Unauthenticated information disclosure in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers read the device's WPS configuration - including the active WPS PIN - by sending a crafted POST request to /cgi-bin/cstecgi.cgi. Because the getWiFiWpsCfg handler performs no access-control check, any party who can reach the web interface can harvest the PIN and use it to derive the Wi-Fi passphrase and join the network. No public exploit identified at time of analysis and EPSS is low (0.18%), but the trivial, network-reachable nature of the flaw makes it high-value against exposed devices.
Unauthenticated information disclosure in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers read diagnostic configuration and stored ping-log contents by sending a crafted POST request to the getDiagnosisCfg handler at /cgi-bin/cstecgi.cgi. The endpoint performs no authentication check (CWE-284), so any network-reachable attacker can retrieve the data. There is no public exploit identified at time of analysis, EPSS is low (0.18%, 7th percentile), and it is not listed in CISA KEV, though CISA SSVC rates it as automatable with total technical impact.
Information disclosure in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers retrieve the device's port-forwarding rules by sending a crafted POST request to the getPortForwardRules handler at /cgi-bin/cstecgi.cgi. The endpoint enforces no authentication (CWE-284), exposing internal host IPs, service ports, and NAT mappings that aid downstream targeting. No public exploit identified at time of analysis; EPSS is low (0.18%, 7th percentile) and CISA SSVC lists exploitation status as none.
Configuration disclosure in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets unauthenticated attackers read the device's syslog configuration by sending a crafted POST request to the getSyslogCfg handler of /cgi-bin/cstecgi.cgi. The affected CGI endpoint fails to enforce authentication (CWE-284), so any actor with network reachability to the web interface can retrieve logging settings. No public exploit identified at time of analysis, EPSS is low (0.18%, 7th percentile), and the CVE is not in CISA KEV.
Stored/reflected cross-site scripting in Synology Chat Server before 2.4.5-22148 lets a remote authenticated user who lures a victim into a UI interaction execute injected script that pivots into the underlying DSM platform to read or write arbitrary files and trigger denial-of-service. The vendor-assigned CVSS 9.0 reflects a scope change (S:C) where compromise of the chat add-on cascades into the host DiskStation Manager operating system. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Cross-tenant kanban bucket injection in Vikunja API (≤ 2.3.0) allows any authenticated user to relocate their own bucket into any other tenant's project view by supplying an arbitrary `project_view_id` in the JSON request body of the bucket update endpoint. The `Bucket.Update()` function in `pkg/models/kanban.go` mass-assigns `project_view_id` directly to the database row via xorm, while the `CanUpdate` authorization check only validates the URL path parameters - never the body field. A detailed curl-based proof-of-concept is publicly available in the GitHub security advisory GHSA-569v-q83c-3j3g, though no active exploitation has been confirmed (not in CISA KEV).
Supply-chain remote code execution affects NousResearch Hermes Agent versions 0.18.2 through 0.18.x (prior to 0.19.0), where the bundled MCP catalog references a third-party upstream repository via a mutable git branch instead of a pinned commit SHA. An attacker who compromises that upstream repository can push malicious code that is automatically pulled onto every host installing the affected catalog entry, achieving code execution with no further operator action. Reported by VulnCheck; a vendor patch exists (v0.19.0) but there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote code execution in Microsoft Edge (Chromium-based) is enabled by a type confusion vulnerability (CWE-843) that can be triggered when a user visits attacker-controlled web content. All versions of Edge (Chromium-based) are affected per the wildcard CPE, with full confidentiality, integrity, and availability impact at a CVSS 8.8. A vendor patch is available via the Microsoft Security Response Center; no active exploitation has been confirmed and no public exploit code has been identified at time of analysis.
