Unauthenticated remote code execution in Chainlit (2.4.0rc0 through 2.11.x) occurs when features.mcp.enabled is set to true, exposing the POST /mcp endpoint that accepts a user-controlled stdio command string. Because the allowlist only validates the executable name and passes arguments unchecked, an attacker can supply 'npx -y -c <payload>' to run arbitrary shell commands as the Chainlit process. Publicly available exploit code exists (working PoC from the reporting researchers and in the advisory); it is not listed in CISA KEV, and MCP has been disabled by default since v2.7.0, limiting the exposed population.
Arbitrary code execution in QWED-MCP before 0.2.1 stems from its verify_math_expression() library function feeding attacker-controlled expression and claimed_result strings into SymPy's parse_expr() with an unrestricted built-in namespace, turning a math-verification routine into a Python eval() sink. Any downstream integration that forwards untrusted input to this public API lets an attacker run OS commands as the qwed-mcp process user (root-level RCE confirmed in a container by the vendor advisory). Publicly available exploit code exists via the GHSA advisory PoC, but this is not listed in CISA KEV; the published CVSS is 9.8 while real reach depends on how the library is wired up.
Server-side template injection in the TYPO3 'Powermail' extension lets an anonymous user submit Fluid template syntax through any form field configured as the sender-name field, which the extension renders as raw template source. Because the value is passed unsanitized into a Fluid View, attackers can invoke arbitrary Fluid ViewHelpers to read server configuration, environment variables and application source, and in many deployments achieve remote code execution. The vendor (TYPO3, advisory TYPO3-EXT-SA-2026-022) reports active exploitation in the wild, and the flaw is unauthenticated (CVSS 4.0 base 9.5, PR:N).
Stack-based buffer overflow in the TOTOLINK N600R router (firmware 4.3.0cu.7647_B20210106) lets remote attackers corrupt memory by supplying an oversized Hostname argument to the setSystemConfig function in /cgi-bin/cstecgi.cgi, potentially enabling arbitrary code execution on the device. Publicly available exploit code exists (disclosed via VulDB and a GitHub write-up), though the flaw is not listed in CISA KEV. VulDB scores it CVSS 4.0 9.3 (Critical), reflecting high confidentiality, integrity, and availability impact.
Unauthenticated vector-store tampering in Nextcloud MCP Server before 0.117.2 lets any network attacker who can reach the /webhooks/nextcloud endpoint delete or force re-indexing of Qdrant semantic-search embeddings for arbitrary users. Because WEBHOOK_SECRET defaults to None and startup never enforces it, the webhook receiver processes forged POSTs and trusts the attacker-supplied user.uid, so looping over document IDs can wipe the entire search index for all users. A working proof-of-concept is published in the GHSA advisory; publicly available exploit code exists, though there is no public exploit identified in CISA KEV.
WebSocket origin-validation bypass in PraisonAI's Browser Server (praisonai/browser/server.py) before 4.6.58 lets an attacker forge a Chrome-extension Origin header and drive connected browser extensions. The check uses re.match() against the unanchored pattern chrome-extension://[a-z0-9]{32}, so any Origin with 32+ trailing characters is accepted before websocket.accept(), after which start_session commands trigger arbitrary browser automation, cookie theft, and screenshot capture. This is a patch bypass of CVE-2026-40289 (GHSA-8x8f-54wf-vv92); a working PoC is published in the advisory, though it is not in CISA KEV - no public exploit weaponization beyond the advisory PoC is identified.
Remote code execution in qwed 5.1.1 allows any authenticated tenant to execute arbitrary Python code inside the API server process by submitting crafted mathematical expressions to the POST /verify/math or POST /verify/batch endpoints. User accounts are freely self-registerable via the default-enabled /auth/signup endpoint - no invitation code or administrator approval required - making the effective exploitation barrier nearly equivalent to unauthenticated. A complete, functional proof-of-concept exploit script is publicly available in the GitHub advisory (GHSA-q27q-98j4-9pfv), and a vendor-released patch is available in version 5.1.2.
