Schema validation bypass in fastify before 5.12.2 allows unauthenticated remote clients to reach route handlers that were explicitly configured to reject all input. When a developer assigns the JSON Schema Draft 7 boolean false as a route's body, querystring, params, or headers schema - a valid pattern meaning 'deny every instance' - fastify evaluates it as JavaScript falsy and skips validator compilation entirely, effectively nullifying the intended deny-all gate. Any attacker aware of such routes can send arbitrary requests that bypass what the application believed was an airtight access control, enabling unauthorized state changes or execution of operations the developer intended to disable. No public exploit has been identified at time of analysis, but exploitation is trivially simple once a vulnerable route is discovered.
PHP object deserialization in SolidInvoice's DataGrid LiveComponent prior to version 3.0.1 allows authenticated low-privilege users to supply arbitrary PHP-serialized payloads through the writable `context` prop, leading to potential remote code execution on the hosting server. The root cause is direct use of PHP's `unserialize()` on client-controlled input without validation or type restriction, confirmed by GitHub Security Advisory GHSA-4gj8-frx2-gmp6. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, but successful exploitation yields full server compromise (C:H/I:H/A:H).
Process-terminating denial of service in undici's WebSocket implementation allows remote unauthenticated attackers to crash any Node.js application that connects to an attacker-controlled or machine-in-the-middle-intercepted WebSocket endpoint. During the opening handshake, if a server returns a Sec-WebSocket-Protocol header that the client never offered, undici dereferences a null value and throws an uncaught TypeError inside a Promise microtask, bypassing all application-level error handlers and killing the entire Node.js process. Affected are undici 6.7.0 through 6.28.0, 7.0.0 through 7.29.0, and 8.0.0 through 8.10.1; no public exploit identified at time of analysis.
Unrestricted file upload in the LearnDash LMS WordPress plugin (versions ≤5.1.5) allows authenticated subscribers enrolled in courses with assignment uploads enabled to bypass file-type validation by submitting a multi-file array, where only the first file is validated and subsequent files - including PHP webshells - are silently accepted and written to wp-content/uploads/learndash/assignments/. Remote code execution is contingent on non-default server configurations that permit PHP execution within the uploads directory. No public exploit or CISA KEV listing has been identified at time of analysis.
Unauthenticated remote information disclosure in IBM Langflow OSS 1.0.0 through 1.11.2 allows network-accessible attackers to retrieve sensitive credential fields that are incompletely scrubbed from API responses or workflow data outputs. The CVSS vector (AV:N/AC:L/PR:N/UI:N/C:H) confirms this is exploitable over the network without any authentication or user interaction, and the high confidentiality impact reflects that leaked credentials may include API keys, passwords, or tokens used to integrate with downstream services. No public exploit code or active exploitation has been identified at time of analysis, and IBM has released a patch via their security advisory.
Denial of service in IBM i versions 7.3, 7.4, 7.5, and 7.6 is exploitable remotely by unauthenticated network attackers via a buffer overflow (CWE-787, out-of-bounds write), degrading service availability without requiring credentials or user interaction. IBM has released a patch via their support portal. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS 5.3 score reflects limited practical impact - no confidentiality or integrity compromise.
Remote denial-of-service in IBM App Connect Enterprise and IBM Integration Bus for z/OS allows unauthenticated network attackers to crash or hang the integration runtime by triggering an infinite loop (CWE-835). Affected are ACE versions 12.0.1.0-12.0.12.28 and 13.0.1.0-13.0.8.1, plus Integration Bus for z/OS 10.1.0.0-10.1.0.7. Impact is confined to availability - no data exposure or integrity loss - but a hung integration broker can disrupt critical business processes in environments relying on IBM middleware for message routing and API mediation. No public exploit or CISA KEV listing exists at time of analysis.
Abrupt TCP disconnections against undici's experimental WebSocketStream client crash the entire Node.js process: undici's internal socket-close handler unconditionally calls abort() on a writable stream that the application has locked with a writer, and discards the returned promise, so the resulting TypeError rejection is never observed and Node's default unhandled-rejection behavior terminates the process. Affected deployments are those running undici 7.0.0 through 7.29.0 or 8.0.0 through 8.10.1 and using the experimental WebSocketStream API to connect to a server an attacker controls or can MITM; the trigger is a single abrupt disconnect with no WebSocket close handshake, requiring no authentication and no user interaction (CVSS 3.1 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, CWE-248). No public exploit code identified at time of analysis, EPSS is 0.35% (28th percentile), and no CISA KEV listing exists; the impact is bounded to availability loss in the subset of services that actually use WebSocketStream against untrusted endpoints.
