Arbitrary shell command execution in aider (aider-chat) is triggered silently when a user runs the tool inside a crafted git repository containing a malicious `.aider.conf.yml` configuration file. The tool unconditionally reads this file at startup and passes `test-cmd` and `lint-cmd` values directly to Python's `subprocess` with `shell=True`, with no user confirmation, no LLM involvement, and no API key required. Confirmed present on version 0.86.2 and the 0.86.3.dev main branch per the VulnCheck advisory; no vendor-released patch has been identified at time of analysis, and no public exploit code has been identified beyond the mechanism documented in the public GitHub issue.
Local privilege escalation in JAL Information Technology's Pallet Control suite (including PalletControl and PalletControl Cloud) enables a low-privileged local attacker to execute arbitrary code with SYSTEM-level privileges due to incorrect default installation permissions (CWE-276). All tracked versions across three CPE entries are listed as affected per JPCERT/CC coordination notice JVN#84094853. No public exploit code has been identified at time of analysis, and the vulnerability is not currently listed in the CISA KEV catalog.
Path traversal in Plesk web hosting control panel (versions ≤18.0.79.9 and 18.0.80-18.0.80.5) enables local users with low privileges to execute arbitrary code as the root user, resulting in full system compromise. The CVSS 4.0 score of 8.5 reflects high CIA impact with no special attack requirements beyond local OS access (AV:L/PR:L). No public exploit code or CISA KEV listing has been identified at time of analysis, but the privilege escalation to root in a widely deployed hosting platform makes this a high-priority patch for server operators, particularly those running multi-tenant shared hosting environments.
Out-of-bounds write in Unidata netcdf-c through 4.10.1 allows an attacker who can supply a crafted HDF5 file to corrupt process memory when the application enumerates HDF5 attribute names. The vulnerable function NC4_HDF5_inq_attname() in libhdf5/hdf5attr.c blindly copies HDF5-returned attribute names into a fixed 256-byte destination buffer without validating the source length, a classic CWE-787 stack/heap corruption sink. No public exploit code or CISA KEV listing has been identified at time of analysis, but the deterministic nature of the overflow and the wide use of netcdf-c in scientific pipelines make this a meaningful risk for any application that processes externally-sourced HDF5 data.
Path traversal in Plandex 2.2.1's ApplyFiles function allows an attacker who can influence the AI model's output - through poisoned repository files or attacker-controlled context - to write files to arbitrary locations outside the intended project directory. Targets such as shell initialization files (~/.bashrc, ~/.zshrc) and cron entries can be silently overwritten, resulting in persistent code execution under the developer's local account. No CISA KEV entry or confirmed public exploit exists at time of analysis, but the attack surface (indirect prompt injection combined with insecure file-write) is increasingly well-understood in the AI tooling threat landscape.
Out-of-bounds memory corruption in PJSIP pjproject's SDP negotiator allows a remote unauthenticated attacker to trigger memory corruption and denial of service by sending a crafted SDP offer or answer containing out-of-range payload-type numbers. The root defect is in assign_pt_and_update_map() in pjmedia/src/pjmedia/sdp_neg.c, where PT numbers from remote SDP are used as fixed-size array indices with only a lower-bound check, not an upper-bound check. Exploitation requires the non-default compile-time flag PJMEDIA_SDP_NEG_MAINTAIN_REMOTE_PT_MAP to be enabled; default builds are entirely unaffected, no public exploit has been identified, and code execution has not been demonstrated.
Missing authorization on the run replay API endpoint in Trigger.dev before 4.5.2 allows authenticated attackers to inject task runs into environments belonging to other organizations or projects. By replaying their own historical runs into victim environments, attackers can consume victim compute resources and permanently pollute that organization's run history and audit logs. No public exploit has been identified at time of analysis, but the vulnerability is trivially exploitable by any authenticated platform user against any other tenant.
