Remote code execution and device takeover in the Tenda HG10 (firmware build 300001138) is possible through a stack buffer overflow in the Boa web server's formIPv6Routing handler, reachable at /boaform/admin/formIPv6Routing. An oversized destNet parameter overflows a fixed-size buffer (CWE-120), letting a remote attacker crash the device or execute arbitrary code with the web server's privileges. Publicly available exploit code exists (VulDB), though the issue is not listed in CISA KEV and no active exploitation is confirmed; EPSS is not provided.
Stored Cross-Site Scripting in the Groundhogg - CRM, Newsletters, and Marketing Automation WordPress plugin before version 4.5.13 allows unauthenticated attackers to inject persistent malicious scripts through optional web form fields, which subsequently execute in the browsers of privileged administrative users. Successful exploitation can yield full administrative session compromise, unauthorized rogue account creation, or arbitrary site modification. A publicly available proof-of-concept is confirmed by WPScan; however, EPSS remains low at 0.17% (7th percentile), indicating limited observed mass exploitation despite that availability.
Stored Cross-Site Scripting in Customer Reviews for WooCommerce (all versions before 5.118.0) lets unauthenticated attackers inject persistent malicious scripts by submitting crafted review content through a vulnerable plugin endpoint, with the payload stored in the WordPress database. When an authenticated user - particularly a store administrator - views the affected review, the injected script executes in their browser context, enabling session hijacking, credential theft, or unauthorized administrative actions. A publicly available exploit exists per WPScan; EPSS sits at 0.17% (7th percentile), indicating limited observed mass exploitation despite POC availability, and the vulnerability is not currently in CISA KEV.
Stack-based buffer overflow in the D-Link DIR-825M 1.1.8 LTE Module Firmware Upgrade handler allows low-privileged remote attackers to achieve remote code execution by supplying an oversized fota_url argument to /boafrm/formLtefotaUpgradeFibocom. The CVSS 4.0 vector scores this at 8.6 with subsequent-system impact (SC:H/SI:H/SA:H), reflecting the potential to compromise the attached Fibocom LTE module as well as the primary router. A public proof-of-concept exploit is available on GitHub, significantly lowering the bar for exploitation; no public patch has been identified at time of analysis.
Memory corruption in TOTOLINK A720R router firmware 4.1.5cu.630_B20250509 allows authenticated remote attackers to trigger a buffer overflow in the MAC filtering subsystem, with potential for arbitrary code execution. The vulnerable path is the `setMacFilterRules` function within `cstecgi.cgi`, exploitable by sending a crafted `desc` argument over the network. A public proof-of-concept is available on GitHub; no CISA KEV listing exists at time of analysis, but the combination of network reachability and published exploit code meaningfully elevates real-world risk.
Reflected XSS in the geotargetingwp WordPress plugin before 3.5.6.2 enables unauthenticated attackers to inject arbitrary JavaScript into victims' browsers via unsanitized parameters echoed back in HTML-typed AJAX responses. Exploitation requires social engineering to trick a target - ideally an authenticated WordPress administrator - into submitting a crafted request, after which the reflected payload executes in the victim's browser session. A publicly available proof-of-concept exists per WPScan; the vulnerability is not listed in CISA KEV, and EPSS sits at 0.17%, indicating limited observed exploitation to date.
Stored cross-site scripting in the SOGO Add Script to Individual Pages Header Footer WordPress plugin (through version 3.9) enables any contributor-level WordPress user to inject arbitrary JavaScript into per-post header and footer script fields without sanitization or capability gating. The payload executes in an administrator's browser when reviewing the pending post, enabling session hijacking and full site takeover, and persists for all site visitors once the post is published. A publicly available proof-of-concept exists per WPScan, though EPSS remains at 0.15% (5th percentile) and there is no CISA KEV listing, indicating limited opportunistic exploitation to date.