Stack-based buffer over-read in FreeIPMI's ipmi-oem Fujitsu OEM module crashes the client process when a Fujitsu BMC returns a shorter-than-expected response to a System Event Log query. All FreeIPMI versions before 1.6.19 are affected; this is a distinct vulnerability from CVE-2026-50031, which covers different version ranges. No public exploit code or active exploitation has been identified at time of analysis.
Observable response discrepancy in Menulux Portal (all builds before 20260903211448) enables unauthenticated account footprinting against the portal's login or account-resolution endpoint. By observing measurable differences in server responses - such as distinct HTTP status codes, error messages, or timing - for valid versus invalid account identifiers, an attacker can systematically enumerate existing user accounts. Reported by TR-CERT with no public exploit code or CISA KEV listing identified at time of analysis.
Server-side request forgery in IBM Langflow OSS 1.0.0 through 1.11.2 allows unauthenticated remote attackers to induce the server to issue HTTP requests to attacker-controlled destinations, enabling exfiltration of sensitive information from internal network resources, cloud metadata endpoints, or the application's own environment. The CVSS vector (PR:N/AV:N/AC:L) indicates this is exploitable without authentication at low complexity, which is notable for an AI workflow platform likely deployed with access to cloud infrastructure credentials. No public exploit code or active exploitation has been identified at time of analysis, though the automatable SSVC signal and high confidentiality impact make this a meaningful exposure in cloud-hosted or hybrid deployments.
Fastify's route schema compilation silently nullifies conditional header requirements declared via the JSON Schema Draft 7 `dependencies` keyword, enabling unauthenticated remote clients to bypass schema-enforced authorization checks. Versions before 5.12.2 lowercase header property keys and the root `required` array during schema compilation but leave trigger and dependent names inside `dependencies` in their original casing; since Node.js stores all incoming request header names in lowercase, those case-sensitive dependency references never match and the conditional requirement is invisibly skipped. An attacker can present a privileged-operation header while omitting the authentication or authorization header the dependency was intended to mandate, causing the application's privileged branch to execute as though the guard had passed. No public exploit has been identified at time of analysis.
Remote unauthenticated denial-of-service against Open5GS v2.7.7 is possible by sending a crafted HTTP/2 SBI request containing an overlong timestamp string to the Session Management Function. The `ogs_sbi_time_from_string()` function in `lib/sbi/conv.c` copies characters into a fixed-size buffer using loop counters `j` and `k` without checking bounds, triggering a buffer overflow that crashes the SMF process and disrupts all active and new PDU sessions. Public proof-of-concept exploit code is available via the hackeryounow/5GCVulDB repository; no active exploitation is confirmed in CISA KEV.
Denial of service in the Free5GC go-upf user plane function (UPF) allows a remote, unauthenticated attacker to crash the UPF process by sending crafted PFCP signaling messages that trigger a null pointer dereference during session lookup and session-report handling. The flaw affects Free5GC v4.2.2 and manifests as a Go runtime panic in internal/pfcp, taking down user-plane packet forwarding for all subscribers served by that UPF. No public exploit is confirmed in the wild and CISA KEV does not list it, but an upstream fix (go-upf PR #97) exists and researcher-published analysis (5GCVulDB gist repository) is publicly linked; EPSS is low at 0.25%, consistent with the narrow exposure of PFCP/N4 interfaces rather than low technical severity.
Observable response discrepancy in GastroMenum Web Panel exposes account existence to unauthenticated remote attackers via differential server responses, enabling systematic account footprinting. All versions prior to 31.08.2026 of the web panel are affected. Reported by TR-CERT, this flaw (CWE-204) allows an attacker to distinguish valid from invalid accounts without any credentials, providing a reliable enumeration primitive for downstream attacks such as credential stuffing or targeted phishing. No public exploit code or CISA KEV listing identified at time of analysis.
Improper authorization in the DDM (Distributed Data Management) target dispatcher on IBM i 7.3 through 7.6 allows remote, unauthenticated attackers to manipulate database transactions across the network. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:L) confirms the path is fully network-exposed with no credential requirement, though high attack complexity suggests specific conditions - such as DDM service availability and potentially specific network positioning - must be met. IBM has released a patch via its support portal; no public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis.