Cross-company authorization bypass in Snipe-IT before 8.6.2 allows authenticated users with the reports.view permission to manipulate checkout-acceptance records belonging to other companies in multi-tenant deployments. By enumerating sequential acceptance IDs and exploiting a null check defect on the legacy users.company_id column, an attacker can soft-delete acceptance records or trigger unsolicited reminder emails across company boundaries. Vendor-released patch v8.6.2 is available; no public exploit or active exploitation has been identified at time of analysis.
Unauthenticated XSS in OpenPanel before 2.3.0 allows remote attackers to execute arbitrary JavaScript in a victim's browser by supplying a malicious SVG URL to the unprotected favicon proxy endpoint GET /misc/favicon. Because the SVG is served from the OpenPanel API origin, embedded scripts inherit same-origin context, enabling the attacker's code to issue credentialed requests against authenticated admin API endpoints on the victim's behalf. No public exploit code has been identified at time of analysis, but the attack requires only standard web delivery and a logged-in admin victim.
Heap buffer overflow in ntop nDPI before version 6.0 allows unauthenticated network-adjacent or remote attackers to corrupt process heap memory by sending crafted packets containing TLS SNI values, HTTP headers, or DNS names with characters that expand during JSON escaping. The root cause in ndpi_json_string_escape (src/lib/ndpi_serializer.c) is that the original bounds check guarded only single-byte writes while escape sequences requiring 2 bytes (e.g., backslash-quote) or 6 bytes (e.g., \u00XX control-character escapes) silently overran the caller-supplied buffer. Vendor-released patch is available via commit 94e82c1 targeting the 6.0 release; no public exploit has been identified at time of analysis.
Heap buffer overflow in PJSIP pjproject's PJLIB-UTIL HTTP client allows a malicious or man-in-the-middle HTTP server to corrupt application heap memory or terminate the process by delivering a response body larger than twice the Content-Length-derived initial allocation. The flaw resides in http_client.c where the buffer growth logic performed only a single doubling, which is insufficient when the server-supplied Content-Length substantially underestimates the actual body size, causing pj_memcpy() to write beyond the allocation boundary. Only applications using the non-incremental whole-body completion callback are affected; the fix (commit 8d5956a) replaces single-doubling with a loop that guarantees the buffer fits the incoming data before any copy occurs.
Incorrect authorization in MISP allows any authenticated user who is a member of an event-owning organization to delete individual attributes or perform bulk attribute deletion from that event, regardless of whether their assigned role carries `perm_modify` or `perm_modify_org` permissions. Three deletion controller actions in `AttributesController.php` - `delete()`, `deleteSelection()`, and `deleteSelected()` - relied only on organization membership checks inside `MispAttribute::deleteAttribute()` rather than on MISP's authoritative `ACL::canModifyEvent()` gate, which attribute editing operations correctly invoked. No public exploit has been identified, but the integrity impact is significant for any collaborative MISP deployment because deleted threat intelligence attributes cannot trivially be recovered.
Unbounded memory accumulation in the elixir-mint Mint HTTP client library (versions 0.1.0 through <1.10.0) enables a remote HTTP server to exhaust client-side memory and crash the entire BEAM VM node. Two HTTP/1 parser states - the status-line decoder and the chunk-extension-line decoder - append successive socket data into `conn.buffer` with no size cap because the existing `:max_header_list_size` guard was wired only to header and trailer parsing, not to these two states. A malicious or attacker-redirected server that withholds CRLF terminators can grow the buffer indefinitely until the OS OOM-killer terminates the node, collaterally killing all other processes sharing it. No public exploit has been identified, but the technique requires only a straightforward streaming server.
Authentication bypass in Frappe CRM prior to v1.73.0 allows network-accessible attackers to impersonate users by replaying logged invitation keys against the crm/api endpoint. The root cause is that invitation keys were never invalidated after acceptance - they remained logged and reusable indefinitely. The vendor released a patch in v1.73.0; no public exploit or CISA KEV listing has been identified at time of analysis.
