Server-side request forgery in ms-swift 4.5.2 allows unauthenticated remote attackers to weaponize the server's multimodal media fetching logic against internal infrastructure. The OpenAI-compatible deploy API accepts image_url, audio_url, and video_url parameters that are passed to vision_utils.py without URL validation or redirect filtering, enabling arbitrary outbound requests to cloud metadata services (e.g., AWS IMDSv1 at 169.254.169.254), internal APIs, and network-adjacent services. No public exploit code or active exploitation has been identified at time of analysis, but the unauthenticated network-accessible attack surface and high confidentiality impact make this a significant risk for any internet-exposed ms-swift deployment.
Argument injection in git-mcp-server 2.15.1 allows unauthenticated remote attackers to write arbitrary files outside the target repository to any filesystem path reachable by the server process. The `ref` and `object` parameters passed to the `git_log`, `git_diff`, and `git_show` tool handlers lack leading-dash validation, permitting injection of git command-line options such as `--output=` directly into the underlying CLI invocation. No public exploit code has been identified at time of analysis, and a corrective release (v2.15.3) is available with fixes in the command-builder and log operation modules.
Authorization bypass in Snipe-IT's bulk delete endpoint (all versions before 8.6.3) allows restricted authenticated users to soft-delete user accounts outside their authorized management scope by supplying arbitrary user IDs in a bulk delete request. The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key / IDOR): the endpoint accepts attacker-controlled user IDs without validating them against the requesting user's permitted scope. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Sensitive system information exposure in XING CPTrans-ME-X (a rack-mounted accessory from XING Inc., distributed under the JOYSOUND product ecosystem) allows unauthenticated remote attackers to retrieve confidential system details over the network without any privileges or user interaction. Classified as CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere), the vulnerability was reported by JPCERT and documented in JVN advisory JVN#32505330. No public exploit code has been identified at time of analysis, though the unauthenticated, low-complexity network attack vector makes opportunistic probing accessible to low-skilled actors if the device is network-reachable.
Stored cross-site scripting in Emlog versions 2.6.29 and prior enables arbitrary JavaScript execution in the browsers of all site visitors. The root cause is Parsedown being invoked without safe mode enabled, so raw HTML - including `<script>` tags and inline event handlers - embedded in article Markdown is passed through and rendered without any additional sanitization. No vendor-released patch was publicly available at the time of disclosure, leaving all deployed instances of Emlog ≤2.6.29 exposed; no public exploit code exists and the vulnerability is not listed in CISA KEV.
Unauthenticated SSRF in OpenPanel before 2.3.0 exposes two utility endpoints - /misc/favicon and /misc/og - that blindly fetch attacker-supplied URLs without adequate validation. Any remote, unauthenticated attacker can direct the OpenPanel server to query internal network hosts or cloud metadata services (such as AWS IMDSv1 at 169.254.169.254), with response bodies returned verbatim to the attacker, enabling direct theft of cloud IAM credentials and systematic enumeration of internal services. The vendor has released a fix in version 2.3.0 per the GitHub Security Advisory GHSA-2hff-m67f-2w2w; no public exploit code or CISA KEV listing is identified at time of analysis.
Hard-coded credentials in SmartIT Desktop Manager by Lightstar expose the AES symmetric key protecting all client-server communications. Unauthenticated remote attackers who can obtain the application binary or source - typical for distributed client software - can extract a static embedded password, use it to retrieve the AES encryption key, and subsequently decrypt the product's communication channel. Reported by TWCERT; no KEV listing and no public exploit code identified at time of analysis.
Stored cross-site scripting in EMX Tecnologia's Gestão X business-management suite (version 8.4 and earlier) lets an authenticated user plant malicious JavaScript inside the Help Chat feature, which then executes in the browser of any other authenticated user who opens that conversation. Successful exploitation enables session hijacking, account takeover and unauthorized actions performed under the victim's identity, with the attacker's own privileges and one victim click as the only prerequisites. No public exploit code or CISA KEV confirmation was identified at time of analysis, and the EPSS score of roughly 0.15 percent (5th percentile) indicates the industry does not currently expect widespread exploitation.