Heap buffer overflow in Corosync's Totem Process Group (totempg) message reassembly exposes high-availability clusters to network-adjacent unauthenticated attack. When processing fragmented multicast messages, the reassembly buffer lacks runtime bounds checking in release builds, allowing an attacker on the same cluster network to trigger heap corruption with attacker-controlled data. The confirmed impact is a daemon crash causing full cluster denial-of-service; the description explicitly acknowledges the potential for further exploitation - including possible code execution - contingent on heap layout control, though RCE remains unconfirmed at time of analysis. No public exploit or KEV listing identified.
Denial-of-service in IBM i 7.3 through 7.6 allows an unauthenticated network-adjacent attacker to crash the ICMPv6 stack by sending a malformed Router Advertisement packet with an invalid prefix length. The underlying flaw is an out-of-bounds write (CWE-787) triggered by absent validation of the RA prefix length field, resulting in limited availability impact without confidentiality or integrity loss. No public exploit code has been identified and this vulnerability is not listed in CISA KEV; a vendor patch is available.
Server-side request forgery (SSRF) in Invoice Ninja v5.13.24 enables attackers to make the application server issue HTTP requests to internal and loopback network targets via unsanitized webhook destination URLs in StoreWebhookRequest.php, UpdateWebhookRequest.php, and WebhookSingle.php. By supplying RFC 1918 private addresses, loopback targets (127.0.0.1, ::1), or cloud metadata endpoints as webhook destinations, an attacker can probe internal services and retrieve sensitive responses that should be inaccessible from the internet. No public exploit code or active exploitation (CISA KEV) has been identified; EPSS at 0.17% (6th percentile) reflects minimal current exploitation interest.
Server-side template injection (SSTI) in IBM Verify Identity Access and Security Verify Access exposes sensitive information to unauthenticated remote attackers via a network-accessible endpoint. The vulnerability affects both traditional appliance deployments and container variants across IBM's IAM product family (versions 10.x and 11.x), and is particularly notable given that IAM platforms routinely handle authentication tokens, user credentials, and security policy configuration - data whose disclosure has outsized downstream impact. IBM has assessed the impact as confidentiality-only (I:N/A:N in the CVSS vector), suggesting the template injection is sandboxed against code execution, but no public exploit or active exploitation has been identified at time of analysis.
Plaintext MQTT transmission in Trueview TI8161 firmware 6.0.23.4 exposes all device communications on TCP port 1883 to passive interception by any attacker on the same network segment. The device sends MQTT traffic without TLS encryption, allowing recovery of device identifiers, operational metadata, and control-related payloads with no authentication required. No public exploit has been identified beyond a GitHub research writeup, and EPSS is very low (0.15%, 4th percentile), though the absence of transport security makes passive interception trivially straightforward for any adjacent network attacker.
Session isolation failure in IBM ContextForge MCP Gateway - Translate Utility (≤ 1.0.8) permits unauthenticated remote attackers to access session data belonging to other users and potentially inject content into those sessions, due to improper enforcement of session boundaries (CWE-488). The CVSS AC:H metric indicates exploitation depends on specific timing or concurrency conditions - likely a race condition or shared mutable state in multi-tenant request handling - rather than a trivially triggerable flaw. IBM has released a remediation; no public exploit code has been identified at time of analysis.
Cross-origin cache key confusion in undici 8.10.0 and 8.10.1 allows unauthenticated network attackers to receive responses intended for a different upstream origin and to persistently poison the cache with attacker-controlled content. When the cache or request-deduplication interceptor is composed directly onto a Client or Pool instance, the origin is silently dropped from the key and falls back to an empty string, meaning any two origins sharing the same HTTP method, path, and relevant headers share a single cache slot. The OpenJS Foundation reporter demonstrated full authentication bypass in which a JWT signed with an attacker-controlled key was accepted in place of a trusted issuer's token because the trusted origin was never contacted; no public exploit code has been released at time of analysis.
SQL injection in Zhao-github APiAdmin v5.0.1 exposes sensitive database information to remote attackers via the User.php component, with no authentication required per the CVSS vector. The vulnerability enables extraction of confidential database records without write or availability impact, scoped to the database as a secondary component. No public exploit code exists and EPSS at 0.17% (7th percentile) reflects low current exploitation activity.
