Remote code execution affects PaperCut MF and PaperCut NG through unsafe dynamic class loading in the database connection utilities, which instantiate JDBC driver classes from configurable driver names without validating them against an allowlist. An attacker who can control administrative system configuration parameters can force the server to load and execute arbitrary Java bytecode already present on the application classpath, running with the full privileges of the PaperCut server process. No public exploit identified at time of analysis, but the PR:H requirement and PaperCut's history of being targeted make prompt patching advisable.
Improper access control (CWE-305) in the PaperCut MF and PaperCut NG web management interface allows unauthenticated remote attackers to trigger backend administrative operations before access validation completes, enabling unauthorized modification of system configurations. The CVSS 4.0 vector rates this AV:N/AC:L/PR:N/UI:N with high integrity impact, indicating network-exploitable, zero-authentication exploitation with no user interaction required. No public exploit code or CISA KEV listing has been identified at time of analysis, though PaperCut products have historically been high-value ransomware targets.
Authentication bypass in JFrog Artifactory allows an unauthenticated, network-adjacent attacker to escalate to full administrative privileges against default-configuration instances (CWE-287, improper authentication). Because Artifactory is the central binary repository in many CI/CD pipelines, admin takeover exposes stored artifacts, credentials, and build integrity. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the 9.8 CVSS and self-reporting by JFrog mark it as a high-priority patch.
Authenticated command injection in IBM Langflow OSS 1.0.0 through 1.11.1 lets any logged-in flow user escalate to arbitrary OS command execution under the server process identity. By saving a flow containing a crafted 'type' field and triggering a build of a wrapper flow that references it, the attacker coerces the backend into evaluating attacker-controlled code, defeating the LANGFLOW_ALLOW_CUSTOM_COMPONENTS=false guardrail intended to block custom code execution. The vendor (IBM) reported it and has released a fix; there is no public exploit identified at time of analysis and it is not in CISA KEV.
Remote code execution in IBM Langflow OSS 1.0.0 through 1.11.1 allows a network-accessible authenticated attacker with low privileges to inject and execute arbitrary code server-side due to improper control of code generation (CWE-94). The CVSS 8.8 High score reflects low attack complexity, no required user interaction, and full confidentiality, integrity, and availability impact against the vulnerable host. IBM has released a patch; no public exploit or CISA KEV listing is identified at time of analysis.
Unauthenticated PHP object injection in the GiveWP WordPress donation plugin (all versions through 4.16.7.1) lets remote attackers reach a deserialization sink and chain it into remote code execution on the hosting server. The flaw is network-reachable with no authentication or user interaction and carries a maximum CVSS of 10.0; Patchstack's public write-up details the full object-injection-to-RCE chain, though no in-the-wild exploitation has been confirmed. Because GiveWP handles donation and payment workflows, a successful attack fully compromises the site and any donor data it processes.
Remote code execution in Yamcs (yamcs-core <= 5.12.7 and 5.13.0-5.13.1) lets an authenticated, low-privileged user run arbitrary OS commands by injecting a StreamSQL LIKE pattern that breaks out of a generated Java string literal compiled at runtime by Janino. Because the pattern is embedded raw whether it arrives as a SQL literal or a bound '?' argument, the sink is reachable not only from the archiving endpoints but from routine read-only APIs (readRows, events search, activities listing), including the Events page search box. A detailed vendor-published proof of concept exists; this is not in CISA KEV, so it is publicly available exploit code rather than confirmed active exploitation.
Remote code execution in Pimcore (all releases up to 12.3.9, plus 2026.1.0 through 2026.1.5) lets any authenticated user holding only the ordinary low-privilege 'objects' DataObjects permission import a DataObject class definition whose field name breaks out of the generated 'protected $<name>;' property and injects attacker-controlled PHP into the class file Pimcore emits, executing arbitrary code as the web-server user when an object of that class is instantiated. The same unvalidated field name is concatenated into ALTER TABLE DDL, giving a parallel SQL-injection primitive. It is an incomplete-fix sibling of CVE-2026-5394, which hardened only the composite-index sink; the advisory (GHSA-9x44-4gxf-8c25) ships a working browser-console PoC, but there is no CISA KEV entry and no EPSS score in the provided data.