Arbitrary file write via path traversal in the WPvivid - Backup, Migration & Staging WordPress plugin (versions before 0.9.133) allows high-privilege WordPress administrators to extract backup archives with traversal sequences that write files outside the designated restore directory. A publicly available proof-of-concept exists per WPScan, though EPSS sits at 0.17% (7th percentile) and CISA KEV lists no active exploitation at time of analysis. Successful exploitation can lead to remote code execution by placing malicious PHP files in web-accessible directories.
Improper privilege management in the Really Simple Security WordPress plugin before 9.8.0 permits a subsite administrator on a WordPress multisite network to install an arbitrary plugin from a user-supplied URL, placing attacker-controlled PHP code into the network-shared plugin directory normally reserved for network (super) administrators. Successful exploitation achieves remote code execution with full confidentiality, integrity, and availability impact across the entire multisite network. A public proof-of-concept is available via WPScan, though EPSS remains low (0.15%) consistent with the high-privilege, non-default-configuration prerequisites; no confirmed active exploitation (CISA KEV) is recorded at time of analysis.
The `qs.stringify` function in the qs Node.js query-string library throws an uncaught `TypeError` when serializing any object whose `constructor.isBuffer` property is truthy but not callable, enabling denial of service against applications that re-serialize attacker-controlled data. Express 4 (default query-parser) and body-parser with `extended: true` both parse incoming HTTP data using options that preserve the `constructor` key in output, meaning a crafted request body or query string can reach the vulnerable code path with no non-default configuration required on the target application. A working proof-of-concept is embedded in the CVE description; no CISA KEV listing exists at time of analysis.
Full authentication bypass in the MyHome Core WordPress plugin (versions up to and including 4.4.5) lets unauthenticated attackers mint a valid activation token for any unconfirmed account and receive that account's auth cookie, enabling silent takeover of administrator accounts. The flaw combines a missing authorization check in the send_link() AJAX handler with weak token validation in activate(). No public exploit has been identified at time of analysis, but the CVSS 9.8 rating and trivial network exploitability against affected configurations make this a high-priority patch item.
Authentication bypass in Magma 1.9.0's AMF Registration Complete Message Handler allows remote, unauthenticated attackers to manipulate registration state in the 5G core network's Access and Mobility Management Function. The vulnerable code path resides in tasks/amf/amf_fsm.cpp, where the finite state machine processing Registration Complete messages fails to properly verify actor identity per CWE-287. A public proof-of-concept exploit exists (GitHub issue #16020), and no confirmed patch version has been identified at time of analysis.
Improper input validation in the NGSetupRequest Handler of Linux Foundation Magma 1.9.0 allows remote unauthenticated attackers to impact availability of the 5G core's Access and Mobility Management Function (AMF) by supplying a malformed NG-IoT-DefaultPagingDRX argument. A public proof-of-concept is available via GitHub issue #16023, though the vulnerability has not been added to CISA KEV and the project maintainers have not responded to the coordinated disclosure, meaning no patch is available. The CVSS 4.0 score of 6.9 reflects limited availability impact only, with no confidentiality or integrity exposure.
State machine mismanagement in the NGSetup Handler of Linux Foundation Magma 1.9.0 allows remote, unauthenticated attackers to induce an invalid state in the AMF component by sending crafted NGAP NGSetup messages. The affected function resides in ngap_amf_handlers.c, which processes the initial setup handshake between 5G base stations (gNBs) and the Access and Mobility Management Function (AMF). A public proof-of-concept is available via a GitHub issue; this is not listed in the CISA KEV catalog.
Race condition exploitation in FileCodeBox's Pickup Limit Handler allows remote unauthenticated attackers to bypass configured file download quotas by sending concurrent retrieval requests. The flaw exists in the `update_file_usage` function (`apps/base/views.py`) across all releases prior to v2.5.0 - including v2.4.0 despite the CVE description citing only 'up to 2.3'. A public proof-of-concept is available via GitHub issue #482, though no active exploitation has been confirmed by CISA KEV. The vendor-released fix is confirmed in v2.5.0 via commit 8d7d856.
