Job deduplication in the cakephp/queue plugin can be bypassed by attackers who control job parameter data, causing legitimate unique jobs to be silently dropped. The flaw affects all applications using `shouldBeUnique = true` on job classes where user-supplied input is passed as job parameters - versions 0.1.10 through 2.3.0. No public exploit identified at time of analysis, and the CVSS score of 3.7 (AV:N/AC:H) reflects that exploitation requires knowledge of the target application's job parameter schema.
Cleartext transmission of OAuth credentials in RooCodeInc Roo-Code up to version 3.51.1 exposes sensitive OAuth tokens to interception via the OAuth callback handler in src/integrations/claude-code/oauth.ts. The vendor has officially archived the repository and explicitly discourages continued use, meaning no patch will be issued. A public proof-of-concept is available on GitHub, though high attack complexity (requiring a network interception position) constrains opportunistic exploitation.
Path traversal in arben-adm mcp-sequential-thinking versions up to and including 0.5.0 allows remote low-privileged attackers to read or write arbitrary files on the server by supplying unsanitized path sequences to the `import_session` and `export_session` functions in `server.py`. A publicly disclosed proof-of-concept exists (GitHub issue #17), and the fix is available in v0.6.0 via commit 2fad3ee8. The CVE is not listed in CISA KEV, indicating no confirmed mass exploitation, but the public PoC meaningfully elevates practical risk above the moderate CVSS score alone.
Path traversal in RooCodeInc Roo-Code through version 3.51.1 allows remote unauthenticated attackers to read and write files outside the intended working directory by manipulating input processed by the path.resolve function in ApplyPatchTool.ts. The vendor has confirmed they archived the repository and discontinued all support, meaning no patch will ever be released. Publicly available exploit code exists via a GitHub Gist, and no vendor-released patch identified at time of analysis - organizations still running this tool are permanently exposed.
Code injection in RooCodeInc Roo-Code through version 3.51.1 allows remote attackers to execute arbitrary code via the ExecaTerminalProcess function in the README File Handler, triggered by passive user interaction with a crafted README file. The vendor has explicitly archived the repository and confirmed no patch will be issued, leaving all installed instances permanently unpatched. A public proof-of-concept exploit is available on GitHub; however, no active exploitation has been confirmed by CISA KEV, and the CVSS 4.0 score of 2.1 reflects limited impact ratings across all three CIA pillars.
Path traversal in MAA-AI MaaMCP (versions up to 1.1.1.dev6+g2e4a41287) allows low-privileged remote users to read or write files outside the intended pipeline directory by supplying crafted path inputs to the save_pipeline and load_pipeline functions in pipeline_tools.py. Publicly available exploit code exists (referenced in GitHub issue #31), though no active exploitation has been confirmed by CISA KEV. The CVSS 4.0 score of 5.1 (Medium) reflects the authentication requirement and limited per-impact severity, but the public POC elevates practical risk above the base score alone.
Code injection in RooCodeInc Roo-Code up to version 3.51.1 allows a remote low-privileged attacker to execute injected code via the `fetch_instructions` function within the MCP (Model Context Protocol) Integration Trust Model component (`malicious_mcp_server.py`). A publicly available proof-of-concept exploit exists on GitHub. Critically, the vendor has explicitly confirmed the product is no longer maintained - the repository is archived - meaning no patch will ever be released, permanently leaving all deployed instances vulnerable.
Code injection in RooCodeInc Roo-Code up to version 3.51.1 allows a remote, low-privileged attacker with passive user interaction to inject and execute arbitrary code via the `optimizeQuery` function in the CodeIndexManager component (`src/utils/helpers.ts`). A public proof-of-concept exploit exists on GitHub. Critically, the vendor has explicitly archived the repository and will not issue a patch, leaving all users of this product permanently unpatched.
