Authentication bypass in libiec61850 v1.6's GOOSE receiver (parseGoosePayload() in goose_receiver.c) lets an attacker on the substation network replay a captured GOOSE frame to be accepted as authentic, defeating the intended message authentication. The library implements IEC 61850 protocols used in electrical-grid protection and automation, so spoofed GOOSE traffic can drive false relay/breaker actions. Publicly available exploit code exists (PoC repo and SSVC-rated PoC), but there is no CISA KEV listing and EPSS is low at 0.26%, indicating no confirmed widespread exploitation.
SQL injection in SourceCodester Modern Loan Management System 1.0 allows remote attackers to inject arbitrary SQL through the district_id, division_id, region_id, and ward_id parameters of ajaxData.php. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, exploitation requires no authentication or user interaction and yields total compromise of the backend database (confidentiality, integrity, and availability all High). Publicly available exploit code exists (documented in the TaintRadar research repository), though EPSS remains low at 0.16% and the flaw is not on the CISA KEV list.
SQL injection in SourceCodester Modern Loan Management System 1.0 lets attackers manipulate the database via the unsanitized 'id' parameter of /admin/delete_group.php. The flaw carries a CVSS 9.8 and CISA SSVC rates technical impact as total and automatable, but EPSS is only 0.16% (5th percentile) and status is publicly available exploit code exists (POC), not active exploitation. A TaintRadar proof-of-concept is published, making trivial exploitation likely against any exposed instance.
Command injection in Advantech ADAM-3600 EdgeLink RTU controllers (versions prior to 2.8.5.1) lets remote attackers execute arbitrary operating-system commands by abusing the firmware upgrade file verification routine. The device fails to sanitize input consumed while validating an uploaded firmware image, so crafted content is passed to a shell context. No public exploit identified at time of analysis, and the EPSS score is low (0.14%), but the CVSS 9.8 rating and the device's role as an industrial edge controller make this a high-value target.
Credential and cryptographic-key exposure in the VPS.org one-click Zulip deployment template ships every instance with an identical hardcoded application signing key, a default database password of "zulip", and HTTPS disabled (DISABLE_HTTPS=True), allowing remote attackers who know the public template defaults to forge authenticated sessions, read Zulip's database, and intercept traffic. Any organization that provisioned Zulip through this VPS.org one-click image is affected until the secrets are rotated. There is no public exploit identified at time of analysis, and the EPSS score is low (0.13%, 3rd percentile), but SSVC rates technical impact as total and automatable, reflecting that the shared secrets are identical across all deployments.
Information disclosure in ANDRITZ HIPASE-250 (formerly 250 SCALA) lets any unauthenticated attacker with network reachability query the device's data and configuration endpoint, exposing live process values and full server configuration. The flaw stems from the default configuration shipping with no authentication and permissive CORS on every response, so no credentials or user interaction are required. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Sensitive credential exposure in ANDRITZ HIPASE-250 (formerly 250 SCALA) stems from storing and transmitting user passwords in a reversible format rather than as one-way hashes, letting anyone who can read the credential store or sniff network traffic recover every stored password in cleartext. The flaw affects the HIPASE-250 protection, control and monitoring platform and carries a CVSS 7.5 (confidentiality-only) rating. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; recovered credentials could enable follow-on authenticated access to the device or connected OT systems.
Privilege escalation to SQL root context in cPanel (and WP Squared) occurs when the database-rename operation fails to preserve the active SQL mode, permitting a low-privileged authenticated hosting user to have SQL executed with root-level database privileges (CWE-89). This carries a CVSS 4.0 base score of 9.4 with a scope change to subsequent systems, and no public exploit has been identified at time of analysis. It is fixed in the cPanel 138 release series per the vendor advisory.
