Remote code execution in Bilibili Desktop v1.17.9 (an Electron-based client for the Bilibili video platform) stems from the bili-inject.js and bili-bridge.js components exposing privileged IPC/native functionality to renderer content without validating message origin. Per the published GitHub advisories, attacker-controlled web content loaded or rendered in the app can invoke these bridge APIs to run arbitrary code on the host. Rated CVSS 9.8 by MITRE, but EPSS is low (0.26%, 17th percentile); no public exploit is independently confirmed and it is not in CISA KEV.
Unauthenticated remote code execution affects BerriAI litellm through version 1.82.4, where the /prompts/test endpoint renders the attacker-supplied dotprompt_content parameter through an unsandboxed jinja2.Environment. Because no authentication is required and templates are evaluated server-side, an attacker can inject a Jinja2 payload that escapes into Python and runs arbitrary OS commands on the proxy host. No public exploit identified at time of analysis and the EPSS probability is low (0.25%), but the CVSS is 9.8 and a third-party technical write-up is referenced.
Authorization bypass in Spring Framework WebFlux functional-endpoint applications deployed on DispatcherServlet allows an attacker to defeat header-based route predicates by sending a CORS pre-flight (OPTIONS) request, reaching routes that should have been gated by header conditions. It affects Spring Framework 5.2.5-5.2.25, 5.3.0-5.3.49, 6.0.0-6.0.30, 6.1.0-6.1.28, 6.2.0-6.2.19, and 7.0.0-7.0.8 in the specific WebFlux-functional-plus-DispatcherServlet deployment mode. No public exploit identified at time of analysis, and EPSS exploitation probability is low (0.19%, 9th percentile).
Server-Sent Events (SSE) stream corruption affects Spring MVC applications built on the functional web framework across Spring Framework 5.3.0-5.3.49, 6.0.0-6.0.30, 6.1.0-6.1.28, 6.2.0-6.2.19 and 7.0.0-7.0.8, where unneutralized CRLF sequences (CWE-93) let an attacker inject into or corrupt the event stream. Reported by VMware/Spring and tagged as Information Disclosure, the flaw can break stream framing and potentially leak or splice data across SSE responses. No public exploit identified at time of analysis, and EPSS is low (0.16%, 6th percentile), but the vendor-assigned CVSS of 9.8 (all-High impact) sits in tension with the information-disclosure framing and warrants scrutiny.
Server-side request forgery and remote code execution affect the Spring Framework's XsltView component across the 5.2.x through 7.0.x branches (5.2.25.RELEASE and earlier, 5.3.0-5.3.49, 6.0.0-6.0.30, 6.1.0-6.1.28, 6.2.0-6.2.19, and 7.0.0-7.0.8). When a Spring MVC application maps '/**' to view rendering and does not explicitly set a view name, an attacker can steer view resolution to XsltView and supply a path that triggers outbound requests and code execution. There is no public exploit identified at time of analysis, and the EPSS probability is low (0.16%), but SSVC rates the technical impact as total and automatable.
Privilege escalation in Veno File Manager 4.4.9 lets an authenticated user holding only the 'rename' permission take over the super administrator account. By sending a crafted POST request to the renameFile endpoint, the attacker renames the application configuration file, which forces the app to rebuild its configuration and reset super-admin credentials to default values. Publicly available exploit code exists (jfs-jfs GitHub repo); this is not in CISA KEV and EPSS is low (0.16%), indicating no observed mass exploitation yet.
Incorrect access control in Veno File Manager 4.4.9 exposes the admin-head-updates.php component without proper authorization enforcement, allowing remote attackers to reach administrative update-handling functionality that should be restricted to authenticated administrators. A public proof-of-concept exists on GitHub (jfs-jfs/CVE-2026-37072), but the vulnerability is not listed in CISA KEV and carries a low EPSS score (0.16%, 5th percentile). The upstream CVSS of 9.8 (full C:H/I:H/A:H) appears aggressive relative to the thin one-line description, which names only an access-control defect in an update-header script rather than a confirmed code-execution or full-compromise path.
