Prototype pollution in ApostropheCMS 4.32.0 and earlier enables an authenticated editor to trigger a persistent, process-wide denial of service via a single PATCH REST API request. By sending `{ "toString.call": "x" }` to `PATCH /api/v1/article/:id`, the attacker walks the JavaScript prototype chain through `apos.util.set()` into the shared `Object.prototype.toString` function object and shadows its `call` method, breaking every subsequent `Object.prototype.toString.call()` invocation in Node.js - including those inside the MongoDB driver - until the server process is manually restarted. No separate proof-of-concept repository has been published, but the exact attack payload is fully disclosed in the public GitHub security advisory GHSA-vmg4-6gfg-83qx and the upstream commit diff, and active exploitation has not been confirmed by CISA KEV.
CORS misconfiguration in the openssl_encrypt pip package (versions before 1.4.0) enables any website to issue fully credentialed cross-origin API requests on behalf of authenticated users, exposing sensitive API responses to attacker-controlled origins. Both standalone server components - key-server and telemetry-server - ship with the maximally permissive combination of allow_origins=["*"] and allow_credentials=True as their default configuration, propagated through docker-compose.yml and .env.example. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code is known at time of analysis, though the attack pattern is a well-understood, low-complexity web exploit.
Missing authorization on Determined's generic task management API endpoints allows any authenticated user to kill, pause, or unpause tasks belonging to other users. The flaw - rooted in CWE-862 (Missing Authorization) - means a low-privileged user with a valid account can disrupt any other user's ML training workloads across the platform without owning those tasks. No public exploit code has been identified at time of analysis, but the attack surface is straightforward: any authenticated API call to the affected endpoints against an unprotected resource suffices.
Incorrect authorization in OpenViking's debug vector scroll and count endpoints exposes all co-tenant records to any authenticated user within the same account. The storage backend in viking_vector_index_backend.py enforces only account-level scoping, with no per-user access controls, enabling lateral data theft of private memories, skills, resources, and secrets without administrative privileges. No active exploitation has been confirmed (not in CISA KEV), and no vendor-released patch version has been identified at time of analysis.
Netfilter's nft_payload offload mask builder in the Linux kernel performs an undefined-behavior shift (1 << 120 on a 32-bit int) when constructing hardware-offload match masks for partial IPv6 address fields, and separately over-masks trailing bytes when priv_len is a multiple of four. Systems running affected kernel versions that use nftables hardware offload rules with partial IPv6 address matches may experience firewall rule bypass (I:H) or kernel instability triggered by UBSAN (A:H). No public exploit is identified at time of analysis, and EPSS sits at 0.16% (5th percentile), consistent with a kernel correctness/stability bug rather than an actively targeted security issue. Patches are available across all active stable branches.
Path traversal (CWE-22) in HashiCorp Packer's third-party plugin installer through version 1.15.4 permits a crafted plugin archive to write files outside the intended extraction directory, enabling code execution on the host. Users who install plugins from malicious or compromised sources trigger the vulnerability through the normal `packer plugins install` workflow. No public exploit code has been identified at time of analysis, and a vendor-released fix is available in Packer 1.16.0.
Redirect URI prefix-matching in Medplum's unauthenticated external IdP callback (GET /auth/external) allows an attacker who can forge or intercept the OAuth state parameter to redirect Medplum authorization codes and login tokens to an attacker-controlled endpoint. All deployments of npm/@medplum/core at version 5.1.5 and below where a ClientApplication has an external identityProvider configured are affected; the fix was released in v5.1.6. Publicly available exploit code exists in the GHSA-m44r-7c5h-m6mj advisory - including curl-based reproduction steps - and because the attacker can inject their own PKCE challenge into the forged state, stolen codes can be redeemed for a full access token without the victim's knowledge, constituting a complete account takeover.
Path traversal in Dell ObjectScale (versions prior to 4.3.0.1) enables a local low-privileged attacker to write to or corrupt files outside intended directory boundaries, achieving high integrity and availability impact without requiring user interaction. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) confirms exploitation requires only a local account with minimal privilege - no elevated rights or user interaction needed. No public exploit code or CISA KEV listing has been identified at time of analysis; risk is primarily from insider threats or attacker-controlled service accounts in post-compromise scenarios.
