Code execution in JetBrains PyCharm before 2026.2.1 is possible through Jupyter MCP (Model Context Protocol) tools that expose critical functions without authentication. The root cause is CWE-306 (Missing Authentication for Critical Function) - the MCP tool surface in PyCharm's Jupyter integration fails to enforce any authentication check before executing code. Any local attacker able to reach the MCP endpoint can trigger arbitrary code execution with the privileges of the running PyCharm process, achieving full confidentiality, integrity, and availability impact. No public exploit code has been identified at time of analysis.
WebView URL injection in OPPO Health 6.2.9 enables token theft when a victim interacts with a maliciously crafted URL that loads inside the application's embedded WebView component. The CVSS 4.0 score of 8.3 reflects network-based delivery with low attack complexity, no required privileges, but mandatory active user interaction, with high confidentiality impact on both the vulnerable and subsequent systems. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.
Incorrect authorization in Mattermost's Boards component across versions 11.7.x through 11.7.6, 10.11.x through 10.11.21, and 11.8.x through 11.8.3 enables privilege escalation within board management. Board editors and non-guest team members can supply arbitrary values in BoardMember.Scheme* fields through the boards member API or archive-import endpoint, effectively granting board admin rights to any user without server-side enforcement. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Missing authorization in stoatchat's Subscribe message handler exposes private server membership data to any authenticated user on the platform. By sending a crafted Subscribe message referencing an arbitrary server ID, an authenticated attacker receives a live stream of UserUpdate events - including display names, avatars, and presence status - for members of private servers they have no legitimate access to. No public exploit code has been identified at time of analysis, but the attack is trivially repeatable by any account holder, requiring only knowledge of a target server's ID.
Out-of-bounds memory read in Deskflow clients prior to continuous build 1.26.0.299 allows a network-reachable malicious server to crash the connected client or disclose up to four bytes of client process memory at an attacker-controlled relative offset. The flaw lives in ServerProxy::setOptions(), where crafted kMsgDSetOptions (DSOP) option values corrupt m_modifierTranslationTable indexes that translateKey() and translateModifierMask() then use to index static seven-row lookup arrays beyond their valid bounds. No active exploitation has been confirmed by CISA KEV and no public exploit code has been identified at time of analysis, but the attack requires no authentication and no client-side user interaction beyond an established server connection.
Out-of-bounds read in Deskflow's client-side `ServerProxy::setOptions()` allows a malicious Deskflow server to crash any connected client by sending an odd-length DSOP options vector during the handshake sequence. Affected releases span from 1.17.0 through all continuous builds before 1.26.0.296, covering the full client codebase across five source files. No active exploitation is listed in CISA KEV and no public exploit code has been identified, though the crash is deterministic and the CVSS C:L component reflects marginal heap/stack memory disclosure from the out-of-bounds read.
Stored cross-site scripting in JetBrains YouTrack before 2026.2.18068 allows remote attackers to persist malicious script payloads via the language label field of fenced code blocks in issues or comments. When any authenticated user views the affected content, the injected script executes within the YouTrack application origin - a scope change that enables session token theft, credential harvesting, or unauthorized actions on behalf of the victim (CVSS C:H). No public exploit code has been identified at time of analysis, but the low-complexity network vector makes this straightforward to weaponize once a reporter or contributor role is obtained.
Zip Slip path traversal in Notepad++'s bundled WinGup update component (versions prior to 8.9.7) allows network-delivered malicious ZIP archives to overwrite DLL files outside the intended extraction directory, enabling arbitrary code execution when Notepad++ next loads the affected plugin. The attack requires user interaction to trigger the update workflow (CVSS UI:R) but demands no authentication on the target system. No public exploit code or CISA KEV listing has been identified at time of analysis; the vulnerability is fixed in the vendor-released 8.9.7 build.
Arbitrary file write outside the extraction destination is possible in extract-zip 2.0.1 and earlier due to an incomplete symlink containment check that validates only the parent directory of each archive entry, not the entry's own final path component. An attacker who can supply a crafted ZIP archive - containing a symlink followed by a same-named regular file - causes extract-zip to plant the symlink during extraction and then write attacker-controlled content through it to any path writable by the process. No public exploit code and no CISA KEV listing are identified at time of analysis, but the attack primitive is a well-understood class (zip slip via symlink chain), lowering effective exploitation complexity for a motivated actor.
