Prompt injection in Amazon Strands Agents Tools before 0.8.0 enables remote actors to execute arbitrary OS commands on the agent's host by crafting input that sets the shell tool's `non_interactive` parameter to `true`, silencing the human consent gate designed to require approval before running shell commands. The CVSS 4.0 vector (AV:N/PR:N) confirms no attacker authentication is required, though the agent must actively process the malicious prompt (UI:A) and the shell tool must be in use (AT:P). No public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based out-of-bounds write in the Zephyr RTOS hawkBit OTA update client (versions 2.4.0 through <4.5.0) allows a malicious or compromised hawkBit update server to corrupt device heap memory by sending a crafted HTTP response body. The off-by-one flaw in response_json_cb() allocates exactly the response body length with no room for the NUL terminator, writing one byte past the heap object and corrupting adjacent allocator metadata. No public exploit identified at time of analysis, but the SSVC framework rates this as automatable and the trigger is deterministic in Zephyr v4.0.0 and later for any response body exceeding 1100 bytes - a size normal for hawkBit deployment metadata.
Out-of-bounds read in MediaTek modem firmware across 19 chipsets enables remote denial of service when a User Equipment (UE) is connected to an attacker-controlled rogue base station. The flaw stems from a missing bounds check (CWE-125) in modem protocol processing, crashing or disrupting the modem without requiring any user interaction or device-side privileges. No active exploitation is confirmed (no CISA KEV listing), and EPSS probability is very low at 0.21% (11th percentile), consistent with SSVC's 'exploitation: none' status - though the attack is classified as automatable once rogue infrastructure is in place.
Signature verification bypass in XML::Sig (Perl) versions 0.29 through 0.71 allows remote unauthenticated attackers to submit arbitrary XML documents that are accepted as cryptographically valid without any digest or key check ever running. The verify() function unconditionally returns true after looping over all dsig:Signature elements, even when every iteration exited early via a skip path before cryptographic validation. No public exploit has been identified beyond the proof-of-concept test case embedded in the fix commit, and this vulnerability is not currently listed in the CISA KEV catalog.
SAML authentication bypass in Net::SAML2 versions before 0.86 for Perl allows remote unauthenticated attackers to forge arbitrary SAML assertions against service providers that omit a trust anchor during library configuration. The flaw is in verify_xml, which exits early after validating the XML signature against the certificate embedded within the response itself - meaning an attacker who controls the response can supply their own self-signed certificate and sign any assertion they choose. No public exploit is identified at time of analysis, but the vulnerability is mechanically trivial to reproduce given that the vulnerable code path is fully documented in referenced MetaCPAN source files.
Remote denial of service in NASA Core Flight System (cFS) v7.0.1 allows unauthenticated network attackers to crash the Software Bus Network (SBN) application by sending a crafted peer subscription packet that triggers a parser boundary flaw. The CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U vector confirms no authentication or user interaction is required, making this trivially reachable against any exposed SBN interface. Despite the high CVSS score of 7.5, the EPSS score of 0.16% at the 5th percentile and absence of a CISA KEV listing or public exploit code suggest no public exploitation activity at time of analysis.
Forced processor reset in NASA Core Flight System (cFS) v7.0.1 is achievable by supplying a crafted entry to the HS.AppMon_Tbl, exploited through the HS_MonitorApplications() function in the Health and Safety application module. The vulnerability targets embedded real-time flight software used in spacecraft, where an unplanned processor reset can have mission-critical consequences. A proof-of-concept exists per SSVC data, exploitation is rated automatable, and the EPSS score of 0.14% (4th percentile) suggests no widespread opportunistic scanning - consistent with narrow, targeted exploitation in aerospace operational contexts. No active CISA KEV listing has been confirmed.
Integer overflow in the Svc::FileDownlink::SendPartial component of NASA's fprime embedded flight software framework v4.2.2 allows unauthenticated remote attackers to crash the service via crafted input, resulting in a Denial of Service. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or special privileges are required, and a potential proof-of-concept is referenced at a public GitHub issue tracker. Despite the high CVSS score, EPSS sits at just 0.14% (4th percentile), and there is no CISA KEV listing, reflecting the niche aerospace deployment context of this framework.
Incorrect access control in NASA Core Flight System (cFS) v7.0.1 permits unauthenticated remote attackers to manipulate the telemetry subscription table by sending arbitrary TO_LAB (Telemetry Output Lab) add and remove subscription commands. Low-index subscriptions can be silently removed and new data streams injected, threatening the integrity of telemetry routing on ground-connected flight software deployments. No public exploit has been identified at time of analysis, and the EPSS score of 0.14% (4th percentile) indicates very low observed exploitation activity, though the complete absence of authentication on a command interface is a structurally severe design flaw.
