Observable response discrepancy in GastroMenum Web Panel exposes account existence to unauthenticated remote attackers via differential server responses, enabling systematic account footprinting. All versions prior to 31.08.2026 of the web panel are affected. Reported by TR-CERT, this flaw (CWE-204) allows an attacker to distinguish valid from invalid accounts without any credentials, providing a reliable enumeration primitive for downstream attacks such as credential stuffing or targeted phishing. No public exploit code or CISA KEV listing identified at time of analysis.
Improper authorization in the DDM (Distributed Data Management) target dispatcher on IBM i 7.3 through 7.6 allows remote, unauthenticated attackers to manipulate database transactions across the network. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:L) confirms the path is fully network-exposed with no credential requirement, though high attack complexity suggests specific conditions - such as DDM service availability and potentially specific network positioning - must be met. IBM has released a patch via its support portal; no public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis.
Heap buffer overflow in Corosync's Totem Process Group (totempg) message reassembly exposes high-availability clusters to network-adjacent unauthenticated attack. When processing fragmented multicast messages, the reassembly buffer lacks runtime bounds checking in release builds, allowing an attacker on the same cluster network to trigger heap corruption with attacker-controlled data. The confirmed impact is a daemon crash causing full cluster denial-of-service; the description explicitly acknowledges the potential for further exploitation - including possible code execution - contingent on heap layout control, though RCE remains unconfirmed at time of analysis. No public exploit or KEV listing identified.
Denial-of-service in IBM i 7.3 through 7.6 allows an unauthenticated network-adjacent attacker to crash the ICMPv6 stack by sending a malformed Router Advertisement packet with an invalid prefix length. The underlying flaw is an out-of-bounds write (CWE-787) triggered by absent validation of the RA prefix length field, resulting in limited availability impact without confidentiality or integrity loss. No public exploit code has been identified and this vulnerability is not listed in CISA KEV; a vendor patch is available.
Server-side request forgery (SSRF) in Invoice Ninja v5.13.24 enables attackers to make the application server issue HTTP requests to internal and loopback network targets via unsanitized webhook destination URLs in StoreWebhookRequest.php, UpdateWebhookRequest.php, and WebhookSingle.php. By supplying RFC 1918 private addresses, loopback targets (127.0.0.1, ::1), or cloud metadata endpoints as webhook destinations, an attacker can probe internal services and retrieve sensitive responses that should be inaccessible from the internet. No public exploit code or active exploitation (CISA KEV) has been identified; EPSS at 0.17% (6th percentile) reflects minimal current exploitation interest.
Server-side template injection (SSTI) in IBM Verify Identity Access and Security Verify Access exposes sensitive information to unauthenticated remote attackers via a network-accessible endpoint. The vulnerability affects both traditional appliance deployments and container variants across IBM's IAM product family (versions 10.x and 11.x), and is particularly notable given that IAM platforms routinely handle authentication tokens, user credentials, and security policy configuration - data whose disclosure has outsized downstream impact. IBM has assessed the impact as confidentiality-only (I:N/A:N in the CVSS vector), suggesting the template injection is sandboxed against code execution, but no public exploit or active exploitation has been identified at time of analysis.
Plaintext MQTT transmission in Trueview TI8161 firmware 6.0.23.4 exposes all device communications on TCP port 1883 to passive interception by any attacker on the same network segment. The device sends MQTT traffic without TLS encryption, allowing recovery of device identifiers, operational metadata, and control-related payloads with no authentication required. No public exploit has been identified beyond a GitHub research writeup, and EPSS is very low (0.15%, 4th percentile), though the absence of transport security makes passive interception trivially straightforward for any adjacent network attacker.
Session isolation failure in IBM ContextForge MCP Gateway - Translate Utility (≤ 1.0.8) permits unauthenticated remote attackers to access session data belonging to other users and potentially inject content into those sessions, due to improper enforcement of session boundaries (CWE-488). The CVSS AC:H metric indicates exploitation depends on specific timing or concurrency conditions - likely a race condition or shared mutable state in multi-tenant request handling - rather than a trivially triggerable flaw. IBM has released a remediation; no public exploit code has been identified at time of analysis.