WHMCS's 2Checkout payment gateway endpoint exposes customer data to unauthenticated remote attackers due to a missing authorization check (CWE-862) across versions 8.13.0 through pre-8.13.8, 9.0.0 through pre-9.0.8, and all end-of-life releases from 4.5.0 onward. The flaw enables an unauthenticated network attacker who meets specific deployment conditions - the 2Checkout payment gateway must be configured and active - to retrieve WHMCS customer records through the unprotected endpoint. Vendor-released patches are available as WHMCS 8.13.8 and 9.0.8; no public exploit code or CISA KEV listing has been identified at time of analysis.
undici's cache interceptor mishandles the Set-Cookie response header, failing to either refuse storage or strip it, so in the default shared-cache mode a cacheable response carrying Set-Cookie is stored and later replayed to a different caller matching the same cache key. This discloses one caller's cookies to another party and lets an untrusted origin inject cookies into cached responses served to every subsequent caller. Affected are undici 7.0.0 through 7.29.1 and 8.0.0 through 8.10.2; fixes are available in 7.29.1 and 8.10.2, exploitation is not confirmed in CISA KEV, EPSS probability is low (0.25%), and no public exploit code has been identified.
Client-certificate authentication (mTLS) in Traefik before v2.11.55 can be silently bypassed by unauthenticated network attackers when routers are configured with multiple hostnames bearing conflicting TLS options. Traefik's conflict resolution logic incorrectly falls back to default (non-mTLS) TLS settings for all hostnames in the affected multi-host router, allowing an attacker to reach mTLS-protected backends without presenting a valid client certificate. No public exploit code or CISA KEV listing has been identified; the CVSS 4.0 AT:P metric confirms that exploitation depends on a specific deployment configuration being present.
Client certificate authentication bypass in Traefik v3.7.0-v3.7.10 allows unauthenticated network clients to reach services protected by the nginx.ingress.kubernetes.io/auth-tls-verify-client: "on" annotation without presenting a valid mTLS client certificate. The flaw stems from a naming collision in the Kubernetes Ingress NGINX provider: when two Ingress objects share the same host, client CA secret, and authentication mode, Traefik's conflict-resolution logic silently falls back to the entry point's default TLS configuration, which imposes no client certificate requirement. No public exploit has been identified at time of analysis, and the issue is fixed in Traefik v3.7.11.
Schema authorization bypass in Fastify before 5.12.2 allows an authenticated low-privilege attacker to substitute an arbitrary body object in place of the schema-validated request body, enabling unauthorized state changes and data disclosure. The flaw arises because Fastify mishandles the resolved value from Ajv async validators: if the validated request body contains a root-level property named `value`, Fastify overwrites the body with that property's value before invoking the route handler, so the handler operates on a different object than the one that passed schema validation. No public exploit code has been identified at time of analysis, but the low attack complexity and network vector make this a meaningful risk for Fastify-based APIs.
Authenticated remote file deletion in IBM Langflow OSS 1.0.0 through 1.11.2 allows any logged-in user to delete arbitrary files or directories on the underlying server via path traversal sequences in a pathname parameter. With PR:L and no UI required, the bar for exploitation is simply a valid account, making this a significant risk in multi-tenant or shared AI workflow deployments. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the CVSS 8.1 rating and high integrity/availability impact reflect the destructive potential.
Unrestricted file upload in AppNitro MachForm v30 permits unauthenticated remote attackers to achieve code execution by uploading a crafted .phar (PHP Archive) file through the application's file upload functionality. Because the application fails to block .phar extensions alongside conventional dangerous types like .php, an attacker can cause the PHP runtime to execute attacker-supplied code upon accessing the uploaded file. A public proof-of-concept is available on GitHub and a write-up is hosted on PacketStorm Security, raising practical exploitability above the low EPSS score would suggest.
Authenticated file upload in Zhao-github's ApiAdmin 5.0.1 lets a low-privileged user upload a crafted .php file that the web server then executes, yielding arbitrary code execution on the host. The flaw is an unrestricted file-type upload (CWE-434) reachable over the network with no user interaction beyond the attacker's own actions, and it carries a CVSS base of 8.1 with high confidentiality and integrity impact. No public exploit code and no CISA KEV entry were identified at time of analysis, and EPSS is low at 0.21% (11th percentile), though a researcher write-up linked from the CVE record suggests the technique is publicly described.