Improper integrity check validation in Linux Foundation Magma 1.9.0's SecurityModeComplete Handler allows remote unauthenticated attackers to bypass NAS-layer security verification in the mobile core network. The SecurityModeComplete message is part of the LTE Non-Access Stratum security negotiation procedure; failure to validate the integrity check value (CWE-354) means crafted messages can be accepted without proper cryptographic verification. A publicly available proof-of-concept exists on GitHub, and the CVSS 4.0 vector confirms network-reachable, zero-prerequisite exploitation with low-level impact across confidentiality, integrity, and availability dimensions.
Stored cross-site scripting in SiYuan before v3.8.1 lets an authenticated user plant HTML/script payloads in a block's name, alias, or memo field, which then execute in another user's session when that user views any document that references or displays the poisoned block via hint, backlink, or breadcrumb rendering. Because the malicious markup runs in the victim's authenticated context, an attacker can hijack sessions and act as the victim. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Stored cross-site scripting in SiYuan before v3.8.1 lets a low-privileged attacker persist HTML/script payloads in bazaar package names and notebook names, which the confirmDialog() function interpolates unescaped into innerHTML. The script executes in a victim's browser session when they uninstall a malicious package or unlock an encrypted notebook, enabling session-context takeover of the note-taking application. No public exploit identified at time of analysis and no active exploitation is recorded.
Unauthenticated stream credential disclosure in AVideo (WWBN, commit e01e41ecc and earlier) lets remote attackers retrieve any user's restream stream_key and stream_url for external platforms like YouTube, Facebook, and Twitch. The getLiveKey.json.php endpoint accepts a 'token' parameter that bypasses both the Live::canRestream() access gate and the restream ownership check, and the token is merely AES-256-CBC encryptString() of an integer id with no user binding, expiry, or authentication tag. Because a public encryption oracle (view/url2Embed.json.php) lets anyone encrypt arbitrary values, valid tokens can be forged with no authentication; no public exploit is identified at time of analysis but the technique is fully described.
Path traversal in Pake before 3.13.1 allows a malicious or compromised web page loaded inside any Pake-generated desktop app to write attacker-fetched content to arbitrary user-writable filesystem locations, including persistence directories. The `download_file` Tauri command accepted a JavaScript-supplied filename and joined it directly to the Downloads directory without stripping path separators or sanitizing sequences such as `../`, enabling writes to locations such as `~/Library/LaunchAgents/` on macOS, `~/.config/autostart/` on Linux, or the Windows Startup folder. Because the HTTP fetch is performed by the Rust backend rather than the sandboxed browser renderer, browser-level download restrictions do not apply. No public exploit is identified at time of analysis, though the attack primitive is straightforward given JFrog's public disclosure.
Arbitrary code execution is achievable in Readest versions prior to 0.11.16 by embedding a malicious EPUB file that bypasses the application's DOMPurify-based HTML sanitizer via a crafted srcdoc attribute on an iframe element. DOMPurify treats srcdoc as an opaque string and does not sanitize its contents, allowing a complete HTML document containing JavaScript to survive sanitization and execute inside an iframe configured with sandbox="allow-same-origin allow-scripts"; the executing script can then call parent.parent.__TAURI_INTERNALS__.invoke() to access the full Tauri IPC command surface and achieve OS-level arbitrary code execution. The attack requires only that a victim open a specially crafted EPUB file, and the payload can be rendered invisibly as a zero-size transparent iframe. No public exploit code has been identified at time of analysis; vendor-released patch version 0.11.16 is available.