Cross-origin cache key confusion in undici 8.10.0 and 8.10.1 allows unauthenticated network attackers to receive responses intended for a different upstream origin and to persistently poison the cache with attacker-controlled content. When the cache or request-deduplication interceptor is composed directly onto a Client or Pool instance, the origin is silently dropped from the key and falls back to an empty string, meaning any two origins sharing the same HTTP method, path, and relevant headers share a single cache slot. The OpenJS Foundation reporter demonstrated full authentication bypass in which a JWT signed with an attacker-controlled key was accepted in place of a trusted issuer's token because the trusted origin was never contacted; no public exploit code has been released at time of analysis.
SQL injection in Zhao-github APiAdmin v5.0.1 exposes sensitive database information to remote attackers via the User.php component, with no authentication required per the CVSS vector. The vulnerability enables extraction of confidential database records without write or availability impact, scoped to the database as a secondary component. No public exploit code exists and EPSS at 0.17% (7th percentile) reflects low current exploitation activity.
Improper verification of cryptographic signatures in the MQTT command handler of Trueview T18161 S firmware 6.0.23.4 lets a network-positioned attacker replay or tamper with captured MQTT messages — including their nonce, timestamp, and signature fields — and have the device accept and execute the embedded commands. The flaw (CWE-347) yields high
Improper OCSP response validation across the Snowflake Python, Go, JDBC, and Node.js drivers allowed a revoked TLS certificate to be treated as valid, enabling a man-in-the-middle attacker to intercept and tamper with driver-to-Snowflake TLS sessions. The root flaw is twofold: OCSP stapled or fetched responses were not reliably bound to the specific certificate under validation, and definitive OCSP verification failures were treated as transient errors (soft-fail), causing the driver to proceed with a connection rather than abort it. Exploitation requires a network-adjacent or on-path position combined with possession of a revoked certificate and its corresponding private key for a Snowflake or storage-stage hostname; no public exploit is identified at time of analysis and EPSS data was not provided, but the CVSS AC:H reflects these steep prerequisites.
Arbitrary file deletion in CRMEB v6.0.0 permits authenticated administrators to erase files at arbitrary server-side paths by sending a crafted POST request to the `/adminapi/file/video_data_save` endpoint. The CWE-73 (External Control of File Name or Path) root cause indicates the endpoint passes attacker-controlled path values directly to filesystem operations without path confinement or canonicalization. No public exploit has been identified at time of analysis and the EPSS score is 0.14% (4th percentile), indicating low current exploitation probability, though admin-level compromise enabling this attack is a meaningful escalation path in shared-credential environments.
Path guard bypass in SiYuan's MCP file-access handler exposes the protected publishAccess.json configuration file to authenticated low-privileged attackers on Linux deployments. The handler enforces access restrictions using case-sensitive string matching, but Linux filesystems are themselves case-sensitive - meaning an attacker requesting a case-variant path such as PublishAccess.json bypasses the guard while the filesystem resolves it to the same protected file. All SiYuan versions before v3.8.2 are affected. No public exploit code or CISA KEV listing is identified at time of analysis.
Path traversal via symlink following in SiYuan's reader-accessible file-read API allows authenticated low-privilege users to escape the workspace boundary and read arbitrary server-side files. Versions before v3.8.2 fail to resolve symlink targets before serving asset content, meaning a reader-role account can request a data/assets/ path that is a symlink pointing outside the workspace and receive the target file bytes. The impact is strictly confidentiality - no integrity or availability consequences - but sensitive server-side files (credentials, SSH keys, configuration) could be exfiltrated. No public exploit code or CISA KEV listing exists at time of analysis.
Path traversal in Grav CMS before 1.10.55 allows an authenticated admin user with the admin.pages.create permission to write arbitrary Markdown files outside the intended pages directory by embedding traversal sequences in the lang POST parameter of the admin plugin's Save As action. The vulnerability gives an attacker-controlled write primitive constrained to .md file extensions, which - depending on Grav's template and plugin layout - may be chained to persistent backdoor placement or secondary code execution. No public exploit has been identified at time of analysis, and exploitation is bounded by requiring a valid authenticated admin session.