PraisonAI's `praisonai serve` subsystem (agents and unified modes) accepts an `--api-key` CLI flag that is parsed but never wired into the underlying FastAPI application, leaving POST /agents, POST /agents/{name}, and POST /api/v1/agents/{id}/invoke fully unauthenticated regardless of any key configured by the operator. All versions prior to 4.6.58 are affected, with the flaw present since approximately 4.6.34 when the serve subsystem first shipped. A public proof-of-concept exists per the GHSA advisory; no public exploit identified at time of analysis in CISA KEV, but the zero-authentication network attack surface makes this a high-priority fix for any deployment exposing the serve interface to untrusted networks.
DNS rebinding in genieacs-mcp's Streamable HTTP transport (versions <= 0.3.1) allows a malicious website to route browser requests through loopback to the unauthenticated /mcp listener and invoke arbitrary GenieACS NBI operations against managed CPE devices. Affected deployments expose full read/write access to TR-069 device state - including firmware update tasks, parameter changes, device reboots, presets, and connection requests - to any attacker who can lure the server operator to a malicious web page. A proof-of-concept is documented in the GitHub security advisory (GHSA-cmwv-wf9p-p8wx); no CISA KEV listing is present, indicating targeted rather than widespread exploitation at time of analysis.
Cross-workspace authorization bypass in Airbyte Platform through v2.0.0 allows any authenticated workspace member to read, modify, and delete resources in workspaces they have no access to. The flaw in AuthenticationHeaderResolver.resolveWorkspace prioritizes a caller-supplied X-Airbyte-Workspace-Id value for authorization, while the actual operation executes against the caller-supplied resource identifier - with no subsequent reconciliation check. A publicly available exploit exists (reported by VulnCheck), and exploitation requires only basic workspace membership, making this a realistic lateral-movement vector in any multi-tenant Airbyte deployment.
PraisonAI's async Jobs API FastAPI service exposes all seven `/api/v1/runs` endpoints - submit, list, status, result, cancel, delete, and stream - with zero authentication on every route, allowing any network-reachable caller to execute arbitrary prompts against the operator's configured LLM credentials and enumerate or exfiltrate cross-tenant job outputs. Publicly available exploit code is documented in GHSA-2jgc-f764-c5r2, with all five attack primitives confirmed via proof-of-concept returning HTTP 202/200/204 with no credentials. This is a distinct, unpatched sibling of CVE-2026-44338 - the Flask server fix at 4.6.34 did not touch the FastAPI jobs module, which remained fully unauthenticated through version 4.6.51.
Unauthenticated remote agent invocation in PraisonAI versions 4.6.34 through 4.6.57 allows any network-reachable caller to execute configured agents via POST /agents and POST /agents/{agent_name} despite an operator-supplied --api-key. The FastAPI app created by _create_agents_app() accepts the key at the CLI layer but never applies it as middleware or a route dependency, rendering the documented authentication control entirely inert on those endpoints. A proof-of-concept is included in GHSA-7ww9-85pg-cv4x, and the flaw is fixed in v4.6.58 via an _authorise_request() method that enforces Bearer or X-Auth-Token header validation.
Unrestricted OS command execution in mcp-shell prior to v0.6.0 allows any LLM connected via stdio to invoke the shell_exec tool with arbitrary command strings, running them as the mcp-shell process user with no filtering, allowlisting, or logging. The root cause is that config.go initializes SecurityConfig.Enabled to false and SecurityValidator.validateCommand unconditionally short-circuits when that flag is false, bypassing all CWE-78-class protections. Both the from-source installation path and the MCP client configuration example in the README omit MCP_SHELL_SEC_CONFIG_FILE, making every operator who follows the documented instructions unknowingly vulnerable. No CISA KEV listing or independent public exploit repository has been identified at time of analysis; a vendor-confirmed fix is available in v0.6.0.
SSRF protection bypass in PraisonAI's praisonaiagents library (all versions before 1.6.58) lets low-privileged users route agent web-fetching functions to internal HTTP services by supplying hostnames - such as 127.0.0.1.nip.io - that pass the static IP blocklist in spider_tools._host_is_blocked() because the function never performs DNS resolution before validation. The affected functions scrape_page, extract_links, crawl, and extract_text are registered as default LLM-callable agent tools, so any agent prompted to retrieve a user-supplied URL will trigger this path; a live proof-of-concept is documented in the GitHub Security Advisory (GHSA-x44h-65qv-cw74), confirming that publicly available exploit code exists. The CVSS scope change (S:C) and high confidentiality impact (C:H) reflect real ability to exfiltrate responses from internal services such as cloud metadata endpoints or localhost-bound APIs.