SQL injection sandbox escape in pgAdmin 4's AI Assistant (versions 9.13 through 9.16) lets an attacker break out of the read-only transaction wrapper on the execute_sql_query tool and run arbitrary write or OS commands on the backend PostgreSQL server. The flaw is an incomplete fix for CVE-2026-12045: the sqlparse-based validator disagrees with PostgreSQL over backslash-before-quote string escaping, so a crafted SELECT parses as one statement to the guard but executes as four statements (including a smuggled COMMIT) on the database. Delivery is via indirect prompt injection, and detailed PoC payloads exist publicly in the vendor's regression tests; there is no public exploit identified as used in the wild and no KEV listing, with EPSS data not provided.
OS command injection in pgAdmin 4 (all versions before 9.18) lets an authenticated user with the commonly-granted tools_import_export_data permission run arbitrary commands on the pgAdmin server host. The Import/Export Data tool renders a user-supplied query into a psql \copy (...) command line; its hand-written parenthesis-balance validator (_is_query_parens_balanced) wrongly assumes standard_conforming_strings=off, treating a backslash-quote (\') as an escaped quote, so a payload like SELECT 'a\') TO PROGRAM 'echo pwned' x' passes validation while real psql (scs=on, the default on PostgreSQL 13-18) closes the string early and executes an attacker-chosen TO PROGRAM clause via popen(). No CISA KEV listing and no standalone public exploit, but the fix commit's regression test discloses a fully working RCE payload; EPSS not provided.
Stored click-XSS in Jodit WYSIWYG editor (all versions through 4.12.30) allows a low-privileged content author to persist obfuscated `javascript:` hrefs that bypass the editor's sanitizer and execute attacker-controlled JavaScript in the victim's browser on click. The bypass exists because `sanitizeHTMLElement` uses a case-sensitive `href.trim().indexOf('javascript') === 0` check—without lowercasing or stripping control bytes—while every other URL attribute already routes through the stricter `isDangerousUrl()` normalizer. No public exploit is listed in CISA KEV, but a working proof-of-concept is confirmed in the GitHub Security Advisory (GHSA-j839-gqq4-gf9j) against the shipped 4.12.30 build.
Insecure Direct Object Reference (IDOR) in the wpForo Forum WordPress plugin before 3.1.2 allows any subscriber-level authenticated user to permanently delete the AI chat message history of arbitrary other users by submitting deletion requests without ownership verification. The plugin's AI chat message deletion endpoint does not validate that the targeted conversation belongs to the requesting user, enabling low-privilege account holders to cause irreversible data loss across the platform. A publicly available proof-of-concept exists per WPScan reporting; however, EPSS is extremely low at 0.13% (3rd percentile) and the vulnerability has not been added to the CISA KEV catalog, indicating limited observed exploitation.
Broken object-level authorization (IDOR) in the BuddyPress WordPress plugin, all versions before 14.5.0, permits any authenticated user at the Subscriber level or above to read, modify, or delete private messages belonging to other users via the plugin's messaging endpoints. A publicly available proof-of-concept exists per WPScan reporting, though EPSS data places exploitation probability at just 0.13% (3rd percentile) and SSVC classification marks it as not automatable, indicating exploitation is currently opportunistic and targeted rather than widespread. No CISA KEV listing is present, but the low privilege bar combined with network accessibility makes this a meaningful privacy and integrity risk on any community-facing or multi-tenant WordPress deployment running BuddyPress.
Remote code execution in ComfyUI v0.23.0 (and all prior 0.x releases) lets unauthenticated attackers run arbitrary Python by abandoning the LoadTrainingDataset node to torch.load a malicious pickle. Because the upload and prompt-queue endpoints require no authentication, an attacker who can reach the web interface can upload a crafted shard_*.pkl file and trigger deserialization to execute commands as the ComfyUI process user. VulnCheck reported the flaw and a vendor fix exists; there is no public exploit identified at time of analysis, though the technique (pickle __reduce__ abuse) is trivial to reproduce.