Cross-user private note disclosure in Blinko 1.8.7 allows any authenticated user to read other users' private notes, attachments, and tags by exploiting a missing ownership check in the noteReferenceList TRPC procedure. The flaw follows a classic IDOR pattern (CWE-639): the API accepts sequential note identifiers without verifying the caller's entitlement to access them, enabling systematic enumeration of the entire note corpus. A patch was introduced in version 1.8.8, and no public exploit code has been identified at time of analysis.
phpMyFAQ before 4.1.8 allows an authenticated attacker who has hijacked a user's session to silently strip two-factor authentication (TOTP) protection from any account, including administrator accounts, by calling either POST /api/user/remove-twofactor or PUT /api/user/data/update with only a valid session cookie and CSRF token - no password re-entry or current TOTP code is required. The root cause is CWE-308: the application guards a security-downgrade operation with single-factor controls (session identity plus CSRF) rather than requiring the second factor whose removal is being requested. After TOTP is disabled, the targeted account becomes accessible via password-only authentication, negating the deployment's MFA posture. No public exploit code or CISA KEV listing has been identified at time of analysis.
Arbitrary file read in ConvertX 0.17.0 allows authenticated users to exfiltrate files accessible to the server process by exploiting the xelatex converter's handling of LaTeX directives. Crafted `.tex` files containing `\input{path}` or `\verbatiminput{path}` directives cause the TeX engine to read and embed target file contents into downloadable PDF output, bypassing any application-level access controls on those files. No active exploitation has been confirmed (not in CISA KEV), and a fix is available in v0.18.0 per the upstream repository reference.
Memory exhaustion in SiYuan's publish-service Basic Auth handler allows authenticated users to repeatedly submit valid credentials, generating persistent session entries that accumulate without expiry or capacity limits, eventually crashing the process. All SiYuan versions before v3.8.2 are affected, as confirmed by vendor security advisory GHSA-f4vj-ppp2-5hg4. No active exploitation has been recorded in CISA KEV and no public proof-of-concept code is known, but the low barrier - only valid credentials required - means any account holder can trigger denial of service on demand.
Server-side request forgery in Nightingale (n9e), the open-source observability platform by ccfos, allows authenticated users of the http_fetch AI-agent tool to bypass the platform's SSRF guard by encoding forbidden IPv4 addresses using 6to4, NAT64, or deprecated site-local IPv6 representations. The isPublicIP function in aiagent/tools/http.go only unwraps standard ::ffff:a.b.c.d IPv4-mapped IPv6 addresses before applying the forbidden-range check, leaving 2002::/16 (6to4), 64:ff9b::/96 and 64:ff9b:1::/48 (NAT64), and fec0::/10 (site-local) unrecognized and passable as 'public'. On dual-stack or NAT64-enabled cloud hosts, this allows an attacker to reach the cloud instance-metadata endpoint (169.254.169.254) or internal services and exfiltrate IAM credentials or sensitive configuration. No public exploit code has been identified at time of analysis.
Authenticated account takeover in phpMyFAQ before 4.1.8 allows any authenticated user-including low-privileged accounts-to silently reset the password of any other account, including administrators, by submitting a crafted PUT request to the user data update API endpoint with only a CSRF token and no current-password verification. Successful exploitation locks the victim out of their account irreversibly and grants the attacker full control of that account, enabling vertical privilege escalation from a low-privilege user to administrator. No public exploit or CISA KEV listing has been identified at time of analysis, but the attack is straightforward for any authenticated session holder.
Missing authorization on the host pool bulk-delete REST endpoint in ntopng before 6.7.260717 allows any authenticated low-privileged user to irreversibly destroy all configured host pools and their member bindings via a POST request. The flaw (CWE-862) bypasses ntopng's capability-based access control model, enabling non-administrator accounts to eliminate traffic policy segmentation, rate-limit assignments, and visibility restrictions that network security teams depend on. No public exploit has been identified at time of analysis, and a patch commit is available in version 6.7.260717.
Authorization bypass in SiYuan through 3.8.1 exposes private notebook content to low-privileged readers via the /api/file/getFile endpoint. Users assigned the reader role can circumvent the Visible:false notebook access control by directly requesting files with a known notebook identifier and file path, retrieving notebook metadata and internal configuration that the workspace owner intended to keep private. No public exploit has been identified and the vulnerability is not listed in CISA KEV, but reader-role access is the only prerequisite for exploitation.
SQL injection in llmware 0.4.6's collection-database abstraction layer allows an authenticated API caller to disclose rows from collections they are scoped out of, with full UNION-based data extraction possible on PostgreSQL backends. The flaw resides in resources.py, where attacker-controlled filter values are string-interpolated directly into SQL WHERE clauses without parameterization; the filter validator checks only key names against an allow-list but never sanitizes values. Affected public API entry points are Library.block_lookup and Query.text_query_with_custom_filter / text_query_by_author_or_speaker. No public exploit code has been identified and this CVE is not listed in CISA KEV at time of analysis.