Remote code execution in Yamcs (open-source mission-control server) versions <= 5.12.7 and 5.13.0-5.13.1 allows a caller with the CreateInstances privilege - or any unauthenticated user in the default no-security.yaml configuration where guest is superuser - to inject YAML into an instance template via the templateArgs parameter of POST /api/instances (and PATCH /api/instances/{instance}). Because arguments are written into the rendered config as raw, unescaped text and then loaded as YAML, an attacker can inject a services: entry that instantiates org.yamcs.ProcessRunner and executes an arbitrary command as the Yamcs service account. Publicly available exploit code exists (a full PoC with a reverse shell is published in the GitHub Security Advisory), and vendor patches are available in 5.12.8 and 5.13.2.
Unbounded native-token (KLV) minting in the Klever blockchain node (klever-go < 1.7.19) lets any funded account inflate the ledger at will. Split-royalty percentages on a KDA asset are validated by summing per-entry values into a uint32 accumulator with no per-entry cap, so two entries near 0x80000000 wrap the sum below the 10000 (100%) limit and pass validation while each stored percentage stays astronomically large; at payout every split recipient is credited pool × hugePct / 10000 and the negative remainder is silently dropped, minting KLV out of thin air. A full working proof-of-concept is published in the GitHub Security Advisory (GHSA-cgc5-v3f2-8m2v); it is not in CISA KEV and no EPSS score was provided, but the flaw is exploitable on current mainnet and not gated by any fork flag.
Ledger value-creation (KLV minting) in Klever's marketplace settlement affects the klever-go node prior to v1.7.19: because referral and royalty cuts are paid in full while a negative seller remainder is silently dropped, any funded account can settle a self-dealt order whose referral% + royalty% exceeds 100% and mint the surplus into attacker-controlled addresses. Exploitation requires only an ordinary account (PR:L) reachable over the public transaction RPC (CVSS 9.6). Committed regression-test exploit code exists, and the vendor advisory (GHSA-p7gw-2pcp-5pf8) and community monitoring document active mainnet exploitation that minted tens of millions of KLV before an emergency guard was deployed, though this CVE is not listed in CISA KEV.
PHP Object Injection leading to remote code execution affects the Pimcore DXP/CMS (composer pimcore/pimcore) in versions 2026.1.0-2026.1.5 and all 12.3.x through 12.3.9, where the Hotspotimage DataObject field marshaller deserializes the persisted `*__hotspots` object-store column with no class allowlist. Any attacker able to write crafted PHP-serialized bytes into that column gains arbitrary object instantiation on the next object load, chainable to RCE via gadgets in Pimcore's own bundled dependencies (guzzlehttp/guzzle 7.11.0). A working proof-of-concept demonstrating attacker-controlled file write is published in the vendor advisory; publicly available exploit code exists, but there is no CISA KEV listing and no EPSS score was provided.
NF registration poisoning in free5GC's Network Repository Function (NRF) lets attackers with SBI network access register forged Network Function profiles containing arbitrary, attacker-controlled service endpoint IPs, because the RegisterNFInstance handler performs no field validation against 3GPP TS 29.510. Legitimate NFs (AMF, SMF, AUSF, UDM, PCF, NSSF) then discover the fake profiles via NFDiscover and route control-plane signaling to the attacker, enabling interception, OAuth2 credential harvesting, and denial of service across the entire 5G core service mesh. Publicly available exploit code exists and the vendor has released a patch; the flaw is CWE-20 with a vendor CVSS 4.0 base score of 9.3 (Critical).
Cross-site scripting in Mozilla's Pocket (read-it-later service) through version 8.33.0.0 lets attacker-controlled external HTML execute in the application DOM when a user's "Save to Pocket" action ingests a malicious page, and the injected JavaScript can then reach native bridge methods to manipulate application state. Publicly available exploit code exists, and the referenced proof-of-concept describes a zero-click Android chain, so the practical impact reaches well beyond a cosmetic script injection. No CISA KEV listing means there is no public exploit identified as actively exploited, but the combination of a working POC and native-bridge reach makes this high priority.