Arbitrary code execution in the Hugging Face sentence-transformers Python library allows attackers who control the contents of a model directory to run code even when the caller explicitly passes trust_remote_code=False. The import_module_class helper in sentence_transformers/util/misc.py short-circuits its trust gate with an 'or os.path.exists(model_name_or_path)' clause, so any local path that exists satisfies the check and triggers dynamic loading of custom Python (e.g. modeling_*.py referenced in modules.json) at model-load time. This is classic CWE-94 code injection with no public exploit identified at time of analysis; the vendor commit deprecates rather than removes the behavior, deferring the actual fix to v6.0.
Panic-triggered remote denial of service in pion/stun (Go STUN library) versions through 3.1.4 (v3), 2.0.0 (v2), and 1.23.1 (v1) allows an unauthenticated network attacker to crash any application embedding this library by sending a single malformed STUN or ICE Binding-response packet containing a zero-length XOR-MAPPED-ADDRESS attribute. The root cause is a misplaced bounds check in XORMappedAddress.GetFromAs that attempts to index into the value slice before validating minimum length, causing an unrecovered Go runtime panic that terminates the process. No public exploit identified at time of analysis, though the patch PR and test case publicly detail the exact malformed packet structure.
Stored and DOM cross-site scripting in the Jodit WYSIWYG editor (npm, all versions before 4.13.6) allows attacker-supplied JavaScript to survive the clean-html sanitizer by exploiting a case-sensitivity flaw in the deny/allow tag filter. SVG- and MathML-namespaced elements return lowercase nodeName values, while the denyTags hash is keyed by uppercase strings, so a `<script>` nested inside `<svg>` reports 'script' instead of 'SCRIPT' and passes the filter unblocked. A publicly disclosed proof-of-concept exists; the vulnerability is not listed in CISA KEV.
Cross-tenant credential theft in pgAdmin 4 (9.0 through 9.16) lets an authenticated non-owner user hijack another user's shared server connection by abusing the Workspaces adhoc-connect endpoint (/misc/workspace/adhoc_connect_server), which clones a target server row verbatim - including its owner's stored database password and tunnel password - and reassigns ownership to the caller. The victim is typically an administrator whose shared server carries saved credentials, and the attacker gains use of those database credentials and any privileges they confer. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the fix (pgAdmin 4 9.17) and the underlying commit are public, and EPSS was not provided.
SQL injection in PHP Jabbers Car Rental Script allows unauthenticated remote attackers to inject arbitrary SQL through sorting-related parameters that are not properly neutralized before use in database queries. The flaw (CWE-89) carries a CVSS 4.0 base score of 9.3 and enables reading or manipulating backend database contents; there is no public exploit identified at time of analysis, and it is fixed in version 4.1. Because sorting parameters are typically reachable on public-facing catalog/listing pages, exploitation requires no credentials or user interaction.
GiveWP WordPress donation plugin before version 4.16.3 allows unauthenticated users to route donations through payment gateways the administrator has explicitly disabled, by supplying a gateway identifier via request input that the plugin fails to validate against the admin-configured allowlist. Rooted in CWE-862 (Missing Authorization), this bypasses financial controls that site operators may have disabled for compliance, fraud prevention, or contractual reasons - making the practical business risk higher than the CVSS Medium score suggests. A publicly available proof-of-concept exists via WPScan; no confirmed active exploitation (CISA KEV) has been identified at time of analysis.
Unauthenticated data overwrite in the Events Made Easy WordPress plugin (all versions before 3.1.4) allows any remote, unauthenticated attacker to overwrite personal data stored in any person record by exploiting a missing authorization check on data-change endpoints. The plugin's nonce mechanism is public and shared, providing no per-record token or ownership binding, making it trivially bypassable under CWE-639. A publicly available exploit exists per WPScan research; no active exploitation has been confirmed in CISA KEV at time of analysis.