Tamper protection bypass in BeyondTrust Endpoint Privilege Management (EPM) for Windows allows local high-privileged users to circumvent agent protection controls by exploiting a flaw in how protections are applied to a support utility process. Affected versions are all EPM Windows Deployment releases prior to 26.1.2, per EUVD-2026-60270 and BeyondTrust advisory BT26-04. No public exploit has been identified and this is not in CISA KEV, but the high confidentiality, integrity, and availability impact on the vulnerable system makes this a meaningful concern for any organization relying on EPM as a core endpoint security control.
Glances versions through 4.5.5 contain an incomplete fix for CVE-2026-53925: the `--disable-config-exec` flag correctly suppresses shell operator interpretation in AMP module commands but fails to do so for on-alert action commands in `glances/actions.py`, where `secure_popen()` is called without `allow_operators=False`. An attacker with write access to `glances.conf` can place shell metacharacters (`>`, `&&`, `|`) in alert action directives, which execute at the Glances process privilege when an alert threshold is crossed - despite the operator supposedly operating in hardened mode. No public exploit confirmed active exploitation (no CISA KEV listing); a benign proof-of-concept is documented in GHSA-59fj-m2j6-hcxh. The fix is available in Glances 4.5.6.
Recursive arbitrary directory deletion in OpenEMR before 8.2.0 is achievable by an unauthenticated attacker through a two-vulnerability chain: a path traversal flaw in standard_tables_manage.php allows the db GET parameter - passed unsanitized to temp_dir_cleanup() - to resolve outside the intended PHP temporary directory, while an open redirect in dicom_frame.php enables delivery of a crafted URL that triggers this deletion inside an authenticated Superuser's active session. The patch is confirmed in OpenEMR 8.2.0 (released 2026-07-08); no active exploitation (CISA KEV) or public proof-of-concept has been identified at time of analysis. The potential for irreversible mass deletion of patient records and EHR runtime data makes this a high-priority patching target despite the social-engineering prerequisite.
Stored cross-site scripting in Pandora's URL observable rendering allows network-reachable attackers to inject arbitrary JavaScript that executes in the context of an authenticated victim's Pandora session when they interact with the Submit to Lookyloo control. The root cause is a JavaScript string injection context mismatch: attacker-controlled URLs extracted from submitted files were interpolated directly into inline onclick handlers, where the template engine's HTML entity encoding provides no protection. Successful exploitation enables session hijacking or unauthorized actions on behalf of the victim; no public exploit has been identified at time of analysis.
Cross-zone isolation is broken in Kong Mesh's global control plane, allowing any authenticated zone to inject and overwrite mesh resources attributed to other zones by spoofing the in-band ControlPlane.Identifier during KDS sync. Multiple release trains are affected, including all Kong Mesh versions prior to 2.7.29, 2.9.19, 2.11.18, 2.12.14, 2.13.10, and 2.14.2. No public exploit has been identified at time of analysis; the CVSS 4.0 score of 7.0 reflects high integrity impact to global control plane state and downstream zones, with no availability impact.
Remote code execution via crafted .FCStd document in FreeCAD prior to 1.1.2 allows arbitrary Python execution when a victim opens a malicious file. The deserialization path in PropertyPythonObject::Restore() passes attacker-controlled module names directly to PyImport_ImportModule(), executing module-level Python code on import; the legacy pickle branch additionally invokes an attacker-controlled class constructor via PyObject_CallObject(). No public exploit or CISA KEV listing is identified at time of analysis, but exploit construction is straightforward for any researcher who can craft the FCStd XML schema.
Cross-site WebSocket hijacking in SiYuan before 3.7.4 lets a remote unauthenticated attacker weaponize the victim's running SiYuan instance as a network proxy to arbitrary attacker-chosen targets. The /ws/network/proxy endpoint explicitly disables WebSocket origin validation by setting CheckOrigin to unconditionally return true, allowing malicious webpages to open unauthorized WebSocket connections through the victim's browser and issue proxy commands to the SiYuan kernel. No public exploit is confirmed in CISA KEV, but SSVC flags a POC exists; the CVSS 4.0 score is 7.1 and EPSS is 0.10%, indicating limited observed exploitation at time of analysis.