Remote code execution in Yamcs (Mission Control) versions <= 5.12.7 and 5.13.0-5.13.1 allows an authenticated user holding the ControlArchiving system privilege to run arbitrary Java on the server host by embedding executable code in a StreamSQL column name. The malicious name is interpolated unescaped into Java source that Janino compiles without a sandbox when a sum() aggregate is evaluated over that column via POST /api/archive/{instance}:executeSql. This is a second, independent Janino sink sharing the root cause of CVE-2026-44632, which the earlier fix did not close; the advisory (GHSA-3g44-3m7x-cgg2) includes a full working PoC verified end-to-end against a real, security-enabled Yamcs 5.13.0, though there is no CISA KEV listing.
Blind SQL injection in WsgiDAV's MySQLBrowserProvider sample module (versions <= 4.3.4) allows unauthenticated network attackers to read arbitrary data from the backing MySQL database via URL path manipulation. The record key segment of the URL is concatenated directly into a WHERE clause without escaping, enabling a boolean status-code oracle that supports full character-by-character data extraction. A secondary typo in the numeric-type check (`INTT` instead of `INT`) ensures all primary key types take the vulnerable quoted branch, and a working PoC with complete extraction script has been publicly confirmed. No public exploit identified as confirmed actively exploited (CISA KEV), but the PoC lowers the exploitation bar significantly.
Privilege escalation in piccolo_admin 1.13.0 and earlier allows any non-superuser admin to permanently elevate to superuser by exploiting a two-flaw chain: the `superuser_validators` access-control function uses a deny-list that omits GET, and the `SessionsBase.token` column is stored as plaintext Varchar without `secret=True`, causing it to appear in every GET /api/tables/sessions/ response. An authenticated low-privilege admin can harvest the superuser's live session token in a single unauthenticated-to-superuser GET request, replay it to issue a PATCH that sets `superuser=true` on their own row, and permanently retain elevated access - the stolen cookie is then discarded. A publicly available proof-of-concept with full reproduction steps was included in the GitHub security advisory (GHSA-2gh4-jmwq-rr8w); no CISA KEV listing is present at time of analysis.
Missing function-level access control in Yamcs Core's REST API allows any authenticated user - including completely unprivileged 'Guest' accounts - to bypass the platform's RBAC system across three distinct API controllers. Affected endpoints in IndexesApi, Cop1Api, and TimeApi omit authorization checks entirely, enabling telemetry metadata exfiltration, disruption of COP-1 satellite telecommand protocols, and manipulation of global simulation time. Publicly available exploit code (curl-based PoC) confirms exploitability; the vulnerability is not currently listed in CISA KEV, though the spacecraft operations context elevates real-world impact severity.
Cross-site scripting in the wallabag Android application (fr.gaulupeau.apps.InThePoche) through version 2.6.0 allows execution of attacker-controlled JavaScript within the app's WebView. Article content fetched from the /api/entries endpoint is rendered in a WebView without sanitization, meaning malicious markup embedded in saved articles executes in the application's security context. A publicly available proof-of-concept references the specific vulnerable source files in the upstream repository; no CISA KEV listing exists at time of analysis, but the CVSS 4.0 score of 8.8 with scope change indicators reflects elevated real-world risk.
SSRF in the Bifrost AI gateway's multimodal URL-fetch path permits any client that can submit a Bedrock or Vertex provider request to reach internal network services - including cloud instance-metadata endpoints - by supplying IPv6 transition-form addresses (6to4, NAT64) or CGNAT addresses that the `isPublicIP` deny-list in `core/providers/utils/fetch.go` incorrectly classifies as routable public IPs. All releases of the `github.com/maximhq/bifrost/core` Go module prior to v1.5.17 are affected, confirmed on dev HEAD f415c14 (core/version 1.5.15). Publicly available exploit code exists in the GHSA advisory as a runnable Go test; no CISA KEV listing at time of analysis.
Integer overflow in Klever-Go's semi-fungible token (SFT) add-quantity path prior to version 1.7.19 allows a mint-role holder to bypass a finite per-nonce MaxSupply constraint, minting approximately 9.2×10^18 tokens in a single transaction. The SFTAddCirculation function in core/kapp/systemAccount/systemAcount.go increments Circulation before checking the cap, enabling an int64 wraparound that makes the MaxSupply comparison permanently false. A proof-of-concept unit test is included in GHSA-mrpp-v6pg-p54x confirming the bypass; no CISA KEV listing is present at time of analysis.