Cross-response information disclosure and stream corruption affects Spring Framework 6.2.0-6.2.19 and 7.0.0-7.0.8 (both MVC and WebFlux) when applications serve Server-Sent Events (SSE) together with view fragments, letting remote attackers corrupt the event stream and potentially bleed data across responses. No public exploit is identified at time of analysis and CISA has not listed the flaw in KEV; EPSS is low at 0.15% (5th percentile). The vendor-assigned 9.8 rating sits uneasily against the CWE-93 root cause, the 'Information Disclosure' tagging, and the SSVC 'exploitation: none' status, suggesting the paper severity outruns observed real-world risk.
Denial of service in Spring Framework WebFlux applications (5.2.25.RELEASE and earlier, 5.3.0-5.3.49, 6.0.0-6.0.30, 6.1.0-6.1.28, 6.2.0-6.2.19, 7.0.0-7.0.8) occurs when the Aalto XML processor is used to parse request bodies, because the maxInMemorySize buffering limit is not correctly enforced. Remote attackers can submit oversized XML to trigger unbounded in-memory buffering and exhaust heap memory. No public exploit identified at time of analysis; EPSS is low (0.14%, 4th percentile) and CISA SSVC lists exploitation status as none, though it rates the flaw automatable with total technical impact.
Stack-based buffer overflow in the Bendix EC80ESP brake ECU family enables adjacent-network attackers to crash the ECU or achieve remote code execution and arbitrary CAN bus traffic injection via a crafted payload. All known variants across both EC80ESP and EC80ESP+ product lines are affected, including J1708, 6S/6M, PLC, 2nd CAN, integrated TPMS, CAN Gateway, and 4S/4M configurations deployed on commercial vehicles. Successful exploitation could disable safety-critical functions including ABS, steering assist, speedometer, and automatic gear shifting. No public exploit has been identified at time of analysis; the flaw was disclosed by CISA ICS-CERT.
CodeMeter Runtime before versions 8.41a and 9.10, when configured as a server, exposes its configuration command handler to arbitrary remote peers due to absent network-origin restrictions. Unauthenticated remote attackers (PR:N per CVSS) can read sensitive configuration data and overwrite values in Server.ini, most critically the WebAdmin credential hash, enabling full WebAdmin account takeover. No public exploit code or CISA KEV listing has been identified at time of analysis, but the CVSS 8.6 rating and PR:N attack vector make this a genuine priority for any organization running CodeMeter in server mode.
Arbitrary file deletion in the Workeera WordPress plugin before 1.0.6 lets any authenticated user with a role as low as subscriber remove files anywhere the web server can reach, because the plugin neither restricts which values a user may write to their own candidate profile nor validates/contains the stored file path before deletion. On a typical WordPress host this enables denial of service and, by deleting wp-config.php to force the installer into a fresh setup, potential full site takeover. No active exploitation is recorded (not in CISA KEV) and no public exploit has been identified; EPSS is low at 0.14%.
Path traversal in blackms aistack's Static File Handler (src/web/server.ts) exposes arbitrary server-side files to unauthenticated remote attackers via unsanitized req.url processing. All versions through 1.6.1 are confirmed affected per NVD CPE data, and a public proof-of-concept exploit exists in GitHub issue #57. The project received responsible disclosure but has not responded, meaning no patch is available at time of analysis.
Path traversal in bsmi021's mcp-file-context-server 1.0.0 allows remote unauthenticated attackers to read arbitrary files on the host system by supplying crafted path arguments to the read_context function in src/index.ts. The Path Resolution component fails to canonicalize or boundary-check caller-supplied paths, enabling directory escape via sequences such as '../'. A public exploit exists (GitHub issue #15), the project maintainer has not responded to disclosure, and no vendor-released patch is available.
Path traversal in linkedin-ads-mcp 1.0.0 allows remote unauthenticated callers to read arbitrary files from the server's filesystem. The vulnerability exists in the Media Upload component where the `filePath` argument is passed directly to Node.js `fs.readFileSync` without sanitization, enabling directory traversal sequences to escape the intended media directory. A publicly available proof-of-concept exploit exists via a GitHub issue report; the maintainer has not responded to the disclosure.
Path traversal in boxpositron/with-context-mcp up to version 3.0.7 exposes the host filesystem through four note-management functions - ingest_notes, teleport_notes, sync_notes, and project_folder - in src/index.ts, allowing unauthenticated remote attackers to read or write files outside the intended working directory. The affected package is a Model Context Protocol (MCP) server, meaning exploitation is triggered via tool-call requests sent to the MCP endpoint, a vector inherently accessible to any AI agent or client connected to the server. A publicly available proof-of-concept has been disclosed via a GitHub issue; the vendor had not responded to the coordinated disclosure at time of reporting, leaving affected versions unpatched.
