Unauthenticated access to a publicly reachable debug log file in the WP OAuth Server (Login with WordPress) WordPress plugin before 6.3.1 exposes sensitive credential material to any network attacker. When debug logging is enabled, the plugin writes OAuth tokens, authorization codes, and full user records including bcrypt password hashes to a fixed, predictable filesystem path that is served without access restriction. No public exploit has been identified at time of analysis, though the attack is fully automatable per SSVC assessment and requires no authentication.
WebFlux applications in Spring Framework running on the Jetty 12 Core reactive adapter omit the SameSite cookie attribute from serialized response cookies, exposing session and authentication cookies to cross-site request contexts. Affected versions span Spring Framework 6.2.0-6.2.19 and 7.0.0-7.0.8, covering a substantial footprint of reactive Java deployments on Jetty 12. The vulnerability carries a vendor CVSS of 7.5 with C:H reflecting potential session-token disclosure; no public exploit code or active exploitation (CISA KEV) has been identified, and EPSS places exploitation probability at 0.14% (4th percentile).
Spring WebFlux applications that enable WebSocket connections leak request headers - potentially containing Authorization tokens, session cookies, or API keys - through exception reason messages exposed over the WebSocket channel. All maintained Spring Framework release trains from 5.2.x through 7.0.x are affected, covering the vast majority of actively deployed Spring reactive applications. The vulnerability is classified as information disclosure (CWE-209), and while the CVSS score is 7.5, the EPSS score of 0.14% (4th percentile) indicates very low observed exploitation probability; no public exploit or CISA KEV listing exists at time of analysis.
Cross-origin data exfiltration in Spring for GraphQL exposes confidential application data when a victim browses a crafted URL pointing to the bundled GraphiQL interface. The GraphiQL IDE, intended for development use, can be weaponized to direct the victim's authenticated browser session to send GraphQL queries whose responses are leaked to an attacker-controlled origin. All major release lines from 1.0.0 through 2.0.4 are affected; no public exploit has been identified and the EPSS score sits at the 4th percentile, but the high confidentiality impact (C:H) and scope change make this notable for any deployment with GraphiQL exposed beyond trusted networks.
Unsafe Java deserialization in Spring Batch's DefaultExecutionContextSerializer exposes the JDBC job repository to potential remote code execution via gadget-chain exploitation. The serializer passes Base64-decoded bytes directly to ObjectInputStream.readObject() without an ObjectInputFilter restricting instantiable types, creating a CWE-502 attack surface that any suitable gadget chain on the classpath can weaponize. Affected versions span Spring Batch 5.2.6 and earlier and 6.0.0 through 6.0.4; no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Hard-coded credentials in the Bendix EC80ESP and EC80ESP+ Brake ECU family allow an adjacent-network attacker to bypass authentication and disable automatic traction control and electronic stability program functions on commercial heavy vehicles. All ten identified EC80ESP/EC80ESP+ variants across J1708, CAN, PLC, and TPMS configurations are affected, with no version exclusion identified in CPE data. No public exploit or KEV-confirmed active exploitation has been identified, though the safety-critical nature of the affected system significantly amplifies real-world operational risk beyond the moderate CVSS score.
Clickjacking vulnerability in the Ebyte NE2-D11 industrial IoT device web management interface enables a remote unauthenticated attacker to embed the administrative UI within a crafted external webpage. By luring an authenticated administrator to visit the malicious page, an attacker can trick that administrator into submitting unintended configuration changes or triggering disruptive actions against the device. Reported by CISA ICS-CERT under advisory ICSA-26-237-06; no public exploit identified at time of analysis.