Missing authorization on the mailbox endpoint in JetBrains YouTrack enables any authenticated user to delete arbitrary entities across the platform, regardless of ownership or role. Affected versions span three active release branches: all releases prior to 2025.3.156085, 2026.1.13914, and 2026.2.18095. The CVSS 3.1 score of 8.1 (High) reflects high integrity and availability impact with a low-privilege authentication bar; no public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis.
Unauthorized project transfer between organizations in JetBrains YouTrack before version 2026.2.17917 exposes high-severity access control failure affecting any multi-tenant or multi-organization deployment. Any authenticated low-privileged user can transfer projects across organizational boundaries without holding the necessary authorization, resulting in high confidentiality and integrity impact against affected projects and their data. No public exploit or CISA KEV listing is identified at time of analysis, but the low attack complexity and authentication-only requirement make this straightforwardly exploitable by any active YouTrack user.
Digest authentication credential replay in http4k-security-digest exposes all URLs within an authentication realm to unauthorized access when an attacker can obtain any valid Digest credential for that realm. The library's `DigestAuthProvider.verify` method never passed the actual request URI into its validation logic, meaning the `uri` field in a client's `Authorization: Digest` header was never compared against the URL actually being requested - a direct violation of the per-request binding mandated by RFC 7616. The flaw has been present since the `DigestAuthProvider` was introduced in 2021 (commit 8a52b615b1); no public exploit code has been identified and no CISA KEV listing is present at time of analysis.
Stored cross-site scripting in Stirling-PDF prior to version 2.0.0 allows an attacker to embed JavaScript payloads inside PDF metadata fields (Title or Author) that execute in a victim's browser session when the user triggers the 'Get Info' workflow. The vulnerable template at get-info-on-pdf.html injects unsanitized metadata directly into the DOM via innerHTML, enabling session token theft and arbitrary page content manipulation against any user who processes a crafted PDF on a shared instance. No public exploit has been identified at time of analysis, and the vendor has shipped a complete fix in the major v2.0.0 release.
Privilege escalation in Dokploy prior to version 0.29.6 allows an authenticated user with member:create permission to permanently seize organization ownership by exploiting two authorization logic flaws: the inviteMember tRPC procedure fails to restrict the role parameter to non-owner values, and the user creation service in user.ts permits arbitrary role assignment on self-hosted instances. Because owner roles cannot be demoted through normal application controls once assigned, a successful takeover is irreversible without direct database intervention. No public exploit code has been identified at time of analysis; vendor-released patch v0.29.6 closes both vulnerable code paths.
Unsafe deserialization in Progress ShareFile Storage Zones Controller v5.12.5 and below exposes the controller host to arbitrary code execution by any low-privileged user holding write access to a connected network share. Rooted in CWE-502 (Deserialization of Untrusted Data), the flaw processes attacker-controlled file metadata without integrity validation, yielding full host compromise with high confidentiality, integrity, and availability impact. No public exploit code has been identified at time of analysis, and the vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Excessive RBAC permissions on the maas-api and maas-controller ServiceAccounts in Red Hat OpenShift AI enable privilege escalation to full cluster administrator. An attacker who compromises either ServiceAccount identity - by exploiting a separate RCE vulnerability within those pods or by creating a malicious pod in the same Kubernetes namespace - can create new ClusterRoleBindings to assume cluster-admin rights or read all secrets across the cluster. No public exploit has been identified at time of analysis, and the CVSS vector confirms high privileges are required as a prerequisite, limiting the realistic threat actor pool to those with existing cluster foothold.
OS Command Injection in Dell ObjectScale versions prior to 4.3.0.1 enables a low-privileged local attacker to inject arbitrary OS commands into a vulnerable management component, leading to full privilege escalation on the affected system. The CVSS:3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms that only a local low-privileged account is required - no interaction or special complexity is necessary beyond that foothold. No public exploit code or CISA KEV listing has been identified at time of analysis.
OS command injection in Dell ObjectScale versions prior to 4.3.0.1 allows a local low-privileged attacker to escalate privileges to a higher permission level by supplying crafted input that is passed unsanitized to a system shell. The CVSS 3.1 score of 7.8 (High) reflects complete compromise of confidentiality, integrity, and availability on the affected node. No active exploitation has been confirmed by CISA KEV and no public exploit code has been identified at time of analysis; a vendor-released patch is available via Dell Security Advisory DSA-2026-328.