Improper verification of cryptographic signatures in the MQTT command handler of Trueview T18161 S firmware 6.0.23.4 lets a network-positioned attacker replay or tamper with captured MQTT messages — including their nonce, timestamp, and signature fields — and have the device accept and execute the embedded commands. The flaw (CWE-347) yields high
Improper OCSP response validation across the Snowflake Python, Go, JDBC, and Node.js drivers allowed a revoked TLS certificate to be treated as valid, enabling a man-in-the-middle attacker to intercept and tamper with driver-to-Snowflake TLS sessions. The root flaw is twofold: OCSP stapled or fetched responses were not reliably bound to the specific certificate under validation, and definitive OCSP verification failures were treated as transient errors (soft-fail), causing the driver to proceed with a connection rather than abort it. Exploitation requires a network-adjacent or on-path position combined with possession of a revoked certificate and its corresponding private key for a Snowflake or storage-stage hostname; no public exploit is identified at time of analysis and EPSS data was not provided, but the CVSS AC:H reflects these steep prerequisites.
Arbitrary file deletion in CRMEB v6.0.0 permits authenticated administrators to erase files at arbitrary server-side paths by sending a crafted POST request to the `/adminapi/file/video_data_save` endpoint. The CWE-73 (External Control of File Name or Path) root cause indicates the endpoint passes attacker-controlled path values directly to filesystem operations without path confinement or canonicalization. No public exploit has been identified at time of analysis and the EPSS score is 0.14% (4th percentile), indicating low current exploitation probability, though admin-level compromise enabling this attack is a meaningful escalation path in shared-credential environments.
Path guard bypass in SiYuan's MCP file-access handler exposes the protected publishAccess.json configuration file to authenticated low-privileged attackers on Linux deployments. The handler enforces access restrictions using case-sensitive string matching, but Linux filesystems are themselves case-sensitive - meaning an attacker requesting a case-variant path such as PublishAccess.json bypasses the guard while the filesystem resolves it to the same protected file. All SiYuan versions before v3.8.2 are affected. No public exploit code or CISA KEV listing is identified at time of analysis.
Path traversal via symlink following in SiYuan's reader-accessible file-read API allows authenticated low-privilege users to escape the workspace boundary and read arbitrary server-side files. Versions before v3.8.2 fail to resolve symlink targets before serving asset content, meaning a reader-role account can request a data/assets/ path that is a symlink pointing outside the workspace and receive the target file bytes. The impact is strictly confidentiality - no integrity or availability consequences - but sensitive server-side files (credentials, SSH keys, configuration) could be exfiltrated. No public exploit code or CISA KEV listing exists at time of analysis.
Path traversal in Grav CMS before 1.10.55 allows an authenticated admin user with the admin.pages.create permission to write arbitrary Markdown files outside the intended pages directory by embedding traversal sequences in the lang POST parameter of the admin plugin's Save As action. The vulnerability gives an attacker-controlled write primitive constrained to .md file extensions, which - depending on Grav's template and plugin layout - may be chained to persistent backdoor placement or secondary code execution. No public exploit has been identified at time of analysis, and exploitation is bounded by requiring a valid authenticated admin session.
Cross-user private note disclosure in Blinko 1.8.7 allows any authenticated user to read other users' private notes, attachments, and tags by exploiting a missing ownership check in the noteReferenceList TRPC procedure. The flaw follows a classic IDOR pattern (CWE-639): the API accepts sequential note identifiers without verifying the caller's entitlement to access them, enabling systematic enumeration of the entire note corpus. A patch was introduced in version 1.8.8, and no public exploit code has been identified at time of analysis.
phpMyFAQ before 4.1.8 allows an authenticated attacker who has hijacked a user's session to silently strip two-factor authentication (TOTP) protection from any account, including administrator accounts, by calling either POST /api/user/remove-twofactor or PUT /api/user/data/update with only a valid session cookie and CSRF token - no password re-entry or current TOTP code is required. The root cause is CWE-308: the application guards a security-downgrade operation with single-factor controls (session identity plus CSRF) rather than requiring the second factor whose removal is being requested. After TOTP is disabled, the targeted account becomes accessible via password-only authentication, negating the deployment's MFA posture. No public exploit code or CISA KEV listing has been identified at time of analysis.
Arbitrary file read in ConvertX 0.17.0 allows authenticated users to exfiltrate files accessible to the server process by exploiting the xelatex converter's handling of LaTeX directives. Crafted `.tex` files containing `\input{path}` or `\verbatiminput{path}` directives cause the TeX engine to read and embed target file contents into downloadable PDF output, bypassing any application-level access controls on those files. No active exploitation has been confirmed (not in CISA KEV), and a fix is available in v0.18.0 per the upstream repository reference.