Arbitrary PHP file upload leading to remote code execution in the Joomla Event Manager extension (joomlaeventmanager.net) versions before 5.0.1 allows an authenticated administrator to write dangerous file types through the administrator source model and execute code on the underlying server. The flaw is a CWE-434 unrestricted upload weakness that turns legitimate back-end file-handling into a webshell delivery path; no public exploit identified at time of analysis and it is not listed in CISA KEV. The CVSS 4.0 base score of 9.4 reflects total confidentiality, integrity, and availability impact, though exploitation requires existing high privileges (PR:H).
Remote code execution in WatchGuard Fireware OS is possible via a heap overflow (CWE-122) in the iked (IKE/IPsec key management) process, letting a remote unauthenticated attacker run arbitrary code by sending specially crafted network traffic to an affected Firebox firewall. The vendor-assigned CVSS 4.0 base score is 9.3 (critical), reflecting network-reachable, no-privilege, no-interaction exploitation with full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and the CVE is not in CISA KEV, but the pre-authentication nature and the perimeter role of the affected device make this a high-priority patching item.
Remote code execution in WatchGuard Fireware OS affects the iked (IKE/IPsec VPN key-exchange) daemon, where a stack-based buffer overflow lets a remote, unauthenticated attacker run arbitrary code by sending specially crafted network traffic. Because iked terminates VPN negotiations at the network edge, any Firebox appliance exposing IKE/IPsec is reachable pre-authentication. No public exploit has been identified at time of analysis and the CVE is not listed in CISA KEV, but the pre-auth RCE profile on a perimeter security device makes this a top-priority patch.
Remote code execution in WatchGuard Fireware OS affects the iked IKE/IPsec VPN daemon, where a memory-safety defect lets a remote unauthenticated attacker run arbitrary code by sending specially crafted network traffic to the appliance's VPN listener. The CVSS 4.0 base score of 9.3 reflects network-reachable, no-privilege, no-interaction exploitation with high confidentiality, integrity, and availability impact. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the pre-authentication RCE profile on an internet-facing firewall makes this high priority.
Remote code execution in WatchGuard Fireware OS affects the epm (Endpoint Protection Manager) service tied to the deprecated Mobile Security feature, where a stack-based buffer overflow lets an unauthenticated remote attacker run arbitrary code on the appliance. The CVSS 4.0 base score is 9.3 (critical) with a network, no-privilege, no-interaction vector. No public exploit identified at time of analysis and it is not listed in CISA KEV, but as a perimeter firewall RCE the impact is severe for any deployment still running Mobile Security.
Fingerprint-verification spoofing in jahlives openssl_encrypt before 1.4.9 lets attackers embed ANSI escape sequences in the email field of an imported identity document, rewriting the terminal line that displays a key fingerprint. A remote, unauthenticated attacker who delivers a crafted identity bundle via normal contact-exchange or keyserver flows can make the tool render a fraudulent fingerprint, defeating the out-of-band verification that guards against key-substitution (MITM) attacks. No public exploit is identified at time of analysis and it is not on CISA KEV.
SQL injection in the Beautiful Taxonomy Filters WordPress plugin (versions 2.4.6 and earlier) lets remote, unauthenticated attackers inject arbitrary SQL through the plugin's taxonomy filtering logic, exposing the entire WordPress database including credentials and secrets. Rated CVSS 9.3 with a network attack vector and no privileges required, though no public exploit code has been identified at time of analysis and it is not listed in CISA KEV. The scope-changed CVSS vector signals impact reaching beyond the plugin into the shared database backing the whole site.
SQL injection in the Epayco payment gateway WordPress plugin (versions 8.4.6 and earlier) lets remote unauthenticated attackers inject arbitrary SQL through the plugin's request handling, per Patchstack's disclosure. Because the CVSS vector marks scope as changed with high confidentiality impact (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L, base 9.3), an attacker can read data beyond the plugin's own tables, potentially exposing WordPress user records and payment-related order data. No public exploit identified at time of analysis, and it is not listed in CISA KEV, but the pre-authentication network reachability makes it a high-priority patching target for any site running the plugin.