Arbitrary OS command execution in mcp-shell's default Docker image allows any MCP tool caller to bypass the secure-mode executable allowlist by supplying `/bin/bash -c <payload>` to the `shell_exec` tool, running commands as `mcpuser` (UID 1000) inside the container. The validator in `security.go` extracts only the first whitespace-delimited token as the executable, approves `/bin/bash` against the default allowlist, and passes the `-c` flag through the metacharacter check unchallenged because the default `blocked_patterns` array is empty. A fully working PoC is included in the GitHub Security Advisory GHSA-3x77-wg38-92r3; no public exploit identified at time of analysis beyond the researcher-provided PoC, and no CISA KEV listing exists. Vendor-released patch v0.6.0 is confirmed.
OS command injection in mcp-shell's 'secure mode' allows any MCP client to execute arbitrary shell commands by exploiting Git's runtime alias mechanism. The security validator in security.go blocks common shell metacharacters but omits '!', the prefix Git uses to invoke shell aliases via '-c alias.NAME=!CMD'. Because /usr/bin/git is in the default allowed_executables list and the CVSS PR:N vector confirms no authentication is required, all default Docker deployments (mcpuser, UID 1000, Git pre-installed) are exploitable by any entity with MCP connectivity. A fully functional PoC is published in the GHSA advisory; no CISA KEV listing is present at time of analysis.
Authentication fail-open in PraisonAI's Recipe HTTP server allows unauthenticated remote attackers to invoke recipe execution endpoints despite authentication being nominally enabled. Versions prior to 4.6.58 of the pip package are affected: when the server is started with --auth api-key or --auth jwt but the corresponding PRAISONAI_API_KEY or PRAISONAI_JWT_SECRET environment variable is absent, create_auth_middleware() silently bypasses all authentication checks. The CLI safety check that blocks external binding only verifies auth mode is not 'none', failing to detect this secret-absent misconfiguration, leaving POST /v1/recipes/run, /v1/recipes/stream, and /v1/recipes endpoints fully open to unauthenticated callers. No active exploitation is confirmed (not in CISA KEV); vendor-released patch is available in v4.6.58.
Authentication bypass in djust's WebSocket LiveView consumer allows unauthenticated remote clients to invoke protected event handlers on views gated by login_required, permission_required, or redirecting on_mount hooks. All djust versions prior to 1.0.4 are affected: handle_mount sends a navigate/redirect frame on auth denial but neither closes the WebSocket nor clears self.view_instance, leaving the socket open and exploitable. Because handle_event never rechecks authentication after mount, a non-browser WebSocket client that ignores the redirect can send arbitrary event frames and execute state-mutating or data-reading handlers without an authenticated session. No public exploit identified at time of analysis beyond the WebsocketCommunicator proof-of-concept reproducer disclosed in GHSA-xx4j-w367-7247; this vulnerability is not listed in CISA KEV.
Authentication bypass in PraisonAI's AgentServer component exposes all routes - /publish, /events, /info, /health - to unauthenticated remote callers, even when operators have explicitly configured an auth_token in ServerConfig. The AgentServer._create_app factory never reads or enforces the configured token, rendering it dead code while /info actively misleads operators by displaying it as masked ('***'), creating a false sense of security. No public exploit code has been identified at time of analysis, and it is not listed in CISA KEV; the fix is confirmed in praisonaiagents 1.6.58.
Server-side template injection in compliance-trestle's custom Jinja2 tags enables remote code execution when the tool processes attacker-controlled Markdown or YAML content. Versions before 3.12.4 and the 4.0.x series through 4.0.3 are affected; the root flaw is that MDCleanInclude and MDSectionInclude re-parse included content using a non-sandboxed jinja2.Environment, allowing injected expressions to traverse Python object internals and invoke arbitrary OS commands as the Trestle process user. No public exploit or CISA KEV listing has been identified at time of analysis, but the attack surface is realistic in supply-chain workflows where users import third-party SSP or YAML documents.