Token minting without source debit in klever-go's percentage-transfer royalty path (`processPercentageRoyaltiesTransfer`) allows an asset owner who configures a 100% split royalty to cause the blockchain to credit the full royalty amount to an attacker-controlled address on every subsequent transfer by any holder, while the sender debit is silently skipped due to an early-return guard placed before the collection call. The exploit fires automatically on third-party transfers once the asset is configured, enabling unbounded off-books token inflation. A full Go unit test and on-chain transaction trace confirming the mint are publicly available; no CISA KEV listing exists, but the patch's inclusion of a hardcoded freeze list for six specific Klever mainnet addresses strongly implies active exploitation occurred prior to the fix.
Unauthenticated XML External Entity (XXE) injection in MapFish Print's GML layer parser allows remote attackers to read arbitrary server-side files and conduct server-side request forgery (SSRF) via a single crafted HTTP POST to the /api/print3/print endpoint. All 3.x branches prior to 3.28.30, 3.30.32, 3.31.24, and 3.33.16, as well as 4.x prior to 4.0.5, are affected. A fully functional proof-of-concept exploit has been publicly disclosed in the GitHub Security Advisory GHSA-5v29-34h8-v68r, enabling exfiltration of Kubernetes service account tokens, OS credential files, and TLS certificates with no authentication required.
Boot registry parameter injection in IGEL OS 12 (before 12.7.6) and IGEL OS 11 (before 11.11.150) allows an attacker with physical access to execute arbitrary Linux kernel command-line parameters by writing to an unencrypted, unsigned configuration partition that the signed bootloader reads at startup. The attack is particularly dangerous because it does not alter the measured boot code path, meaning TPM PCR attestation does not detect the tampering - effectively defeating the trust assumptions of the secure boot and full-disk encryption stack. A publicly available exploit script and a DEF CON 34 presentation detail the technique; no CISA KEV listing has been issued at time of analysis, indicating exploitation has not been confirmed at scale.
Unbounded symlink-following in KubeVela's Terraform remote configuration loader allows any principal with `ComponentDefinition` create/update RBAC rights to OOM-kill the cluster-wide vela-core controller and halt all OAM application reconciliation. The root cause (CWE-59) is that `GetTerraformConfigurationFromRemote` in `pkg/controller/utils/capability.go` calls `os.ReadFile` on a symlink target without verifying the target is a regular file or bounding the read size; a repository containing `variables.tf -> /dev/zero` is sufficient to exhaust controller memory before HCL parsing is ever reached. No CISA KEV listing has been identified at time of analysis, but a complete proof-of-concept with exact reproduction commands is publicly disclosed in GHSA-fmgp-q6jx-gg3x, materially lowering the exploitation bar.
Privilege escalation in SpringBlade 2.7.3 through 3.5.0 lets authenticated low-privilege users forge admin JWT tokens using a hardcoded signing key embedded in publicly distributed JARs, then POST to an unprotected internal Feign user-creation endpoint to register new system administrator accounts. The Spring Cloud Gateway authentication filter validates JWT structure but performs no role or caller-identity checks, making bypass trivial for anyone with initial account access. A public POC is available; vendor-released patch exists in v5.0.0; no CISA KEV listing confirmed at time of analysis.
Cross-project Kanban data destruction in Vikunja allows any authenticated user to permanently wipe `task_buckets` and `task_positions` for any project view in the entire instance, regardless of project membership. Affecting versions 0.24.6 through 2.4.0, the `ProjectView.Delete` method performs two unscoped cascading SQL deletes using only the URL-supplied view ID after an authorization check that verifies admin rights on the attacker's own project - never confirming the target view belongs to that project. A working PoC is publicly available via the GHSA advisory; view IDs are auto-increment integers, making full-instance enumeration trivial with no prior reconnaissance.