SQL injection in the WordPress plugin Visitor Traffic Real Time Statistics Pro (all versions up to and including 11.17) lets remote unauthenticated attackers (PR:N) inject arbitrary SQL through the plugin's statistics-handling code, enabling extraction of database contents such as user records and password hashes. The flaw is network-reachable with low complexity and no user interaction (CVSS 9.3, S:C/C:H). No public exploit identified at time of analysis and the CVE is not listed in CISA KEV, so exploitation is currently theoretical but the barrier is low.
SQL injection in Toools iSquad exposes the unauthenticated '/ws/apitribuna/setVisita' web-service endpoint, where the id_video and id_ambito parameters flow into SQL queries without validation or sanitization (CWE-89). Remote attackers can inject arbitrary SQL to disrupt query execution, trigger database errors, and manipulate visit-tracking records, corrupting the integrity of analytics data. The flaw was reported by Spain's INCIBE-CERT and a vendor patch is available; no public exploit identified at time of analysis.
Arbitrary code execution in openssl_encrypt (the jahlives Python encryption utility) before 1.4.9 allows an attacker-supplied plugin to run in the host process at import time. Because the plugin signature policy defaulted to WARN, an unsigned or unverifiable non-built-in plugin was compiled and executed before the runtime sandbox was installed, with only a bypassable AST denylist as a gate. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the flaw yields full code execution as the invoking user once a malicious plugin is loaded.
Privilege escalation to account takeover in WatchGuard Dimension allows a low-privileged Dimension Administrator to hijack a Super Administrator account by harvesting that user's session token from a diagnostic log in the web UI. Because session identifiers are written unredacted, any authenticated administrator who can read the diagnostic log can impersonate a Super Administrator while that user is logged in, gaining full control of the management platform. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Arbitrary code execution in jahlives openssl_encrypt before 1.4.9 stems from a flawed plugin trust model that uses a denylist rather than an allowlist to identify built-in plugins, so unsigned plugins dropped into top-level plugins/ directories or unrecognized subdirectories evade signature verification entirely. An attacker who can place a malicious plugin along documented installation paths gains code execution inside the CLI process, exposing user passwords and cryptographic keys. No public exploit identified at time of analysis, and the CVSS 4.0 score is 9.3 (Critical), though the network vector conflicts with the local plugin-placement prerequisite.
Arbitrary command execution in jahlives' openssl_encrypt before 1.4.9 arises when the tool's 'info' command reconstructs and prints a CLI invocation using untrusted metadata fields (such as pepper_name) without shell-quoting. An attacker who controls the metadata of an encrypted file can embed shell commands that run on the victim's system the moment the printed CLI block is copied and pasted into a terminal. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; risk hinges on the victim copy-pasting attacker-influenced output.
SQL injection in toools Isquad exposes the '/ws/apiprensa/getVideoNextPrev' endpoint to unauthenticated database manipulation through the unsanitized id_ambito parameter, which is concatenated directly into a MariaDB query. Remote attackers can inject arbitrary SQL syntax to break query execution, trigger verbose database error messages, and enumerate the internal query and schema structure, which facilitates full data extraction. Reported by INCIBE with a vendor patch available; no public exploit identified at time of analysis and it is not listed in CISA KEV.
SQL injection in Toools iSquad's '/ws/apiprensa/getVideoSubcanal' API endpoint lets remote unauthenticated attackers manipulate backend database queries via the unsanitized 'id_video' parameter. Failed injection attempts trigger the Slim framework's default error handler, which discloses internal file paths and full stack traces, compounding the SQLi with an information-disclosure primitive. No public exploit has been identified at time of analysis, but a vendor patch is available via INCIBE advisory INCIBE-CERT.
Channel hijack and denial of service in FastGPT (labring/FastGPT) before 4.15.2 lets an unauthenticated remote attacker take over or disable a victim team's WeChat (iLink) bot binding. The WeChat share-channel endpoints authorize on the public shareId alone with no identity or team-ownership check, so an attacker who reads a shareId from any shared chat URL can wipe the stored WeChat token (offlining the bot) or bind the app to their own bot to siphon the team's private responses. No public exploit identified at time of analysis, but the flaw is trivially triggerable and fixed in version 4.15.2.