PHP Object Injection in the Fluent Boards Pro WordPress plugin (versions 2.0.11 and earlier) allows authenticated administrators to pass arbitrary serialized PHP data through the editor component, triggering unsafe deserialization on the server and potentially achieving remote code execution, file writes, or full system compromise. The vulnerability is classified as CWE-502 and carries a CVSS 3.1 score of 7.2 (High), with full Confidentiality, Integrity, and Availability impact. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Privilege escalation in FluentCRM Pro (WordPress plugin, versions <= 3.1.12) allows authenticated users holding the Editor role to elevate their access level, yielding full confidentiality, integrity, and availability impact against the WordPress installation. Reported by Patchstack and scored CVSS 7.2 with PR:H, the flaw is rooted in CWE-266 (Incorrect Privilege Assignment), meaning the plugin fails to correctly enforce role boundaries for Editors interacting with CRM functionality. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Privilege escalation in Bluewave Labs Checkmate <=3.3.0 allows authenticated administrators to self-elevate to the superadmin role by supplying an arbitrary role value via the role parameter in the POST /api/v1/invite API endpoint, handled by inviteController.js. The flaw stems from improper privilege management (CWE-269): the invite handler trusts the caller-supplied role field without enforcing that admins cannot grant themselves or others a higher tier than their own. A researcher's write-up and code sample are publicly referenced via GitHub Gist and an Outline blog post, indicating at minimum a working proof of concept exists. No active exploitation has been confirmed and EPSS sits at 0.22% (12th percentile), consistent with a niche, authenticated-only attack surface.
Broken object-level authorization across Flowintel task endpoints allows authenticated editor-level users to perform unauthorized operations on tasks belonging to cases they do not own. Flowintel versions >= 3.3.0 accept a case ID and task ID pair on task-related routes but previously failed to verify that the referenced task actually belonged to the supplied case, enabling cross-case data access and manipulation. No public exploit or CISA KEV listing exists at time of analysis, but the CVSS 4.0 score of 7.2 reflects high integrity impact - affected operations include task editing, deletion, note management, file handling, assignment, MISP-linking, and export.
Privilege escalation to network-wide remote code execution in the Smush WordPress plugin (versions 3.22.1 through 4.3.2) allows any authenticated single-site administrator on a WordPress multisite network to execute arbitrary code across all sites in that network. The flaw arises because the plugin's network-wide configuration interface fails to restrict access to network administrators only, permitting lower-privileged site admins to reach settings with cross-network impact. No public exploit has been identified and SSVC confirms no active exploitation, though the technical impact is rated 'total' given successful exploitation grants full control over the entire multisite infrastructure.
Privilege escalation in the CMP WordPress plugin before 4.1.18 allows Editor-role users to overwrite arbitrary WordPress options via an unguarded AJAX settings-import action, ultimately achieving full Administrator access. The flaw is contingent on an administrator having explicitly granted Editor-role users access to CMP's admin-bar controls - a non-default configuration - making real-world exposure narrower than the CVSS 7.2 score implies. No active exploitation is confirmed (absent from CISA KEV), and the EPSS score of 0.13% at the 3rd percentile corroborates the SSVC assessment of exploitation status 'none'; however, SSVC rates technical impact as 'total' given that successful exploitation yields unrestricted site control.
Path traversal in Volmarg Personal Management System exposes arbitrary server-side files to any authenticated user through the GET /public/get-file/{path} endpoint. The Symfony PHP controller forwards the route parameter directly to file_get_contents() without canonicalization or base-directory enforcement, making absolute filesystem paths such as /etc/passwd or application .env files fully retrievable within the PHP-FPM worker's permission boundary. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and high confidentiality impact make this an urgent remediation target for any self-hosted deployment storing sensitive personal or credential data.
Flowintel's PDF export pipeline passes attacker-controlled note content to Pandoc with the raw_tex extension enabled, allowing authenticated users to inject XeLaTeX directives such as \input{} or \verbatiminput{} that cause the server to read arbitrary local files and embed their contents into the exported PDF. Any authenticated user with note-editing access can exploit this to exfiltrate sensitive server-side files - credentials, keys, or intelligence data stored on the host. No public exploit has been identified at time of analysis, but the LaTeX injection-to-file-read technique is well-documented and requires no specialized tooling.
Spring Data REST fails to protect entity identifier (@Id) and optimistic-locking version (@Version) fields from mutation through RFC 6902 JSON Patch (application/json-patch+json) PATCH requests, allowing authenticated low-privilege network attackers to overwrite primary keys and version counters on exposed JPA entities. Affected versions span the full 3.x lineage through 5.1.0, representing a broad swath of the Spring ecosystem. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Unauthenticated XSS in the WP w3all phpBB WordPress plugin (versions 3.0.6 and earlier) allows remote unauthenticated attackers to inject malicious scripts into pages served to victims, with scope change confirmed by the CVSS vector. Any WordPress site running this plugin at or below version 3.0.6 is exposed: no login or elevated privileges are required to craft a malicious payload, though successful exploitation requires victim interaction (UI:R), limiting opportunistic mass compromise. No public exploit code or active exploitation has been identified at time of analysis, but the low complexity and zero-authentication barrier make this straightforward to exploit once a target is identified.