Local privilege escalation to root in Amazon's log4j-cve-2021-44228-hotpatch package (Amazon Linux before version 1.3-9) stems from an OS command injection flaw triggered when the hotpatch daemon processes a Java executable whose filesystem path contains embedded newline characters. A low-privileged local user can craft such a path and launch a Java process, causing the unpatched daemon to pass the unsanitized path into a shell command and execute the injected content with root privileges. Amazon has released a patched version (1.3-9) via ALAS2-2026-3784; no public exploit or CISA KEV listing has been identified at time of analysis.
Unauthenticated path traversal in AgentScope through 2.0.7.post1 allows remote attackers to copy arbitrary server-side directories into the agent workspace via the unvalidated skill_path parameter in LocalWorkspace.add_skill, exposing sensitive server files through the workspace skill listing API. The affected function performs no confinement of the source path, enabling directory traversal to any filesystem location readable by the server process. No patch has been confirmed at time of analysis; CVSS 4.0 rates this 8.7 with no privileges or user interaction required.
Server-side request forgery in camel-ai OWL's DocumentProcessingToolkit exposes internal network resources to unauthenticated remote attackers across all tracked versions. The `extract_document_content` tool fetches caller-supplied URLs with no scheme, host, or IP allowlist, enabling attackers to pivot through the agent server to reach cloud metadata endpoints, internal APIs, or other SSRF-reachable services. The attack is delivered via prompt injection - malicious URL directives embedded in content processed by the OWL agent - with SSRF responses surfaced directly in the agent's context window, potentially leaking credentials or internal topology. No public exploit code or CISA KEV listing has been identified at time of analysis.
SSRF guard bypass in LLaMA-Factory's OpenAI-compatible API multimodal media URL handler exposes internal network services and cloud metadata endpoints to unauthenticated remote attackers. The vulnerability stems from a TOCTOU (time-of-check/time-of-use) race in the check_ssrf_url guard: the URL is validated once, but the subsequent requests.get call follows HTTP redirects and re-resolves DNS without re-validation, defeating the protection. Attackers can exploit this via HTTP redirect chains or DNS rebinding to force the API server to fetch resources from RFC1918 addresses or cloud instance metadata services (e.g., AWS IMDSv1 at 169.254.169.254), potentially exfiltrating IAM credentials. No public exploit is identified at time of analysis and the CVE is not in CISA KEV.
Unauthenticated arbitrary-path file read in Xinference v3.x (including commit 4a94832 and v3.3.0) exposes server filesystem content to any network-accessible attacker via the POST /v1/models/llm/auto-register endpoint. The endpoint accepts a caller-supplied model_path without authentication or path validation, reads config.json, tokenizer_config.json, and chat_template.jinja from that path, and reflects the parsed content in the HTTP response. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the zero-prerequisite network attack makes any internet-exposed Xinference instance immediately at risk.
Cross-site request forgery in MISP's sharing group quick-edit feature allows an unauthenticated attacker to manipulate threat intelligence sharing group membership by tricking a privileged MISP user into loading a crafted URL. The root cause is that HTTP method enforcement - which should have restricted the addOrg, removeOrg, addServer, and removeServer actions to POST-only - was commented out in the shared helper __initialiseSGQuickEdit(), leaving all four endpoints reachable via GET. Successful exploitation can silently add or remove organisations and servers from a sharing group, potentially exposing sensitive threat intelligence to unintended recipients or severing legitimate information-sharing relationships.
Privilege escalation in Google Cloud Integration Connectors (HTTP Connector component) allows an authenticated low-privilege user to attach an unauthorized service account to a connector, effectively taking over the associated Google Cloud Project. Affected versions are those deployed prior to the 2025-12-11 server-side patch, which Google applied automatically with no customer action required. No public exploit has been identified at time of analysis, but the CVSS 4.0 vector reflects high subsequent-system impact across confidentiality, integrity, and availability - matching a full project compromise scenario.