Unauthenticated exposure of live TLS session keys in Keploy 3.1.0-3.6.25 allows any network-reachable attacker to decrypt recorded application TLS traffic by calling the agent control-plane's /agent/pcap/keylog endpoint, which streams NSS keylog lines without any authentication gate. The root cause is the agent HTTP server binding to 0.0.0.0 (all interfaces) rather than loopback, as confirmed by the patch commit diff. Additional endpoints /agent/stop and /agent/storemocks allow unauthenticated manipulation of test recording sessions. No public exploit code or CISA KEV listing has been identified at time of analysis, though exploitation requires only a standard HTTP client.
Path traversal in AJCloud's AJY IPC camera firmware (jdbhttpd web service, port 80) allows unauthenticated remote attackers to read arbitrary files with root privileges on devices running firmware prior to 01.10715.11.37. Sensitive data directly accessible includes cleartext RTSP credentials, Wi-Fi SSID and pre-shared key, device serial numbers, and cloud binding parameters, enabling material follow-on attacks beyond the device itself. No public exploit code has been identified at time of analysis, but the attack primitive requires no authentication and no special conditions beyond network reachability.
AshGraphql's Absinthe complexity calculator undercounts nested Relay connection and keyset pagination queries, allowing unauthenticated clients to bypass any configured `max_complexity` cap and force unbounded database reads. Versions 0.16.23 through 1.10.x expose this flaw whenever a schema uses `first`/`last`-based pagination: a single crafted query such as `posts(first: 500) { edges { node { comments(first: 500) { ... } } } }` scores near-zero in Absinthe's guard while materializing up to 250,000 records per request. No active exploitation is confirmed (no CISA KEV listing), but the attack requires no authentication and is trivially constructable from the public advisory description alone.
Blind SQL injection in Admidio before 5.0.12 allows unauthenticated remote attackers to extract full database contents - including password hashes and user credentials - via the `relation_type_list` parameter of `lists_show.php`. Authentication is circumvented by supplying a dummy UUID in the `role_list` parameter, requiring no valid session or credentials against a default installation. No public exploit code or CISA KEV entry has been identified at time of analysis, but the low-complexity, zero-authentication nature of this flaw makes exploitation straightforward once the attack pattern is known.
Server-side request forgery in jina-ai reader allows unauthenticated remote attackers to reach cloud metadata services and internal HTTP endpoints by supplying publicly resolvable hostnames that map to private IP addresses. The private-address guard - intended to block RFC 1918 and metadata service IPs - is only enforced when the service runs inside Google Cloud, leaving all other deployment environments (AWS, Azure, on-premises) completely unprotected by this control. Successful exploitation in cloud-hosted deployments can yield instance metadata including IAM credentials and access tokens. No public exploit code has been identified at time of analysis, and this CVE is not currently listed in CISA KEV.
Credential exfiltration in NextChat 2.15.8-2.16.1 allows unauthenticated network attackers to steal the server's OpenAI API key by exploiting flawed URL validation in the proxy endpoint. The x-base-url header is checked using substring matching rather than hostname parsing, so any URL containing the string 'api.openai.com' - including attacker-controlled domains like 'evil.attacker.com/api.openai.com' - passes validation and causes NextChat to forward the OpenAI API key in the Authorization header to the attacker's server. No public exploit identified at time of analysis, though a GitHub issue documenting the flaw is publicly accessible.
Unauthenticated information disclosure in Admidio before 5.0.12 exposes private forum and announcement content through unprotected RSS feed endpoints. Remote attackers with no credentials can retrieve full post text, titles, author names, and timestamps from modules explicitly configured as login-only, bypassing the intended access restriction entirely. No public exploit code has been identified and the CVE is not in CISA KEV, but the attack requires nothing more than a standard HTTP GET request, making it trivially executable against any reachable instance.
Stack-based buffer overflow in D-Link DIR-825M firmware 1.1.8 enables remote code execution via the web management interface's disk formatting endpoint. The `partition` argument to the `sub_46725C` function at `/boafrm/formDiskFormat` is not bounds-checked (CWE-119), allowing a low-privileged authenticated attacker to overwrite the stack and achieve arbitrary code execution on the router. A public proof-of-concept exploit exists, substantially elevating practical risk; no CISA KEV listing has been confirmed at time of analysis.