Memory exhaustion in SiYuan's publish-service Basic Auth handler allows authenticated users to repeatedly submit valid credentials, generating persistent session entries that accumulate without expiry or capacity limits, eventually crashing the process. All SiYuan versions before v3.8.2 are affected, as confirmed by vendor security advisory GHSA-f4vj-ppp2-5hg4. No active exploitation has been recorded in CISA KEV and no public proof-of-concept code is known, but the low barrier - only valid credentials required - means any account holder can trigger denial of service on demand.
Server-side request forgery in Nightingale (n9e), the open-source observability platform by ccfos, allows authenticated users of the http_fetch AI-agent tool to bypass the platform's SSRF guard by encoding forbidden IPv4 addresses using 6to4, NAT64, or deprecated site-local IPv6 representations. The isPublicIP function in aiagent/tools/http.go only unwraps standard ::ffff:a.b.c.d IPv4-mapped IPv6 addresses before applying the forbidden-range check, leaving 2002::/16 (6to4), 64:ff9b::/96 and 64:ff9b:1::/48 (NAT64), and fec0::/10 (site-local) unrecognized and passable as 'public'. On dual-stack or NAT64-enabled cloud hosts, this allows an attacker to reach the cloud instance-metadata endpoint (169.254.169.254) or internal services and exfiltrate IAM credentials or sensitive configuration. No public exploit code has been identified at time of analysis.
Authenticated account takeover in phpMyFAQ before 4.1.8 allows any authenticated user-including low-privileged accounts-to silently reset the password of any other account, including administrators, by submitting a crafted PUT request to the user data update API endpoint with only a CSRF token and no current-password verification. Successful exploitation locks the victim out of their account irreversibly and grants the attacker full control of that account, enabling vertical privilege escalation from a low-privilege user to administrator. No public exploit or CISA KEV listing has been identified at time of analysis, but the attack is straightforward for any authenticated session holder.
Missing authorization on the host pool bulk-delete REST endpoint in ntopng before 6.7.260717 allows any authenticated low-privileged user to irreversibly destroy all configured host pools and their member bindings via a POST request. The flaw (CWE-862) bypasses ntopng's capability-based access control model, enabling non-administrator accounts to eliminate traffic policy segmentation, rate-limit assignments, and visibility restrictions that network security teams depend on. No public exploit has been identified at time of analysis, and a patch commit is available in version 6.7.260717.
Authorization bypass in SiYuan through 3.8.1 exposes private notebook content to low-privileged readers via the /api/file/getFile endpoint. Users assigned the reader role can circumvent the Visible:false notebook access control by directly requesting files with a known notebook identifier and file path, retrieving notebook metadata and internal configuration that the workspace owner intended to keep private. No public exploit has been identified and the vulnerability is not listed in CISA KEV, but reader-role access is the only prerequisite for exploitation.
SQL injection in llmware 0.4.6's collection-database abstraction layer allows an authenticated API caller to disclose rows from collections they are scoped out of, with full UNION-based data extraction possible on PostgreSQL backends. The flaw resides in resources.py, where attacker-controlled filter values are string-interpolated directly into SQL WHERE clauses without parameterization; the filter validator checks only key names against an allow-list but never sanitizes values. Affected public API entry points are Library.block_lookup and Query.text_query_with_custom_filter / text_query_by_author_or_speaker. No public exploit code has been identified and this CVE is not listed in CISA KEV at time of analysis.
Cross-user private file content disclosure in mckaywrigley's Chatbot UI allows any authenticated user to read indexed file chunks belonging to other users by supplying arbitrary file UUIDs to the retrieval endpoint. The root cause is that the `/api/retrieval/retrieve` route uses a Supabase service-role client - which carries elevated privileges that bypass Supabase row-level security (RLS) - while performing no file ownership check against the requesting user's identity. No public exploit or KEV listing is identified at time of analysis, but the vulnerability is straightforward to exploit given valid credentials and knowledge of a target file UUID.
Missing authorization in ntopng's REST v2 API allows any authenticated low-privilege user to permanently delete all configured notification endpoints and recipients, silencing the entire alert pipeline. Affected versions are all ntopng releases before 6.7.260717; the vendor confirmed and patched the flaw via GitHub Security Advisory GHSA-m22w-f647-vx88. No public exploit code has been identified at time of analysis, but the attack requires only a valid user session and a straightforward POST request, making exploitation trivially simple for any authenticated ntopng account holder.