Privilege escalation to administrator in the Ultimate Member WordPress plugin (versions 2.6.7 through 2.12.x) allows unauthenticated users registering via the plugin's own forms to self-assign any WordPress role, including administrator, by exploiting a logic failure in role validation. When the plugin cannot resolve the allowed roles for a given profile form, it falls back to validating the submitted role against the full site-wide role registry rather than the form's own allow-list - accepting any valid registered role. A publicly available exploit exists per WPScan, though SSVC assessment indicates no confirmed active exploitation campaigns at time of analysis. Vendor-released patch is available in version 2.13.0.
phpSysInfo up to and including version 3.4.5 exposes a complete IP allowlist bypass in read_config.php that any unauthenticated remote attacker can exploit by sending a spoofed X-Forwarded-For or Client-IP HTTP header set to any address present in the PSI_ALLOWED configuration. The flaw (CWE-290) renders the application's only access-control mechanism entirely ineffective, allowing full retrieval of system telemetry including hostname, kernel version, CPU model, memory layout, filesystems, and network interface addresses. A working proof-of-concept is publicly available on Exploit-DB; no CISA KEV listing exists at time of analysis.
Uncontrolled resource consumption in relibc's with_argv function (commit 61f42d) enables remote unauthenticated attackers to crash applications by supplying a crafted argument payload, causing a Denial of Service. relibc is a Rust-based C standard library implementation for Redox OS; the affected function in /unistd/mod.rs fails to bound resource usage when parsing process arguments. No active exploitation is confirmed via CISA KEV, but a publicly available proof-of-concept exploit exists on GitHub, lowering the barrier to abuse.
Denial of Service in relibc's seekdir() implementation at git commit 61f42d allows an attacker to crash or hang applications that use the library by supplying crafted directory position input to the vulnerable /dirent/mod.rs code path. The flaw is rooted in uncontrolled resource consumption (CWE-400), and a public proof-of-concept exploit exists at the Marsman1996 GitHub repository. No active exploitation has been confirmed in production environments - relibc is not listed in the CISA KEV catalog - but the combination of a public PoC and a network-attributed CVSS score elevates practical concern for any application consuming this library version.
Log-record tampering in Graylog's FortiGate syslog parser enables unauthenticated network senders to overwrite or erase critical security-log fields - including srcip, dstip, date, time, and tz - or cause entire log messages to be silently discarded, creating a viable log-evasion primitive. Affected are Graylog Server versions prior to 6.3.12, 7.0.7, and 7.1.2 (all branches), and Graylog Forwarder prior to version 7.3, on any deployment ingesting FortiGate key-value syslog. No public exploit code exists and this is not in CISA KEV, but the attack requires no authentication and minimal crafting skill, making it a realistic threat to security-monitoring integrity in FortiGate-centric environments.
Remote unauthenticated denial-of-service in alos-http, a Linux amd64 Go web framework, allows any network-reachable client to crash the entire server process with a single malformed HTTP request. The flaw exists in the request-line parser's `sanitizeRequestPath` function, which performs an unchecked index into an empty string after stripping a bare query-string path such as `GET ? HTTP/1.1`. Because the panic fires in the connection-worker goroutine before the handler chain, the framework's own `core.Recovery()` middleware cannot intercept it, making the crash total and immediate. A publicly available proof-of-concept exploit exists; the vulnerability is not currently listed in the CISA KEV catalog.
Authentication denial of service in free5GC AUSF v1.4.4 and current main allows an attacker with access to the AUSF SBI/N12 interface to permanently block a target subscriber from completing 5G authentication by flooding the AUSF with concurrent POST /nausf-auth/v1/ue-authentications requests for the same SUPI. Each concurrent request silently overwrites the active EAP-AKA' session context stored under that SUPI key, so the legitimate UE's EAP response is validated against mismatched cryptographic material (K_aut, XRES) and fails AT_MAC verification. No vendor patch has been released; a working proof-of-concept was reproduced in a controlled lab and is documented in the upstream GHSA advisory, with no CISA KEV listing identified at time of analysis.
Unauthenticated arbitrary file read in the Shared Files Pro WordPress plugin (all versions before 1.7.70) allows remote attackers to supply an unvalidated path parameter during featured image creation, causing the plugin to read and republish any file accessible to the web server process at a public URL. This compound impact - read plus republication - means sensitive data such as wp-config.php database credentials or secret keys can be exfiltrated and exposed to any internet user, not just the attacker. A publicly available proof-of-concept exists, and the CVSS vector confirms no authentication or user interaction is required against any default installation of the affected plugin.