Exposure of a default-credentialed PostgreSQL database in the VPS.org one-click Supabase template allows remote attackers to connect directly to the database on 0.0.0.0:5432 using the well-known default password 'postgres', gaining full read/write access. The flaw stems from insecure default initialization combined with Docker's iptables rules overriding host UFW firewall policy, so operators who believe UFW protects the port are silently exposed. No public exploit has been identified at time of analysis, and EPSS is low (0.14%, 4th percentile), but SSVC rates the technical impact as total and exploitation as automatable.
Arbitrary file upload in the Realtyna Organic IDX (WPL Real Estate) plugin for WordPress affects all versions up to and including 5.3.0, allowing authenticated attackers with subscriber-level access to write attacker-controlled files to the server and potentially achieve remote code execution. The flaw chains missing extension/content validation in saveLiveImages() with a weak authorization check on the get_keys() AJAX handler and a missing authentication check on the REST API import endpoint. Reported by Wordfence and scored CVSS 8.8; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Post-login redirect validation in GeoNetwork's OAuth2/OIDC and Keycloak SSO authentication filters can be bypassed to redirect authenticated users to attacker-controlled external sites, enabling phishing attacks. Versions 3.12.0 through 4.2.15 and 4.4.0 through 4.4.10 are affected across both supported and archived release lines. The bypass exploits the filter's failure to reject protocol-relative URLs (e.g., //evil.example.com) that Java treats as relative paths but browsers resolve as absolute external destinations; no public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV.
Cross-site request forgery in the PrestaShop totadministrativemandate module (versions prior to 1.8.1) enables unauthorized order confirmation by exploiting a payment validation controller with no CSRF token. An attacker who induces an authenticated store administrator to follow a crafted link can silently trigger order-status changes - confirming awaiting-payment orders without receipt of funds. No public exploit code or active exploitation has been identified; the 0.14% EPSS score (4th percentile) reflects negligible observed exploitation activity.
HTTP security header spoofing in CodeIgniter4 prior to 4.7.4 allows remote unauthenticated attackers to trick the framework into treating plain HTTP requests as HTTPS by injecting forged X-Forwarded-Proto or Front-End-Https headers. The root cause is that IncomingRequest::isSecure() unconditionally trusted these headers from any source rather than restricting trust to configured trusted proxies, undermining isSecure(), force_https(), and forceGlobalSecureRequests enforcement logic. No public exploit or CISA KEV listing exists; real-world impact is conditioned on deployment topology and CVSS AC:H reflects this complexity.
SQL injection in pgAdmin 4 through an incomplete remediation of CVE-2026-12044 allows a low-privileged authenticated user to execute arbitrary SQL in a higher-privileged victim's database session. By creating a PostgreSQL object - table, index, publication, or subscription - with an apostrophe in its name (a character PostgreSQL legally permits in quoted identifiers), the attacker plants a payload that fires the moment any other pgAdmin user opens the object's Statistics or Dependencies tab, triggering raw Jinja2 template interpolation in coll_stats.sql, dependencies.sql, and get_position.sql without the qtLiteral escaping applied by the prior fix. The cross-user injection escalates impact well beyond the attacker's own database privileges, with the injected SQL executing under the victim's session credentials. No public exploit has been identified at time of analysis, and this CVE has not been added to the CISA KEV catalog.
Path traversal and query parameter injection in hashi-vault-js (npm, versions ≤ 0.5.1) allow an attacker who can influence identifiers passed to the library to redirect Vault API requests to arbitrary endpoints - including administrative paths such as `/v1/sys/seal` - or inject unauthorized query parameters, all executed under the permissions of the application's configured Vault token. The vulnerability arises because `Vault.js` contains zero calls to `encodeURIComponent()`, concatenating every caller-supplied identifier directly into HTTP URL strings. Two attack vectors are dynamically confirmed in the GHSA advisory: path traversal via `../../sys/seal` as a secret name, and query injection via `1&list=true` as a version value. No public standalone exploit tool has been identified and this CVE is not listed in the CISA KEV catalog.