Unauthenticated remote attackers can manipulate the CCSDS File Delivery Protocol (CFDP) metadata handler in NASA Core Flight System v7.0.1, specifically the CF_CFDP_RecvMd() function, to control the destination path where received file content is stored on the target system, resulting in high-impact information disclosure. A publicly available proof-of-concept exists per SSVC classification, making this exploitable without authentication or user interaction against any network-reachable cFS instance with the CF application enabled. Despite the availability of exploit code and network-accessible attack vector, the EPSS score of 0.14% (4th percentile) reflects the extremely limited real-world deployment footprint of this aerospace-domain platform.
Uncontrolled resource consumption in NASA's fprime framework v4.2.2 exposes the Ref::SignalGen component to remote denial-of-service attacks via unsanitized user-supplied parameters. The CVSS vector (AV:N/AC:L/PR:N/UI:N) reflects unauthenticated, low-complexity network exploitation - however, this risk must be contextualized: fprime is a niche aerospace embedded software framework, and a POC exists per SSVC data, though EPSS of 0.14% (4th percentile) signals negligible real-world exploitation interest. No public exploit has been confirmed as actively exploited, and the vulnerability is not listed in the CISA KEV catalog.
Denial of service in NASA Core Flight System (cFS) v7.0.1 results from insufficient replay protection in the CFDP (CCSDS File Delivery Protocol) receive path, enabling unauthenticated network attackers to crash or disrupt the flight software stack by sending replayed final CFDP PDUs. SSVC classifies this as automatable with a proof-of-concept available, though the EPSS score of 0.14% (4th percentile) reflects the narrow operational footprint of aerospace flight software. No CISA KEV listing confirms active exploitation at time of analysis.
Denial of Service in NASA core Flight System (cFS) v7.0.1 is achievable by any network-adjacent attacker who can reach the SBN UDP interface, requiring no authentication or special privileges. Sending a single crafted SBN frame is sufficient to trigger the fault, consistent with CWE-20 (Improper Input Validation) in the Software Bus Network application's UDP packet handler. No public exploit code and no CISA KEV listing have been identified; EPSS stands at 0.14% (4th percentile), reflecting the niche aerospace deployment footprint rather than low technical severity.
Path traversal in the DS_SetDestPathCmd() function of NASA Core Flight System (cFS) v7.0.1 enables remote unauthenticated attackers to bypass access controls and read sensitive system components by supplying a crafted destination path string. The DS (Data Storage) application fails to properly sanitize or restrict path values passed via command, violating the intended access control boundary between storage destinations and protected system components. A proof-of-concept exists per SSVC data, and exploitation is assessed as automatable, though real-world risk is tempered by the specialized aerospace deployment context and a very low EPSS score of 0.14% (4th percentile).
Git-config section-name injection in GitPython <= 3.1.52 enables remote code execution by writing attacker-controlled `core.sshCommand` directives into a victim's `.git/config` via the `create_submodule()` or `clone_from()` API methods. The vulnerable component (CPE: `cpe:2.3:a:gitpython-developers:gitpython`) fails to escape bracket characters in submodule names, allowing a crafted name such as `x"] [core] sshCommand=malicious #` to close the intended config section header and open a new one on the same line - bypassing the existing CR/LF/NUL guard entirely. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but the fully documented injection mechanism and RCE primitive make this a high-priority fix for any pipeline processing untrusted repositories.
Incorrect default permissions in Synology Assistant before version 7.0.7-50095 expose locally created installation artifacts to unauthorized access, enabling low-privileged local users to read or write arbitrary files and trigger denial-of-service conditions during the installation window. The CVSS score of 7.3 (High) with C:H/I:H/A:H reflects the breadth of potential file system impact, though an EPSS of 0.13% (3rd percentile) and SSVC exploitation status of 'none' confirm no public exploitation activity at time of analysis. A vendor-released patch exists at version 7.0.7-50095, and no public exploit code has been identified.
Insecure automatic update delivery in eParakstītājs 3.0 for Windows (versions before 1.10.0) enables a man-in-the-middle attacker to deliver and execute arbitrary code on a victim's machine without any integrity verification. The application fetches update metadata over TLS but accepts any TLS certificate via a permissive TrustManager and a HostnameVerifier that always returns true, then downloads and executes an installer with no digital signature, Authenticode, or checksum validation. No public exploit has been identified at time of analysis, though the vulnerability class (CWE-494) is reliably exploitable once MITM positioning is achieved.