Arbitrary code execution in CompuGroup Medical CGM ISIS MED 2510.1.0.20 is achievable when a local attacker plants a crafted DLL in a path searched by the application (CWE-427: Uncontrolled Search Path Element). Despite the description labeling this a 'remote' attack, the NVD CVSS vector is AV:L/UI:R, consistent with classic DLL hijacking - delivery of the malicious DLL may occur remotely (phishing, network share), but exploitation is local and requires the victim to launch the application. A proof-of-concept is publicly available per SSVC data and the researcher's GitHub repository, though no CISA KEV listing confirms active exploitation.
Stack-based buffer overflow in Notepad++ before version 8.9.7 enables local code execution or process termination through the Run Dialog's variable expansion routine. The `expandNppEnvironmentStrs` function copies Notepad++ variable names from `$(...)` syntax into a fixed-size `wchar_t str[MAX_PATH]` stack buffer without bounding the loop index `m`, allowing any variable name of 260 or more wide characters to corrupt adjacent stack memory and trigger `__report_gsfailure` or, with precise crafting, execute arbitrary code. No public exploit has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Arbitrary Python code execution in FreeCAD's BIM module (versions 0.19 through pre-1.1.1) is triggered when a user opens a malicious project template file through the BIM Project Manager's Load Template function. The loadTemplate() method in BimProjectManager.py passes FCStd metadata fields (wpposition, wpu, wpv, wpaxis) directly to Python's built-in eval(), enabling an attacker who can deliver a crafted template to achieve full code execution under the victim's user account. No public exploit has been identified at time of analysis; the vendor-released patch is confirmed in version 1.1.1.
Remote code execution in JetBrains IntelliJ IDEA before version 2026.2.1 is achievable through the Markdown export tool via OS command injection. An attacker who can deliver a crafted Markdown file to a developer and induce them to export it can execute arbitrary operating system commands in the context of the IntelliJ IDEA process. No public exploit or CISA KEV listing has been identified at time of analysis, but the CWE-78 root cause and full C/H/I/H/A:H impact make this a meaningful risk for development workstation environments.
Sandbox escape in O2OA v.10.0.2's Invoke script execution mechanism allows a locally authenticated low-privileged attacker to bypass code isolation controls and execute arbitrary commands on the host system, achieving full confidentiality, integrity, and availability compromise (C:H/I:H/A:H). The CVSS vector AV:L/AC:L/PR:L/UI:N confirms exploitation requires only a valid low-privileged platform account with access to the Invoke JAX-RS endpoint - no complex conditions or user interaction are needed. A detailed vulnerability analysis document has been publicly disclosed via GitHub, lowering the technical barrier for exploitation; no public exploit code or CISA KEV listing has been identified at time of analysis.
Arbitrary Python code execution in FreeCAD's BIM Workbench (versions 0.19 through 1.1.0) is triggered when a user creates a TechDraw page from a malicious SVG template, due to an unsafe eval() call in BimTDPage.py at line 87. Exploitation requires social engineering - an attacker must deliver a crafted SVG template to a victim who then performs the TechDraw page creation action. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but the vulnerability is structurally trivial (direct eval of attacker-controlled input, CWE-95) and the fix is available in version 1.1.1.
Shell command injection in openshift-metal3/fakefish allows low-privileged network-accessible attackers to execute arbitrary OS commands by supplying crafted Image URLs or BMC credential values. Unquoted shell variable expansion in FakeFish scripts passes attacker-controlled strings directly into shell command lines and Kubernetes manifests without sanitization, with the Changed scope (S:C) in the CVSS vector indicating impact extends beyond the FakeFish process to the underlying provisioning infrastructure. No public exploit code has been identified at time of analysis, and no active exploitation is recorded in CISA KEV.
UpTrain versions 0.7.1 and prior expose a critical authentication bypass combining two design flaws: a static default API key that equals the default username (making it predictable to any observer), and a permissive CORS policy that allows cross-origin requests from any domain. Any malicious website can authenticate to a reachable UpTrain instance by embedding the known static key in the `uptrain-access-token` header, performing privileged operations as the default user. Proof-of-concept exploit code exists (confirmed by CVSS 4.0 E:P metric), and no vendor patch has been released as of publication.