Cross-user private file content disclosure in mckaywrigley's Chatbot UI allows any authenticated user to read indexed file chunks belonging to other users by supplying arbitrary file UUIDs to the retrieval endpoint. The root cause is that the `/api/retrieval/retrieve` route uses a Supabase service-role client - which carries elevated privileges that bypass Supabase row-level security (RLS) - while performing no file ownership check against the requesting user's identity. No public exploit or KEV listing is identified at time of analysis, but the vulnerability is straightforward to exploit given valid credentials and knowledge of a target file UUID.
Missing authorization in ntopng's REST v2 API allows any authenticated low-privilege user to permanently delete all configured notification endpoints and recipients, silencing the entire alert pipeline. Affected versions are all ntopng releases before 6.7.260717; the vendor confirmed and patched the flaw via GitHub Security Advisory GHSA-m22w-f647-vx88. No public exploit code has been identified at time of analysis, but the attack requires only a valid user session and a straightforward POST request, making exploitation trivially simple for any authenticated ntopng account holder.
Null pointer dereference in PX4 Autopilot through 1.17.0 allows any party with PX4 shell access to crash the autopilot process by issuing 'param select' or 'param select-backup' with no path argument, triggering a dereference of a null filename pointer passed to strcmp() inside param_set_default_file() and param_set_backup_file(). The CVSS 4.0 vector (AV:A) confirms the shell must be reachable via an adjacent vector - MAVLink console, UART/USB serial, or companion-computer link - with no authentication required within the shell environment itself. In airborne or safety-critical deployments, a process crash during flight could have consequences beyond mere software unavailability. No public exploit code identified at time of analysis; the fix is confirmed in upstream PR #28475.
Argument injection in GFI Exinda AI before 7.6.5 allows any authenticated user - including those with the lowest-privilege Unprivileged account - to exfiltrate arbitrary files from the host system. The web_tools_cmd() function in the Tools Iperf Client feature concatenates user-supplied server and options parameters directly into an iperf command without sanitization, enabling injection of the iperf -F flag to redirect file contents to an attacker-controlled iperf server. No public exploit has been identified and the vulnerability is not listed in CISA KEV, but exploitation is straightforward given knowledge of standard iperf flags.
Missing ownership verification in potpie through 2.0.0 allows authenticated users to inject arbitrary file changes into other users' conversations via the POST /conversations/{conversation_id}/code-changes/sync endpoint. Because the API never checks that the requesting user owns the supplied conversation_id, any authenticated account can overwrite pending code-change state in conversations belonging to other users-an Insecure Direct Object Reference (IDOR) pattern classified as CWE-862. No public exploit or CISA KEV listing exists at time of analysis, but the vulnerability is straightforward to exploit given valid authentication and knowledge of a target conversation ID.
Plaintext password storage in Menulux Portal (CWE-256) exposes embedded credentials to any low-privileged authenticated user over the network. All portal versions prior to build 20260903211448 are affected. Disclosed by TR-CERT; no public exploit code or active exploitation has been identified at time of analysis, though the High CVSS confidentiality rating reflects full credential retrieval capability.
Incomplete SQL validation denylist in Amazon awslabs postgres-mcp-server before 1.1.7 allows an unauthenticated attacker to bypass read-only enforcement and perform write operations against a PostgreSQL database by embedding crafted SQL in content processed when an authenticated user interacts with the MCP server. The vulnerability (CWE-184) exploits the incomplete list of disallowed SQL constructs, effectively turning user-triggered MCP interactions into a vector for unauthorized data modification with high integrity impact (VI:H) and no confidentiality or availability effect. No public exploit code has been identified at time of analysis; a vendor-released patch is available at version 1.1.7.
Improper authorization (IDOR/CWE-639) in IBM Langflow OSS 1.0.0 through 1.10.2 allows a remote authenticated attacker to access other users' workflow data and inject messages into workflow history they do not own. The flaw stems from user-controlled keys not being validated against the authenticated session's authorization scope, enabling horizontal privilege escalation across tenant workflows. No public exploit or active exploitation has been identified; IBM has released a patch and the SSVC assessment confirms exploitation is currently none with partial technical impact.