Rate-limiting bypass in WWBN AVideo (through commit e01e41ecc) allows unauthenticated remote attackers to conduct unlimited brute-force attacks against login.json.php and 13 other protected endpoints by exploiting a logic flaw in enforceRateLimit(). The function relies on ObjectYPT::setCacheGlobal to persist per-client attempt counters, but silently discards those writes whenever isBot() classifies the client as a bot - which occurs by default for any request omitting a User-Agent header or using agent strings matching 'curl', 'bot', 'crawler', or 'spider'. No active exploitation has been confirmed at time of analysis, but the trivial bypass mechanism makes this immediately usable for credential stuffing without any specialized tooling.
OS command injection in Qubes OS (qubes-core-dom0-linux before 4.3.22) allows an attacker who controls any qube to execute arbitrary commands in dom0 - the privileged hypervisor control domain - when a dom0 operator runs qvm-copy-to-vm targeting that attacker-controlled qube. The root cause (CWE-78) is qfile-dom0-agent.c passing unsanitized, attacker-crafted error messages to the C system() function, where embedded shell metacharacters are interpreted as commands in the dom0 shell context. No public exploit or CISA KEV listing has been identified; however, successful exploitation yields complete Qubes OS compromise because dom0 governs all other virtual machines on the system.
Authentication bypass in oidcc (Erlang/Elixir OpenID Connect library) versions 3.2.0-beta.1 through before 3.9.0 allows unauthenticated attackers to impersonate arbitrary users by presenting a JWE-encrypted ID token or JARM response that wraps unsigned claims, which the library incorrectly accepted as fully validated. The relying party's public encryption key - typically published at a well-known JWKS endpoint - is all an attacker needs to forge tokens with arbitrary sub, iss, and aud values, bypassing provider signing-key possession entirely. No public exploit has been identified at time of analysis, and this CVE is not listed in CISA KEV; however, the impact for affected deployments using encrypted ID tokens or JARM is complete authentication bypass.
Per-file size and file-count upload limit enforcement in Apache Wicket 8.x through 10.x can be bypassed when a co-deployed servlet component pre-consumes the multipart request body before Wicket processes it. Affected deployments fall back to HttpServletRequest#getParts(), which silently skips Wicket's configured Form#setFileMaxSize and Form#setFileCountMax constraints, allowing remote unauthenticated submitters to upload files larger or more numerous than the application intends to permit. Parts omitting a Content-Type header are additionally loaded entirely into JVM heap during parsing, creating a secondary denial-of-service path limited only by external container allocation bounds. No public exploit or CISA KEV listing exists; EPSS stands at 0.20% (10th percentile), consistent with a conditional, architecturally specific flaw.
Stored XSS in the MW WP Form WordPress plugin (all versions before 5.1.6) lets authenticated users holding the Editor role or above inject persistent malicious JavaScript into form settings, which then executes in the browser of any administrator who views the affected dashboard page. A publicly available proof-of-concept has been published by WPScan, though EPSS sits at 0.15% (5th percentile), indicating low measured exploitation probability at this time. No confirmed active exploitation has been reported and the vulnerability is not listed in the CISA KEV catalog.
Silent schema cross-contamination in ash_postgres multi-tenancy allows a low-privileged user who can trigger a tenant rename to gain unauthorized read and write access to a different tenant's PostgreSQL schema. Affected versions span 0.25.0 through 2.13.0 of the ash-project/ash_postgres Elixir library. When PostgreSQL rejects the ALTER SCHEMA rename due to a name collision, the library silently reports success, causing the tenant metadata row to be committed pointing at the victim's live schema - routing all subsequent reads and writes for the attacker's tenant against the victim's data. No public exploit code or CISA KEV listing has been identified at time of analysis.