Arbitrary shell command execution in aider (aider-chat) is triggered silently when a user runs the tool inside a crafted git repository containing a malicious `.aider.conf.yml` configuration file. The tool unconditionally reads this file at startup and passes `test-cmd` and `lint-cmd` values directly to Python's `subprocess` with `shell=True`, with no user confirmation, no LLM involvement, and no API key required. Confirmed present on version 0.86.2 and the 0.86.3.dev main branch per the VulnCheck advisory; no vendor-released patch has been identified at time of analysis, and no public exploit code has been identified beyond the mechanism documented in the public GitHub issue.
Local privilege escalation in JAL Information Technology's Pallet Control suite (including PalletControl and PalletControl Cloud) enables a low-privileged local attacker to execute arbitrary code with SYSTEM-level privileges due to incorrect default installation permissions (CWE-276). All tracked versions across three CPE entries are listed as affected per JPCERT/CC coordination notice JVN#84094853. No public exploit code has been identified at time of analysis, and the vulnerability is not currently listed in the CISA KEV catalog.
Path traversal in Plesk web hosting control panel (versions ≤18.0.79.9 and 18.0.80-18.0.80.5) enables local users with low privileges to execute arbitrary code as the root user, resulting in full system compromise. The CVSS 4.0 score of 8.5 reflects high CIA impact with no special attack requirements beyond local OS access (AV:L/PR:L). No public exploit code or CISA KEV listing has been identified at time of analysis, but the privilege escalation to root in a widely deployed hosting platform makes this a high-priority patch for server operators, particularly those running multi-tenant shared hosting environments.
Out-of-bounds write in Unidata netcdf-c through 4.10.1 allows an attacker who can supply a crafted HDF5 file to corrupt process memory when the application enumerates HDF5 attribute names. The vulnerable function NC4_HDF5_inq_attname() in libhdf5/hdf5attr.c blindly copies HDF5-returned attribute names into a fixed 256-byte destination buffer without validating the source length, a classic CWE-787 stack/heap corruption sink. No public exploit code or CISA KEV listing has been identified at time of analysis, but the deterministic nature of the overflow and the wide use of netcdf-c in scientific pipelines make this a meaningful risk for any application that processes externally-sourced HDF5 data.
Path traversal in Plandex 2.2.1's ApplyFiles function allows an attacker who can influence the AI model's output - through poisoned repository files or attacker-controlled context - to write files to arbitrary locations outside the intended project directory. Targets such as shell initialization files (~/.bashrc, ~/.zshrc) and cron entries can be silently overwritten, resulting in persistent code execution under the developer's local account. No CISA KEV entry or confirmed public exploit exists at time of analysis, but the attack surface (indirect prompt injection combined with insecure file-write) is increasingly well-understood in the AI tooling threat landscape.
Out-of-bounds memory corruption in PJSIP pjproject's SDP negotiator allows a remote unauthenticated attacker to trigger memory corruption and denial of service by sending a crafted SDP offer or answer containing out-of-range payload-type numbers. The root defect is in assign_pt_and_update_map() in pjmedia/src/pjmedia/sdp_neg.c, where PT numbers from remote SDP are used as fixed-size array indices with only a lower-bound check, not an upper-bound check. Exploitation requires the non-default compile-time flag PJMEDIA_SDP_NEG_MAINTAIN_REMOTE_PT_MAP to be enabled; default builds are entirely unaffected, no public exploit has been identified, and code execution has not been demonstrated.
Missing authorization on the run replay API endpoint in Trigger.dev before 4.5.2 allows authenticated attackers to inject task runs into environments belonging to other organizations or projects. By replaying their own historical runs into victim environments, attackers can consume victim compute resources and permanently pollute that organization's run history and audit logs. No public exploit has been identified at time of analysis, but the vulnerability is trivially exploitable by any authenticated platform user against any other tenant.
