence of authorization, nonce validation, and ownership checks on the plugin's front-end request dispatcher. Any unauthenticated remote attacker can upload files - constrained to the plugin's inert allowed extensions - and attach those files to any user's support ticket without possessing an account. A publicly available proof-of-concept exists per WPScan reporting; however, EPSS remains very low (0.14%, 4th percentile) and the vulnerability is not listed in CISA KEV, indicating limited observed exploitation despite POC availability.
Payment verification bypass in the FlxWoo WordPress plugin before 3.1.1 allows unauthenticated attackers to complete WooCommerce orders without paying, because the plugin marks orders as paid without confirming the checkout session was actually settled with the payment processor. Publicly available exploit code exists, and a vendor patch is released; no active exploitation is confirmed in CISA KEV. The flaw enables fraudulent free acquisition of goods or services from any store running the plugin.
Prototype pollution in @phun-ky/defaults-deep prior to version 2.0.5 allows remote unauthenticated attackers to write arbitrary properties to Object.prototype by supplying crafted objects containing keys such as __proto__, constructor, or prototype to the defaultsDeep() function. The root cause is that the library performed recursive object merging without filtering these special property names, enabling full process-wide prototype chain manipulation. No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack class is well-understood and exploitation is straightforward wherever untrusted input reaches the affected function.
Remote code execution in the ElementsKit Elementor Addons WordPress plugin before 3.10.01 allows an authenticated administrator to inject arbitrary PHP code into server-side execution by crafting a malicious custom widget definition. The plugin writes this definition verbatim into a generated PHP file and subsequently executes it without sanitization. The critical escalation scenario occurs on WordPress multisite networks, where a subsite Administrator - ordinarily barred from file or code editing - can exploit this flaw to achieve host-level code execution, bypassing the privilege boundaries the network enforces. A publicly available exploit exists; no confirmed active exploitation (CISA KEV) at time of analysis.
Hard-coded credential exposure in Andritz HIPASE-250 (formerly 250 SCALA) engineering workstations lets an adjacent-network attacker log in over VNC using a fixed x11vnc password baked into the provisioning script. Because every workstation provisioned with that script shares the identical credential, one leaked or reverse-engineered password unlocks remote graphical control of all affected units across a site. Rated CVSS 8.1; no public exploit identified at time of analysis and not listed in CISA KEV.
Information disclosure in ANDRITZ HIPASE-250 (formerly 250 SCALA) lets any unauthenticated attacker with network reachability query the device's data and configuration endpoint, exposing live process values and full server configuration. The flaw stems from the default configuration shipping with no authentication and permissive CORS on every response, so no credentials or user interaction are required. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Sensitive credential exposure in ANDRITZ HIPASE-250 (formerly 250 SCALA) stems from storing and transmitting user passwords in a reversible format rather than as one-way hashes, letting anyone who can read the credential store or sniff network traffic recover every stored password in cleartext. The flaw affects the HIPASE-250 protection, control and monitoring platform and carries a CVSS 7.5 (confidentiality-only) rating. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; recovered credentials could enable follow-on authenticated access to the device or connected OT systems.
Arbitrary file upload in the Realtyna Organic IDX (WPL Real Estate) plugin for WordPress affects all versions up to and including 5.3.0, allowing authenticated attackers with subscriber-level access to write attacker-controlled files to the server and potentially achieve remote code execution. The flaw chains missing extension/content validation in saveLiveImages() with a weak authorization check on the get_keys() AJAX handler and a missing authentication check on the REST API import endpoint. Reported by Wordfence and scored CVSS 8.8; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Cross-site request forgery in the PrestaShop totadministrativemandate module (versions prior to 1.8.1) enables unauthorized order confirmation by exploiting a payment validation controller with no CSRF token. An attacker who induces an authenticated store administrator to follow a crafted link can silently trigger order-status changes - confirming awaiting-payment orders without receipt of funds. No public exploit code or active exploitation has been identified; the 0.14% EPSS score (4th percentile) reflects negligible observed exploitation activity.
