CRLF injection in Laravel Framework (CWE-93) enables unauthenticated remote attackers to manipulate outbound email processing in any application that passes user-supplied email addresses to Laravel's mail functions. An attacker who can provide an email address to an application flow - such as registration, password reset, or contact forms - can embed carriage-return/line-feed sequences to inject additional SMTP headers, reroute messages to unintended recipients, or abuse the application's mail infrastructure as an open relay. The vendor has released patches in versions 12.60.0 and 13.10.0; no public exploit code or CISA KEV listing has been identified at time of analysis.
Arbitrary file write and deletion in datalab-to/marker through v2.0.0 exposes servers to full filesystem compromise via the FastAPI /marker/upload handler. Unauthenticated remote attackers can supply directory traversal sequences in the `file.filename` parameter - unsanitized before use in path construction - to write attacker-controlled content to or delete files at any location reachable by the server process. No public exploit code has been confirmed at time of analysis, but the VulnCheck advisory and GitHub issue #1047 reference the vulnerable code path in `marker/scripts/server.py`, making independent reproduction straightforward.
Remote code execution in IBM Langflow OSS 1.0.0 through 1.11.2 is reachable by any low-privileged authenticated attacker through an authorization bypass in the platform's flow build process. The flaw (CWE-94, Code Injection) allows a user with minimal credentials to submit flow build requests that exceed their authorized scope, causing the server to execute attacker-supplied code with full confidentiality, integrity, and availability impact. No CISA KEV listing and no public exploit code have been identified at time of analysis.
Stack-based buffer overflow in PJSIP's SRTP/SDES media transport allows a remote unauthenticated attacker to crash or potentially hijack control flow in any pjproject-based application with SRTP/SDES keying enabled. The flaw in `sdes_encode_sdp()` (transport_srtp_sdes.c) collects `a=crypto` attributes from a remote SDP offer into a fixed-size stack array without bounding the count, so a malicious SIP peer can overflow that array by including more attributes than it can hold. The vulnerability is reachable from an incoming SIP INVITE before application-level authentication, and a fix is available as upstream commit a1b707c; no public exploit or CISA KEV listing has been identified at time of analysis.
Credential theft and privilege escalation in IBM ContextForge MCP Gateway v1.0.7 and earlier allow a remote low-privilege authenticated attacker to extract sensitive credentials and elevate to higher access tiers by submitting maliciously crafted jq filter expressions that the gateway fails to properly validate. The jq filter injection bypasses input controls within the Model Context Protocol (MCP) gateway layer, giving authenticated-but-low-privilege users a direct path to confidentiality and integrity compromise of the entire gateway service. No public exploit code has been identified at time of analysis, and IBM has released a patch via advisory 7286052.
Stack buffer overflow in PJSIP's PJSUA library allows a malicious or compromised SIP registrar to crash applications - or potentially corrupt memory - by returning an excessive number of Service-Route headers in a 2xx registration response. The vulnerability affects all applications using the PJSUA/PJSUA2 account API (the default registration path) prior to commit acc03b5 in pjproject. The most likely outcome is denial of service via unexpected termination; however, because the overflow writes internal stack pointers rather than attacker-controlled bytes, arbitrary code execution is considered less probable though not excluded. No public exploit code or CISA KEV listing is present at time of analysis.
Stack buffer overflow in PJSIP's GnuTLS TLS backend allows a network-positioned attacker to corrupt memory or hijack control flow by presenting a crafted X.509 certificate with an oversized Subject Alternative Name entry during TLS handshake. Only builds compiled with GnuTLS (--with-gnutls) are affected; OpenSSL and Apple SecureTransport/Network.framework builds are explicitly unaffected. The vulnerability triggers before any SIP-level authentication, making it exploitable against both clients (connecting to a malicious server) and servers that request client certificates, with impact ranging from application termination to potential arbitrary code execution. No public exploit has been identified at time of analysis; upstream fix is available via commit c4a151a.
Blind SQL injection in GOLDENHORN ONEIT, an enterprise trade management platform by TAC Information Services Internal and External Trade Inc., allows low-privileged authenticated attackers to enumerate and extract the full database contents. The CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N) reflects network-accessible exploitation requiring only a valid low-privilege account, with full confidentiality, integrity, and availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis; the flaw was disclosed by TR-CERT (TR-26-0990).