Arbitrary file write in BuilderIO gpt-crawler through 1.5.1 allows unauthenticated remote attackers to overwrite any file on the server filesystem by supplying absolute paths or path traversal sequences in the unsanitized `outputFileName` parameter of the POST /crawl endpoint. File content is sourced from attacker-controlled URLs, making this a combined path traversal and server-side fetch primitive capable of depositing web shells, poisoning cron jobs, or corrupting application configs. No public exploit code or CISA KEV listing exists at time of analysis; the CVSS 4.0 score of 8.8 reflects high integrity impact with no authentication barrier.
Unauthenticated SSRF in DataElement bisheng through 2.6.0-fix2 exposes internal network services and cloud metadata endpoints to any internet-accessible attacker. The POST /api/v1/workflow/report/callback endpoint applies no authentication, no URL scheme restrictions, and no host filtering, allowing arbitrary server-side HTTP requests whose responses are retrievable from object storage via caller-controlled object names - enabling cloud credential theft (e.g., AWS IMDSv1 role keys) and internal network enumeration. No public exploit code has been identified and this CVE is not in CISA KEV at time of analysis.
The /github-app/setup endpoint in Atlantis through 0.47.1 is completely unauthenticated, exposing GitHub App credentials-including the RSA private key and webhook secret-to any network caller who reaches the endpoint during a setup session. Successful exploitation grants an attacker the ability to mint valid GitHub App installation tokens and forge webhook payloads, effectively compromising the trust chain between Atlantis and all GitHub repositories managed through that App installation. No public exploit code or CISA KEV listing has been identified at time of analysis, but the credential class exposed makes this a high-priority remediation for any internet-exposed Atlantis instance using GitHub App authentication.
Pega Platform (marketed as Pega Infinity) versions 7.1.0 through 25.1.2 expose a network-accessible, unauthenticated attack surface via CWE-606 (Unchecked Input for Loop Condition), where attacker-controlled input can trigger unbounded loop execution. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no privileges or user interaction, with vendor-assigned impacts of high integrity and high availability loss on the vulnerable system plus residual availability impact on downstream systems. No public exploit code and no CISA KEV listing were identified at time of analysis, but the low-complexity, unauthenticated network exposure makes this a credible denial-of-service risk for any internet-reachable Pega deployment in the affected version range.
Out-of-bounds read in the Linux kernel HID subsystem (hid_get_report) allows an adjacent, unauthenticated attacker to trigger a kernel panic or leak kernel memory by submitting a zero-length numbered HID report via a crafted Bluetooth or USB device. The vulnerability affects multiple stable kernel branches from 5.10.x through 7.1.x, with patches backported across all supported trees. No public exploit has been identified at time of analysis, and EPSS remains very low at 0.18% (7th percentile), indicating limited threat actor awareness thus far.
Use-after-free in the Linux kernel's batman-adv mesh networking gateway module exposes systems on batman-adv mesh segments to kernel memory corruption via crafted Ethernet frames. The flaw occurs because pskb_may_pull(), called within batadv_get_vid(), can reallocate the socket buffer backing store, leaving the ethernet header pointer stale; the code then dereferences this freed pointer before the fix reassigns it. No public exploit exists and EPSS sits at 0.18% (7th percentile) with no CISA KEV listing, but kernel-level UAF carries theoretical escalation-to-privilege-or-crash potential on any system actively running batman-adv.
Out-of-bounds heap read in the Linux kernel's wcn36xx WiFi driver allows an adjacent-network attacker to corrupt Block Acknowledgment session state by sending crafted 802.11 frames that elicit a short firmware response. Kernels from 4.7 through pre-patch stable branches on devices equipped with Qualcomm WCN3660/WCN3620/WCN3680 WiFi hardware are affected. No public exploit code exists and no CISA KEV listing is present; EPSS of 0.17% (7th percentile) reflects negligible observed exploitation probability consistent with the hardware-specific attack surface.
Use-after-free in the Linux kernel Bluetooth SCO subsystem allows an adjacent unauthenticated attacker to corrupt freed kernel memory by exploiting a reference-counting race between socket close() and Bluetooth controller Disconnection Complete events. The race causes sco_conn_del() to perform a double put on a kref, confirmed by KASAN as slab-use-after-free, with potential to escalate privileges or crash the system. No public exploit or CISA KEV listing exists; EPSS is 0.17% (6th percentile), consistent with the race condition complexity limiting practical exploitation.