PHP object injection via unsafe deserialization in the User Frontend WordPress plugin (versions before 4.3.10) grants Editor-level users the ability to execute arbitrary PHP code on the host server. The plugin fails to validate field type definitions and deserializes user-controlled post metadata at render time - a CWE-502 flaw exploitable through any available POP chain present in the WordPress environment. A public proof-of-concept exists per WPScan, though SSVC assessment notes no confirmed active exploitation at time of analysis.
Privilege escalation in the User Registration & Membership WordPress plugin before 5.2.6 lets authenticated users holding the plugin's delegated management capability overwrite arbitrary WordPress site options, including those governing user roles, enabling full administrator takeover. The root cause is a missing capability check on the login settings save handler - the plugin fails to verify the caller's WordPress capabilities before persisting changes to the wp_options table. A public proof-of-concept exploit exists per WPScan; however, SSVC reports no active exploitation and the CVE is absent from CISA KEV.
Expression language injection in Flextype CMS through v1.0.0-dev enables authenticated API token holders to read arbitrary server-side files by passing unsanitized input to the Symfony ExpressionLanguage engine via POST /api/v1/query. The evaluation scope exposes application objects including filesystem() and serializers(), making sensitive file disclosure (credentials, configuration files, secrets) straightforward for any token-bearing attacker. Escalation to remote code execution is conditionally possible if a secondary vector exists to place a PHP file on disk; a publicly available proof-of-concept exists, and the vulnerability is not yet in CISA KEV.
Exponential backtracking ReDoS in Protego (pip/protego <= 0.6.1) allows any party who can serve a crafted robots.txt to freeze the `can_fetch()` call indefinitely, denying service to any application using this library for robots.txt compliance. A working proof-of-concept is publicly available in the GitHub security advisory GHSA-wjmf-p669-5m5p; the CVSS 4.0 score of 7.1 (VA:H) reflects meaningful availability risk for web-crawling deployments. No public exploit identified at time of analysis beyond the published PoC, and no CISA KEV listing exists.
Cross-tenant IDOR in Vikunja's kanban task-placement endpoint (POST /api/v1/projects/{project}/views/{view}/buckets/{bucket}/tasks) allows any authenticated user to read the complete contents of any task on the instance and partially mutate its state, defeating Vikunja's project-isolation model. The authorization check in TaskBucket.CanUpdate validates only the URL-scoped project and bucket, never the attacker-controlled task_id supplied in the JSON body; because task IDs are a global sequential integer space, brute-force enumeration of all instance tasks is trivial. This is the fifth documented instance of the same missing-authorization-on-task-child class in Vikunja (siblings: CVE-2026-33676, CVE-2026-33678, CVE-2026-33313, CVE-2026-35598); the vendor-confirmed fix ships in v2.4.0 and no public exploit beyond the detailed advisory proof-of-concept has been identified at time of analysis.
Unauthenticated cluster node admission in Arc Enterprise allows a network attacker who can reach the coordinator TCP port to register a rogue node as a trusted cluster member when clustering is enabled without a configured shared secret. Once registered, the cluster router forwards legitimate end-user requests - including full HTTP headers such as Authorization and x-api-key - to attacker-controlled addresses, enabling credential interception. A detailed proof-of-concept is included in the advisory, and a vendor-released patch is available as of v26.06.2; no public exploit confirmed in CISA KEV at time of analysis.
Arbitrary file deletion via path traversal in the Shared Files and Shared Files Pro WordPress plugins (versions before 1.7.67 and 1.7.68 respectively) enables unauthenticated attackers to trigger deletion of critical server files such as wp-config.php, causing denial of service and potential site takeover. The plugin's single-pass traversal filter is bypassable during frontend file submission, allowing a crafted path pointing outside the uploads directory to be stored; when an administrator later permanently deletes the corresponding file entry, the resolved arbitrary file is removed. A publicly available proof-of-concept exists, though SSVC assessment rates exploitation as none at time of analysis, likely reflecting the two-stage attack dependency on administrator action.
Archive symlink traversal in aquaproj/aqua prior to v2.60.1 enables an attacker who controls a tool archive to write arbitrary files outside the extraction directory with the privileges of the user running aqua. The vulnerable combination in `pkg/unarchive/archives.go` - creating a symlink without destination validation, then following it with a regular file write - allows a malicious tar.gz to overwrite files such as shell startup scripts or PATH entries, resulting in user-level code execution. A working PoC is confirmed in GHSA-mf5c-hw34-4hpp; no CISA KEV listing is present and EPSS data is unavailable for this CVE.