SQL injection in pgAdmin 4 through an incomplete remediation of CVE-2026-12044 allows a low-privileged authenticated user to execute arbitrary SQL in a higher-privileged victim's database session. By creating a PostgreSQL object - table, index, publication, or subscription - with an apostrophe in its name (a character PostgreSQL legally permits in quoted identifiers), the attacker plants a payload that fires the moment any other pgAdmin user opens the object's Statistics or Dependencies tab, triggering raw Jinja2 template interpolation in coll_stats.sql, dependencies.sql, and get_position.sql without the qtLiteral escaping applied by the prior fix. The cross-user injection escalates impact well beyond the attacker's own database privileges, with the injected SQL executing under the victim's session credentials. No public exploit has been identified at time of analysis, and this CVE has not been added to the CISA KEV catalog.
Path traversal and query parameter injection in hashi-vault-js (npm, versions ≤ 0.5.1) allow an attacker who can influence identifiers passed to the library to redirect Vault API requests to arbitrary endpoints - including administrative paths such as `/v1/sys/seal` - or inject unauthorized query parameters, all executed under the permissions of the application's configured Vault token. The vulnerability arises because `Vault.js` contains zero calls to `encodeURIComponent()`, concatenating every caller-supplied identifier directly into HTTP URL strings. Two attack vectors are dynamically confirmed in the GHSA advisory: path traversal via `../../sys/seal` as a secret name, and query injection via `1&list=true` as a version value. No public standalone exploit tool has been identified and this CVE is not listed in the CISA KEV catalog.
OS command injection in the VPN module of TP-Link Archer AXE75 V1 routers allows an adjacent, authenticated attacker with administrator-level access to achieve full device compromise by importing a specially crafted VPN client configuration file. Improper filtering of special characters (CWE-78) in configuration input permits injection of arbitrary OS commands, granting an attacker complete control over the device including configuration integrity, network routing, and service availability. No public exploit identified at time of analysis; vendor-released patch is available.
SQL injection in PHP Jabbers PHP Poll Script (versions prior to 4.1) allows an authenticated attacker with administrative access to inject arbitrary SQL through the pjAdminPolls.controller.php endpoint, where user-supplied input is not properly neutralized before being used in database queries. Successful exploitation can expose or modify poll and backend database contents (CVSS 4.0 base 8.6, high confidentiality/integrity impact). There is no public exploit identified at time of analysis and no active-exploitation (KEV) listing; the fix landed in version 4.1.
SQL injection in multiple PHP Jabbers PHP scripts allows an authenticated user to inject arbitrary SQL through the sorting parameters, enabling database read and modification. Reported by CERT Polska (cert.pl) and classified as CWE-89, it carries a CVSS 4.0 base score of 8.6; no public exploit identified at time of analysis and it is not listed in CISA KEV. The vendor states the issue is fixed in updated versions listed in the (not-provided) affected-products list, so patched builds exist but exact fix versions are not confirmed in the supplied data.
DNS rebinding defeats `nltk.pathsec.urlopen()`'s SSRF filter in NLTK 3.9.4 and earlier, allowing unauthenticated remote attackers to reach loopback addresses, private networks, and cloud instance metadata endpoints - even with `ENFORCE = True` - and receive full, non-blind HTTP responses. The root cause is a TOCTOU gap: validation resolves the hostname once, but `urllib` independently re-resolves it at connect time via a separate `getaddrinfo` call, connecting to whatever the attacker's TTL-0 rebinding record returns on the second lookup. A working proof-of-concept is publicly available in the GHSA advisory, and the `lru_cache` annotation on `_resolve_hostname` creates a false assurance that rebinding is already mitigated, meaning operators who adopted this boundary believe themselves protected when they are not.