Insufficient validation of S1G (802.11ah/Wi-Fi HaLow) Target Wake Time setup frames in the Linux kernel's mac80211 subsystem allows an unauthenticated adjacent-network attacker to submit a malformed individual TWT agreement whose parameter block is shorter than the full struct ieee80211_twt_params. The driver callback drv_add_twt_setup() and associated kernel tracepoint both consume the complete parameters structure regardless of the truncated length, potentially triggering kernel memory corruption, out-of-bounds reads exposing sensitive kernel memory, or a denial-of-service crash. No public exploit code has been identified, CISA KEV listing is absent, and patches are confirmed across seven stable kernel branches; real-world exposure is substantially narrowed by the requirement for S1G hardware.
Use-after-free in the Linux kernel Bluetooth HCI sync subsystem exposes systems running vulnerable kernel versions (6.6.51-pre-6.7 and 6.8.9-pre-6.9) to potential kernel-context memory corruption from an adjacent attacker with no privileges required. The race condition occurs when hci_connect_acl/le_sync() callbacks dereference a freed hci_conn object during concurrent connection teardown, yielding a theoretical path to arbitrary code execution or kernel panic. No public exploit code has been identified at time of analysis, and EPSS at 0.15% (5th percentile) indicates very low observed exploitation activity.
Out-of-bounds kernel heap read in the Linux kernel's classic in-tree NTFS driver (`fs/ntfs/`) allows a local, low-privileged user to disclose kernel memory - and potentially chain to privilege escalation - by mounting a crafted NTFS image at the filesystem layer. The flaw is a u16 integer truncation in `ntfs_check_restart_area()` that silently defeats a page-size bounds check, causing `ntfs_check_log_client_array()` to dereference up to ~64 KiB beyond an allocated heap buffer using attacker-controlled on-disk values. No public exploit code exists and no active exploitation has been confirmed; EPSS is 0.15% (5th percentile), reflecting negligible observed exploitation pressure.
Out-of-bounds write in the Linux kernel's OCFS2 cluster filesystem driver corrupts adjacent kernel memory when a low-privileged user unlinks a refcounted file whose refcount tree contains leaf blocks, triggering a fortify panic on hardened kernels. The root cause is an incorrect memset bound in `ocfs2_remove_refcount_extent()` arising from a union aliasing issue between `rf_records.rl_count` and `rf_list.l_tree_depth`. No public exploit or active exploitation has been identified; EPSS is 0.15% (5th percentile) and the vulnerability does not appear in CISA KEV, reflecting low real-world exploitation risk at time of analysis.
Missing dma_resv lock acquisition before dma_buf_unpin() in the Linux kernel iommufd subsystem causes a kernel WARN on every IOAS destruction or unmap path that releases the last reference to a DMABUF-backed iopt_pages object. Affected are kernel versions from the commit introducing DMABUF pinning in iommufd (8c5f9645c389) through the fix commits in the 7.1 and 7.2 stable trees, with patches confirmed at Linux 7.1.5 and 7.2. No public exploit or active exploitation has been identified; EPSS is 0.15% (5th percentile), indicating negligible automated exploitation probability at time of analysis.
Use-after-free race condition in the Linux kernel's amdxdna AMD AI accelerator driver allows a local low-privileged user to trigger kernel memory corruption by racing device removal against GEM object deallocation, potentially achieving full kernel privilege escalation. The flaw is specific to deployments where force_iova mode is enabled in the amdxdna driver, limiting the real-world exposure to systems with AMD XDna-capable hardware. No CISA KEV listing and no public proof-of-concept exist; EPSS of 0.15% (5th percentile) confirms this remains a theoretical priority rather than an active exploitation concern.
vmclock in the Linux kernel exposes a shared ABI memory page that a low-privileged guest process can upgrade from read-only to writable using mprotect(), allowing direct corruption of host-maintained timekeeping fields including sequence counters, UTC time, and TSC offsets. Affected deployments are virtualized Linux guests running kernels prior to patched stable releases 6.18.47, 7.2.1, and 7.1.11, where the vmclock miscdevice driver fails to clear VM_MAYWRITE on read-only mmap paths. No public exploit code has been identified at time of analysis, and EPSS at 0.15% (5th percentile) reflects low observed exploitation pressure despite a CVSS 8.8 score driven by the scope-changing guest-to-host integrity impact.