Unauthenticated Cross-Site Scripting in the CozyStay WordPress theme (versions 1.10.0 and earlier) by Loftocean allows a remote, unauthenticated attacker to inject arbitrary JavaScript into pages viewed by victims, crossing the security boundary into the victim's browser (S:C per CVSS vector). Exploitation requires social engineering a target into visiting a crafted URL, making phishing a prerequisite step. No public exploit code and no active exploitation via CISA KEV have been identified at time of analysis.
Cross-site scripting in Music Player for WooCommerce plugin version 1.8.9 and earlier allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in victims' browsers when they interact with a crafted link or page. The flaw targets WooCommerce stores running the Codepeople plugin and could enable session hijacking, credential theft, or malicious redirects against store customers or administrators. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated cross-site scripting in the CP Media Player WordPress plugin (versions 1.3.0 and earlier, by Codepeople) allows a remote unauthenticated attacker to inject arbitrary JavaScript into a victim's browser session by tricking them into visiting a crafted URL. Because the CVSS vector indicates a scope change (S:C), successful exploitation affects the victim's browser context beyond the plugin itself - enabling session hijacking, credential theft, or redirection to malicious infrastructure. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Cross-site scripting in the Realtyna Organic IDX WordPress plugin (versions 5.4.1 and below) allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in victims' browsers. The plugin, used by real estate agencies for MLS/IDX property listing integration on WordPress sites, fails to properly sanitize or encode attacker-controlled input before reflecting it in HTML output. With scope change (S:C in the CVSS vector), successful exploitation can compromise the victim's session, harvest credentials, or perform unauthorized actions on the site on the victim's behalf. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Incorrect authorization in Dolibarr's REST API before version 23.0.4 allows authenticated users holding only read-level module permissions to permanently delete documents via the DELETE /api/index.php/documents endpoint. The flaw in Documents::delete() at htdocs/api/class/api_documents.class.php passes the mode argument 'read' rather than 'write' to dol_check_secure_access_document(), meaning any API account with societe:lire, facture:lire, or equivalent read-only grants can irrecoverably destroy third-party files, invoices, orders, proposals, project files, and generated PDFs. No public exploit has been identified at time of analysis, but the corrective one-line commit diff is publicly visible on GitHub, making the flaw trivial to weaponize for any holder of low-privilege API credentials.
Injection via unsanitized namespace identifiers in the MongoDB Rust Driver's Client::bulk_write operation allows an authenticated actor who can influence database or collection name arguments to redirect write operations to an unintended database within the same MongoDB deployment, using the application's own credentials. All versions of the mongodb crate prior to v3.8.2 are affected per vendor release notes; no public exploit or CISA KEV listing exists at time of analysis. The high integrity impact (VI:H in the CVSS 4.0 vector) reflects the potential for unauthorized modification of co-tenanted or privileged data across application-enforced logical boundaries.
Namespace injection in MongoDB Go Driver's Client.BulkWrite API allows an attacker who controls the database name argument to redirect bulk write operations to an unintended database and collection. When an application passes untrusted, user-supplied input directly as a database name, the driver fails to escape reserved MongoDB namespace separator characters before constructing the target namespace string. The impact is a high-integrity write misdirection - data is silently written to attacker-influenced storage targets. No public exploit and no CISA KEV listing exist at time of analysis.
Connection-option injection in the MongoDB C# Driver allows a low-privileged application user to introduce or suppress security-relevant MongoDB connection settings by embedding URL delimiter characters in user-supplied input. When an application passes untrusted text into the driver's connection-URL builder and the resulting string is re-parsed as authoritative client configuration, the injected delimiters are treated as structural URL syntax rather than literal data - allowing options such as TLS mode or authentication parameters to be overridden. No public exploit has been identified at time of analysis; vendor-confirmed patch is available as version 3.11.1 on NuGet.