SQL injection in WPLP Cookie Consent WordPress plugin (versions 3.0.0 through before 4.4.2) allows authenticated administrators to execute arbitrary SQL queries via an unvalidated pagination parameter passed directly into a database query without sanitization. The vendor CVSS includes a scope-change flag (S:C), indicating the injection may permit cross-schema database reads beyond the plugin's own tables. A publicly available proof-of-concept exists via WPScan, though exploitation is gated behind WordPress administrator credentials.
Kernel heap corruption in Imagination Technologies Graphics DDK enables local privilege escalation from a non-privileged user to kernel level via crafted GPU IOCTL calls. By fabricating a specific combination of flags on the GPU memory allocation interface, an attacker causes the driver to execute an incorrect double-free on the associated allocation, resulting in CWE-416-class use-after-free memory corruption in the kernel heap. CVSS 7.8 (AV:L/PR:L) accurately reflects the local-only attack surface; no public exploit has been identified at time of analysis, and EPSS at 0.14% (4th percentile) indicates low observed exploitation probability.
OS command injection in IBM i 7.3 through 7.6 allows a local, low-privileged attacker to execute arbitrary operating system commands by supplying specially crafted input containing shell metacharacters that the platform fails to sanitize before passing to an OS command interpreter. The vulnerability (CWE-78) affects IBM's flagship Power Systems operating system across four supported release lines and carries a CVSS 7.8 score reflecting full confidentiality, integrity, and availability impact upon successful exploitation. No public exploit code or CISA KEV listing exists at time of analysis; a vendor-released patch is available via IBM support.
Local OS command injection in IBM i 7.3 through 7.6 allows a low-privileged local user to execute arbitrary system commands, achieving full system compromise (confidentiality, integrity, and availability all at High). The vulnerability stems from insufficient neutralization of shell metacharacters in OS command construction (CWE-78). No public exploit code has been identified and EPSS sits at 0.11% (1st percentile), but IBM has confirmed the issue and released a patch via support page node/7285844.
Authenticated path traversal in IBM Langflow OSS 1.0.0 through 1.11.2 allows any logged-in user to read arbitrary files from the server filesystem - including JWT signing keys, the application secret_key, the runtime database, /proc/self/environ, and other tenants' uploaded files - by supplying absolute paths or traversal sequences in the files parameter of a build request. What elevates the risk beyond a standard directory traversal is the exfiltration mechanism: file contents are embedded directly into the LLM prompt and transmitted to the configured model endpoint, meaning secrets leave the controlled environment and reach third-party AI provider infrastructure. This attack path bypasses the LANGFLOW_RESTRICT_LOCAL_FILE_ACCESS=true containment flag, which enforces restrictions on other file-reading components but was never applied to the Chat Input to Message attachment pipeline. No public exploit code has been identified at time of analysis.
Sensitive information disclosure in IBM ContextForge MCP Gateway (mcp-contextforge-gateway) v1.0.6 and earlier enables remote authenticated attackers to reach internal network resources via a DNS rebinding attack during tool invocation. The vulnerability is classified as CWE-918 (SSRF), with the DNS rebinding mechanism serving as a bypass to route gateway-initiated requests to otherwise-unreachable internal hosts. The CVSS Scope:Changed metric confirms that the impact extends beyond the gateway itself to downstream internal services, resulting in high confidentiality impact. No public exploit code or active exploitation has been identified at time of analysis.
IBM Instana Agent Operator on OpenShift exposes etcd mTLS client credentials to authenticated cluster users via missing namespace destination validation. Builds 1.0.303 through 1.0.323 of IBM Observability with Instana allow a low-privileged authenticated attacker who controls a Kubernetes namespace to redirect the operator's credential-copy routine - intended to distribute etcd mTLS client certs within Instana-managed namespaces - into their own attacker-controlled namespace. Successful exploitation yields etcd mTLS client certificates, which grant broad read access to the OpenShift cluster's entire backing key-value store. No public exploit or CISA KEV listing identified at time of analysis.