Dangling pointer dereference in the Linux kernel Bluetooth ISO subsystem exposes systems running kernel versions prior to 6.18.44, 7.1.8, and 7.2 to potential kernel memory corruption from adjacent Bluetooth attackers. After iso_conn_del() is invoked, ISO sockets may continue to dereference the freed hcon (HCI connection) pointer due to imprecise reference-counting logic, creating a use-after-free-class condition in kernel space. Despite a high NVD CVSS score of 8.8, the EPSS rating of 0.15% (5th percentile) and absence from CISA KEV indicate no public exploit or observed active exploitation at time of analysis.
OS command injection in PLANET GS-4210-16P2S managed switch firmware allows a remote attacker with administrator web credentials to execute arbitrary operating-system commands on the device. The web_smtp_test_post handler in /cgi-bin/dispatcher.cgi passes a caller-supplied SMTP server field directly into a shell command without sanitization, exposing the full underlying firmware OS to the authenticated attacker. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; however, the CVSS 4.0 score of 8.6 reflects full confidentiality, integrity, and availability compromise on successful exploitation.
OS command injection in the PLANET GS-4210-16P2S managed PoE switch firmware before 3.441b260626 allows an authenticated remote attacker with administrative access to execute arbitrary operating-system commands on the device. The VLAN membership editing handler in /cgi-bin/dispatcher.cgi passes the memberTags POST parameter directly into a shell command without any sanitization, constituting a textbook CWE-78 flaw. No public exploit code and no CISA KEV listing are identified at time of analysis, though the CVSS 4.0 score of 8.6 reflects full confidentiality, integrity, and availability impact upon successful exploitation.
Path traversal in the aws:downloadContent plugin of amazon-ssm-agent before 3.3.4515.0 allows an authenticated attacker with a specifically scoped ssm:SendCommand IAM permission to write arbitrary files outside the intended download directory with root privileges on targeted managed instances. By directing the AWS-DownloadContent SSM document to retrieve from a controlled S3 source containing crafted object keys with path traversal sequences, an attacker can overwrite sensitive system files and escalate to full remote code execution as root. No public exploit code or CISA KEV listing has been identified at time of analysis, but the root-privilege arbitrary write primitive represents a high-impact capability in compromised-credential scenarios.
Path traversal and trust inheritance flaws in gitoxide's Rust crates gix (≤ 0.72.0) and gix-validate (≤ 0.10.0) allow an attacker who supplies a malicious repository to read arbitrary git configuration files - including embedded credentials - from a victim system. The attack chains three bugs: a first-occurrence-only `find(b"..")` check in submodule name validation that is bypassed by names like `a..b/../../../.git/`, the fact that this validation function is never invoked in production code, and a trust inheritance flaw in `Submodule::open()` that propagates the parent repository's `Trust::Full` to the traversed path while skipping ownership verification entirely. No public exploit has been identified at time of analysis, though a compiled PoC was referenced (truncated) in the GHSA advisory.
Stack buffer overflow in the PLANET GS-4210-16P2S managed switch web management interface exposes all firmware versions prior to 3.441b260626 to unauthenticated remote denial of service and potential memory corruption. The _readHttpParam function copies attacker-supplied HTTP query string data into a fixed-size stack buffer without enforcing size limits or guaranteeing NUL termination, after which parse_query_string processes the unbounded attacker-controlled content. No public exploit code has been identified at time of analysis and KEV status is not confirmed, but the pre-authentication network vector with no special preconditions makes this straightforwardly reachable; a vendor patch is available.