Cross-tenant data disclosure in ash_graphql affects authenticated subscribers in multi-tenant deployments running versions 1.4.0 through 1.10.x. The subscription resolver's in-memory authorization fast path evaluates read policy filters without any tenant condition, allowing a subscriber scoped to tenant A to receive GraphQL subscription notifications carrying tenant B's records. The single-notification code path had no tenant guard at all, and the batched path checked tenant only on the list head, leaving all subsequent entries to authorize purely in memory without tenancy enforcement. No public exploit code exists and the vulnerability is not listed in CISA KEV, but the impact is high confidentiality loss for any multi-tenant SaaS product built on this stack.
Incorrect authorization in Frappe Framework development builds allows any authenticated low-privileged user holding print permission on a document to supply raw Jinja template strings to the render_jinja_template endpoint, bypassing the intended System Manager restriction. The template engine executes these strings server-side, enabling arbitrary SELECT queries across unrelated database tables - critically including extraction of password hashes from the __Auth table. No public exploit has been identified at the time of analysis, but the attack is mechanically straightforward for any user with a valid Frappe account and default print permissions, making credential theft the primary real-world risk.
SSRF filter bypass in WWBN AVideo exposes cloud metadata services and loopback interfaces to authenticated low-privilege attackers. The isSSRFSafeURL function fails to normalize IPv6 NAT64 addresses rendered in hexadecimal notation, allowing crafted URLs such as 64:ff9b::a9fe:a9fe to resolve to protected addresses like 169.254.169.254 while evading the SSRF blocklist. Exploitation could yield cloud instance credentials or access to internal services; no public exploit or KEV listing is confirmed at time of analysis.
Local privilege escalation in SiYuan's Windows NSIS installer affects versions 2.0.14 through 3.8.0, allowing a local attacker with write access to a directory to execute arbitrary code with elevated privileges by planting a malicious binary that the NSIS installer resolves ahead of System32 during an all-users installation. The root cause is electron-builder's preInit hook invoking system utilities such as TASKKILL by short name via nsExec::Exec, causing the installer's launch directory to take search-path precedence over System32 before the license page is even displayed. No public exploit code has been identified at time of analysis, though the binary-planting technique is well-documented in Windows installer security research.
Predictable authentication token generation in TOTOLINK N600R firmware 4.3.0cu.7866_B20220506 exposes the router's web management interface to session token prediction attacks from the network. The loginAuth function in /web_cste/cgi-bin/cstecgi.cgi generates insufficiently random values (CWE-330), enabling unauthenticated remote attackers to predict valid session tokens and gain unauthorized access to router configuration data. A proof-of-concept exploit script (poc.py) is publicly available on GitHub, though high attack complexity limits practical exploitation to technically capable attackers.
Stack-based buffer overflow in NASA Trick 19.6.0's JSONVariableServer component exposes the simulation framework to remote exploitation via crafted TCP requests, with no patch available and no vendor response to disclosure. The vulnerability resides in JSONVariableServerThread::parse_request, where user-supplied network data is processed through an unbounded sscanf call without bounds checking on a stack-allocated buffer. Unauthenticated remote attackers reaching the TCP socket can trigger this overflow, potentially crashing the simulation process or achieving code execution on the host.
Internal Ash attribute and argument names leak through GraphQL error responses in ash_graphql 1.9.0 through 1.10.x, bypassing application-configured error handlers intended to redact them. A logic flaw in AshGraphql.Errors causes a sanitizing error_handler's decision to suppress the :path field to be silently overridden, re-injecting raw internal field names via build_error_path/5. Unauthenticated remote clients can trigger validation failures on non-exposed or nested fields to enumerate internal schema structure that the application deliberately chose to hide. No public exploit or KEV listing exists at time of analysis.