Command injection in MBS-Solutions X-Serie Gateway firmware V6_00_05 enables an authenticated low-privileged Standard-role user to execute arbitrary OS commands as root by exploiting the ugw-restart method in /cgi-bin/wwwugw.cgi. Unsanitized user input is passed directly to the dpcheck system utility, which runs with root privileges, yielding full device compromise from a minimal trust level. Publicly available exploit code exists via a GitHub proof-of-concept repository; EPSS is low (0.24%, 15th percentile), consistent with a niche product, though the public PoC substantially lowers the barrier for targeted attacks.
Arbitrary file upload via the `/cgi-bin/ugwupload.cgi` endpoint in MBS-Solutions X-Serie Gateway firmware V6_00_05 permits an authenticated administrator to write files of arbitrary content to hardcoded filesystem paths. The CWE-434 flaw can be used to plant backdoors, overwrite critical device configuration, or corrupt the operating environment, potentially resulting in full device compromise. A public proof-of-concept repository exists on GitHub (SilviaMun/vulnerability-research), though current EPSS exploitation probability is low at 0.24% (15th percentile), consistent with a niche embedded device with limited deployment footprint.
Authenticated remote code execution in seacms v13.6 allows a low-privileged attacker to execute arbitrary OS commands by sending a crafted POST request to the admin_config.php component, exploiting a CWE-78 OS command injection flaw. The vulnerability achieves full system compromise (C:H/I:H/A:H) over the network with no user interaction required beyond authentication. No public exploit has been identified at time of analysis and EPSS sits at 0.24% (15th percentile), indicating minimal observed exploitation pressure currently.
Session hijacking in the Canva Android App before version 2.376.0 arises from an unrestricted header-reflection flaw in a privileged WebView component. An attacker who can control an external origin loaded within that WebView receives sensitive HTTP headers - including session tokens - that the app fails to suppress, exposing the authenticated user's session and enabling full account takeover. No public exploit has been identified at time of analysis; the flaw is patched in v2.376.0 per the Canva trust advisory.
Integer underflow leading to heap-based buffer overflow in IBM i 7.3 through 7.6 allows a remote attacker with low-privilege authenticated access to corrupt memory, potentially achieving arbitrary code execution or full system compromise. IBM has released patches for all four affected major versions; no active exploitation is recorded in CISA KEV and EPSS sits at 0.20% (10th percentile), placing real-world exploitation probability low despite the high CVSS score. SSVC rates this non-automatable with partial technical impact, suggesting the authentication barrier and service specificity meaningfully constrain mass exploitation.
Arbitrary local file read in firecrawl-mcp-server 3.20.2 allows any caller of the firecrawl_parse MCP tool to extract sensitive host files - including credentials, SSH keys, and environment variables - by supplying absolute paths or directory traversal sequences as the unconstrained filePath argument. Retrieved file contents are uploaded and injected directly into the AI model's context window, making this both a direct exfiltration risk and a prompt-injection amplifier. No CISA KEV listing or public exploit code has been identified at time of analysis, but the attack mechanics are trivially reproducible from the GitHub issue report and the CVSS 4.0 score of 8.7 makes this an urgent remediation target.
Privilege escalation on MBS-Solutions X-Serie Gateway firmware V6_00_05 allows an authenticated low-privileged service user to gain full root access on the device. The firmware grants passwordless sudo execution of /usr/bin/tcpdump as root; by supplying the -z post-rotate flag, the attacker triggers execution of an arbitrary command with root privileges, achieving complete system compromise. A public proof-of-concept is available via the researcher's GitHub repository; no CISA KEV listing has been identified at time of analysis.
SQL injection in Apache Griffin's Hive Metastore Module exposes all versions of this retired data quality platform to authenticated network exploitation. Low-privileged users can inject arbitrary SQL into Hive Metastore queries, achieving full confidentiality, integrity, and availability compromise of the underlying metadata store. Critically, the Apache Software Foundation has officially retired this project and will not release a patch, leaving deployments permanently unmitigated at the software level.
SQL injection in DreamMaker by Interinfo allows low-privileged authenticated remote attackers to inject arbitrary SQL commands, granting full read, modify, and delete access to the underlying database. Disclosed via TWCERT with a CVSS 4.0 score of 8.7, the flaw affects all known versions per the wildcard CPE. No public exploit code or CISA KEV listing has been identified at time of analysis.