Cross-site request forgery against the PraisonAI MCP HTTP-stream transport allows unauthenticated remote attackers to execute arbitrary MCP tools on a developer's local machine when a victim visits a malicious webpage. The attack is enabled by a flawed prefix-match origin check (`startswith`) in versions prior to 4.6.58 that accepts `http://localhost.attacker.com` as a valid localhost origin, and is further facilitated by the absence of a default API key and the CORS simple-request mechanism (Content-Type: text/plain) that bypasses browser preflight. The highest-impact consequence is persistent prompt injection: a forged request can write attacker-controlled agent instruction files that the runtime loads on every subsequent agent run. No public exploit is identified at time of analysis; vendor-released patch 4.6.58 is confirmed.
Credential leakage in the urllib Node.js HTTP client (npm package node-modules/urllib) allows attacker-controlled redirect targets to capture sensitive authentication headers sent by the victim application. Versions through 4.9.0 (v3/v4 branch) and through 2.44.0 (v2 branch) recursively reuse the original caller-supplied options object - including Authorization, Cookie, Proxy-Authorization, x-api-key, x-auth-token, and x-access-token headers - when following redirects to a different origin, violating the WHATWG Fetch specification's cross-origin header-stripping requirement. No public exploit code has been released beyond the proof-of-concept topology described in the GHSA advisory, and no active exploitation has been confirmed by CISA KEV at time of analysis.
Server-Side Request Forgery in praisonaiagents (pip package, versions < 1.6.58) allows any attacker who can influence an AI agent's crawl target - via crafted task instructions or prompt injection embedded in previously crawled content - to exfiltrate cloud instance metadata (including IAM credentials), internal localhost services, and RFC1918 API endpoints. The web_crawl tool's SSRF protection validates only the initial URL's hostname IP, then invokes httpx with follow_redirects=True, allowing an attacker-controlled public URL to 302-redirect the agent to 169.254.169.254 or 127.0.0.1 without any re-validation. This is an incomplete fix for a prior SSRF class in the same component. A fully functional proof-of-concept is publicly documented in GHSA-5r34-2g38-6569, and no public exploit identified at time of analysis beyond the PoC; no CISA KEV listing is present.
Authentication bypass in PraisonAI's HTTP agent-serving layer allows unauthenticated remote invocation of registered agents despite the operator having configured an API key via --api-key. The root defect is in _create_agents_app(): it never reads config["api_key"] and never attaches a FastAPI Depends() auth dependency to POST /agents and POST /agents/{agent_name}, making the advertised --api-key flag a no-op. A public proof-of-concept confirms HTTP 200 responses to credentialless requests on all agent invocation routes while sibling /api/v1/ routes correctly return 401; no CISA KEV listing was identified at time of analysis.
Blind SSRF in Chainlit's MCP endpoint allows unauthenticated remote attackers to force the server to issue outbound HTTP requests to arbitrary internal or external URLs - including cloud metadata endpoints (e.g., AWS IMDSv1 at 169.254.169.254) - with fully attacker-controlled HTTP headers including Authorization and Cookie. Affected versions span 2.4.0rc0 through 2.11.x; the amplified form with attacker-controlled header forwarding affects 2.6.4 through 2.11.x, enabling state-changing authenticated requests against internal APIs without requiring any response read-back. Publicly available exploit code exists, confirmed against Chainlit 2.11.0 by SPL Security researchers; no CISA KEV listing is present at time of analysis.
Path traversal in praisonaiagents prior to 1.6.58 allows a low-privileged caller to write arbitrary JSON files to any process-writable filesystem location by supplying a crafted user_id containing ../ sequences to the FileMemory constructor. All versions of the praisonaiagents pip package below 1.6.58 are affected; the vulnerability exists in the core library's FileMemory class, not an example or optional component. A detailed proof-of-concept is included in the GitHub Security Advisory (GHSA-gxmw-5f7x-6g22), and no public exploit identified at time of analysis beyond that PoC; no CISA KEV listing exists.