OS command injection in AlexGladkov claude-in-mobile 3.10.2 allows a local low-privileged attacker to execute arbitrary shell commands by supplying metacharacter-laced parameters to the tool's ADB and iOS simulator CLI subsystem. The Rust CLI modules (android.rs, ios.rs) interpolated caller-supplied strings - package names, permission identifiers, XML filenames, preference keys, SQLite database paths, and relative file paths - directly into device-side sh -c invocations without sanitization. A public proof-of-concept exists (GitHub issue #40), and a vendor-released patch (v3.10.3) is available.
Spring Cloud Stream versions 5.0.0-5.0.2, 4.3.0-4.3.3, and 4.2.0-4.2.6 expose a deserialization of untrusted types flaw that could allow a network-positioned attacker with high privileges and required user interaction to gain limited read and write access to application data. The CVSS vector (AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N) reflects heavy exploitation constraints, making real-world abuse unlikely without insider-level access and specific preconditions. No public exploit code has been identified and the vulnerability is absent from CISA KEV at time of analysis.
Spring Cloud Stream's partition interceptor logic improperly inserts a partition interceptor during message sends under specific conditions, potentially routing messages to unintended partitions. Affected versions span three active release lines: 5.0.0-5.0.2, 4.3.0-4.3.3, and 4.2.0-4.2.6. An authenticated operator with high privileges who triggers a message send under the required conditions could cause limited information disclosure or message integrity degradation by routing data to an unintended partition consumer. No public exploit identified at time of analysis; CVSS score of 3.1 reflects the high access bar and narrow impact.
Improper content-type caching in the Avro component of Spring Cloud Stream can produce incorrect content-type metadata on processed messages, creating a low-severity information-disclosure and data-integrity risk. Affected versions span the 4.2.x, 4.3.x, and 5.0.x release trains. Exploitation requires network access, high privilege level, high attack complexity, and user interaction, making real-world impact minimal; no public exploit code or active exploitation has been identified at time of analysis.
Spring Cloud Stream's dynamic destination cache lacks an upper bound on its size, exposing applications to limited information disclosure and integrity concerns under constrained conditions. Affected versions span the 4.2.x, 4.3.x, and 5.0.x release lines, reported by VMware (Broadcom), the Spring project maintainer. No public exploit code exists and the vulnerability is not listed in CISA KEV; the low CVSS score of 3.1 reflects the highly constrained exploitation prerequisites including high privilege requirements and user interaction.
HTTP response splitting in Spring Framework affects applications that construct Content-Disposition HTTP headers by concatenating untrusted user-supplied file names without stripping CRLF characters, allowing remote attackers to inject arbitrary headers into HTTP responses. The vulnerability spans the entire actively-maintained Spring Framework lineage - versions 5.2.x through 7.0.8 - giving it a broad potential surface across Java enterprise application portfolios. No public exploit is identified at time of analysis, and EPSS at 0.16% (6th percentile) indicates low current exploitation probability.
HTTP header filtering deficiency in Spring Cloud Function versions 5.0.0-5.0.3, 4.3.0-4.3.4, 4.2.0-4.2.7, and 3.2.16 and earlier allows network-accessible authenticated attackers - under high-complexity conditions and requiring user interaction - to achieve limited confidentiality and integrity impacts via crafted HTTP headers. Reported by VMware, the flaw scores 3.1 (Low) under CVSS 3.1, with multiple compounding prerequisites that substantially restrict real-world exploitability. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Stored cross-site scripting in CMP WordPress plugin before version 4.1.18 allows Editor-role users - only when an administrator has explicitly delegated CMP admin-bar control access to them - to persist malicious scripts in the coming-soon page settings field. Any visitor who subsequently loads the coming-soon page executes the injected script in their browser. No public exploit code exists, EPSS stands at 0.15% (5th percentile), and SSVC marks exploitation as none, confirming this as a low-probability risk that is inert on standard WordPress installations lacking the non-default Editor delegation.
Spring Cloud Function's AWS adapter component may inadvertently write sensitive data to application logs, creating an information disclosure exposure across a wide range of maintained version branches (3.x through 5.x). The CVSS score of 3.1 reflects genuinely low severity - exploitation requires high privileges and high attack complexity - but the risk in regulated or multi-tenant environments is elevated if log stores are accessible to unauthorized parties or if sensitive data (credentials, payloads, tokens) persists in cloud-native logging services such as AWS CloudWatch. No public exploit code exists and no active exploitation has been identified at time of analysis.