Server-side request forgery in Douyin_TikTok_Download_API through version 4.1.2 exposes internal network resources and cloud instance credentials to unauthenticated remote attackers. The /api/download and /api/hybrid/video_data endpoints accept a user-supplied url query parameter without validation, allowing any caller to instruct the server to fetch arbitrary URLs - including cloud metadata services (e.g., AWS IMDSv1 at 169.254.169.254) - and read back full response bodies or error messages containing sensitive credentials. No vendor-released patch has been identified at time of analysis, and the GitHub issue tracker confirms the disclosure is public.
Remote code execution in Grav CMS (versions ≤2.0.17) lets authenticated users holding only page-write rights achieve arbitrary PHP execution on the web server by exploiting a Twig sandbox bypass in the |sort filter. The sortFunc wrapper in GravExtension.php incorrectly hardcodes isSandboxed=false-unlike |map, |filter, and |reduce-allowing |sort to resolve plain PHP callable names including spl_autoload, which is absent from the function denylist and performs a PHP include operation. A content editor can deliver a crafted payload through mechanisms such as form frontmatter rendered by the Email plugin, resulting in code execution as the web server user. A vendor-released patch is available in version 2.0.19, and no active exploitation appears in CISA KEV at time of analysis.
Insecure Direct Object Reference (IDOR) in Blinko 1.8.7 allows any authenticated user to read, modify, and delete AI chat history belonging to other accounts by supplying arbitrary sequential integer IDs to five tRPC API procedures. The affected endpoints - message.list, message.update, message.delete, message.clearAfter, and conversation.clearMessages - enforce authentication but perform no ownership verification against the caller's identity before querying the database. Version 1.8.8 appears to resolve the issue based on GitHub references pointing to corrected source files; no public exploit code has been identified at time of analysis.
Path traversal in Google Cloud Agent Development Kit (ADK) Python versions 1.9.0 through 1.21.0 exposes arbitrary server files to unauthenticated remote attackers via a crafted `file_path` query parameter on the builder endpoint. The root cause, confirmed by the upstream commit diff, is that `fast_api.py` passed the user-supplied path directly into filesystem operations without sanitization or boundary enforcement, allowing `../` sequences to escape the agents directory. No public exploit code or active exploitation has been identified; vendor-released fix is available in v1.22.0.
Server-side request forgery in OGX's (formerly Llama Stack) OpenAI-compatible POST /v1/responses endpoint allows remote unauthenticated attackers to force the server to open connections to arbitrary internal addresses, including cloud instance metadata services at 169.254.169.254, and relay attacker-controlled headers and bearer tokens to those destinations. MCP tool definitions accept a server_url parameter that is fetched server-side without applying the existing validate_url_not_private() guard that protects other URL inputs. On OGX's default starter configuration - which runs without any authentication - exploitation requires only a crafted HTTP request, exposing cloud credentials and internal network topology to any remote attacker. No public exploit has been identified at time of analysis.
Arbitrary command execution in goose v1.37.0 allows an attacker to embed shell commands inside recipe stdio extension definitions and retry.check fields that are silently executed under the victim user's OS privileges. The built-in recipe security scanner does not inspect these fields, providing a false safety guarantee and a clear bypass path. No public exploit is identified at time of analysis, but exploitation is low-complexity once a target user loads a malicious recipe.
Authenticated remote code execution in OpenPanel before 2.3.0 allows any project member with read access to escape the mathjs formula sandbox by traversing matrix object prototypes to recover the native JavaScript Function constructor. Once recovered, the constructor enables loading Node.js core modules such as child_process, granting full OS command execution with the privileges of the API process. The vulnerability crosses organization authorization boundaries, meaning a low-privileged member of one project can pivot to affect all organizations co-hosted on the same OpenPanel instance. No public exploit has been identified at time of analysis.
SQL injection in ILIAS e-learning platform versions before 9.22, 10.10, and 11.3 allows authenticated users holding write permission on any repository container to achieve full database compromise and administrator account takeover. The repository trash table's sort parameter is passed unsanitized into an ORDER BY clause, and because the ILIAS database layer has multi-statement execution enabled, stacked queries permit arbitrary DML and DDL - not merely data enumeration. Patch versions are available from the vendor; no public exploit code or CISA KEV listing has been identified at time of analysis.