Symlink following in gitoxide before 0.52.1 and the gix crate before 0.83.0 allows an attacker who supplies a malicious repository to exfiltrate arbitrary files outside the repository boundary through submodule metadata. When Repository::submodules() processes a worktree .gitmodules that is a symlink, std::fs::read() transparently follows it to an attacker-chosen target, and the resulting bytes are parsed as submodule configuration, exposing attacker-controlled name, path, and url values. A proof-of-concept is publicly confirmed in the GHSA advisory; no CISA KEV listing was present at time of analysis.
Path traversal in gitoxide before 0.52.1 and gix before 0.83.0 allows an attacker who supplies a malicious git repository to redirect submodule git directory resolution outside .git/modules, exposing arbitrary on-disk repository structure to inspection. The flaw stems from submodule names read from .gitmodules being joined directly as filesystem path components with no normalization or confinement check, so a name such as '../../../escaped-target.git' escapes the expected directory boundary. A proof-of-concept is publicly available via GHSA-fr8x-3vfx-f45h; no confirmed active exploitation at time of analysis.
Path traversal in Qwen-Agent through 0.0.34 allows unauthenticated remote attackers to read arbitrary files from the server filesystem by supplying absolute paths to the Gradio document-parsing interface. The flaw exists in the simple_doc_parser and supporting utility code, which pass caller-controlled paths directly to file-open operations without restricting access to an intended directory. The CVSS 4.0 score of 8.7 (AV:N/AC:L/PR:N) reflects a zero-prerequisite, network-accessible attack surface; no active exploitation is confirmed in CISA KEV and no public POC has been identified at time of analysis.
Denial of service in SvelteKit versions 2.49.0 through 2.53.2 is achievable by unauthenticated remote attackers who submit crafted multipart form requests that exploit a deserialization expansion flaw in the experimental `form` remote function, causing the server to construct disproportionately large `files` arrays and exhaust processing resources. Exploitation is gated behind a non-default opt-in flag (`experimental.remoteFunctions: true`) and requires the application to process the `files` array without length or size validation, substantially narrowing real-world exposure despite the CVSS 4.0 score of 8.7. No public exploit has been identified at time of analysis and the vulnerability does not appear in the CISA KEV catalog.
Denial-of-service in gitoxide's gix-pack crate before 0.69.0 exposes Rust Git clients to remote process crashes during clone or fetch operations via two distinct attack vectors. Unchecked array indexing in the delta application routine causes index-out-of-bounds panics on truncated pack data, while uncapped buffer allocation from attacker-controlled LEB128 size headers allows a 10-byte crafted pack entry to trigger an immediate out-of-memory process kill - both exploitable by any Git server the victim connects to. No active exploitation has been confirmed (not in CISA KEV), but the unauthenticated, network-reachable attack surface with trivial complexity makes this a high-priority patch for any environment running automated clone or fetch workflows against external remotes.
CPU exhaustion in SvelteKit's experimental remote form deserialization endpoint allows unauthenticated remote attackers to render affected servers unresponsive by submitting malformed form data, resulting in denial of service. Versions 2.49.0 through 2.52.1 of @sveltejs/kit are affected, but only when both the experimental.remoteFunctions and form features are simultaneously enabled - a non-default, opt-in configuration. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; the CVSS 4.0 score of 8.7 reflects the complete availability impact against network-reachable endpoints with no authentication barrier once the experimental features are active.
Memory exhaustion in @sveltejs/kit versions 2.49.0 through 2.52.1 allows unauthenticated remote attackers to crash the server process by sending malformed form data to a remote function endpoint, resulting in complete denial of service. Exploitation is gated behind two simultaneous non-default opt-in conditions - the experimental.remoteFunctions flag and form usage - which significantly narrows the real-world attack surface relative to the CVSS 4.0 score of 8.7. No public exploit or CISA KEV listing has been identified; a vendor-released patch is available in version 2.52.2.