Cross-company authorization bypass in Snipe-IT before 8.6.2 allows authenticated users with the reports.view permission to manipulate checkout-acceptance records belonging to other companies in multi-tenant deployments. By enumerating sequential acceptance IDs and exploiting a null check defect on the legacy users.company_id column, an attacker can soft-delete acceptance records or trigger unsolicited reminder emails across company boundaries. Vendor-released patch v8.6.2 is available; no public exploit or active exploitation has been identified at time of analysis.
Unauthenticated XSS in OpenPanel before 2.3.0 allows remote attackers to execute arbitrary JavaScript in a victim's browser by supplying a malicious SVG URL to the unprotected favicon proxy endpoint GET /misc/favicon. Because the SVG is served from the OpenPanel API origin, embedded scripts inherit same-origin context, enabling the attacker's code to issue credentialed requests against authenticated admin API endpoints on the victim's behalf. No public exploit code has been identified at time of analysis, but the attack requires only standard web delivery and a logged-in admin victim.
Heap buffer overflow in ntop nDPI before version 6.0 allows unauthenticated network-adjacent or remote attackers to corrupt process heap memory by sending crafted packets containing TLS SNI values, HTTP headers, or DNS names with characters that expand during JSON escaping. The root cause in ndpi_json_string_escape (src/lib/ndpi_serializer.c) is that the original bounds check guarded only single-byte writes while escape sequences requiring 2 bytes (e.g., backslash-quote) or 6 bytes (e.g., \u00XX control-character escapes) silently overran the caller-supplied buffer. Vendor-released patch is available via commit 94e82c1 targeting the 6.0 release; no public exploit has been identified at time of analysis.
Heap buffer overflow in PJSIP pjproject's PJLIB-UTIL HTTP client allows a malicious or man-in-the-middle HTTP server to corrupt application heap memory or terminate the process by delivering a response body larger than twice the Content-Length-derived initial allocation. The flaw resides in http_client.c where the buffer growth logic performed only a single doubling, which is insufficient when the server-supplied Content-Length substantially underestimates the actual body size, causing pj_memcpy() to write beyond the allocation boundary. Only applications using the non-incremental whole-body completion callback are affected; the fix (commit 8d5956a) replaces single-doubling with a loop that guarantees the buffer fits the incoming data before any copy occurs.
Incorrect authorization in MISP allows any authenticated user who is a member of an event-owning organization to delete individual attributes or perform bulk attribute deletion from that event, regardless of whether their assigned role carries `perm_modify` or `perm_modify_org` permissions. Three deletion controller actions in `AttributesController.php` - `delete()`, `deleteSelection()`, and `deleteSelected()` - relied only on organization membership checks inside `MispAttribute::deleteAttribute()` rather than on MISP's authoritative `ACL::canModifyEvent()` gate, which attribute editing operations correctly invoked. No public exploit has been identified, but the integrity impact is significant for any collaborative MISP deployment because deleted threat intelligence attributes cannot trivially be recovered.
Unbounded memory accumulation in the elixir-mint Mint HTTP client library (versions 0.1.0 through <1.10.0) enables a remote HTTP server to exhaust client-side memory and crash the entire BEAM VM node. Two HTTP/1 parser states - the status-line decoder and the chunk-extension-line decoder - append successive socket data into `conn.buffer` with no size cap because the existing `:max_header_list_size` guard was wired only to header and trailer parsing, not to these two states. A malicious or attacker-redirected server that withholds CRLF terminators can grow the buffer indefinitely until the OS OOM-killer terminates the node, collaterally killing all other processes sharing it. No public exploit has been identified, but the technique requires only a straightforward streaming server.
Authentication bypass in Frappe CRM prior to v1.73.0 allows network-accessible attackers to impersonate users by replaying logged invitation keys against the crm/api endpoint. The root cause is that invitation keys were never invalidated after acceptance - they remained logged and reusable indefinitely. The vendor released a patch in v1.73.0; no public exploit or CISA KEV listing has been identified at time of analysis.