Spring Cloud Function's composition lookup mechanism can be abused by a highly privileged attacker to poison the base function, potentially degrading the integrity and confidentiality of function execution across versions 3.2.16 and earlier through 5.0.3. The vendor-assigned CVSS base score of 3.1 reflects severely constrained exploitation prerequisites - high privilege level, high attack complexity, and required user interaction - substantially limiting realistic exposure. No public exploit code has been identified, and the vulnerability does not appear in the CISA KEV catalog at time of analysis.
Spring Cloud Function's ServerlessHttpServletRequest.isSecure() method returns an unchecked result that does not reflect the actual HTTP transport scheme, enabling applications that gate security decisions on this call to behave incorrectly. Affected versions span three active release lines: 5.0.0-5.0.3, 4.3.0-4.3.4, and 4.2.0-4.2.7. No public exploit code exists and the vulnerability is not listed in CISA KEV; the vendor-assigned CVSS of 3.1 (Low) reflects constrained exploitation prerequisites including high privilege and user interaction.
Spring Integration's default file-based metadata store writes persistent state to a world-readable file under java.io.tmpdir, exposing integration metadata to any local OS user on the affected host. All actively maintained branches are affected, spanning versions 5.5.21 and earlier through 7.1.0. No public exploit code or active exploitation has been identified at time of analysis; practical impact is limited to local confidentiality disclosure on shared or multi-user systems.
Session invalidation failure in HCL IntelliOps Event Management (IEM) v1.3 and v1.4 allows session tokens to persist as valid after an admin explicitly logs out or an administrator deletes the session. An attacker who has previously captured a valid session token - through network interception, XSS, or other means - can replay that token post-logout to retain unauthorized access to admin-level functionality. No public exploit code has been identified at time of analysis, and EPSS/KEV data are not available for this CVE.
Sensitive data exposure in Spring Cloud Stream versions 4.2.0-4.2.6, 4.3.0-4.3.3, and 5.0.0-5.0.2 allows logging of sensitive information - such as message payloads, headers, or configuration values - under specific conditions. The vulnerability is classified as information disclosure with a low CVSS base score of 3.1, reflecting the high attack complexity and privilege requirements. No public exploit code has been identified and this vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
DNS rebinding in Dropbox's mcp-server-dash (network mode) allows a malicious web page to reach the local MCP listener and invoke Dropbox API tools - company-search and file-detail - under the victim's stored Dropbox credential. The server bound to the loopback interface but performed no Host header validation, letting a browser issue cross-origin requests via a rebound domain that resolves to 127.0.0.1. No public exploit has been identified at time of analysis; CVSS 4.0 scores this at 2.3, reflecting the attack's prerequisites of user interaction and a specific deployment mode.
Symlink following in Dool (versions up to and including 1.3.8) allows a local attacker to cause arbitrary file truncation and overwriting when the tool is run with the non-default '--devel' flag. The vulnerable code path opens a log file without the O_NOFOLLOW flag (CWE-59), allowing a pre-placed symlink to redirect the write to any file the dool process can access - an impact that escalates from trivial to severe if dool runs under elevated privileges such as root. No public exploit code or CISA KEV active exploitation is identified; the issue was reported by CERT-PL and addressed upstream via pull request #116.
Input injection in MongoDB libmongocrypt's automatic-encryption context setup permits caller-supplied database and collection name arguments containing '.' or NUL bytes to pass without sanitization, causing incorrect schema selection during Client-Side Field Level Encryption (CSFLE) operations. Affected callers - those with local access and low privileges - may obtain limited unauthorized disclosure or modification of data processed under the wrong encryption schema. No public exploit code exists and this vulnerability is not in CISA KEV; the CVSS 4.0 score of 2.0 reflects the constrained real-world impact.