Unbounded memory consumption in SiYuan's request-concurrency middleware allows unauthenticated remote attackers to permanently exhaust process memory by flooding the application with unique request paths. The root cause is a mutex-entry map that grows without bound - each distinct URL path creates a new mutex entry that is never evicted, causing memory and synchronization overhead to accumulate indefinitely. All SiYuan deployments prior to v3.8.2 are affected; no public exploit or CISA KEV listing has been identified at time of analysis.
Memory exhaustion in Chroma 1.5.9 allows unauthenticated remote attackers to crash the vector database server by supplying arbitrarily large HNSW index parameter values (max_neighbors, ef_construction, ef_search) in collection-create requests. Because no upper-bound validation exists in the Rust-based HNSW configuration layer, the server allocates memory proportional to attacker-supplied values during index compaction, causing denial of service. No public exploit code or active exploitation has been identified at time of analysis, but the zero-complexity unauthenticated network path makes this a straightforward availability risk for any internet-facing Chroma deployment.
Unauthenticated cross-tenant document disclosure in QAnything 2.0.0 allows any network attacker to retrieve base64-encoded files or parsed document chunks from any knowledge base without credentials or ownership verification. The /api/local_doc_qa/get_file_base64 and /api/local_doc_qa/get_doc endpoints lack authentication guards entirely (CWE-306), and file identifiers can be enumerated via separate unauthenticated endpoints, making full corpus extraction feasible. No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack requires no technical sophistication.
Sandbox method allow-list bypass in Twig versions 1.0.0 through 3.26.x allows untrusted template authors to invoke any public method on Twig\Markup subclass objects, completely circumventing the application-configured SecurityPolicy allowedMethods list. The root cause is that SecurityPolicy::checkMethodAllowed() unconditionally skips policy enforcement for any object that is an instance of Twig\Markup - and because the class is not declared final, subclasses inherit the bypass. Applications using Twig's sandbox mode that pass Markup-derived objects into sandboxed templates (a common pattern for marking HTML as safe) inadvertently expose the full public API of those subclasses to potentially untrusted template authors. Vendor-released patch: 3.27.0. No public exploit identified at time of analysis.
Unauthenticated SSRF in MegaParse 0.0.55 allows any remote attacker to make the server issue arbitrary HTTP requests by supplying attacker-controlled URLs to the POST /v1/url endpoint, with full responses returned in the JSON reply. Because no authentication is required and the endpoint fetches URLs server-side without restriction, attackers can pivot to cloud provider metadata services (e.g., AWS IMDSv1 at 169.254.169.254), internal APIs, and other non-routable services that are reachable from the MegaParse host. No public exploit or CISA KEV listing has been identified at time of analysis, though the attack surface is trivially exploitable against any internet-exposed deployment.
Decompression bomb handling in Amazon ion-java before version 1.12.1 allows remote unauthenticated attackers to cause denial of service by submitting crafted GZIP-compressed Ion documents that expand to arbitrarily large sizes during automatic decompression. The vulnerability is a bypass of the incomplete fix for CVE-2026-75936, which introduced a GZIP auto-decompression opt-out that did not cover all decompression paths in the library. No public exploit has been identified at time of analysis, but the straightforward nature of decompression bomb construction makes the attack practically accessible to any attacker who can submit Ion data to a vulnerable application.
Memory exhaustion denial-of-service in SiYuan's publish-service Basic Auth throttle allows unauthenticated remote attackers to crash or degrade the service by submitting authentication requests with an unbounded number of unique invalid usernames. Because the throttle tracks per-username failure state in memory with no capacity limit or eviction policy, the in-memory tracking structure grows without bound until the process exhausts available heap. All SiYuan versions prior to v3.8.2 are affected; no active exploitation has been identified at time of analysis.
Unauthenticated remote memory exhaustion in SiYuan before v3.8.2 allows any network-reachable attacker to degrade or crash the service by flooding the /api/system/uiproc endpoint with unique process identifiers. The endpoint retains each submitted identifier in memory without size bounds, rate limiting, or authentication checks, making the attack trivially automatable. No public exploit code or KEV status is confirmed at time of analysis, but the simplicity of exploitation via repeated HTTP requests requires no special tooling.
Server-side request forgery in jina-ai reader allows unauthenticated remote attackers to probe internal network infrastructure and cloud metadata services by exploiting a redirect-validation gap in the URL fetching pipeline. The service validates URLs on initial submission but fails to re-validate the destination after HTTP redirects, enabling attackers to pivot from an attacker-controlled public URL to cloud instance metadata endpoints (e.g., AWS IMDS at 169.254.169.254) or RFC-1918 internal addresses, with the response body returned to the attacker. No public exploit code has been independently confirmed at time of analysis, though a VulnCheck advisory and a public GitHub issue (jina-ai/reader#1252) detail the flaw.
