Full takeover of Oracle Hyperion Infrastructure Technology 11.2.25.0.000 is possible when a remote unauthenticated attacker over HTTP lures an authorized user into interacting with malicious content, exploiting a flaw in the Installation and Configuration component. Because the vulnerability carries a scope change, successful exploitation can extend beyond Hyperion to significantly impact other integrated products, yielding complete confidentiality, integrity, and availability compromise. Oracle rates it CVSS 9.6; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Privilege-escalating data compromise in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 (Lifecycle Management component) lets a low-privileged attacker with HTTP network access read, create, modify, or delete critical data across the platform. The scope-change design means the flaw pivots beyond Hyperion to significantly impact additional connected products, and the vendor's own tag of 'Authentication Bypass' plus a CVSS 9.6 mark it as a high-priority Critical Patch Update item. No public exploit identified at time of analysis, and it is not listed in CISA KEV, but the low attack complexity and network vector make it an attractive target.
Cross-scope compromise of Oracle WebCenter Content (Content Server component) in Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0 allows a remote unauthenticated attacker to fully read, create, modify or delete all Content Server-accessible data and cause a partial denial of service. Oracle rates it CVSS 9.6, driven by a scope change (S:C) meaning successful attacks can significantly impact products beyond WebCenter Content itself. Exploitation requires tricking a legitimate user into an action (UI:R); there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Privilege-scoped data compromise in Oracle Web Services Manager (OWSM), a component of Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0, allows a low-privileged attacker with HTTP network access to read and modify all OWSM-accessible critical data, with a scope change that can significantly impact additional integrated products. Tagged by the reporter as an authentication bypass, the flaw carries a CVSS 3.1 base score of 9.6 driven by high confidentiality and integrity impact plus scope change. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Privilege-abusing data compromise in Oracle Service Delivery Platform (Fusion Middleware, Messaging Enabler component) versions 14.1.2.0.0 and 12.2.1.4.0 lets a low-privileged attacker with Oracle Net network access read, alter, create, or delete all platform-accessible data, with a scope change that can significantly impact additional connected products. Rated CVSS 3.1 9.6 (Critical) with high confidentiality and integrity impact but no availability impact, this is remotely reachable and low-complexity. No public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS data was not provided.
Privilege-leveraging compromise of Oracle Demand Planning (Internal Operations component) in Oracle Supply Chain / E-Business Suite versions 12.1 and 12.2 lets a low-privileged attacker with HTTP network access read and modify all data reachable by the module. Because the CVSS scope is Changed (S:C), successful attacks can extend impact beyond Demand Planning to additional connected products. There is no public exploit identified at time of analysis and the issue is not in CISA KEV, but the 9.6 base score and low attack complexity make it a high-priority patch.
Sandbox-escaping remote code execution in Google Chrome for macOS (versions prior to 151.0.7922.169) stems from an improper implementation in the browser's Media component, letting a remote attacker who lures a victim to a crafted HTML page run arbitrary code outside the renderer sandbox. Rated High by Chromium and carrying a 9.6 CVSS with a scope change, this flaw breaks the browser's primary containment boundary, though there is no public exploit identified at time of analysis. Google has shipped a fix in the Stable channel, and only user interaction (visiting a malicious page) is required to trigger it.
Privilege abuse and cross-product compromise in Oracle Hyperion Calculation Manager 11.2.25.0.000 lets an attacker holding only low-level network credentials read and tamper with all data the product can reach, and - because of a scope change - pivot to significantly impact additional Oracle Hyperion components beyond Calculation Manager. Oracle rates it CVSS 3.1 9.6 with high confidentiality and integrity impact but no availability impact, and the vendor tags it as an authentication-bypass-class flaw in the Security component. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Server-side request forgery in the Red Hat Ansible Automation Platform 2 Controller's HashiCorp Vault credential plugin lets an authenticated user with credential-creation rights force the controller pod to leak its own Kubernetes service account token. When a HashiCorp Vault Secret Lookup credential configured for kubernetes_role authentication is tested, the kubernetes_auth() routine in awx_plugins/credentials/hashivault.py transmits the pod token to an attacker-supplied URL. With that token the attacker gains Kubernetes API access to control-plane namespaces, enabling full pod CRUD and secret reads including database credentials and the Django SECRET_KEY. No public exploit identified at time of analysis, and the flaw is not on the CISA KEV list.