OS command injection in the VPN module of TP-Link Archer AXE75 V1 routers allows an adjacent, authenticated attacker with administrator-level access to achieve full device compromise by importing a specially crafted VPN client configuration file. Improper filtering of special characters (CWE-78) in configuration input permits injection of arbitrary OS commands, granting an attacker complete control over the device including configuration integrity, network routing, and service availability. No public exploit identified at time of analysis; vendor-released patch is available.
SQL injection in PHP Jabbers PHP Poll Script (versions prior to 4.1) allows an authenticated attacker with administrative access to inject arbitrary SQL through the pjAdminPolls.controller.php endpoint, where user-supplied input is not properly neutralized before being used in database queries. Successful exploitation can expose or modify poll and backend database contents (CVSS 4.0 base 8.6, high confidentiality/integrity impact). There is no public exploit identified at time of analysis and no active-exploitation (KEV) listing; the fix landed in version 4.1.
SQL injection in multiple PHP Jabbers PHP scripts allows an authenticated user to inject arbitrary SQL through the sorting parameters, enabling database read and modification. Reported by CERT Polska (cert.pl) and classified as CWE-89, it carries a CVSS 4.0 base score of 8.6; no public exploit identified at time of analysis and it is not listed in CISA KEV. The vendor states the issue is fixed in updated versions listed in the (not-provided) affected-products list, so patched builds exist but exact fix versions are not confirmed in the supplied data.
DNS rebinding defeats `nltk.pathsec.urlopen()`'s SSRF filter in NLTK 3.9.4 and earlier, allowing unauthenticated remote attackers to reach loopback addresses, private networks, and cloud instance metadata endpoints - even with `ENFORCE = True` - and receive full, non-blind HTTP responses. The root cause is a TOCTOU gap: validation resolves the hostname once, but `urllib` independently re-resolves it at connect time via a separate `getaddrinfo` call, connecting to whatever the attacker's TTL-0 rebinding record returns on the second lookup. A working proof-of-concept is publicly available in the GHSA advisory, and the `lru_cache` annotation on `_resolve_hostname` creates a false assurance that rebinding is already mitigated, meaning operators who adopted this boundary believe themselves protected when they are not.
Deploy-time policy bypass in Red Hat Advanced Cluster Security for Kubernetes 4 lets a user with Kubernetes Deployment-create permission spoof workload identity by setting the openshift.io/encoded-deployment-config label to "null", forcing ACS to record the workload with empty UID, name and labels and a "default" namespace. This evades ACS deploy-time policy detection and enforcement visibility and corrupts Central's persistence, violation reporting and compliance correlation. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Broken Object Level Authorization in the Academy LMS WordPress plugin through 3.8.2 exposes every user's quiz attempt records - including IP addresses, full names, registration dates, and quiz results - to any authenticated subscriber-level user who is enrolled in at least one course. The flaw stems from missing ownership checks on quiz attempt record retrieval endpoints (CWE-639), enabling horizontal privilege escalation across the entire site's student population. A publicly available proof-of-concept exists per WPScan; exploitation probability remains low (EPSS 0.13%, 3rd percentile) with no confirmed active exploitation in CISA KEV.
Broken authorization in the JS Help Desk WordPress plugin (versions prior to 3.1.4) allows any authenticated user at Subscriber level or above to overwrite the content of any support-ticket reply site-wide, regardless of ownership. The plugin's reply-update endpoint fails to validate that the requesting user owns the targeted reply, enabling unauthorized content manipulation across all tickets. A publicly available proof-of-concept exploit exists; no active exploitation has been confirmed in CISA KEV at time of analysis.
Insecure Direct Object Reference in the Paid Membership Subscriptions WordPress plugin (before 3.0.7) allows any authenticated subscriber-level user to enumerate and retrieve payment records belonging to other members. The AJAX handler responsible for payment data retrieval performs neither a WordPress capability check nor a nonce validation, meaning horizontal privilege escalation requires only a valid low-privilege account on the target site. A publicly available proof-of-concept exists per WPScan, though no CISA KEV listing confirms active widespread exploitation at time of analysis.