Relay node query crash in AshGraphql (ash_graphql 0.27.0 through 1.10.x) allows an unauthenticated remote caller to abort the Absinthe node(id:...) resolver by supplying a base64-encoded relay ID whose type segment resolves to an existing BEAM VM atom that is not a registered relay resource type. Because the resolver calls Map.fetch!/2 before Absinthe's rescue handlers run, the resulting KeyError surfaces as an unhandled process exception rather than a structured GraphQL error, potentially leaking an internal stacktrace with module names and file paths. No public exploit code has been identified at time of analysis, though the fix commit is publicly visible on GitHub.
Authenticated administrators in SiYuan before v3.8.1 can bypass the IsForbiddenAbsPath security guard - introduced to remediate GHSA-c8r8-95hg-mp34 - by targeting the /history/*path and /repo/diff/*path API endpoints, which construct file paths independently and were never covered by the guard. Exploitation enables retrieval of historical file snapshots including data/.siyuan/publishAccess.json, which stores plaintext publish-mode passwords, and files under data/templates/. No public exploit identified at time of analysis; the vendor-released patch is v3.8.1.
Arbitrary directory creation in browser-use web-ui 2.0.0-3.0.0 allows remote unauthenticated attackers to create directories at any path writable by the root-running container. The `run_agent_task` function passes user-supplied `save_recording_path`, `save_trace_path`, `save_agent_history_path`, and `save_download_path` values directly to filesystem operations without sanitizing absolute path inputs. Because the Gradio interface requires no authentication and containers commonly run as root, the effective write surface spans the entire container filesystem. No public exploit has been identified at time of analysis.
SiYuan's publish mode before v3.8.1 leaks invisible-tier content to unauthenticated readers through three unguarded rendering pathways: SQL embed blocks, attribute-view keys, and attribute-view backlinks. Administrators who mark notes as invisible to control what anonymous visitors see receive no protection - those same visitors can enumerate the hidden content by exploiting any of the three listing mechanisms. No active exploitation has been identified (no CISA KEV listing, no public POC), and the vendor has released a fix in v3.8.1.
WWBN AVideo's Live plugin exposes an unauthenticated endpoint at plugin/Live/api/preauthorize.json.php that accepts credentials via HTTP GET with no rate limiting, enabling two distinct abuse vectors: sustained brute-force password guessing against any user account and uncapped triggering of two-factor authentication confirmation emails. All versions of AVideo are affected per CPE data, and exploitation requires no privileges or user interaction. No public exploit code or active exploitation has been identified at time of analysis, though the attack surface is trivially low-complexity for any remote attacker.
Cleartext API key storage in browser-use web-ui versions 2.0.0 through 3.0.0 exposes configured LLM provider credentials to any local user with filesystem read access. The application writes API keys to predictably-named JSON files in a temporary settings directory without encryption or access controls, as identified in src/webui/webui_manager.py. An attacker who gains read access to that directory can silently harvest credentials and use them to impersonate the victim against third-party LLM APIs, incurring charges or extracting data. No public exploit code has been identified at time of analysis.
Denial of service in Open5GS AMF (Access and Mobility Management Function) versions up to 2.7.7 allows a remote low-privileged attacker to crash the AMF process by submitting a crafted N1N2MessageTransfer request containing an unrecognized ngapIeType value, triggering an unchecked assertion termination. The AMF is a singleton or small-cluster critical component of 5G core infrastructure; its crash disconnects all user equipment registered through that instance until service restarts. A public exploit exists (GitHub issue #4396) and the fix is available in version 2.8.0, making patching the clear immediate action.
Denial of service via improper resource shutdown in Magma 1.9.0's gNB Termination Handler allows remote low-privileged attackers to disrupt or crash the AMF's NGAP processing of 5G base station connections. The flaw in tasks/ngap/ngap_amf.c stems from CWE-404 (improper resource release), producing availability impact against the vulnerable system with no confidentiality or integrity consequence. A public proof-of-concept exploit exists per the referenced GitHub issue #16019, though CISA has not confirmed active exploitation.