Full compromise of Oracle Portable Clusterware is possible for an unauthenticated attacker who can reach the physical communication segment attached to the clustering hardware, per Oracle's August 2026 Critical Patch Update (CVE-2026-71064). Affected releases span Oracle Database Server 19.3-19.32, 21.3-21.23, and 23.4.0-23.26.3, and because the flaw carries a scope change (S:C) a successful takeover can significantly impact additional products beyond Clusterware itself. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the 9.6 CVSS and 'easily exploitable' vendor language make it high priority.
Complete takeover of the Oracle Portable Clusterware component in Oracle Database Server (19.3-19.32, 21.3-21.23, 23.4.0-23.26.3) is achievable by an unauthenticated attacker positioned on the same physical communication segment as the clustering hardware. Because the flaw carries a scope change, a successful compromise cascades beyond Clusterware to significantly impact additional products, driving a CVSS 3.1 base score of 9.6 with full confidentiality, integrity, and availability loss. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and lack of authentication make it a high-priority patch for affected clustered database estates.
Unauthenticated arbitrary file upload in the Piotnet Addons For Elementor Pro WordPress plugin (versions <= 7.1.67) lets remote attackers upload files of dangerous types, a CWE-434 flaw that typically enables webshell deployment and full site takeover. The issue was reported by Patchstack and carries a critical 9.6 CVSS score; no public exploit has been identified at time of analysis, and it is not listed in CISA KEV. Because exploitation requires no authentication, any exposed site running an affected version is a viable target.
Arbitrary file read via path traversal in MobSF prior to 4.5.1 allows authenticated users with scan-upload permissions to exfiltrate server-side files by embedding traversal sequences in the android:icon attribute of a crafted AndroidManifest.xml inside a ZIP or APK upload. The vulnerable find_icon_path_zip() function resolves the attacker-controlled icon path without containment checks, copies the target file to a predictable location in DWD_DIR, and exposes it through the /download/ endpoint. A fully functional proof-of-concept script is publicly available in the GHSA advisory; this issue is not listed in the CISA KEV catalog.
SQL injection in code-projects Task Management System 1.0 exposes the login endpoint at /index.php to unauthenticated remote exploitation via the email parameter. The vulnerable function Operation::select_with_multiple_condition fails to sanitize user input before constructing SQL queries, enabling authentication bypass or database enumeration. A public proof-of-concept exploit is available per VulDB and a linked GitHub issue, materially lowering the skill threshold for exploitation; no confirmed CISA KEV listing exists at time of analysis.
SQL injection in PHPGurukul Complaint Management System 1.0 exposes the user/check_availability.php endpoint to remote unauthenticated database manipulation via a crafted email parameter, enabling unauthorized data read, write, and limited availability disruption against the backend database. A public proof-of-concept exploit is confirmed available on GitHub, lowering the skill bar for opportunistic exploitation. No CISA KEV listing at time of analysis, but the CVSS 4.0 vector includes E:P confirming exploit code exists publicly.
Arbitrary root file read in Linuxfabrik monitoring plugins allows a local attacker controlling the nagios or icinga account to exfiltrate any root-readable file by exploiting the hidden but permanently live --test argument accepted by all sudoers-whitelisted check plugins. Invoking the deb-updates plugin via sudo with --test=/etc/shadow,,0 causes lftest.py to read the supplied path as root with no path confinement and echo its full contents to stdout; approximately 22 additional whitelisted plugins yield filtered leaks or file-existence oracles through the same mechanism. No active exploitation has been confirmed by CISA KEV, but a fully functional proof-of-concept command is publicly disclosed in the vendor's own GitHub security advisory GHSA-rh9c-rqvg-f7pr, and patches are available in linuxfabrik-lib v6.1.0 and monitoring-plugins v7.0.0.