Unauthenticated arbitrary file read in the surya 0.22.1 screenshot server allows any network-reachable attacker to exfiltrate image and PDF files from the host filesystem by supplying attacker-controlled paths to three unprotected HTTP routes. The /info, /page, and /process endpoints pass raw file_path parameters directly to Pillow's Image.open and pypdfium2.PdfDocument, returning rendered file contents as base64-encoded HTTP responses. The /info route additionally acts as a file-existence oracle, enabling systematic enumeration of host paths before targeted exfiltration; no public exploit has been identified at time of analysis.
Server-side request forgery in ms-swift 4.5.2 allows unauthenticated remote attackers to weaponize the server's multimodal media fetching logic against internal infrastructure. The OpenAI-compatible deploy API accepts image_url, audio_url, and video_url parameters that are passed to vision_utils.py without URL validation or redirect filtering, enabling arbitrary outbound requests to cloud metadata services (e.g., AWS IMDSv1 at 169.254.169.254), internal APIs, and network-adjacent services. No public exploit code or active exploitation has been identified at time of analysis, but the unauthenticated network-accessible attack surface and high confidentiality impact make this a significant risk for any internet-exposed ms-swift deployment.
Argument injection in git-mcp-server 2.15.1 allows unauthenticated remote attackers to write arbitrary files outside the target repository to any filesystem path reachable by the server process. The `ref` and `object` parameters passed to the `git_log`, `git_diff`, and `git_show` tool handlers lack leading-dash validation, permitting injection of git command-line options such as `--output=` directly into the underlying CLI invocation. No public exploit code has been identified at time of analysis, and a corrective release (v2.15.3) is available with fixes in the command-builder and log operation modules.
Authorization bypass in Snipe-IT's bulk delete endpoint (all versions before 8.6.3) allows restricted authenticated users to soft-delete user accounts outside their authorized management scope by supplying arbitrary user IDs in a bulk delete request. The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key / IDOR): the endpoint accepts attacker-controlled user IDs without validating them against the requesting user's permitted scope. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Sensitive system information exposure in XING CPTrans-ME-X (a rack-mounted accessory from XING Inc., distributed under the JOYSOUND product ecosystem) allows unauthenticated remote attackers to retrieve confidential system details over the network without any privileges or user interaction. Classified as CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere), the vulnerability was reported by JPCERT and documented in JVN advisory JVN#32505330. No public exploit code has been identified at time of analysis, though the unauthenticated, low-complexity network attack vector makes opportunistic probing accessible to low-skilled actors if the device is network-reachable.
Stored cross-site scripting in Emlog versions 2.6.29 and prior enables arbitrary JavaScript execution in the browsers of all site visitors. The root cause is Parsedown being invoked without safe mode enabled, so raw HTML - including `<script>` tags and inline event handlers - embedded in article Markdown is passed through and rendered without any additional sanitization. No vendor-released patch was publicly available at the time of disclosure, leaving all deployed instances of Emlog ≤2.6.29 exposed; no public exploit code exists and the vulnerability is not listed in CISA KEV.
Unauthenticated SSRF in OpenPanel before 2.3.0 exposes two utility endpoints - /misc/favicon and /misc/og - that blindly fetch attacker-supplied URLs without adequate validation. Any remote, unauthenticated attacker can direct the OpenPanel server to query internal network hosts or cloud metadata services (such as AWS IMDSv1 at 169.254.169.254), with response bodies returned verbatim to the attacker, enabling direct theft of cloud IAM credentials and systematic enumeration of internal services. The vendor has released a fix in version 2.3.0 per the GitHub Security Advisory GHSA-2hff-m67f-2w2w; no public exploit code or CISA KEV listing is identified at time of analysis.
Hard-coded credentials in SmartIT Desktop Manager by Lightstar expose the AES symmetric key protecting all client-server communications. Unauthenticated remote attackers who can obtain the application binary or source - typical for distributed client software - can extract a static embedded password, use it to retrieve the AES encryption key, and subsequently decrypt the product's communication channel. Reported by TWCERT; no KEV listing and no public exploit code identified at time of analysis.