Stack-based buffer overflow in the MongoDB BI Connector ODBC driver allows a low-privileged SQL-capable user to overwrite adjacent stack memory by submitting a positioned-cursor statement with a cursor name exceeding the size of an internal fixed-length buffer. Any application exposing MongoDB through this ODBC driver - including common BI tools such as Tableau, Excel, or MicroStrategy - is affected across all currently listed versions (CPE wildcard). Successful exploitation can crash the hosting application process and may enable unintended code execution within that process context; no public exploit or CISA KEV listing is confirmed at time of analysis.
Server-side request forgery in Portkey AI Gateway through version 1.15.2 enables unauthenticated remote attackers to weaponize the gateway as an internal network proxy by injecting arbitrary host values into the x-portkey-custom-host header on the /v1/proxy/* route, which lacks requestValidator middleware. The gateway faithfully forwards outbound requests - including Authorization headers carrying LLM provider API keys - to attacker-specified internal addresses, enabling credential exfiltration and internal service enumeration. No public exploit code has been identified at time of analysis and no CISA KEV listing exists, but the unauthenticated, low-complexity nature of the attack vector makes this an urgent remediation priority for any internet-exposed gateway deployment.
Authenticated OS command injection in PLANET GS-4210-16P2S managed switch firmware prior to 3.441b260626 enables a remote administrator to execute arbitrary commands on the device operating system via a crafted certificate upload request targeting /cgi-bin/httpuploadcert.cgi. The certificate password field is incorporated into a shell command without sanitization of shell metacharacters, a textbook CWE-78 root cause. No public exploit code or CISA KEV listing has been identified at time of analysis; exploitation requires valid administrator-level web credentials, confirmed by CVSS 4.0 PR:H.
Log storage exhaustion in MongoDB Connector for BI (mongosqld) allows any unauthenticated network peer to crash the shared process by generating sufficient connection log volume to fill the configured log path's backing storage. When a subsequent log write or rotation operation fails, an uncaught exception (CWE-248) terminates the mongosqld process, immediately denying SQL service to all connected clients. The process cannot recover autonomously - it continues to fail on startup until an operator manually reclaims disk space - and the diagnostic message explaining the condition is never persisted, compounding operational triage difficulty. No active exploitation has been identified at time of analysis.
Command injection in Snyk Sweater Comb before version 3.8.8 allows an attacker who controls the .vervet.yaml configuration file to execute arbitrary OS commands on the host running the lint operation. The root cause is the expectGitBranch() function in src/lint.ts passing the unsanitized linters.<key>.optic-ci.original branch name value directly into Node.js child_process.exec() via an unescaped template literal, where the shell interpreter evaluates injected metacharacters as commands. The highest-risk exploitation path is a malicious pull request that plants a crafted .vervet.yaml, triggering command execution when a maintainer or CI pipeline subsequently runs sweater-comb lint; no CISA KEV listing or confirmed public exploit exists at time of analysis.
Stack-based buffer overflow in TP-Link TL-MR100 V3.20 allows an adjacent unauthenticated attacker to corrupt the httpd process stack by sending a crafted encrypted payload to the /cgi/login endpoint before any authentication occurs. The flaw resides in the http_gdpr_decrypt function, which performs insufficient bounds checking on incoming data, enabling overwrite of saved control-flow data and potential arbitrary code execution in the context of the httpd process. Vendor patch is available; no public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated connection exhaustion in MongoDB Connector for BI allows any network-reachable client to hold authentication sessions open indefinitely by initiating a SASL login exchange and then withholding further data. The absence of a wall-clock timeout on the negotiation loop and no read deadline on the client socket means each such session permanently occupies a worker thread, a connection slot, and associated backend MongoDB handles until the process is restarted. Sustained repetition of this pattern can exhaust the configured connection pool capacity entirely, denying service to all legitimate BI tool users; no public exploit has been identified at time of analysis.