Plaintext administrative credential exposure in the Ebyte NE2-D11 firmware management interface allows anyone with physical access to directly observe device credentials without any authentication or tooling. Reported by ICS-CERT under advisory ICSA-26-237-06, the flaw (CWE-522) affects all known firmware versions per CPE data, with a physical attack vector (AV:P) confirming that exploitation requires proximity to the device. Credential capture could enable full administrative control over the device, with downstream risk to industrial operations where the NE2-D11 is deployed. No public exploit has been identified and the vulnerability is not listed in CISA KEV.
FrontAccounting 2.4.20 and earlier selectively enforces CSRF validation - tokens are generated for every rendered form but the validation call is absent from all financial transaction handlers, including journal entries, supplier invoices, customer payments, bank transactions, and company configuration. An attacker who can induce an authenticated FrontAccounting user to visit a malicious page can silently forge any of those POST requests under the victim's live session, recording fraudulent accounting data without the victim's awareness. No public exploit identified at time of analysis, though a detailed researcher disclosure with technical specifics is publicly available on GitHub.
Reflected cross-site scripting in Siemens Element maps-ng allows a network-accessible attacker with low privileges to execute arbitrary JavaScript in a victim's browser session by crafting a malicious URL containing an unsanitized payload in the si-map component's points property. Affected are all V47 builds prior to V47.12.3, all V48 builds prior to V48.11.3, and all V49 builds prior to V49.16.1. Exploitation requires the victim to load the crafted URL and hover over a map pin to trigger tooltip rendering, at which point the injected script executes with full access to the victim's browser session context. No public exploit code or CISA KEV listing has been identified at time of analysis.
Incomplete NAT64 prefix filtering in CC: Tweaked prior to 1.120.0 allows any Lua-capable Minecraft player on a dual-stack server to bypass SSRF protections and reach loopback, RFC 1918, cloud metadata, or internal API endpoints. The flaw resides in AddressPredicate.java, which correctly blocks the RFC 6052 Well-Known NAT64 prefix (64:ff9b::/96) but omits the RFC 8215 Local-Use prefix (64:ff9b:1::/48), enabling requests via http.request or http.websocket to mapped internal IPv4 addresses. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog; exploitation requires a non-default dual-stack NAT64 deployment.
Server-side request forgery in AVideo before 24.0 allows unauthenticated network attackers to bypass SSRF protections in the isSSRFSafeURL function by encoding private IPv4 targets inside NAT64, 6to4, or Teredo IPv6 transition address formats. The LiveLinks proxy endpoint serves as the attack surface, enabling requests to reach internal network services and cloud instance metadata endpoints (e.g., 169.254.169.254 equivalents) that should be unreachable. No active exploitation is confirmed (not in CISA KEV) and no public proof-of-concept has been identified at time of analysis; however, the unauthenticated network vector and patch availability make this a straightforward prioritization for any AVideo operator.
Log injection in Flowintel versions 3.3.0 and later allows unauthenticated remote attackers to forge arbitrary log lines by supplying email values containing CR/LF characters at the login endpoint. The vulnerability traces to a misuse of WTForms validation - the code constructed a validator object via Email(email) without invoking it, leaving attacker-controlled input unsanitized before it was interpolated into both the standard warning logger and the custom audit logger via Python f-strings. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the attack is trivially executable with a single HTTP request against any network-exposed deployment, and its impact falls directly on security logging integrity rather than application confidentiality or availability.
OpenFaaS gateway versions 0.27.11 through 0.27.13 expose the administrative GET /system/telemetry route without authentication even when basic_auth is enabled, allowing any network-reachable client to retrieve provider telemetry data without credentials. The TelemetryHandler was omitted from the auth.DecorateWithBasicAuth wrapper applied to all other /system/* routes - confirmed by fix commit 8d803bf9 in the official repository. No active exploitation is confirmed (not in CISA KEV), though a researcher advisory is publicly available and a patch exists in version 0.27.14.
Uncontrolled recursion in NLTK's FeatStructReader component (all versions before 3.10.3) enables unauthenticated remote attackers to crash any Python application that parses user-supplied feature structures or feature grammars. Attackers submit trivially crafted payloads containing deeply nested brackets, exhausting Python's call stack and raising an unhandled RecursionError that terminates the application process. No active exploitation has been confirmed by CISA KEV, and no public exploit code has been identified at time of analysis; a vendor patch is available in NLTK 3.10.3.