Unauthenticated data access and manipulation in ArcadeDB before 26.8.1 arises because the Redis wire-protocol plugin exposes no authentication gate, letting anyone who can reach the Redis port read, write, and delete records across any database on the server. VulnCheck reported the flaw (CWE-306, Missing Authentication) with a CVSS 4.0 base score of 9.3, reflecting network-reachable, no-privilege exploitation with high confidentiality, integrity, and availability impact. No public exploit is identified at time of analysis, and it is not listed in CISA KEV.
Account takeover in authentik (goauthentik) identity provider before 2026.2.6 and 2026.5.5 allows an attacker holding an account on an upstream SAML identity provider to hijack a victim's authentik account. By injecting an XML comment into the SAML NameID (e.g. victim<!--x-->attacker), the value authentik reads for user matching is truncated to the text before the comment while the IdP's signed assertion still validates, because comment-excluding canonicalization (xml-exc-c14n) strips the comment before the signature digest is computed. This binds the attacker's external identity to the victim's existing account without the victim's password or the IdP private key, and the malicious link persists across future logins. No public exploit identified at time of analysis; the flaw is fixed upstream and demonstrated by regression tests in the vendor patch.
DNS zone-file injection in Froxlor's DomainZones.add API (versions ≤ 2.3.7) enables an authenticated customer with DNS-zone permissions to embed arbitrary BIND resource-record lines into zone files by supplying tab characters, newlines, and semicolons in the `record` or `type` parameter - characters the code processes through IDNA encoding and lowercasing but never rejects. BIND parses the resulting file without error, treating injected control characters as legitimate zone-file syntax and accepting the fabricated RRs as valid DNS entries. No public exploit is in CISA KEV, but the GHSA advisory published by the researcher (Yaohui Wang) includes a working proof-of-concept with confirmed BIND zone load output; exploitation is bounded to domains the attacker already manages within Froxlor.
Unauthenticated remote compromise of Oracle Helidon 3.2.18 (Imperative Web Server component) lets network attackers read, alter, or destroy all data the framework can access and degrade its availability. The flaw is remotely reachable over HTTP with no authentication or user interaction and carries a CVSS 3.1 base score of 9.4. It was disclosed in Oracle's August 2026 Critical Patch Update; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated remote compromise of Oracle Reports Developer 14.1.2.0.0 (Oracle Fusion Middleware, Security and Authentication component) allows attackers with only HTTP network access to tamper with or destroy critical data, read a subset of accessible data, and force a complete denial of service. Oracle rates this CVSS 9.4, reflecting high integrity and availability impact combined with trivial exploitability and no authentication requirement. No public exploit identified at time of analysis, but the low-complexity, no-privileges vector makes it a high-priority patch from Oracle's August 2026 Critical Patch Update.
Unauthenticated remote compromise in Oracle Helidon 4.5.0's Imperative Web Server component lets network attackers reach critical data and disrupt service over plain HTTP with no credentials and no user interaction. Oracle rates it CVSS 3.1 9.4, reflecting high confidentiality and integrity impact plus partial denial of service, and it was disclosed in the Oracle Critical Patch Update of August 2026. No public exploit identified at time of analysis, but the trivial exploitability and unauthenticated network reach make it a top-tier patch priority.
Unauthenticated remote compromise of Oracle Helidon 4.5.0 (Imperative Web Server component, part of Oracle Fusion Middleware) lets a network attacker read, create, delete or modify all Helidon-accessible data and cause a partial denial of service, all over HTTP without credentials. Oracle rates this CVSS 9.4 and tags it as an authentication bypass, meaning attackers reach protected functionality without logging in. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Privilege escalation in ArcadeDB server (versions 26.7.3 and earlier) allows a low-privileged authenticated user with read-only access to a single database to gain full server-wide administrative control. The flaw stems from the server failing to bind the authenticated principal to asynchronous command worker threads, so a JavaScript command submitted with awaitResponse:false runs with no user context and bypasses the scripting authorization gate entirely. VulnCheck reported the issue; there is no public exploit identified at time of analysis, but the mechanics are fully documented in the vendor advisory, making exploitation straightforward.
Privilege escalation in ArcadeDB before 26.8.1 lets a low-privileged authenticated reader escalate to full server administrator via the gRPC transaction interface. Because the server fails to bind the authenticated principal to the gRPC transaction executor thread in beginTransaction, an attacker can call executeCommand with a valid transaction ID to run arbitrary JavaScript that bypasses scripting authorization, ultimately creating server-wide admin accounts. Reported by VulnCheck with a linked GitHub security advisory; no public exploit is identified at time of analysis, and the flaw carries a CVSS 4.0 base score of 9.4.