Server-Side Request Forgery in IBM Langflow OSS 1.0.0 through 1.11.2 enables authenticated remote attackers to exploit a URL parser discrepancy, causing the application to issue unauthorized backend requests to internal services and expose sensitive information beyond the application's trust boundary. The CVSS scope-change metric (S:C) confirms that impact extends past the Langflow instance itself to internal network resources not directly reachable by the attacker. Vendor patch is available via IBM's support portal; no public exploit code or active exploitation has been identified at time of analysis.
XML external entity injection in the SAP Adapter component of IBM App Connect Enterprise and IBM Integration Bus for z/OS enables authenticated remote users to read arbitrary files from the server filesystem or conduct server-side request forgery against internal network resources. Affected releases span App Connect Enterprise 12.0.1.0-12.0.12.28 and 13.0.1.0-13.0.8.1, plus Integration Bus for z/OS 10.1.0.0-10.1.0.7. The CVSS scope-change flag (S:C) reflects that a successful XXE can pivot beyond the integration engine itself into adjacent internal infrastructure. No public exploit has been identified at time of analysis, and IBM has released a patch.
Server-side request forgery in nebula-mesh 0.6.0-0.7.1 lets any low-privilege 'user'-role operator coerce the control plane into making HTTP requests to internal, loopback, and link-local addresses by setting allow_private: true on their own webhook subscription. The missing authorization check in both the create and update webhook handlers (internal/api/webhooks.go) means the SSRF guard that protects all other tenants is silently bypassed at delivery time, exposing cloud metadata endpoints, internal APIs, or backend services reachable only from the server. A working proof-of-concept has been verified against a live instance; vendor-released patch v0.7.2 is available.
Blind SQL injection in WooCommerce's Analytics Orders reporting allows high-privileged authenticated users to extract arbitrary database contents by injecting into the date column parameter used in order analytics queries. Affected are all WooCommerce installations running versions before 11.0. The vulnerability stems from the `woocommerce_date_type` option value and the `date_type` query argument being interpolated directly into SQL without allowlist validation, enabling exfiltration of customer PII, payment data, and credentials via time-based or boolean blind techniques. No public exploit identified at time of analysis, though Patchstack discovery typically precedes weaponization.
Sharing Group authorization bypass in MISP allows an authenticated user with attribute or Galaxy Cluster creation permissions to associate objects with Sharing Groups they are not permitted to use. The flaw resides in AttributesController and GalaxyClustersController, where authorization checks against the Sharing Group were only invoked when the request explicitly set distribution == 4 - an attacker can craft a request containing sharing_group_id while omitting or manipulating the distribution parameter, causing the membership verification to be skipped entirely. Successful exploitation can silently breach organizational information-sharing boundaries, injecting data into restricted Sharing Groups and potentially distributing it to unauthorized member organizations. No public exploit has been identified at time of analysis.
Heap use-after-free in libsoup's HTTP/2 client implementation allows a malicious HTTP/2 server or MITM attacker to corrupt memory during asynchronous file upload operations. When a GNOME application uploads a file over HTTP/2 and the server sends a GOAWAY frame while the request body is being read asynchronously, the freed memory region can be accessed again, leading to information disclosure or arbitrary code execution on the client. No public exploit has been identified at time of analysis, and no KEV listing is present, but the unauthenticated network reachability combined with user-interaction-only barrier makes this a meaningful client-side threat.
Authentication hook bypass in Fastify 4.0.0-5.12.1 allows unauthenticated network attackers to reach a private plugin's custom not-found handler by sending a malformed URL under a sibling public plugin's prefix. The internal not-found router dispatches malformed paths through a single shared handler pointer before URL decoding, ignoring plugin-prefix scoping and skipping the preHandler lifecycle - the mechanism most Fastify applications use to enforce JWT or session authentication. No public exploit code has been identified at time of analysis, but the AV:N/AC:L/PR:N/UI:N vector means any reachable Fastify deployment meeting the required architecture is exploitable without friction.