WatchGuard Dimension, the network security visibility and management platform, contains a business logic flaw (CWE-284) that permits an authenticated administrator to trigger multiple backend operations within a single logical request flow by sending a specially crafted HTTP request. All versions of Dimension are listed as affected via the wildcard CPE, and the impact is high confidentiality exposure on the Dimension system itself with limited subsequent-system effect. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists, but the PR:H requirement constrains exploitation to actors who already hold or have compromised administrator credentials.
Remote code execution in Spring Batch 5.2.0-5.2.6 and 6.0.0-6.0.4 arises because the JobParameterDeserializer fails to enforce the trusted-types allowlist when Jackson2ExecutionContextStringSerializer deserializes execution contexts from a job repository backed by an untrusted data source. An attacker who can plant crafted execution-context data can trigger known Jackson polymorphic deserialization gadgets to execute arbitrary code in the batch application's process. No public exploit identified at time of analysis; EPSS is low (0.25%, 16th percentile) and CISA SSVC lists exploitation status as none, so the 9.8 CVSS reflects worst-case impact rather than observed activity.
Heap-based buffer overflow in WatchGuard Fireware OS's iked process allows an authenticated administrator to crash the IKE daemon by saving a specially crafted configuration, resulting in denial of service and disruption of IPsec VPN services. The CVSS 4.0 score of 6.9 with PR:H reflects the high-privilege requirement, meaning exploitation is gated behind valid administrator credentials. No active exploitation has been identified (not in CISA KEV) and no public exploit code is known at time of analysis.
Unauthenticated content tampering in Joomla Event Manager before version 5.0.1 permits any anonymous visitor to overwrite and force-publish articles linked to events on the affected Joomla site. Rooted in CWE-284 (Improper Access Control), the extension fails to enforce authorization before processing article modification requests, treating a routine guest session token - automatically issued to every site visitor - as sufficient proof of permission. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-authentication barrier means exploitation requires no special tooling or credentials.
Cleartext transmission of OAuth credentials in RooCodeInc Roo-Code up to version 3.51.1 exposes sensitive OAuth tokens to interception via the OAuth callback handler in src/integrations/claude-code/oauth.ts. The vendor has officially archived the repository and explicitly discourages continued use, meaning no patch will be issued. A public proof-of-concept is available on GitHub, though high attack complexity (requiring a network interception position) constrains opportunistic exploitation.
NoSQL injection in the MongoDB C# Driver's LINQ-to-aggregation translation layer allows network-accessible, unauthenticated attackers to manipulate database queries by embedding special elements in application-supplied values. Affected applications using LINQ query constructs that incorporate user-controlled input fail to properly escape those values before transmission to MongoDB, enabling query logic injection. The CVSS 4.0 score of 6.9 (AV:N/AC:L/PR:N/UI:N) reflects broad reachability with limited but real data confidentiality and integrity impact; no public exploit or CISA KEV listing is identified at time of analysis.
Filesystem containment bypass in NLTK's Downloader component allows local attackers with write access to a shared download directory to overwrite arbitrary files outside the intended install root by planting hardlinks before a download operation. All NLTK versions prior to 3.10.3 are affected via the Downloader.download and Downloader.incr_download methods, which fail to validate link targets during package extraction. No public exploit has been identified at time of analysis; risk is highest in shared multi-user environments such as HPC clusters or build servers where the NLTK data directory is world- or group-writable.
Uncontrolled resource consumption in the jahlives openssl_encrypt PHP library (versions before 1.4.9) allows local attackers with write access to identity stores to crash the host by supplying an excessively large memory_cost parameter in a crafted identity file. The flaw manifests during Argon2 key derivation when the library unlocks identities prior to authentication, triggering an out-of-memory condition on the host. No public exploit code has been identified at time of analysis, and this vulnerability has not been added to the CISA KEV catalog.
Local information disclosure in the openssl-encrypt pip package (versions ≤ 1.4.8) exposes steganography passwords to all unprivileged users on the same Linux host. When the desktop GUI initiates an encrypt or decrypt operation involving the steganography feature, it spawns a CLI child process with the password supplied as the `--stego-password` command-line argument rather than via an environment variable, making it readable from `/proc/<pid>/cmdline` for the entire subprocess lifetime by any local user. The main encryption password is handled correctly via environment variable and is unaffected. A vendor-released patch is available in version 1.4.9; no public exploit has been identified at time of analysis.