Signature verification bypass in openssl_encrypt (the jahlives Python encryption library) before version 1.4.9 lets attackers who possess a revoked or expired-but-formerly-trusted GPG signing key defeat plugin authenticity checks and run malicious code in the host process. The flaw lives in gpg_runner.verify_detached, which treats a VALIDSIG status line as success while ignoring REVKEYSIG, EXPKEYSIG, and gpg's own exit code. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV, but the network-reachable, unauthenticated CVSS 4.0 score of 9.3 marks it as high priority for any deployment that loads signed plugins.
Account takeover affects the 3DPassport identity component bundled with Dassault Systèmes 3DSwymer across 3DEXPERIENCE releases R2023x through R2026x, where an improper authorization flaw (CWE-285) lets a remote, unauthenticated attacker who lures a victim into interacting with crafted content gain access to some user accounts. Because 3DPassport is the platform's single-sign-on gateway, a successful attack yields high confidentiality and integrity impact and crosses a trust boundary (scope-changed) into downstream 3DEXPERIENCE apps. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score supplied.
SQL injection in toools Isquad lets remote unauthenticated attackers manipulate database queries via the id_seccion parameter of the '/ws/apiprensa/getVideoUltimasSeccion' web-service endpoint. The parameter is concatenated into a complex query using grouping and sorting, letting an attacker break the query structure, trigger database errors that leak internal query logic, and potentially extract or alter content-retrieval data. No public exploit is identified at time of analysis, though the flaw is trivially reachable (AV:N/AC:L/PR:N) and carries a 9.3 CVSS 4.0 score.
Stored cross-site scripting escalating to remote code execution affects TriliumNext Trilium versions up to and including 0.103.0, where the default-on "Safe import" filter sanitizes HTML for text notes but omits the 'book' note type. Because book-note content is rendered through the same HTML path as text notes and injected via jQuery's html() in grid-view preview cards, an attacker-supplied import archive can smuggle an executable payload past sanitization; on the Electron desktop client with Node integration enabled this becomes full RCE. No public exploit identified at time of analysis, though the upstream fix commit ships a proof-style test payload, and it is not listed in CISA KEV.
Stored cross-site scripting escalating to remote code execution affects TriliumNext Trilium through version 0.103.0, where the default-on "Safe import" filter sanitizes HTML only for text notes and skips the mindMap note type entirely. An attacker who gets a victim to import a crafted note archive can embed a dangerouslySetInnerHTML payload in the mind map's unsanitized JSON, which Mind Elixir assigns directly to a node's innerHTML when the map is opened; on the Electron desktop client, Node integration turns that XSS into full RCE. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV; the issue is fixed in version 0.104.0.
Stored cross-site scripting escalating to remote code execution affects TriliumNext Trilium through version 0.103.0, where an attacker-supplied import archive can carry a note whose title contains an HTML event-handler payload. The default-on "Safe import" filter strips scripts but never escapes titles, and the GeoMap view interpolates the marker note's title directly into innerHTML, so the payload fires the moment the victim opens the map; on the desktop Electron client, Node integration turns that XSS into full RCE on the victim's host. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the flaw is fixed in version 0.104.0.
Terminal escape-sequence injection in jahlives openssl_encrypt before 1.4.9 lets an attacker embed control characters in a file's metadata that are emitted verbatim when a victim runs the tool's 'info' command, letting the attacker repaint the terminal and forge the integrity/verification output the tool displays. The practical impact is spoofing: a tampered or malicious file can be made to appear verified or trustworthy to the operator. No public exploit identified at time of analysis, and the flaw requires the victim to run 'info' on attacker-supplied input.
Terminal escape-sequence injection in jahlives' openssl_encrypt (a Python OpenSSL-based file encryption utility) before 1.4.9 lets an attacker embed ANSI/VT control sequences in the key_id field of a crafted encrypted file; because the tool prints this attacker-controlled value unescaped to stderr during decrypt key auto-detection, an attacker can repaint the terminal and forge authenticity-verification output to deceive the operator. Any user who decrypts a malicious file is affected. This is a CWE-117 output-neutralization flaw reported by VulnCheck with no public exploit identified at time of analysis and no CISA KEV listing.
Verdict spoofing in the openssl-encrypt pip package (versions <= 1.4.8) lets an attacker who controls the contents of a scanned drive forge a PASSED tamper-check result. Because filenames read from untrusted drive data are printed by the verify-usb command without neutralizing terminal control bytes, crafted names containing cursor-movement and erase-line sequences can repaint the screen to hide genuine tamper detection. There is no public exploit identified at time of analysis and it is not in CISA KEV; the issue is fixed in 1.4.9, which routes drive-derived names through sanitize_for_display().