Workspace boundary escape in PraisonAI's praisonai.code CODE_TOOLS exposes three independent path traversal vectors affecting all file operation and command execution tools exported for use by AI agents. Agents configured with a workspace parameter - intended as a filesystem security boundary - can be manipulated via prompt injection or untrusted input to read, write, enumerate, and execute commands outside that boundary, bounded only by the process user's OS permissions. Publicly available proof-of-concept code demonstrates all six bypass paths against real praisonai.code agent tools; no CISA KEV listing exists at time of analysis.
Server-Side Request Forgery in PraisonAI's Jobs API (pip/praisonai < 4.6.58) results from two compounding flaws: a fail-open DNS error handler in `JobSubmitRequest.validate_webhook_url()` that silently accepts any webhook URL when `socket.gaierror` is raised, and a TOCTOU race where `JobExecutor._send_webhook()` performs a completely independent DNS resolution via `httpx.AsyncClient` minutes to hours after validation. Authenticated attackers with a valid API bearer token can submit a job whose `webhook_url` hostname returns NXDOMAIN at validation time, then update DNS to a private IP before job completion, causing the executor to POST job result data to internal infrastructure. A detailed proof-of-concept is publicly available in GHSA-rg5q-pp8p-f7jm; no public exploit identified at time of analysis beyond the PoC, and this CVE is not listed in CISA KEV.
Origin header validation bypass in PraisonAI's MCP HTTP Stream transport allows a malicious webpage to invoke unauthenticated MCP tool calls against a locally-running server by exploiting a Python `startswith()` prefix match that accepts `http://localhost.evil.example` as a trusted localhost origin. Affected are all pip/praisonai installations prior to version 4.6.58 running the MCP HTTP Stream server under the CLI-default configuration (no API key). A functional proof-of-concept is included in the GitHub security advisory demonstrating local file read via `praisonai.files.create` and arbitrary state writes via `praisonai.todo.add`; no public exploit identified at time of analysis beyond this researcher-provided PoC.
Hard-coded credentials in all versions of the Furuno FA-50 maritime AIS transponder allow any attacker with knowledge of the static credentials and access to the vessel's internal network to authenticate to the device's settings screen and alter the vessel's identification number. Modification of the AIS identification number (MMSI) carries serious maritime safety implications, enabling vessel impersonation or disruption of AIS-based collision avoidance and vessel tracking systems. Disclosed via JPCERT coordination and JVN advisory JVNVU95422936; no public exploit has been identified at time of analysis.
Server-Side Request Forgery in PraisonAI before version 4.6.58 allows unauthenticated remote attackers to force the application server to make HTTP requests to internal network resources, including cloud metadata endpoints (169.254.169.254), loopback services, and RFC 1918 hosts. Two independent bypass paths exist in the Jobs API webhook_url validator: a DNS rebinding path exploiting the TOCTOU gap between validation and request dispatch, and a fail-open condition where socket.gaierror exceptions are silently swallowed, accepting unresolvable domains with no validation at all. A detailed proof-of-concept including curl commands is published in the GHSA advisory; no CISA KEV listing was present at time of analysis.
Configuration manipulation in the Furuno FA-50 maritime device (all versions) is possible without authentication from the vessel's internal network. The product fails to enforce access controls on its settings interface (CWE-306), allowing any attacker who gains internal network access to alter device configuration parameters. No public exploit code has been identified at time of analysis, and the device is not listed in CISA KEV, but the unauthenticated network-accessible vector and high integrity impact (CVSS 4.0: 8.7, VI:H) make this a meaningful risk in maritime operational environments.
Unbounded recursive referrer traversal in ORAS CLI versions through 1.3.2 allows a malicious OCI registry to trigger client-side denial of service by returning a cyclic referrer graph. Because neither `fetchAllReferrers` in the discover path nor `RecursiveFindReferrers` in the backup/restore graph logic tracked visited descriptors, a minimal two-node cycle (A→B→A) is sufficient to exhaust heap memory and CPU on the connecting client. No public exploit has been identified at time of analysis, though the fix commit and its accompanying regression tests make the attack pattern trivially reproducible. A patched release, version 1.3.3, is available.
Memory exhaustion in PraisonAI's MCP HTTP Stream server allows remote unauthenticated attackers to crash the service by flooding the initialize endpoint with requests. Each initialize call unconditionally appends a new dictionary to self._sessions with no eviction: the cleanup routine _cleanup_sessions is defined but has zero call sites in versions prior to 4.6.58, and the configured TTL is stored but never enforced. No public exploit is identified at time of analysis, but the attack requires only standard HTTP tooling against default deployments where no API key is configured.