WHMCS's 2Checkout payment gateway endpoint exposes customer data to unauthenticated remote attackers due to a missing authorization check (CWE-862) across versions 8.13.0 through pre-8.13.8, 9.0.0 through pre-9.0.8, and all end-of-life releases from 4.5.0 onward. The flaw enables an unauthenticated network attacker who meets specific deployment conditions - the 2Checkout payment gateway must be configured and active - to retrieve WHMCS customer records through the unprotected endpoint. Vendor-released patches are available as WHMCS 8.13.8 and 9.0.8; no public exploit code or CISA KEV listing has been identified at time of analysis.
undici's cache interceptor mishandles the Set-Cookie response header, failing to either refuse storage or strip it, so in the default shared-cache mode a cacheable response carrying Set-Cookie is stored and later replayed to a different caller matching the same cache key. This discloses one caller's cookies to another party and lets an untrusted origin inject cookies into cached responses served to every subsequent caller. Affected are undici 7.0.0 through 7.29.1 and 8.0.0 through 8.10.2; fixes are available in 7.29.1 and 8.10.2, exploitation is not confirmed in CISA KEV, EPSS probability is low (0.25%), and no public exploit code has been identified.
Client-certificate authentication (mTLS) in Traefik before v2.11.55 can be silently bypassed by unauthenticated network attackers when routers are configured with multiple hostnames bearing conflicting TLS options. Traefik's conflict resolution logic incorrectly falls back to default (non-mTLS) TLS settings for all hostnames in the affected multi-host router, allowing an attacker to reach mTLS-protected backends without presenting a valid client certificate. No public exploit code or CISA KEV listing has been identified; the CVSS 4.0 AT:P metric confirms that exploitation depends on a specific deployment configuration being present.
Client certificate authentication bypass in Traefik v3.7.0-v3.7.10 allows unauthenticated network clients to reach services protected by the nginx.ingress.kubernetes.io/auth-tls-verify-client: "on" annotation without presenting a valid mTLS client certificate. The flaw stems from a naming collision in the Kubernetes Ingress NGINX provider: when two Ingress objects share the same host, client CA secret, and authentication mode, Traefik's conflict-resolution logic silently falls back to the entry point's default TLS configuration, which imposes no client certificate requirement. No public exploit has been identified at time of analysis, and the issue is fixed in Traefik v3.7.11.
Schema authorization bypass in Fastify before 5.12.2 allows an authenticated low-privilege attacker to substitute an arbitrary body object in place of the schema-validated request body, enabling unauthorized state changes and data disclosure. The flaw arises because Fastify mishandles the resolved value from Ajv async validators: if the validated request body contains a root-level property named `value`, Fastify overwrites the body with that property's value before invoking the route handler, so the handler operates on a different object than the one that passed schema validation. No public exploit code has been identified at time of analysis, but the low attack complexity and network vector make this a meaningful risk for Fastify-based APIs.
Authenticated remote file deletion in IBM Langflow OSS 1.0.0 through 1.11.2 allows any logged-in user to delete arbitrary files or directories on the underlying server via path traversal sequences in a pathname parameter. With PR:L and no UI required, the bar for exploitation is simply a valid account, making this a significant risk in multi-tenant or shared AI workflow deployments. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the CVSS 8.1 rating and high integrity/availability impact reflect the destructive potential.
Unrestricted file upload in AppNitro MachForm v30 permits unauthenticated remote attackers to achieve code execution by uploading a crafted .phar (PHP Archive) file through the application's file upload functionality. Because the application fails to block .phar extensions alongside conventional dangerous types like .php, an attacker can cause the PHP runtime to execute attacker-supplied code upon accessing the uploaded file. A public proof-of-concept is available on GitHub and a write-up is hosted on PacketStorm Security, raising practical exploitability above the low EPSS score would suggest.