SQL injection in ERPNext's Inactive Customers report allows any authenticated user to manipulate raw database queries via an unvalidated doctype filter parameter. Affected versions prior to 15.116.0 (v15 branch) and 16.23.0 (v16 branch) interpolate user-supplied input directly into f-string SQL in get_sales_details and get_last_sales_amt, enabling exfiltration of sensitive ERP data and limited database manipulation. No public exploit code has been identified at time of analysis, and no active exploitation is confirmed.
Remote unauthenticated denial of service in ACME mini_httpd 1.30 and earlier is triggered by sending crafted HTTP requests that exploit a parsing flaw in the handle_request() function's header processing logic. The attack requires no authentication, no user interaction, and is classified as automatable by CISA's SSVC framework, meaning scripted mass-scanning for vulnerable instances is feasible. No active exploitation has been confirmed in CISA KEV, and no public exploit code has been independently verified, though a researcher blog post linked in NVD references the vulnerability directly.
Directory traversal and reported remote code execution in Pronis Loisirs Billetterie CSE (all versions prior to April 2026) expose sensitive server-side files to unauthenticated remote attackers. A public proof-of-concept repository is available on GitHub, materially lowering the skill barrier for exploitation. EPSS sits at 0.40% (34th percentile), indicating limited observed exploitation activity at time of analysis; no CISA KEV listing is confirmed.
Remote code execution in UpTrain v0.7.1 and prior is achievable by any authenticated user through the `/create_project` API endpoint, where the `checks` and `metadata` parameters are processed without adequate sanitization, allowing arbitrary code to run in the context of the host process. Discovered and reported by GitHub Security Lab (GHSL-2024-198/GHSL-2024-199), the flaw targets the dashboard backend (app.py:L691) and is most commonly exploited within Docker-based deployments as recommended by official documentation. No vendor patch exists as of publication, and a proof-of-concept is confirmed by the CVSS 4.0 E:P modifier, elevating real-world urgency despite the authentication prerequisite.
Missing authorization in Dolusoft Software Technologies Fortilogger (before version 6.1.5.9) allows unauthenticated remote attackers to access functionality that should be restricted by access control lists. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no authentication and no user interaction over the network, with a resulting high confidentiality impact. No public exploit code or active exploitation has been identified at time of analysis, though the vulnerability was flagged and disclosed by Turkey's national USOM cybersecurity authority.
Unauthenticated directory traversal in hermes-studio v.0.6.26 exposes arbitrary server-side files through the api/hermes/download endpoint, where the validatePath function fails to adequately restrict path sequences supplied by the caller. The flaw (CWE-22) enables a remote attacker with no credentials to retrieve sensitive files - including configuration files, credentials, and OS artifacts - bounded only by the filesystem permissions of the server process. Publicly available exploit code exists in a GitHub repository; EPSS places current exploitation probability at 0.26% (18th percentile), indicating low observed exploitation volume at time of analysis with no CISA KEV listing.
Missing Authorization in Sonlogger (Dolusoft Software Technologies) versions v6.6.6 through before 6.7.4.8 exposes protected functionality to unauthenticated remote attackers via ACL bypass, resulting in high confidentiality impact. The CVSS vector confirms AV:N/PR:N, meaning no credentials are required - any network-reachable instance is exposed by default. No public exploit or active exploitation has been identified at time of analysis, but SSVC flags the flaw as automatable, meaning mass scanning and opportunistic exploitation is technically feasible.
Remote denial-of-service in Apple iOS, iPadOS, and macOS Tahoe exploits a use-after-free memory corruption flaw, allowing an unauthenticated remote attacker to trigger unexpected system termination without user interaction. Affected platforms include iOS and iPadOS prior to 26.6.1 and macOS Tahoe prior to 26.6.2, as confirmed by Apple security advisories. No public exploit code or active exploitation has been identified at time of analysis, but the network-accessible, zero-interaction attack surface presents a meaningful availability risk for all unpatched Apple devices.