Schema validation bypass in fastify before 5.12.2 allows unauthenticated remote clients to reach route handlers that were explicitly configured to reject all input. When a developer assigns the JSON Schema Draft 7 boolean false as a route's body, querystring, params, or headers schema - a valid pattern meaning 'deny every instance' - fastify evaluates it as JavaScript falsy and skips validator compilation entirely, effectively nullifying the intended deny-all gate. Any attacker aware of such routes can send arbitrary requests that bypass what the application believed was an airtight access control, enabling unauthorized state changes or execution of operations the developer intended to disable. No public exploit has been identified at time of analysis, but exploitation is trivially simple once a vulnerable route is discovered.
PHP object deserialization in SolidInvoice's DataGrid LiveComponent prior to version 3.0.1 allows authenticated low-privilege users to supply arbitrary PHP-serialized payloads through the writable `context` prop, leading to potential remote code execution on the hosting server. The root cause is direct use of PHP's `unserialize()` on client-controlled input without validation or type restriction, confirmed by GitHub Security Advisory GHSA-4gj8-frx2-gmp6. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, but successful exploitation yields full server compromise (C:H/I:H/A:H).
Process-terminating denial of service in undici's WebSocket implementation allows remote unauthenticated attackers to crash any Node.js application that connects to an attacker-controlled or machine-in-the-middle-intercepted WebSocket endpoint. During the opening handshake, if a server returns a Sec-WebSocket-Protocol header that the client never offered, undici dereferences a null value and throws an uncaught TypeError inside a Promise microtask, bypassing all application-level error handlers and killing the entire Node.js process. Affected are undici 6.7.0 through 6.28.0, 7.0.0 through 7.29.0, and 8.0.0 through 8.10.1; no public exploit identified at time of analysis.
Unrestricted file upload in the LearnDash LMS WordPress plugin (versions ≤5.1.5) allows authenticated subscribers enrolled in courses with assignment uploads enabled to bypass file-type validation by submitting a multi-file array, where only the first file is validated and subsequent files - including PHP webshells - are silently accepted and written to wp-content/uploads/learndash/assignments/. Remote code execution is contingent on non-default server configurations that permit PHP execution within the uploads directory. No public exploit or CISA KEV listing has been identified at time of analysis.
Unauthenticated remote information disclosure in IBM Langflow OSS 1.0.0 through 1.11.2 allows network-accessible attackers to retrieve sensitive credential fields that are incompletely scrubbed from API responses or workflow data outputs. The CVSS vector (AV:N/AC:L/PR:N/UI:N/C:H) confirms this is exploitable over the network without any authentication or user interaction, and the high confidentiality impact reflects that leaked credentials may include API keys, passwords, or tokens used to integrate with downstream services. No public exploit code or active exploitation has been identified at time of analysis, and IBM has released a patch via their security advisory.
Denial of service in IBM i versions 7.3, 7.4, 7.5, and 7.6 is exploitable remotely by unauthenticated network attackers via a buffer overflow (CWE-787, out-of-bounds write), degrading service availability without requiring credentials or user interaction. IBM has released a patch via their support portal. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS 5.3 score reflects limited practical impact - no confidentiality or integrity compromise.
Remote denial-of-service in IBM App Connect Enterprise and IBM Integration Bus for z/OS allows unauthenticated network attackers to crash or hang the integration runtime by triggering an infinite loop (CWE-835). Affected are ACE versions 12.0.1.0-12.0.12.28 and 13.0.1.0-13.0.8.1, plus Integration Bus for z/OS 10.1.0.0-10.1.0.7. Impact is confined to availability - no data exposure or integrity loss - but a hung integration broker can disrupt critical business processes in environments relying on IBM middleware for message routing and API mediation. No public exploit or CISA KEV listing exists at time of analysis.