Authenticated file upload in Zhao-github's ApiAdmin 5.0.1 lets a low-privileged user upload a crafted .php file that the web server then executes, yielding arbitrary code execution on the host. The flaw is an unrestricted file-type upload (CWE-434) reachable over the network with no user interaction beyond the attacker's own actions, and it carries a CVSS base of 8.1 with high confidentiality and integrity impact. No public exploit code and no CISA KEV entry were identified at time of analysis, and EPSS is low at 0.21% (11th percentile), though a researcher write-up linked from the CVE record suggests the technique is publicly described.
Kernel heap corruption in Imagination Technologies Graphics DDK enables local privilege escalation from a non-privileged user to kernel level via crafted GPU IOCTL calls. By fabricating a specific combination of flags on the GPU memory allocation interface, an attacker causes the driver to execute an incorrect double-free on the associated allocation, resulting in CWE-416-class use-after-free memory corruption in the kernel heap. CVSS 7.8 (AV:L/PR:L) accurately reflects the local-only attack surface; no public exploit has been identified at time of analysis, and EPSS at 0.14% (4th percentile) indicates low observed exploitation probability.
OS command injection in IBM i 7.3 through 7.6 allows a local, low-privileged attacker to execute arbitrary operating system commands by supplying specially crafted input containing shell metacharacters that the platform fails to sanitize before passing to an OS command interpreter. The vulnerability (CWE-78) affects IBM's flagship Power Systems operating system across four supported release lines and carries a CVSS 7.8 score reflecting full confidentiality, integrity, and availability impact upon successful exploitation. No public exploit code or CISA KEV listing exists at time of analysis; a vendor-released patch is available via IBM support.
Local OS command injection in IBM i 7.3 through 7.6 allows a low-privileged local user to execute arbitrary system commands, achieving full system compromise (confidentiality, integrity, and availability all at High). The vulnerability stems from insufficient neutralization of shell metacharacters in OS command construction (CWE-78). No public exploit code has been identified and EPSS sits at 0.11% (1st percentile), but IBM has confirmed the issue and released a patch via support page node/7285844.
Authenticated path traversal in IBM Langflow OSS 1.0.0 through 1.11.2 allows any logged-in user to read arbitrary files from the server filesystem - including JWT signing keys, the application secret_key, the runtime database, /proc/self/environ, and other tenants' uploaded files - by supplying absolute paths or traversal sequences in the files parameter of a build request. What elevates the risk beyond a standard directory traversal is the exfiltration mechanism: file contents are embedded directly into the LLM prompt and transmitted to the configured model endpoint, meaning secrets leave the controlled environment and reach third-party AI provider infrastructure. This attack path bypasses the LANGFLOW_RESTRICT_LOCAL_FILE_ACCESS=true containment flag, which enforces restrictions on other file-reading components but was never applied to the Chat Input to Message attachment pipeline. No public exploit code has been identified at time of analysis.
Sensitive information disclosure in IBM ContextForge MCP Gateway (mcp-contextforge-gateway) v1.0.6 and earlier enables remote authenticated attackers to reach internal network resources via a DNS rebinding attack during tool invocation. The vulnerability is classified as CWE-918 (SSRF), with the DNS rebinding mechanism serving as a bypass to route gateway-initiated requests to otherwise-unreachable internal hosts. The CVSS Scope:Changed metric confirms that the impact extends beyond the gateway itself to downstream internal services, resulting in high confidentiality impact. No public exploit code or active exploitation has been identified at time of analysis.
IBM Instana Agent Operator on OpenShift exposes etcd mTLS client credentials to authenticated cluster users via missing namespace destination validation. Builds 1.0.303 through 1.0.323 of IBM Observability with Instana allow a low-privileged authenticated attacker who controls a Kubernetes namespace to redirect the operator's credential-copy routine - intended to distribute etcd mTLS client certs within Instana-managed namespaces - into their own attacker-controlled namespace. Successful exploitation yields etcd mTLS client certificates, which grant broad read access to the OpenShift cluster's entire backing key-value store. No public exploit or CISA KEV listing identified at time of analysis.