Uncontrolled recursion in docx4j-core's PropertyResolver crashes Java server-side applications that process untrusted DOCX files. The fillPPrStack method and adjacent style-resolution helpers traverse the OpenXML w:basedOn style inheritance chain without cycle detection, meaning a crafted DOCX with two mutually referencing styles triggers unbounded recursion and a java.lang.StackOverflowError, killing the processing thread. No public exploit identified at time of analysis, but the attack is trivially reproducible by editing OOXML XML internals, and the malicious document is a syntactically valid OOXML package that bypasses antivirus and content-inspection filters.
Unbounded gzip decompression in http4k's `ServerFilters.GZip` and `RequestFilters.GunZip` filters allows any unauthenticated remote client to exhaust JVM heap memory by sending a small (kilobyte-scale) gzip-encoded request body that decompresses to gigabytes - a classic compression bomb attack. All http4k servers using these filters across the v4.x, v5.x, and v6.x lines are affected; the flaw was silently present for approximately 9 years (since commit 2618fe08f9, 2017-08-01). No public exploit code or CISA KEV listing is identified at time of analysis, though the attack technique is trivially constructable from publicly documented zip-bomb methodology.
CPU exhaustion via ReDoS in sqlparse affects all Python applications that pass caller-controlled SQL text to sqlparse.parse(), sqlparse.format(), or sqlparse.split() prior to version 0.6.0. The root cause is a backreference regex pattern in the dollar-quoted literal lexer that, combined with the per-position lexer loop, produces O(n²) CPU complexity when processing inputs containing many unique, unclosed dollar-quote openers or multiline comment delimiters — making it trivially exploitable from the network with no authentication. No public exploit code or CISA KEV listing has been identified at time of analysis, but the fix commit includes a purpose-built benchmark script that doubles as a functional reproduction guide.
Path traversal in PostCSS's automatic source map loading allows arbitrary `.map` file disclosure when untrusted CSS is processed without explicitly opting out. Specifically, `lib/previous-map.js` constructs file paths from attacker-controlled `sourceMappingURL` comment values without sandboxing directory traversal sequences, enabling an attacker who can supply CSS to a PostCSS-processing service to exfiltrate `sourcesContent` from any `.map` file reachable by the process. The flaw affects all PostCSS versions from 8.0.0 through 8.5.17; no public exploit or CISA KEV listing has been confirmed at time of analysis, though the GHSA advisory provides a detailed attack scenario.
Unauthenticated denial-of-service in New API (QuantumNous), an open-source LLM gateway and AI asset management platform, allows remote attackers to exhaust host memory and disk resources by sending arbitrarily large payloads to payment webhook endpoints before any signature validation occurs. The payment processing routes for Stripe, Creem, and Waffo read and fully log request bodies prior to any cryptographic verification, meaning no valid payment credential or forged signature is required to trigger sustained resource consumption. No public exploit code has been identified at time of analysis, but the attack is trivially automatable given the unauthenticated, network-accessible surface and low complexity; the vendor-released fix in v1.0.0-rc.11 enforces a configurable 512 KB body limit on all anonymous endpoints.
OS command injection in Dell ObjectScale (versions prior to 4.3.0.1) enables a low-privileged local attacker to execute arbitrary operating system commands, yielding full confidentiality, integrity, and availability compromise of the affected node. The CVSS vector (AV:L/PR:L/UI:R) constrains exploitation to authenticated local actors who must also induce user interaction, making this a post-access lateral-movement or insider threat rather than a direct external attack path. No active exploitation has been confirmed (not listed in CISA KEV) and no public exploit code has been identified at time of analysis, though the Dell advisory DSA-2026-328 confirms the issue and provides a patch.
Remote code execution in UpTrain 0.7.1 and prior allows authenticated users to execute arbitrary commands on the host system via the `/new_run` API endpoint. The `checks` and `metadata` parameters are unsanitized, enabling injection attacks (CWE-74) that run in the context of the underlying process - typically a Docker container per the official deployment documentation. Publicly available exploit code exists (CVSS 4.0 E:P per GitHub Security Lab advisory GHSL-2024-200/201), and no vendor-released patch has been identified at time of publication.
Remote code execution in UpTrain's `/add_prompts` API endpoint allows any authenticated user to execute arbitrary commands on the host system by injecting malicious payloads into the `checks` or `metadata` parameters. Affected versions are 0.7.1 and prior, and deployments following the official documentation run inside Docker containers, meaning successful exploitation grants control of the container environment. GitHub Security Lab (GHSL-2024-200/201) has published an advisory and the CVSS 4.0 E:P modifier confirms publicly available proof-of-concept exploit code exists; no vendor-released patch has been issued as of time of publication.