Output-encoding text injection in jahlives openssl_encrypt before 1.4.9 lets an attacker forge the desktop GUI's irreversible-removal confirmation dialog. By embedding bidirectional-override and line-separator control characters in the recovery-slot identifier of a crafted encrypted file, an attacker can rewrite the warning text a victim sees, tricking them into approving destructive file-removal operations. No public exploit is identified at time of analysis, and the record is not in CISA KEV; the published 9.3 CVSS 4.0 rating appears inflated relative to the spoofing-only mechanism.
Cryptographic-integrity bypass in the openssl_encrypt file-encryption utility (jahlives) before 1.4.9 lets an attacker edit the header of an envelope-format encrypted file to delete recovery-slot fields without any key and without re-encrypting the payload. Because recovery-slot presence is never cryptographically verified (CWE-347), recovery paths that the owner deliberately added can be silently stripped and the tampering goes undetected. There is no public exploit or CISA KEV listing at time of analysis, and no EPSS score was supplied; the action is trivially performed by anyone able to modify the file, which drives the critical CVSS 4.0 score of 9.3.
Signature-trust bypass in the openssl_encrypt Python library (PyPI 'openssl-encrypt') versions 1.4.8 and earlier lets an attacker get a forged GPG key enrolled as a plugin-signing trust anchor. Because enroll_trust_key matches key fingerprints with a suffix-tolerant comparison, an operator who verifies only a short (~32-bit, forgeable) GPG key id can be tricked into trusting an attacker-controlled colliding key, which then validly signs malicious plugins even under the strict ENFORCE signature policy. No CISA KEV listing and no public exploit identified at time of analysis; the fix is in 1.4.9.
Silent cryptographic key substitution affects openssl_encrypt (the jahlives Python encryption library) before 1.4.9, which loads identities from identity.json without re-deriving and validating their fingerprints. An attacker who can tamper with an identity store can swap in their own public keys while preserving the claimed fingerprint, so the library encrypts data to attacker-controlled keys and treats attacker signatures as valid without any visible warning. No public exploit has been identified at time of analysis, and the flaw is not listed in CISA KEV.
Silent cryptographic key substitution in jahlives openssl_encrypt before 1.4.9 lets attackers register 'shadow' contact entries in the IdentityStore whose namespace collides with a user's own identity, staying hidden until that own identity is deleted. Once the own identity is removed, the attacker-controlled contact surfaces and resolves to the attacker's keys, so files subsequently encrypted for that identity are protected with keys the attacker holds. No public exploit is identified at time of analysis, and the issue is not in CISA KEV; the high CVSS 4.0 score (9.3) reflects the severe confidentiality and integrity impact of undetected key substitution.
Sensitive-file exposure in the openssl-encrypt pip package (openssl_encrypt) at versions <= 1.4.8 stems from its 'Encrypted USB Workspace' feature writing a marker that falsely declares the workspace AES-256-GCM encrypted while the derived key is never applied and the directory remains in cleartext. Users who trust the branding and store files in the workspace leave them fully readable on the removable media, so anyone with physical possession of the USB device can recover the data. No public exploit identified at time of analysis and the flaw is not in CISA KEV, but the failure silently defeats the product's core security promise.
Cryptographic integrity bypass and weak key derivation in the openssl-encrypt Python package (jahlives) before 1.4.9 let an attacker with physical write access to a portable USB drive plant an undetected root-level autorun payload and precompute the drive encryption key offline. The integrity verifier only checks manifest-listed files, so added files pass verification, while a hard-coded fallback KDF salt (_LEGACY_FIXED_SALT) enables an offline rainbow-table attack against drives lacking a per-drive salt. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Authentication bypass in the Telnyx MCP server (team-telnyx/telnyx-node, through 6.83.0) lets any network-reachable caller invoke MCP tools with no credential. The Streamable HTTP transport bound to all interfaces and parsed auth headers in a non-failing mode, so a request lacking credentials still completed initialisation and dispatched tools - which then forwarded the server's own stored Telnyx API key, client secret, and code-execution key upstream. Reported by VulnCheck with CVSS 4.0 9.3; no public exploit identified at time of analysis.