The optional D-Bus crypto service in jahlives/openssl_encrypt 1.4.x before 1.4.9 exposes org.freedesktop.DBus.Properties.Set without polkit authorization or input validation, enabling any local system-bus user to persistently disable the root daemon. Setting MaxConcurrentOperations to zero or a negative value causes the concurrency gate to reject all subsequent cryptographic requests from the daemon; setting it to an arbitrarily large value or manipulating DefaultTimeout degrades stability in the opposite direction. No public exploit code has been identified at time of analysis, and the flaw is not listed in CISA KEV.
Arbitrary file deletion in Fluent Boards Pro (WordPress plugin) versions up to and including 2.0.11 allows authenticated Editor-level users to delete files anywhere on the server via path traversal. The changed scope (S:C in the CVSS vector) indicates that deletion can extend to files outside the WordPress installation - including potentially critical OS-level or application files - causing severe availability impact. No public exploit code or CISA KEV listing is identified at time of analysis.
Out-of-bounds read and write primitives in the hank-ai Darknet neural network framework (all versions through 6.0) are triggered by parsing a crafted configuration file, yielding a reliable crash and a single fixed-byte heap write at an attacker-controlled offset. The parser in src-lib/darknet_cfg.cpp consumes the `from` field of shortcut, scale_channels, and sam sections-and the `layers` field of route sections-as a direct array index into the layer heap allocation without validating it against the array's declared size. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Token exfiltration in airtable-mcp-cli before 0.2.5 allows an attacker who convinces a user to run the configure command with a malicious endpoint URL to receive the user's Airtable personal access token on every subsequent CLI invocation. The root cause is that ConfigureCommand.execute in src/cli.ts persisted the --endpoint option directly into the user profile, bypassing the createSafeUrl helper in src/config.ts that already enforced HTTPS and vendor-host restrictions for the environment-variable pathway. Because src/mcp.ts attaches the stored token as a bearer credential on every outbound request, the stolen token grants full API-level access to the victim's Airtable account. No public exploit or CISA KEV listing has been identified at time of analysis.
Unauthenticated notification injection in APITable through 1.13.0-beta.1 permits any network-reachable client to write arbitrary messages into any user's inbox by exploiting a missing-authentication annotation on the internal notification create endpoint. The InternalNotifyController marks its create handler with requiredLogin = false, causing ResourceInterceptor to skip all session and API key validation; because the nginx gateway bundled with the product proxies every /api path to the Java backend, the endpoint POST /api/v1/internal/notification/create is fully exposed to unauthenticated callers. Setting fromUserId to 0 makes injected messages render as legitimate system notifications, enabling platform-wide social-engineering attacks; no public exploit code has been identified at time of analysis, though the flaw is documented in a public GitHub issue (no KEV listing).
Symlink redirection in Spring Integration's Zip/UnZip transformer allows a local unprivileged user sharing the same host to hijack transformer output by pre-creating /tmp/ziptransformer as a symlink before application startup. Affected versions span the 6.4, 6.5, 7.0, and 7.1 release lines, covering a wide range of enterprise Java deployments that use Spring Integration's file transformation capabilities. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, though the integrity and availability impact is rated High by the vendor-assigned CVSS score.
Reflected XSS in Netron desktop application versions 9.1.2 and earlier enables arbitrary JavaScript execution within the Electron/Chromium renderer by injecting payloads into unsanitized model node names, types, and attribute descriptions. Reported by HiddenLayer, the vulnerability allows an attacker who can deliver a crafted ML model file to hide graph nodes, conduct local network port scanning, and - when chained with a Chrome n-day exploit - escalate to full Remote Code Execution on the victim's machine. No public exploit has been identified at time of analysis, and the CVE is not currently listed in the CISA KEV catalog.
Reflected XSS in Netron ≤9.1.2 desktop application executes attacker-controlled JavaScript when a user opens a specially crafted ML model file containing malicious node names, descriptions, or type labels. Because Netron is Electron-based, XSS runs in a privileged Chromium renderer context - enabling SSRF-style local port scanning and, when chained with an unspecified Chrome n-day vulnerability, potential remote code execution on the host. No public exploit confirmed at time of analysis, but HiddenLayer published a security advisory documenting the impact chain.