External file path control in Microsoft Edge for Android (versions below 151.0.4129.59) allows a local low-privileged attacker to disclose sensitive information stored on the device. Rooted in CWE-73, the flaw permits attacker-controlled input to dictate file name or path resolution within the browser, potentially exposing files outside the intended access scope. No public exploit identified at time of analysis, and SSVC confirms no known exploitation; however, the CVSS C:H and I:H ratings suggest the path control primitive may extend beyond read-only disclosure.
Bouncy Castle for Java's BKS and UBER keystore implementation crashes with an OutOfMemoryError when loading a crafted keystore because heap allocation from stream-declared lengths occurs before the HMAC integrity check. Any application calling KeyStore.load() with attacker-controlled BKS or UBER keystore data is affected - bc-java before 1.85 and bc-lts-java before 2.73.12. A POC was submitted alongside the report, confirming that a file of just a few dozen bytes declaring Integer.MAX_VALUE-length fields is sufficient to exhaust JVM heap regardless of heap configuration or supplied password. No public exploit identified at time of analysis beyond the researcher's POC referenced in the patch commit.
Credential exfiltration in Amazon MQ MCP Server (awslabs.amazon-mq-mcp-server) before version 2.0.24 allows a remote unauthenticated attacker - operating through prompt injection - to redirect RabbitMQ broker credentials or OAuth access tokens to an attacker-controlled endpoint by supplying a crafted broker hostname in the MCP client context. The RabbitMQ broker connection tools fail to validate that hostnames resolved through the MCP client context correspond to legitimate Amazon MQ broker endpoints, enabling a server-side request forgery-like exfiltration primitive. No public exploit code has been identified at time of analysis, no CISA KEV listing exists, and the vendor (Amazon) has released a confirmed fix in version 2.0.24.
Blind SQL injection in Shlink's tag statistics REST endpoint allows any API key holder to extract sensitive data from the underlying database across all tenants. The unvalidated `direction` value of the `orderBy` query parameter flows unsanitized into a Doctrine QueryBuilder ORDER BY clause, enabling time-based, boolean-oracle, and error-based extraction of long URLs, visitor records, IP addresses, geolocation data, user agents, and hashed API key secrets. A public proof-of-concept exploit is available on GitHub, no public exploit identified at time of analysis as confirmed actively exploited, but the low barrier to exploitation - any valid API key suffices - makes this a genuine remediation priority for Shlink operators.
Open redirect in Grav's form plugin (getgrav/grav-plugin-form) versions 9.1.11 through 9.1.12 allows unauthenticated form submitters to cause the server to issue a 302 redirect to an arbitrary external URL, enabling phishing attacks against site visitors. The vulnerability exists because the redirect process action, introduced in v9.1.11, evaluates user-supplied form field values through Twig expressions without sanitizing the resulting URL, and Grav::redirect() passes that output to the browser without origin validation. No public exploit code has been identified at time of analysis, and no active exploitation is confirmed in CISA KEV, though the low attack complexity and zero-authentication requirement make this straightforward to abuse against any site with a susceptible form blueprint.
Arbitrary code execution in the NSA's Ghidra reverse engineering framework allows an attacker who can deliver a malicious project file to execute arbitrary binaries as the victim's OS user when the victim opens the project. The SwiftDemanglerAnalyzer restores a user-supplied Swift binary directory path persisted in project state and passes it directly to SwiftNativeDemangler, which executes the resolved binary without any integrity or signature check - a textbook CWE-427 uncontrolled search path element. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but the attack is fully described in a VulnCheck advisory and the upstream patch confirms the vulnerability mechanism.
Bouncy Castle for Java's BKS keystore implementation silently accepted legacy version 0/1 keystores that derive a critically weak 16-bit HMAC integrity key - brute-forceable offline in milliseconds against the 65,536-value keyspace - allowing an attacker who can supply or tamper with a keystore file to forge the integrity MAC, inject rogue trusted certificates, and have the manipulated keystore accepted without error. All bc-java releases before 1.85 and bc-lts-java releases before 2.73.12 are affected. No public exploit code has been identified and this vulnerability does not appear in the CISA KEV catalog at time of analysis.
Cross-site request forgery in Admidio's Category Report preferences module (all versions before 5.0.11) enables an unauthenticated attacker to silently delete or duplicate Category Report configurations by tricking an authenticated administrator into visiting a crafted URL. The endpoint modules/category-report/preferences.php processes state-changing delete and copy operations via HTTP GET parameters without validating the adm_csrf_token, meaning any browser request carrying a valid admin session cookie will be executed regardless of origin. No active exploitation has been confirmed (not in CISA KEV) and no public proof-of-concept has been identified at time of analysis; risk is constrained by the social engineering prerequisite.