Heap memory disclosure in Coturn 4.5.2-4.14.0 allows an unauthenticated remote attacker to extract up to ~870 bytes of adjacent process heap per request by sending a single HTTP GET to the ACME redirect plaintext TCP listener. The leaked memory originates from recycled, unzeroed network receive buffers and on busy relay servers can contain TURN credentials, OAuth tokens, or relayed session payloads from concurrent clients. Exploitation is trivially automatable against the affected configuration; no public exploit identified at time of analysis beyond the proof-of-concept test case shipped with the advisory.
mTLS authentication bypass in aap-gateway, the gateway component of Red Hat Ansible Automation Platform's Event-Driven Ansible (EDA), permits unauthenticated remote attackers to inject arbitrary events into automation workflows. The bypass exploits event stream URL manipulation and HTTP Subject header forgery; the attack surface is further reduced by the component's inadvertent disclosure of the expected TLS certificate subject in error responses (CWE-295). No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and CVSS 8.2 score make this a credible priority for organizations running EDA-integrated automation pipelines.
Stored cross-site scripting in ComfyUI (Comfy-Org) before 0.28.0 lets an attacker upload HTML or SVG to the per-user userdata store via POST /userdata and have it served with an executable content type by GET /userdata/{file}, so a script runs in the ComfyUI origin the moment a victim opens the file URL. Because it executes same-origin, the payload can read browser-stored API tokens, settings, and workflows and issue authenticated-equivalent API calls. Rated CVSS 8.2 (High); no public exploit identified at time of analysis and it is not in CISA KEV.
Stored cross-site scripting in ComfyUI before 0.28.0 lets an attacker upload a malicious SVG that the /view endpoint serves inline in the application origin, executing arbitrary JavaScript in the browser of any user who opens it. Because image/svg+xml and related XML content types were missing from the dangerous-content-type list, uploaded markup rendered instead of downloading; a victim viewing the file triggers script that runs with full access to the ComfyUI session. No public exploit was identified at time of analysis and it is not listed in CISA KEV, but the fix commit and released version 0.28.0 are confirmed by the vendor advisory.
HMAC-SHA1 URL signature bypass in Thumbor (pip/thumbor ≤ 7.7.7) allows unauthenticated remote attackers to defeat the signed URL security mechanism by injecting duplicate signature strings into the request path. Python's global `str.replace()` removes all occurrences of the signature during pre-validation stripping, causing the validated URL to differ from the actual requested resource. No public exploit code is identified at time of analysis, though the detailed disclosure and fix commit make independent exploitation straightforward; this is not listed in CISA KEV.
Path traversal bypass in Apache Kyuubi 1.6.0-1.11.x allows any authenticated client accessing the server via Kyuubi frontend protocols to circumvent the server-side `kyuubi.session.local.dir.allowlist` security control by supplying unprefixed Spark configuration aliases. This represents an incomplete remediation of CVE-2025-66518, meaning the original attack surface was known and partially disclosed before this variant was identified. With CVSS 8.1 (C:H, I:H), exploitation could allow reading or writing arbitrary files accessible to the Kyuubi service account. No public exploit or CISA KEV listing has been identified at time of analysis.
Code injection in the Savon Ruby SOAP client (rubygems/savon versions 0.9.8 through 2.17.1) enables arbitrary Ruby code execution in the application process when `Savon::Model.all_operations` is called with an attacker-controlled WSDL document. WSDL operation names are interpolated directly into Ruby source strings passed to `module_eval`, allowing an attacker who serves or intercepts a malicious WSDL to escape the generated method definition and execute arbitrary code. No public exploit identified at time of analysis, though a proof-of-concept was confirmed during responsible disclosure; vendor patch was released as version 2.17.2.