Remote code execution in Grav CMS before 2.0.15 allows attackers holding page-edit or blueprint-config privileges to write arbitrary PHP into web-accessible files and execute it. The flaw lives in the Blueprint dynamic-data 'bare-function' validation, which relies on an incomplete denylist rather than a positive allowlist, letting the error_log function be invoked through a data directive to append attacker-controlled PHP payloads. Reported by VulnCheck; no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Authentication bypass in ArcadeDB before 26.8.1 lets unauthenticated attackers run full CRUD operations against any database through the MongoDB wire-protocol plugin on TCP port 27017. The plugin negotiates a SASL handshake but never actually enforces it on data commands (insert, find, update, delete, create), so an attacker who can reach the port gains complete read/write access with no credentials. Reported by VulnCheck; no public exploit code has been identified at time of analysis, though the trivial reproduction path makes weaponization straightforward.
Heap buffer overflow in the baresip 'libre' real-time communications library (versions prior to 4.8.1) lets remote attackers corrupt heap memory or crash any application running a WebSocket server via websock_accept()/websock_accept_proto(). The websock_decode() function miscalculates frame bounds for 64-bit extended-length masked frames, and the out-of-bounds XOR unmasking write is attacker-controlled. No public exploit identified at time of analysis, but the flaw is network-reachable and unauthenticated per the CVSS vector.
Reflected JavaScript injection and open redirect in MyBB forum software before 1.8.40 lets a remote attacker execute script in a victim's browser session. The Contact module (contact.php) takes a redirect target from the 'from' request parameter or the Referer header and passes it to redirect() without validating the URL scheme, so a javascript: URI can be delivered as the destination of the post-submission 'Click here if you don't want to wait any longer' link. CVSS is 9.3; no public exploit identified at time of analysis, and the flaw requires the victim to click the crafted link.
SQL injection in the JetAppointment (JetAppointments Booking) WordPress plugin by Crocoblock lets remote unauthenticated attackers inject arbitrary SQL through the booking workflow in all versions up to and including 2.5.2. Rated CVSS 9.3 (CWE-89), it enables extraction of sensitive database contents such as user records and credentials without any login. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated SQL injection in the WordPress plugin Affiliates Manager (by wp.insider) through version 2.9.53 lets remote attackers inject crafted SQL through affiliate-facing input without any authentication (PR:N), enabling extraction of sensitive database contents such as user records, affiliate payout data, and WordPress secrets. The high CVSS base score of 9.3 is driven by network reach, low complexity, and a scope change (S:C) reflecting impact on the wider WordPress database beyond the plugin's own tables. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV, but SQLi in a public-facing WordPress plugin is a well-understood and easily weaponized class.
SQL injection in the Modern Events Calendar WordPress plugin (versions prior to 7.35.0 by Webnus Inc.) allows unauthenticated remote attackers to inject arbitrary SQL through user-supplied input, enabling extraction of sensitive database contents such as user credentials and secrets. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms this is remotely reachable with no authentication or user interaction, making it a high-priority patch. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
SQL injection in the Sticky Chat Widget WordPress plugin (by gingerplugins) affects all versions up to and including 1.4.2, allowing remote unauthenticated attackers to inject arbitrary SQL and read sensitive database contents. Rated CVSS 9.3 with a scope-changed vector, it requires no authentication or user interaction, making it directly reachable on any site running the plugin. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Stored cross-site scripting combined with privilege escalation in Confluence Data Center and Server lets an unauthenticated attacker persist malicious HTML/JavaScript that runs in a victim's browser, enabling actions performed as a higher-privileged user and abuse of insecure default configurations. Atlassian rates it Critical (vendor CVSS 4.0 score 9.3; the advisory body text separately cites 8.6), and it affects a long list of 7.x through 10.2.x branches. There is no public exploit identified at time of analysis and it is not on CISA KEV; it was found through Atlassian's bug bounty program.