Hardcoded HTTP Digest authentication credentials baked into CP Plus CP-XR-DE21-S Router firmware grant any adjacent-network attacker full administrative access without valid credentials. Because the credentials are identical across every device running the affected firmware, a single firmware extraction exposes the entire deployed population. No active exploitation is confirmed by CISA KEV, but the trivially low exploitation complexity and total administrative compromise make this a high-priority remediation target for any network where this router is deployed.
Mongosqld in the MongoDB BI Connector requests but does not enforce client certificates during the TLS handshake when configured with a CA file, silently accepting connections from clients that present no certificate at all. Deployments that rely on client certificate authentication as the sole means of identifying users are fully exposed - any remote party with network access to the listener can establish a session and read all MongoDB data surfaced through the SQL interface. The CVSS 4.0 score of 8.7 reflects the network-accessible, zero-privilege nature of the flaw; no public exploit code or CISA KEV listing has been identified at time of analysis, and real-world impact is bounded by a specific non-default configuration prerequisite.
Credential disclosure in AUTOMATIC1111 Stable Diffusion WebUI through version 1.10.1 exposes configured authentication credentials to unauthenticated network attackers via the `/sdapi/v1/cmd-flags` REST endpoint. The endpoint serializes all runtime command-line arguments - including `gradio_auth` and `api_auth` values - into a cleartext JSON response with no access control, directly nullifying the authentication protection those flags are meant to provide. No public exploit or active exploitation has been confirmed, but the attack path is a single unauthenticated HTTP request to a known endpoint, making this a high-priority finding for any publicly reachable deployment.
Remote code execution in BISHENG's workflow engine (versions before 2.6.0) allows any authenticated user to submit crafted Code node definitions to the POST /api/v1/workflow/run_once endpoint, where they are evaluated via Python's exec() built-in without sandboxing or process isolation. Successful exploitation grants full server-side code execution with access to the host filesystem, stored credentials, and internal network resources reachable from the BISHENG backend process. No public exploit or CISA KEV listing has been identified at time of analysis, but the low-complexity, authenticated network attack path represents a critical risk especially in multi-tenant or shared-access deployments.
Server-side request forgery in Qwen-Agent through 0.0.34 allows unauthenticated remote attackers to exfiltrate data from internal infrastructure by exploiting the document parsing path's failure to validate caller-supplied URLs. The Gradio interface - exposed without authentication by default - serves as the entry point, enabling attackers to direct the server to issue HTTP requests to cloud metadata endpoints such as AWS IMDSv1 or GCP metadata APIs and retrieve responses through the document parsing output. No public exploit code or CISA KEV listing exists at time of analysis, but the zero-privilege, zero-interaction attack vector against credential-bearing metadata services makes this a high-priority risk for any cloud-hosted deployment.
Credential exfiltration in gitoxide's gix-transport crate allows a server controlling an HTTP redirect response to steal the caller's HTTP Basic Authorization credentials by exploiting a hand-rolled URL parser in gix-url that misidentifies the authority component of crafted redirect URLs. Affected are gix-url versions ≤ 0.32.0 and gix-transport versions ≤ 0.49.0; the redirect identity guard `can_reuse_identity` fails open when the parser does not treat '?' or '#' as authority terminators per RFC 3986, causing credentials to be forwarded to an unintended host. No public exploit has been identified at time of analysis, though the CVSS 4.0 score of 8.7 reflects a full confidentiality impact with no authentication prerequisites.
Unauthenticated blind SQL injection in the Sexy Polling Reloaded Joomla extension (Jefferson49) affects all versions below 5.6.1, enabling remote attackers to exfiltrate the entire underlying database without credentials. The CVSS 4.0 score of 8.7 reflects a trivial exploitation path - no authentication, no user interaction, and no configuration preconditions required against default installations of the extension. No public exploit code or CISA KEV listing has been identified at time of analysis, though the fully unauthenticated network vector makes opportunistic automated scanning a realistic threat vector.