Abrupt TCP disconnections against undici's experimental WebSocketStream client crash the entire Node.js process: undici's internal socket-close handler unconditionally calls abort() on a writable stream that the application has locked with a writer, and discards the returned promise, so the resulting TypeError rejection is never observed and Node's default unhandled-rejection behavior terminates the process. Affected deployments are those running undici 7.0.0 through 7.29.0 or 8.0.0 through 8.10.1 and using the experimental WebSocketStream API to connect to a server an attacker controls or can MITM; the trigger is a single abrupt disconnect with no WebSocket close handshake, requiring no authentication and no user interaction (CVSS 3.1 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, CWE-248). No public exploit code identified at time of analysis, EPSS is 0.35% (28th percentile), and no CISA KEV listing exists; the impact is bounded to availability loss in the subset of services that actually use WebSocketStream against untrusted endpoints.
Stack-based buffer over-read in FreeIPMI's ipmi-oem Fujitsu OEM module crashes the client process when a Fujitsu BMC returns a shorter-than-expected response to a System Event Log query. All FreeIPMI versions before 1.6.19 are affected; this is a distinct vulnerability from CVE-2026-50031, which covers different version ranges. No public exploit code or active exploitation has been identified at time of analysis.
Observable response discrepancy in Menulux Portal (all builds before 20260903211448) enables unauthenticated account footprinting against the portal's login or account-resolution endpoint. By observing measurable differences in server responses - such as distinct HTTP status codes, error messages, or timing - for valid versus invalid account identifiers, an attacker can systematically enumerate existing user accounts. Reported by TR-CERT with no public exploit code or CISA KEV listing identified at time of analysis.
Server-side request forgery in IBM Langflow OSS 1.0.0 through 1.11.2 allows unauthenticated remote attackers to induce the server to issue HTTP requests to attacker-controlled destinations, enabling exfiltration of sensitive information from internal network resources, cloud metadata endpoints, or the application's own environment. The CVSS vector (PR:N/AV:N/AC:L) indicates this is exploitable without authentication at low complexity, which is notable for an AI workflow platform likely deployed with access to cloud infrastructure credentials. No public exploit code or active exploitation has been identified at time of analysis, though the automatable SSVC signal and high confidentiality impact make this a meaningful exposure in cloud-hosted or hybrid deployments.
Fastify's route schema compilation silently nullifies conditional header requirements declared via the JSON Schema Draft 7 `dependencies` keyword, enabling unauthenticated remote clients to bypass schema-enforced authorization checks. Versions before 5.12.2 lowercase header property keys and the root `required` array during schema compilation but leave trigger and dependent names inside `dependencies` in their original casing; since Node.js stores all incoming request header names in lowercase, those case-sensitive dependency references never match and the conditional requirement is invisibly skipped. An attacker can present a privileged-operation header while omitting the authentication or authorization header the dependency was intended to mandate, causing the application's privileged branch to execute as though the guard had passed. No public exploit has been identified at time of analysis.
Remote unauthenticated denial-of-service against Open5GS v2.7.7 is possible by sending a crafted HTTP/2 SBI request containing an overlong timestamp string to the Session Management Function. The `ogs_sbi_time_from_string()` function in `lib/sbi/conv.c` copies characters into a fixed-size buffer using loop counters `j` and `k` without checking bounds, triggering a buffer overflow that crashes the SMF process and disrupts all active and new PDU sessions. Public proof-of-concept exploit code is available via the hackeryounow/5GCVulDB repository; no active exploitation is confirmed in CISA KEV.
Denial of service in the Free5GC go-upf user plane function (UPF) allows a remote, unauthenticated attacker to crash the UPF process by sending crafted PFCP signaling messages that trigger a null pointer dereference during session lookup and session-report handling. The flaw affects Free5GC v4.2.2 and manifests as a Go runtime panic in internal/pfcp, taking down user-plane packet forwarding for all subscribers served by that UPF. No public exploit is confirmed in the wild and CISA KEV does not list it, but an upstream fix (go-upf PR #97) exists and researcher-published analysis (5GCVulDB gist repository) is publicly linked; EPSS is low at 0.25%, consistent with the narrow exposure of PFCP/N4 interfaces rather than low technical severity.