Server-Side Request Forgery in IBM Langflow OSS 1.0.0 through 1.11.2 enables authenticated remote attackers to exploit a URL parser discrepancy, causing the application to issue unauthorized backend requests to internal services and expose sensitive information beyond the application's trust boundary. The CVSS scope-change metric (S:C) confirms that impact extends past the Langflow instance itself to internal network resources not directly reachable by the attacker. Vendor patch is available via IBM's support portal; no public exploit code or active exploitation has been identified at time of analysis.
XML external entity injection in the SAP Adapter component of IBM App Connect Enterprise and IBM Integration Bus for z/OS enables authenticated remote users to read arbitrary files from the server filesystem or conduct server-side request forgery against internal network resources. Affected releases span App Connect Enterprise 12.0.1.0-12.0.12.28 and 13.0.1.0-13.0.8.1, plus Integration Bus for z/OS 10.1.0.0-10.1.0.7. The CVSS scope-change flag (S:C) reflects that a successful XXE can pivot beyond the integration engine itself into adjacent internal infrastructure. No public exploit has been identified at time of analysis, and IBM has released a patch.
Server-side request forgery in nebula-mesh 0.6.0-0.7.1 lets any low-privilege 'user'-role operator coerce the control plane into making HTTP requests to internal, loopback, and link-local addresses by setting allow_private: true on their own webhook subscription. The missing authorization check in both the create and update webhook handlers (internal/api/webhooks.go) means the SSRF guard that protects all other tenants is silently bypassed at delivery time, exposing cloud metadata endpoints, internal APIs, or backend services reachable only from the server. A working proof-of-concept has been verified against a live instance; vendor-released patch v0.7.2 is available.
Blind SQL injection in WooCommerce's Analytics Orders reporting allows high-privileged authenticated users to extract arbitrary database contents by injecting into the date column parameter used in order analytics queries. Affected are all WooCommerce installations running versions before 11.0. The vulnerability stems from the `woocommerce_date_type` option value and the `date_type` query argument being interpolated directly into SQL without allowlist validation, enabling exfiltration of customer PII, payment data, and credentials via time-based or boolean blind techniques. No public exploit identified at time of analysis, though Patchstack discovery typically precedes weaponization.
Sharing Group authorization bypass in MISP allows an authenticated user with attribute or Galaxy Cluster creation permissions to associate objects with Sharing Groups they are not permitted to use. The flaw resides in AttributesController and GalaxyClustersController, where authorization checks against the Sharing Group were only invoked when the request explicitly set distribution == 4 - an attacker can craft a request containing sharing_group_id while omitting or manipulating the distribution parameter, causing the membership verification to be skipped entirely. Successful exploitation can silently breach organizational information-sharing boundaries, injecting data into restricted Sharing Groups and potentially distributing it to unauthorized member organizations. No public exploit has been identified at time of analysis.
Heap use-after-free in libsoup's HTTP/2 client implementation allows a malicious HTTP/2 server or MITM attacker to corrupt memory during asynchronous file upload operations. When a GNOME application uploads a file over HTTP/2 and the server sends a GOAWAY frame while the request body is being read asynchronously, the freed memory region can be accessed again, leading to information disclosure or arbitrary code execution on the client. No public exploit has been identified at time of analysis, and no KEV listing is present, but the unauthenticated network reachability combined with user-interaction-only barrier makes this a meaningful client-side threat.
Authentication hook bypass in Fastify 4.0.0-5.12.1 allows unauthenticated network attackers to reach a private plugin's custom not-found handler by sending a malformed URL under a sibling public plugin's prefix. The internal not-found router dispatches malformed paths through a single shared handler pointer before URL decoding, ignoring plugin-prefix scoping and skipping the preHandler lifecycle - the mechanism most Fastify applications use to enforce JWT or session authentication. No public exploit code has been identified at time of analysis, but the AV:N/AC:L/PR:N/UI:N vector means any reachable Fastify deployment meeting the required architecture is exploitable without friction.