Arbitrary code execution in Adobe Campaign Classic (ACC) arises from OS command injection (CWE-78), letting an attacker run arbitrary commands in the context of the running user. The flaw is rated CVSS 10.0 with a network attack vector, no privileges, no user interaction, and a scope change reaching the underlying host. No public exploit identified at time of analysis, but the maximal score and unauthenticated network reach make it a top-tier patching priority.
OS command injection in Adobe Campaign Classic (ACC) allows an attacker to execute arbitrary operating-system commands, achieving code execution in the context of the current user with a scope change that extends impact beyond the vulnerable component. Adobe (the reporting vendor) rates this maximum severity CVSS 10.0 (CWE-78), and exploitation requires no user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so this is a vendor-disclosed, not-yet-actively-exploited critical flaw.
Server-side request forgery in Adobe Campaign Classic (ACC) escalates to arbitrary code execution in the context of the running user, giving an unauthenticated network attacker full control per Adobe's CVSS:3.1 base score of 10.0 (scope-changed). The flaw lets an attacker coerce the server into making attacker-controlled requests that pivot into code execution with no user interaction. No public exploit has been identified at time of analysis and the issue is not listed in CISA KEV; the only reference is an Adobe advisory (APSB26-134) served from an internal, non-public host and could not be independently verified.
Unauthorized filesystem mutation in praisonaiagents allows an LLM-controlled agent to rewrite arbitrary on-disk source files by invoking ast_grep_rewrite with dry_run=False, bypassing the @require_approval authorization gate uniformly enforced on every sibling mutation tool in the framework. All praisonaiagents releases prior to 1.6.58 are affected; the vulnerable function is registered as a top-level tool and exposed through the code_intelligence built-in profile. Exploitability is confirmed by a proof-of-concept in GHSA advisory GHSA-cfxv-8fw8-rwpv, and a secondary defect causes the function to return 'No changes made' to the caller even when files were modified, silently concealing the write.
Unauthenticated authentication bypass in miniOrange's SAML Single Sign-On extensions for Joomla (SAML SSO < 11.0.2, SAML SP Login with ADFS < 6.4, and SAML SSO login with Google Apps < 6.4) lets remote attackers log in as any Joomla account, including administrators. The mo_saml_validate_signature() function treats OpenSSL's -1 error return as a successful signature verification, so a crafted SAMLResponse with an attacker-chosen NameID and a deliberately malformed signature bypasses validation entirely. Rated CVSS 4.0 10.0; no public exploit identified at time of analysis, but the flaw is trivially reachable and yields full site takeover.
Privilege escalation and remote code execution in NVIDIA OpenShell for Linux stem from an incomplete deny-list in its sandbox provisioning API, letting an authenticated attacker submit inputs that were meant to be blocked but were not. Because the flaw crosses the sandbox boundary (CVSS scope change), a successful exploit can yield code execution, privilege escalation, information disclosure, data tampering, and denial of service against the host. No public exploit identified at time of analysis, and the issue is not in CISA KEV.
Sandbox escape in NVIDIA OpenShell for Linux lets a low-privileged actor already operating inside the sandbox break its isolation boundary, potentially achieving code execution, privilege escalation, data tampering, and information disclosure on the host. The flaw is rooted in an uncontrolled search path element (CWE-427), so a resource the sandbox loads can be redirected to attacker-supplied code. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the assigned 9.9 CVSS reflects the full compromise achievable once the sandbox boundary is breached.
Stack overflow denial of service in github.com/graphql-go/graphql (through v0.8.1) crashes any Go server process embedding the library when an attacker submits a specifically crafted GraphQL request containing a deeply nested scalar value of a mismatched type. The `coerceString` and `coerceBool` functions in `scalars.go` violate the GraphQL specification by accepting type-mismatched scalar input instead of returning a request error, and under specific deep-nesting conditions exhaust Go's call stack and trigger an unrecoverable fatal error that immediately terminates the host process. A publicly available proof-of-concept exists via the Openwall security list; however, no active exploitation is confirmed in CISA KEV, and the CVSS 4.0 vector (AV:L, AT:P) combined with the description's explicit caveat that this is not triggered by typical web JSON traffic indicates exploitation requires a non-standard input path.