IMAP command injection in Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3 enables authenticated remote attackers to disclose information or escalate privileges by exploiting a desynchronization between mail search operations and LITERAL+ byte-count handling. The flaw was reported by Zach Hanley of Horizon3.ai and is classified as CWE-77 (Command Injection), with the vendor releasing patched versions 1.6.18 and 1.7.3 on 2026-08-09. No public exploit code or CISA KEV listing has been identified at time of analysis, though the C:H/I:H CVSS impact and the researcher's track record for producing working exploits elevate the urgency of patching.
Cross-site scripting (XSS) in OpenText Directory Services through version 22.2 allows network-based unauthenticated attackers to inject malicious scripts that execute in victims' browsers, yielding high confidentiality and integrity impact against the vulnerable system. A proof-of-concept exploit exists per the CVSS 4.0 E:P modifier, though this CVE does not appear in the CISA KEV catalog and user interaction is required to trigger the flaw. Because directory services platforms manage authentication credentials and identity data, successful exploitation can enable session hijacking or account takeover with downstream access implications across integrated systems.
Path traversal in Progress ShareFile Storage Zones Controller (v5 ≤ 5.12.5, v6 ≤ 6.0.2) enables an authenticated zone administrator to write attacker-controlled files outside the intended download preparation directory. On v5 versions this file-write primitive escalates to confirmed remote code execution; the vendor has not confirmed RCE on v6. No public exploit has been identified at time of analysis, though the vulnerability was self-disclosed by Progress via security@progress.com.
Privilege escalation in Dell ObjectScale versions prior to 4.3.0.1 is enabled by an Uncontrolled Search Path Element (CWE-427), allowing a low-privileged local attacker to plant a malicious binary or shared library in a directory that the application resolves before the legitimate path, resulting in code execution under a higher-privileged context. The CVSS 3.1 score of 7.3 reflects full confidentiality, integrity, and availability impact, though the attack is constrained to local access and requires user interaction to trigger the vulnerable operation. Dell has released a fix in version 4.3.0.1 per advisory DSA-2026-328; no public exploit code has been identified at time of analysis.
Memory corruption in the kernel-mode driver component of BeyondTrust Endpoint Privilege Management for Windows (all versions prior to 26.1.2) allows a low-privileged local user to trigger an out-of-bounds read, potentially disclosing kernel memory contents or corrupting system state. The flaw is rooted in insufficient input validation within a Ring 0 component - the most privileged execution layer on Windows - amplifying the potential impact of what would otherwise be a constrained user-level action. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor has released a fix in version 26.1.2.
Path traversal in Progress ShareFile Storage Zones Controller v5.12.5 and below enables an authenticated party holding valid zone credentials to write arbitrary content to any filesystem location accessible by the application's service account via the resumable upload initiation endpoint. By manipulating path parameters in upload requests, the attacker can plant attacker-controlled files outside intended storage boundaries, with the vendor explicitly noting this may result in execution of attacker-supplied code. No public exploit identified at time of analysis and no CISA KEV listing, but the direct path to code execution and the vendor-confirmed scope make this a high-priority patch target for on-premises deployments.
Roundcube Webmail's built-in CSS proxy failed to validate responses from external CSS sources, enabling XSS or information disclosure via browser MIME sniffing in versions before 1.6.18 and 1.7.x before 1.7.3. The CVSS 3.1 score of 7.2 with Changed scope reflects that successful exploitation compromises the victim's browser session within the webmail origin. No active exploitation has been confirmed by CISA KEV, and no public proof-of-concept exploit has been identified at the time of analysis.
Unauthorized S3 signed-URL generation in Budibase prior to 3.41.3 allows any authenticated published-app user holding the low-privilege BASIC role to supply arbitrary bucket and key values to POST /api/attachments/:datasourceId/url and receive valid signedUrl and publicUrl values generated using the application's stored S3 datasource credentials. The root cause is missing authorization (CWE-862) on this endpoint, which fails to restrict low-privileged app users from invoking datasource-credential-backed operations. No public exploit or CISA KEV listing has been identified at time of analysis, though the low attack complexity and the wide availability of BASIC-role accounts in published Budibase apps makes this a realistic internal threat.