Deploy-time policy bypass in Red Hat Advanced Cluster Security for Kubernetes 4 lets a user with Kubernetes Deployment-create permission spoof workload identity by setting the openshift.io/encoded-deployment-config label to "null", forcing ACS to record the workload with empty UID, name and labels and a "default" namespace. This evades ACS deploy-time policy detection and enforcement visibility and corrupts Central's persistence, violation reporting and compliance correlation. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Heap memory disclosure in Coturn 4.5.2-4.14.0 allows an unauthenticated remote attacker to extract up to ~870 bytes of adjacent process heap per request by sending a single HTTP GET to the ACME redirect plaintext TCP listener. The leaked memory originates from recycled, unzeroed network receive buffers and on busy relay servers can contain TURN credentials, OAuth tokens, or relayed session payloads from concurrent clients. Exploitation is trivially automatable against the affected configuration; no public exploit identified at time of analysis beyond the proof-of-concept test case shipped with the advisory.
mTLS authentication bypass in aap-gateway, the gateway component of Red Hat Ansible Automation Platform's Event-Driven Ansible (EDA), permits unauthenticated remote attackers to inject arbitrary events into automation workflows. The bypass exploits event stream URL manipulation and HTTP Subject header forgery; the attack surface is further reduced by the component's inadvertent disclosure of the expected TLS certificate subject in error responses (CWE-295). No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and CVSS 8.2 score make this a credible priority for organizations running EDA-integrated automation pipelines.
Stored cross-site scripting in ComfyUI (Comfy-Org) before 0.28.0 lets an attacker upload HTML or SVG to the per-user userdata store via POST /userdata and have it served with an executable content type by GET /userdata/{file}, so a script runs in the ComfyUI origin the moment a victim opens the file URL. Because it executes same-origin, the payload can read browser-stored API tokens, settings, and workflows and issue authenticated-equivalent API calls. Rated CVSS 8.2 (High); no public exploit identified at time of analysis and it is not in CISA KEV.
Stored cross-site scripting in ComfyUI before 0.28.0 lets an attacker upload a malicious SVG that the /view endpoint serves inline in the application origin, executing arbitrary JavaScript in the browser of any user who opens it. Because image/svg+xml and related XML content types were missing from the dangerous-content-type list, uploaded markup rendered instead of downloading; a victim viewing the file triggers script that runs with full access to the ComfyUI session. No public exploit was identified at time of analysis and it is not listed in CISA KEV, but the fix commit and released version 0.28.0 are confirmed by the vendor advisory.
HMAC-SHA1 URL signature bypass in Thumbor (pip/thumbor ≤ 7.7.7) allows unauthenticated remote attackers to defeat the signed URL security mechanism by injecting duplicate signature strings into the request path. Python's global `str.replace()` removes all occurrences of the signature during pre-validation stripping, causing the validated URL to differ from the actual requested resource. No public exploit code is identified at time of analysis, though the detailed disclosure and fix commit make independent exploitation straightforward; this is not listed in CISA KEV.
Path traversal bypass in Apache Kyuubi 1.6.0-1.11.x allows any authenticated client accessing the server via Kyuubi frontend protocols to circumvent the server-side `kyuubi.session.local.dir.allowlist` security control by supplying unprefixed Spark configuration aliases. This represents an incomplete remediation of CVE-2025-66518, meaning the original attack surface was known and partially disclosed before this variant was identified. With CVSS 8.1 (C:H, I:H), exploitation could allow reading or writing arbitrary files accessible to the Kyuubi service account. No public exploit or CISA KEV listing has been identified at time of analysis.
Code injection in the Savon Ruby SOAP client (rubygems/savon versions 0.9.8 through 2.17.1) enables arbitrary Ruby code execution in the application process when `Savon::Model.all_operations` is called with an attacker-controlled WSDL document. WSDL operation names are interpolated directly into Ruby source strings passed to `module_eval`, allowing an attacker who serves or intercepts a malicious WSDL to escape the generated method definition and execute arbitrary code. No public exploit identified at time of analysis, though a proof-of-concept was confirmed during responsible disclosure; vendor patch was released as version 2.17.2.
Authorization bypass in Google mcp-toolbox v1.3.0 and v1.4.0 lets an unauthenticated remote attacker invoke tools that were meant to be protected by the scopeRequired MCP-auth feature by routing tool-invocation requests through the legacy direct HTTP API endpoints, which do not honor those scope checks. Exploitation requires the server to be started with the --enable-api flag alongside scope-protected tools. There is no public exploit identified at time of analysis (CVSS 4.0 exploit maturity is Unproven), but the flaw carries high confidentiality, integrity, and availability impact because the exposed tools can act on backend data sources.