Weak authentication in NVIDIA NemoClaw for Linux (versions 0 through 0.0.4) lets remote attackers bypass the authentication enforced by its remote-access helper workflow, enabling code execution, information disclosure, and data tampering on the host. The flaw was self-reported by NVIDIA and carries a critical 9.8 CVSS rating with a fully unauthenticated network vector. No public exploit identified at time of analysis, and EPSS estimates only a 0.57% 30-day exploitation probability, so the raw severity outpaces observed real-world activity.
Remote code execution and denial of service in the Zephyr RTOS OCPP 1.6 client (subsys/net/lib/ocpp) allows an attacker who controls or man-in-the-middles the central system endpoint to smash the OCPP reader thread's stack. A malicious GetConfiguration message with an over-long JSON "key" field triggers an unbounded strcpy() into a fixed 50-byte stack buffer, corrupting the reader thread's stack with attacker-chosen bytes. A vendor patch exists and no public exploit has been identified at time of analysis; CVSS is rated 9.8, though real-world reach is bounded by the OCPP-charging-station niche.
Two-factor authentication bypass in the Perl module Punk::Plugin::TOTP before 0.05 lets an attacker who already knows a victim's password clear the victim's TOTP challenge using a recovery code issued to the attacker's own account. The flaw stems from the recovery-code helper looking up codes by digest across all users and then binding ownership through a numeric comparison of user identifiers, which fails whenever accounts are keyed by username, email, or UUID. No CISA KEV listing and no public exploit identified at time of analysis, with a low EPSS score of 0.44% (37th percentile) despite the 9.8 CVSS rating.
Denial of service in OpenSSL's CMP (Certificate Management Protocol) client affects versions 3.4.x, 3.5.x, 3.6.x and 4.0.x, where ossl_cmp_msg_check_update() passes a peer-supplied sender distinguished name directly as a format string to ERR_raise_data(). A malicious or intercepted CMP server can return a sender DN containing format specifiers (e.g. 'CN=%s%n') to crash a validating client. Despite a 9.8 CVSS score and an 'RCE' tag, the vendor explicitly states the reliable consequence is a crash only; there is no public exploit identified at time of analysis and EPSS is low (0.41%).
Privilege escalation in the Total Donations WordPress plugin (all versions through 2.0.5) lets unauthenticated attackers promote themselves to full administrator, per Wordfence and Patchstack advisories. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) rates it Critical 9.8 with complete confidentiality, integrity, and availability impact. No public exploit code is identified at the time of analysis and it is not listed in CISA KEV, but the unauthenticated network-reachable admin-takeover primitive makes it high priority.
SQL injection in the Apache Hive Metastore (versions 4.0.0 through 4.2.0) lets a caller who can invoke partition-name Metastore RPCs manipulate the generated WHERE clause so operations intended for one partition match additional rows in the same table. Because client-supplied partition names are concatenated into direct-SQL statements instead of bound as parameters, a crafted name containing a single quote can redirect reads, statistics updates, truncate/drop targets, and file-metadata cache operations to unintended partitions. No public exploit is identified at time of analysis and the flaw is not in CISA KEV; the input assigns CVSS 9.8, but the vendor description constrains impact to partition targeting within referenceable tables rather than arbitrary cross-database access.
Unrestricted file upload in TRtek Software Repository Management (all versions before commit 2fb4acee) lets remote attackers upload executable web shells to the server, yielding server-side code execution. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates network-reachable exploitation with no authentication or user interaction, and the full C:H/I:H/A:H impact reflects total server compromise. It was reported by Turkey's national CERT (TR-CERT); there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Improper certificate validation in NVIDIA NemoClaw for Linux (versions up to and including 0.0.1) allows network attackers to intercept or manipulate the deployment process, potentially yielding information disclosure, data tampering, remote code execution, and privilege escalation. The flaw stems from the deployment routine failing to properly verify TLS certificates (CWE-295), enabling machine-in-the-middle attacks. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the vendor rates full technical impact.