Unauthorized data access and modification in Oracle Commerce Guided Search / Experience Manager 11.4.0 (Experience Manager component) lets a remote, unauthenticated attacker who lures an authorized user into interacting with malicious content read, alter, or destroy all data reachable by the application and pivot into other products (scope change). Oracle rates it CVSS 9.3 with high confidentiality and integrity impact but no availability impact, and the profile (AV:N/UI:R/S:C/C:H/I:H/A:N, plus the 'Authentication Bypass' tag) is consistent with a cross-site-scripting-class flaw. There is no public exploit identified at time of analysis and it is not in CISA KEV, but Oracle assigns it a critical score.
Cross-boundary compromise in Oracle Siebel CRM's Siebel Apps - Self Service module (Helpdesk/Training component, versions 17.0 through 26.6) lets an unauthenticated remote attacker fully read and modify all data accessible to the application after luring a legitimate user into interacting with a crafted HTTP request. Because the CVSS vector carries a scope change (S:C), successful exploitation can significantly impact products beyond Siebel itself, and the vendor/analyst tagging as an 'Authentication Bypass' reinforces the high confidentiality and integrity risk. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the 9.3 base score and network-facing, unauthenticated nature make it a top-tier patch priority.
Authentication bypass in Oracle Reports Developer 14.1.2.0.0 (Oracle Fusion Middleware, Security and Authentication component) allows a remote unauthenticated attacker to reach and compromise the reporting service over HTTP, exposing critical data and enabling partial data modification. The scope-changing flaw (CVSS 3.1 9.3) can also significantly impact adjacent products beyond Reports Developer itself. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV, but the low-complexity, no-privilege, no-interaction profile makes it high priority.
Vertical privilege escalation in Grav CMS before 2.0.14 lets a delegated administrator holding only the admin.users permission promote an account to super-admin by saving a group with access[admin][super]=true. The core group blueprint omits the required security@: admin.super guard on the access field, so the operator inherits full super-admin capabilities including the task scheduler and arbitrary Twig template evaluation - effectively code execution on the host. No public exploit identified at time of analysis and the issue is not in CISA KEV, but the fix is confirmed in the vendor GHSA advisory.
SQL injection in the Readabler WordPress accessibility plugin (by Merkulove) before version 2.0.18 lets unauthenticated remote attackers inject arbitrary SQL against the site database. The CVSS 3.1 score is 9.3 with a scope change, reflecting that a low-privilege network request can reach and read backend data. No public exploit has been identified at time of analysis, and it is not in CISA KEV.
Stored cross-site scripting in Grav CMS before 2.0.15 lets authenticated editors smuggle JavaScript event handlers past the detectXss() sanitizer, which fails to flag event handlers (e.g. onerror=) placed in unquoted HTML attribute values containing unpaired quotes. The malicious payload is persisted in page content and executes in the browser of any visitor who later renders that page. Reported by VulnCheck with a CVSS 4.0 base score of 9.3; no public exploit identified at time of analysis and not listed in CISA KEV.
Stored cross-site scripting in SpiderFoot (smicallef) lets attacker-controlled reconnaissance data execute JavaScript in an operator's browser. Because correlation titles are assembled from external scan inputs such as server banners and service metadata without HTML-escaping, an attacker who controls a scanned target can persist an HTML event-handler payload that fires when the operator opens the correlations view, enabling theft of stored API keys and session-context actions. No public exploit identified at time of analysis; the flaw was reported by VulnCheck and is not listed in CISA KEV.
Authentication bypass in Oracle Helidon 3.2.18 (Imperative Web Server component of Oracle Fusion Middleware) lets an unauthenticated remote attacker send crafted HTTP requests to gain unauthorized read access to critical data and limited write (insert/update/delete) access. The flaw carries a scope-changing CVSS 3.1 base score of 9.3, meaning a successful attack can significantly impact products beyond Helidon itself. Addressed in Oracle's August 2026 Critical Patch Update; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated authentication bypass in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (Endeca Application Controller), version 11.4.0, lets a remote attacker reach the application over HTTP without credentials and read critical data while also tampering with a subset of it. Because the flaw carries a scope change, successful exploitation can reach beyond the vulnerable component and affect additional products in the deployment. Oracle rates it CVSS 3.1 9.3; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated remote compromise of Oracle Reports Developer 12.2.1.19.0 (Oracle Fusion Middleware, Security and Authentication component) allows a network attacker to reach protected data and cross a trust boundary into other products. An attacker with only HTTP access can read all data accessible to Oracle Reports Developer and make limited unauthorized modifications, and because the flaw is scope-changing it can significantly impact additional products beyond Reports Developer itself. It carries a CVSS 3.1 base score of 9.3 and is addressed in Oracle's August 2026 Critical Patch Update; no public exploit identified at time of analysis.