Stored cross-site scripting in EMX Tecnologia's Gestão X business-management suite (version 8.4 and earlier) lets an authenticated user plant malicious JavaScript inside the Help Chat feature, which then executes in the browser of any other authenticated user who opens that conversation. Successful exploitation enables session hijacking, account takeover and unauthorized actions performed under the victim's identity, with the attacker's own privileges and one victim click as the only prerequisites. No public exploit code or CISA KEV confirmation was identified at time of analysis, and the EPSS score of roughly 0.15 percent (5th percentile) indicates the industry does not currently expect widespread exploitation.
Local privilege escalation to root in Amazon's log4j-cve-2021-44228-hotpatch package (Amazon Linux before version 1.3-9) stems from an OS command injection flaw triggered when the hotpatch daemon processes a Java executable whose filesystem path contains embedded newline characters. A low-privileged local user can craft such a path and launch a Java process, causing the unpatched daemon to pass the unsanitized path into a shell command and execute the injected content with root privileges. Amazon has released a patched version (1.3-9) via ALAS2-2026-3784; no public exploit or CISA KEV listing has been identified at time of analysis.
Unauthenticated path traversal in AgentScope through 2.0.7.post1 allows remote attackers to copy arbitrary server-side directories into the agent workspace via the unvalidated skill_path parameter in LocalWorkspace.add_skill, exposing sensitive server files through the workspace skill listing API. The affected function performs no confinement of the source path, enabling directory traversal to any filesystem location readable by the server process. No patch has been confirmed at time of analysis; CVSS 4.0 rates this 8.7 with no privileges or user interaction required.
Server-side request forgery in camel-ai OWL's DocumentProcessingToolkit exposes internal network resources to unauthenticated remote attackers across all tracked versions. The `extract_document_content` tool fetches caller-supplied URLs with no scheme, host, or IP allowlist, enabling attackers to pivot through the agent server to reach cloud metadata endpoints, internal APIs, or other SSRF-reachable services. The attack is delivered via prompt injection - malicious URL directives embedded in content processed by the OWL agent - with SSRF responses surfaced directly in the agent's context window, potentially leaking credentials or internal topology. No public exploit code or CISA KEV listing has been identified at time of analysis.
SSRF guard bypass in LLaMA-Factory's OpenAI-compatible API multimodal media URL handler exposes internal network services and cloud metadata endpoints to unauthenticated remote attackers. The vulnerability stems from a TOCTOU (time-of-check/time-of-use) race in the check_ssrf_url guard: the URL is validated once, but the subsequent requests.get call follows HTTP redirects and re-resolves DNS without re-validation, defeating the protection. Attackers can exploit this via HTTP redirect chains or DNS rebinding to force the API server to fetch resources from RFC1918 addresses or cloud instance metadata services (e.g., AWS IMDSv1 at 169.254.169.254), potentially exfiltrating IAM credentials. No public exploit is identified at time of analysis and the CVE is not in CISA KEV.
Unauthenticated arbitrary-path file read in Xinference v3.x (including commit 4a94832 and v3.3.0) exposes server filesystem content to any network-accessible attacker via the POST /v1/models/llm/auto-register endpoint. The endpoint accepts a caller-supplied model_path without authentication or path validation, reads config.json, tokenizer_config.json, and chat_template.jinja from that path, and reflects the parsed content in the HTTP response. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the zero-prerequisite network attack makes any internet-exposed Xinference instance immediately at risk.
Cross-site request forgery in MISP's sharing group quick-edit feature allows an unauthenticated attacker to manipulate threat intelligence sharing group membership by tricking a privileged MISP user into loading a crafted URL. The root cause is that HTTP method enforcement - which should have restricted the addOrg, removeOrg, addServer, and removeServer actions to POST-only - was commented out in the shared helper __initialiseSGQuickEdit(), leaving all four endpoints reachable via GET. Successful exploitation can silently add or remove organisations and servers from a sharing group, potentially exposing sensitive threat intelligence to unintended recipients or severing legitimate information-sharing relationships.
Privilege escalation in Google Cloud Integration Connectors (HTTP Connector component) allows an authenticated low-privilege user to attach an unauthorized service account to a connector, effectively taking over the associated Google Cloud Project. Affected versions are those deployed prior to the 2025-12-11 server-side patch, which Google applied automatically with no customer action required. No public exploit has been identified at time of analysis, but the CVSS 4.0 vector reflects high subsequent-system impact across confidentiality, integrity, and availability - matching a full project compromise scenario.