Token exchange in Keycloak bypasses Google Workspace domain allowlist restrictions, enabling any valid Google account holder - regardless of their domain - to swap a Google OAuth token for a Keycloak realm token and gain unauthorized access. Affected deployments are those specifically configured to restrict Google-based logins to approved Workspace domains while also having token exchange enabled; both conditions must be present. No public exploit code has been identified at time of analysis, and EPSS sits at 0.20% (10th percentile), consistent with SSVC's exploitation status of 'none', though SSVC rates technical impact as 'total' given that successful exploitation delivers full realm access.
Tenant-restriction bypass in Keycloak's Microsoft identity provider integration allows attackers holding any valid Microsoft OAuth token - even from a completely unrelated Azure AD organization - to authenticate into a Keycloak realm via the token exchange feature. Affected deployments include Red Hat Build of Keycloak, Red Hat Single Sign-On 7, and Red Hat JBoss EAP Expansion Pack. With CVSS PR:L reflecting the need for a valid Microsoft credential (trivially obtained by registering a free Azure tenant), successful exploitation grants high confidentiality and integrity impact within the realm. No public exploit or active exploitation has been identified at time of analysis; EPSS sits at 0.19% (9th percentile), consistent with SSVC exploitation=none.
Authentication bypass via OAuth audience confusion in Google mcp-toolbox 1.4.0 lets any holder of a valid Google OAuth access token reach protected tools and backend data. The flaw triggers when a Google authService is configured with mcpEnabled: true but no audience or clientId, causing the opaque-token path in ValidateMCPAuth to skip audience validation, so tokens minted for entirely unrelated Google ecosystem apps are accepted. Reported by Google itself; no public exploit identified at time of analysis and the CVSS 4.0 vector carries E:U (exploit unproven).
Server-Side Request Forgery in Google mcp-toolbox versions 0.3.0 through 1.4.0 lets remote attackers coerce the toolbox into making unauthorized requests to internal or arbitrary endpoints by supplying a crafted path parameter that triggers an open redirect or destination swap on the backend. Because the HTTP client in internal/sources/http/http.go was initialized without a CheckRedirect policy or target-IP validation, baseline parameter sanitization is bypassed once the server follows the redirect. There is no public exploit identified at time of analysis (CVSS 4.0 carries E:U, Exploit Unproven), and the flaw is notably reachable via malicious data-driven LLM prompts, not just direct attacker input.
Local privilege escalation to root via argument injection in the APT backend of yggdrasil-worker-package-manager, the Red Hat Insights remote package-management worker shipped with Red Hat Enterprise Linux 10. Because package names are passed directly to apt-get without an argument terminator, a name beginning with a hyphen is parsed as a command-line option rather than a package, letting an attacker who can influence the package list achieve root-level remote code execution. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but an upstream source fix is already merged and released in versions 0.1.4 and 0.2.4.
Arbitrary code execution in Adobe Premiere Pro stems from an out-of-bounds write (CWE-787) triggered when processing a specially crafted media or project file, running code in the context of the logged-in user. The attack is file-based and local, requiring an adversary to socially engineer a victim - a realistic threat vector for creative professionals who routinely receive media files from external sources. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis, but the high CVSS impact metrics (C:H/I:H/A:H) indicate full user-level compromise upon successful exploitation.
Command injection in pgAdmin 4's MASTER_PASSWORD_HOOK feature exposes the pgAdmin service account to arbitrary OS command execution by any authenticated user whose identity originates from an external auth source (OAuth/OIDC, Kerberos, webserver headers). Affected deployments span versions 7.2 through 9.16, but only those with the hook configured to use the `%u` substitution token alongside an external IdP where usernames can be attacker-influenced. No public exploit code or CISA KEV listing exists at time of analysis; however, the commit diff publicly discloses the exact vulnerable code path, significantly lowering the barrier to independent exploit development.