Cross-site request forgery in Halo CMS through version 2.25.4 lets a remote attacker abuse weaknesses in the CorsConfigurer.java and CsrfConfigurer.java security-configuration components to force an authenticated victim's browser into performing unintended state-changing actions. The advisory further claims this can lead to arbitrary code execution, though the CWE-352/CSRF classification and the CVSS user-interaction requirement suggest the RCE outcome is likely a chained or victim-privilege-dependent consequence rather than a direct memory-corruption RCE. No public exploit identified at time of analysis (not in CISA KEV), and the EPSS probability is low at 0.24% (15th percentile).
Broken API-key scope enforcement in the Grav CMS API plugin (getgrav/grav-plugin-api) before 1.0.14 lets an authenticated holder of a restricted, scoped API key read authorize-gated administrative UI metadata that their scope should forbid. Because userPassesAuthorize() checks the underlying account's super-admin flag and ACL grants instead of the presenting key's declared scopes, a low-privilege key minted on a privileged account inherits the account's full authorization, exposing sidebar/menubar/widget item definitions and users-list columns, row-actions, and filter-tabs. No public exploit identified at time of analysis; impact is information disclosure only, and the published CVSS 4.0 9.3 appears materially overstated versus the described effect.
Authorization bypass in the Grav API plugin (getgrav/grav-plugin-api, bundled with Grav 2.0) before 1.0.15 lets a holder of a narrowly-scoped API key act outside its granted scope. Because BlueprintPathResolver::resolveUserScope() checks the underlying account's raw super-admin ACL flag (access.api.super) rather than the scope actually minted into the presented key, an attacker with a key limited to api.media.write on a super-admin account can write files into other users' account directories and enumerate their file listings without holding api.users.write. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Cross-site scripting escalating to full remote code execution in SiYuan, an Electron-based personal knowledge-management and note-taking application, affects all releases before v3.7.4. The file-upload validation flow inserts unescaped filenames into the DOM via insertAdjacentHTML, so a filename carrying a script payload runs in the privileged renderer and reaches OS command execution when a victim drags, drops, or pastes the file into the editor. Reported by VulnCheck and fixed in v3.7.4; no public exploit identified at time of analysis.
Arbitrary command execution in Hugo 0.162.0 through 0.164.x occurs when the static site generator builds a project whose Tailwind configuration is supplied by an attacker-controlled theme, module, or starter template. Because these releases added tailwindcss to the AllowChildProcess default, Hugo launches the tool with --allow-child-process, and any top-level JavaScript in tailwind.config.js (loaded via require at startup) can spawn a non-Node shell that inherits none of the Node.js permission restrictions and runs with the full privileges of the build account. This is a build-time supply-chain execution flaw with no public exploit identified at time of analysis; it was reported by VulnCheck and fixed in Hugo 0.165.0.
Authorization bypass in FUXA (a web-based SCADA/HMI/dashboard platform) versions 1.3.2 and earlier lets a remote unauthenticated attacker escalate to full runtime control when the Node-RED integration is enabled in secure mode. The allowDashboard gate in server/integrations/node-red/index.js verifies a JWT's signature but never inspects the decoded identity, so a low-privilege guest token that anyone can mint from POST /api/heartbeat is accepted for the privileged Node-RED editor and flow-deployment API. With no second adminAuth gate on Node-RED, the attacker deploys function nodes or calls fuxa.runScript to seize project data, configuration, scripts, and - where nodeRedUnsafeModules is enabled - operating-system command execution. No public exploit identified at time of analysis, but the fix (v1.3.3) and PR diff publicly reveal the flaw.