SQL injection in MariaDB Connector/Node.js exposes applications to data exfiltration or modification when using non-default multi-byte character sets (big5, gbk, sjis, cp932, or gb18030) with attacker-controlled Buffer query parameters. Versions prior to 3.2.4, 3.3.3, 3.4.6, and 3.5.3 contain a charset-unaware byte-wise escape routine that allows an attacker-supplied lead byte to absorb the connector-inserted backslash (0x5C) as a multi-byte trail byte, leaving the following quote (0x27) unescaped and terminating the SQL string literal. No public exploit code has been identified at time of analysis and this CVE is not in the CISA KEV catalog, but the root technique is well-documented in public security literature as the classic GBK/Big5 multi-byte escape bypass.
Unauthenticated BLE packet injection in BitChat for iOS v1.5.0 (reported in the CVE as v1.15.0) allows any device within Bluetooth adjacency range to inject crafted MESSAGE packets into the mesh gossip cache, causing denial of service for all mesh participants. The attack exploits a TTL=0 validation bypass in BLEService.swift that accepted packets as anonymous without full sender authentication. A public proof-of-concept is available at a named GitHub repository; no active exploitation has been confirmed by CISA KEV.
OS command injection in 23blocks-OS ai-maestro v0.24.17 lets an attacker who controls an agent or tmux session name run arbitrary shell commands on the host. The flawed killSessionSync path (lib/agent-runtime.ts) built tmux commands by interpolating the session name into a shell string passed to execSync, so metacharacters in the name break out into command context. The upstream commit 06d54f0 fixes it in v0.24.18 by switching to execFileSync with argument arrays and adding an agent-name allowlist; no public exploit or CISA KEV listing is confirmed, though a third-party research advisory exists.
Server-side request forgery in the Kubeflow Pipelines frontend server (prior to 2.17.0) lets any unauthenticated network client coerce the pipeline UI backend into making arbitrary HTTP/HTTPS requests to internal targets via the /_proxy/ route. Because the route sits outside the authorization middleware even when ENABLE_AUTHZ=true, attackers can reach cloud metadata endpoints, the Kubernetes API, and other cluster-internal services, forwarding chosen methods, Authorization/Cookie headers, and POST bodies while receiving the upstream response. No public exploit identified at time of analysis, but the CVSS 10.0 rating and default reachability make this a critical priority for any exposed Kubeflow deployment.
Charset-confusion in MariaDB Connector/J (all branches prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9) allows a server-side character set change mid-session to silently decouple the driver's UTF-8 encoding assumption from the server's active encoding. Because the driver continues escaping SQL string literals as UTF-8 while the server parses incoming bytes under a different multi-byte encoding (e.g., GBK or BIG5), the mismatch can defeat byte-wise SQL quoting and enable SQL injection - a well-documented attack class for charset-confusion primitives. No public exploit has been identified and this CVE is not listed in CISA KEV at time of analysis.
Privilege escalation via session fixation in IBM Administration Runtime Expert (ARE) for i, version 1R1M0, lets a remote attacker cause actions to run under another user's authenticated profile through flawed handling in the ARE GUI component, yielding elevated privileges on the IBM i host. The description characterizes the attacker as unauthenticated, though the CVSS 3.1 vector (PR:L) implies some low-privilege foothold - this signal conflict should be confirmed with IBM. No public exploit identified at time of analysis, and it is not on CISA KEV; EPSS was not provided.
PAM dialog authentication in MariaDB Connector/Node.js discloses account passwords in cleartext when connections use plain TCP, because the SendPamAuthPacketFactory handler omitted the secure-transport gate that was already applied to the sibling mysql_clear_password plugin. Applications connecting to MariaDB with default settings (sslMode=DISABLE, restrictedAuth=null) over untrusted network paths are exposed to credential theft by any on-path attacker or rogue server that issues an Authentication Switch Request for the dialog plugin. No active exploitation or public exploit code has been identified; vendor-released patches are available across all active 3.x branches.