Null pointer dereference in PX4 Autopilot through 1.17.0 allows any party with PX4 shell access to crash the autopilot process by issuing 'param select' or 'param select-backup' with no path argument, triggering a dereference of a null filename pointer passed to strcmp() inside param_set_default_file() and param_set_backup_file(). The CVSS 4.0 vector (AV:A) confirms the shell must be reachable via an adjacent vector - MAVLink console, UART/USB serial, or companion-computer link - with no authentication required within the shell environment itself. In airborne or safety-critical deployments, a process crash during flight could have consequences beyond mere software unavailability. No public exploit code identified at time of analysis; the fix is confirmed in upstream PR #28475.
Argument injection in GFI Exinda AI before 7.6.5 allows any authenticated user - including those with the lowest-privilege Unprivileged account - to exfiltrate arbitrary files from the host system. The web_tools_cmd() function in the Tools Iperf Client feature concatenates user-supplied server and options parameters directly into an iperf command without sanitization, enabling injection of the iperf -F flag to redirect file contents to an attacker-controlled iperf server. No public exploit has been identified and the vulnerability is not listed in CISA KEV, but exploitation is straightforward given knowledge of standard iperf flags.
Missing ownership verification in potpie through 2.0.0 allows authenticated users to inject arbitrary file changes into other users' conversations via the POST /conversations/{conversation_id}/code-changes/sync endpoint. Because the API never checks that the requesting user owns the supplied conversation_id, any authenticated account can overwrite pending code-change state in conversations belonging to other users-an Insecure Direct Object Reference (IDOR) pattern classified as CWE-862. No public exploit or CISA KEV listing exists at time of analysis, but the vulnerability is straightforward to exploit given valid authentication and knowledge of a target conversation ID.
Plaintext password storage in Menulux Portal (CWE-256) exposes embedded credentials to any low-privileged authenticated user over the network. All portal versions prior to build 20260903211448 are affected. Disclosed by TR-CERT; no public exploit code or active exploitation has been identified at time of analysis, though the High CVSS confidentiality rating reflects full credential retrieval capability.
Incomplete SQL validation denylist in Amazon awslabs postgres-mcp-server before 1.1.7 allows an unauthenticated attacker to bypass read-only enforcement and perform write operations against a PostgreSQL database by embedding crafted SQL in content processed when an authenticated user interacts with the MCP server. The vulnerability (CWE-184) exploits the incomplete list of disallowed SQL constructs, effectively turning user-triggered MCP interactions into a vector for unauthorized data modification with high integrity impact (VI:H) and no confidentiality or availability effect. No public exploit code has been identified at time of analysis; a vendor-released patch is available at version 1.1.7.
Improper authorization (IDOR/CWE-639) in IBM Langflow OSS 1.0.0 through 1.10.2 allows a remote authenticated attacker to access other users' workflow data and inject messages into workflow history they do not own. The flaw stems from user-controlled keys not being validated against the authenticated session's authorization scope, enabling horizontal privilege escalation across tenant workflows. No public exploit or active exploitation has been identified; IBM has released a patch and the SSVC assessment confirms exploitation is currently none with partial technical impact.
Template injection in the AWS CDK generator component of Amazon's awslabs.dynamodb-mcp-server allows a context-dependent attacker to achieve arbitrary code execution on the host machine that processes and deploys the generated CDK application. The attack surface is the data model file: crafted DynamoDB table, index, or attribute names containing template engine directives are passed unsanitized through the CDK generator, with payload execution occurring at deploy time. Versions before 2.1.6 are affected; no public exploit or active exploitation is confirmed at the time of analysis.
Arbitrary root-level file deletion in GFI Exinda AI before 7.6.5 is possible through a path traversal flaw in the diagnostic file deletion handler. The `unlink_or_email_file()` function appends user-controlled parameter values (prefixed `v_file_row_`) directly to a base directory path without sanitizing for `../` sequences, allowing any file on the filesystem to be targeted. Exploitation requires authenticated Admin-level access via the network management interface; no public exploit code or CISA KEV listing exists at time of analysis.
Credential disclosure in Onyx 4.6.6 allows any authenticated user to retrieve plaintext API keys and authorization headers that administrators configured for custom tool integrations. By calling GET /tool or GET /tool/{tool_id} with standard user credentials, an attacker can read admin-defined third-party API keys stored in custom_headers fields without any privilege escalation. A proof-of-concept exists per SSVC classification, and the stolen credentials can be leveraged to directly access upstream APIs the Onyx instance is connected to, entirely outside the platform's audit trail.