Authorization bypass in Google mcp-toolbox v1.3.0 and v1.4.0 lets an unauthenticated remote attacker invoke tools that were meant to be protected by the scopeRequired MCP-auth feature by routing tool-invocation requests through the legacy direct HTTP API endpoints, which do not honor those scope checks. Exploitation requires the server to be started with the --enable-api flag alongside scope-protected tools. There is no public exploit identified at time of analysis (CVSS 4.0 exploit maturity is Unproven), but the flaw carries high confidentiality, integrity, and availability impact because the exposed tools can act on backend data sources.
Token exchange in Keycloak bypasses Google Workspace domain allowlist restrictions, enabling any valid Google account holder - regardless of their domain - to swap a Google OAuth token for a Keycloak realm token and gain unauthorized access. Affected deployments are those specifically configured to restrict Google-based logins to approved Workspace domains while also having token exchange enabled; both conditions must be present. No public exploit code has been identified at time of analysis, and EPSS sits at 0.20% (10th percentile), consistent with SSVC's exploitation status of 'none', though SSVC rates technical impact as 'total' given that successful exploitation delivers full realm access.
Tenant-restriction bypass in Keycloak's Microsoft identity provider integration allows attackers holding any valid Microsoft OAuth token - even from a completely unrelated Azure AD organization - to authenticate into a Keycloak realm via the token exchange feature. Affected deployments include Red Hat Build of Keycloak, Red Hat Single Sign-On 7, and Red Hat JBoss EAP Expansion Pack. With CVSS PR:L reflecting the need for a valid Microsoft credential (trivially obtained by registering a free Azure tenant), successful exploitation grants high confidentiality and integrity impact within the realm. No public exploit or active exploitation has been identified at time of analysis; EPSS sits at 0.19% (9th percentile), consistent with SSVC exploitation=none.
Authentication bypass via OAuth audience confusion in Google mcp-toolbox 1.4.0 lets any holder of a valid Google OAuth access token reach protected tools and backend data. The flaw triggers when a Google authService is configured with mcpEnabled: true but no audience or clientId, causing the opaque-token path in ValidateMCPAuth to skip audience validation, so tokens minted for entirely unrelated Google ecosystem apps are accepted. Reported by Google itself; no public exploit identified at time of analysis and the CVSS 4.0 vector carries E:U (exploit unproven).
Server-Side Request Forgery in Google mcp-toolbox versions 0.3.0 through 1.4.0 lets remote attackers coerce the toolbox into making unauthorized requests to internal or arbitrary endpoints by supplying a crafted path parameter that triggers an open redirect or destination swap on the backend. Because the HTTP client in internal/sources/http/http.go was initialized without a CheckRedirect policy or target-IP validation, baseline parameter sanitization is bypassed once the server follows the redirect. There is no public exploit identified at time of analysis (CVSS 4.0 carries E:U, Exploit Unproven), and the flaw is notably reachable via malicious data-driven LLM prompts, not just direct attacker input.
Local privilege escalation to root via argument injection in the APT backend of yggdrasil-worker-package-manager, the Red Hat Insights remote package-management worker shipped with Red Hat Enterprise Linux 10. Because package names are passed directly to apt-get without an argument terminator, a name beginning with a hyphen is parsed as a command-line option rather than a package, letting an attacker who can influence the package list achieve root-level remote code execution. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but an upstream source fix is already merged and released in versions 0.1.4 and 0.2.4.
Arbitrary code execution in Adobe Premiere Pro stems from an out-of-bounds write (CWE-787) triggered when processing a specially crafted media or project file, running code in the context of the logged-in user. The attack is file-based and local, requiring an adversary to socially engineer a victim - a realistic threat vector for creative professionals who routinely receive media files from external sources. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis, but the high CVSS impact metrics (C:H/I:H/A:H) indicate full user-level compromise upon successful exploitation.