Template injection in the AWS CDK generator component of Amazon's awslabs.dynamodb-mcp-server allows a context-dependent attacker to achieve arbitrary code execution on the host machine that processes and deploys the generated CDK application. The attack surface is the data model file: crafted DynamoDB table, index, or attribute names containing template engine directives are passed unsanitized through the CDK generator, with payload execution occurring at deploy time. Versions before 2.1.6 are affected; no public exploit or active exploitation is confirmed at the time of analysis.
Arbitrary root-level file deletion in GFI Exinda AI before 7.6.5 is possible through a path traversal flaw in the diagnostic file deletion handler. The `unlink_or_email_file()` function appends user-controlled parameter values (prefixed `v_file_row_`) directly to a base directory path without sanitizing for `../` sequences, allowing any file on the filesystem to be targeted. Exploitation requires authenticated Admin-level access via the network management interface; no public exploit code or CISA KEV listing exists at time of analysis.
Missing post-ownership authorization in Directorist WordPress plugin before 8.9 allows any authenticated subscriber-level user to overwrite image metadata on posts belonging to other users. The plugin fails to verify that the uploading user owns the target post before writing file references to its metadata, enabling cross-user content tampering limited to image attachment references. No public exploit confirmed via CISA KEV, but WPScan has published a proof-of-concept, and a vendor patch is available at version 8.9.
Credential disclosure in Onyx 4.6.6 allows any authenticated user to retrieve plaintext API keys and authorization headers that administrators configured for custom tool integrations. By calling GET /tool or GET /tool/{tool_id} with standard user credentials, an attacker can read admin-defined third-party API keys stored in custom_headers fields without any privilege escalation. A proof-of-concept exists per SSVC classification, and the stolen credentials can be leveraged to directly access upstream APIs the Onyx instance is connected to, entirely outside the platform's audit trail.
Documenso 2.17.0's PDF-serving endpoint fails to enforce document visibility settings or validate ownership of document data identifiers, allowing authenticated low-privilege users to retrieve restricted documents belonging to other users - including across organizational tenant boundaries. The flaw is pinned to files.helpers.ts in the Remix server layer and is tracked via VulnCheck advisory and GitHub issue #3112. No active exploitation or public exploit code is confirmed at time of analysis.
Out-of-bounds write in Hugging Face tokenizers v0.23.1 allows any actor who can supply a crafted tokenizer.json file to abort the loading process immediately, causing denial of service in Rust applications and FFI embeddings before any inference occurs. The defect in BpeBuilder::build (tokenizers/src/models/bpe/model.rs) allocates a scratch buffer sized to the longest vocabulary key, then writes concatenated BPE merge pairs into it without bounding the write to the buffer size; a merge whose result exceeds that length triggers a Rust panic and process abort (CWE-787). A secondary usize underflow at the same code site, activated when continuing_subword_prefix is set and a merge token is shorter than the prefix, produces a panic in debug builds and potential memory corruption in release builds, elevating the secondary impact beyond availability alone. No public exploit code or CISA KEV listing has been identified at time of analysis; a fix appears in the v0.23.2 source.
Path traversal in Bruno API client through version 3.4.2 allows an attacker who can deliver a crafted collection to a victim to exfiltrate arbitrary local files from the victim's filesystem. When a user executes a Bruno collection containing a `body:file` request with `../` traversal sequences in the file path, the application resolves the path outside the collection directory and transmits the resulting file contents to an attacker-controlled HTTP endpoint. No public exploit has been identified at time of analysis, but the VulnCheck advisory and a GitHub issue confirm the issue is documented, and the attack surface is realistic given the common practice of sharing Bruno collections.
Traefik's Kubernetes Ingress provider, starting from v3.7.1, incorrectly fails to enforce crossProviderNamespaces namespace-isolation controls on the traefik.ingress.kubernetes.io/service.middlewares Service annotation. A low-privileged tenant scoped to their own Kubernetes namespace can attach an operator-owned middleware from a namespace they are not permitted to reference, and if that middleware injects authentication credentials into backend requests, the attacker can exfiltrate those credentials via a backend endpoint under their control. No public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis.
Path traversal in GFI Exinda AI before 7.6.5 allows an authenticated administrator to read arbitrary files from the underlying system as root. The vulnerability resides in the wcf_handle_download() function within the system maintenance configuration download handler, which fails to sanitize directory traversal sequences embedded in parameters prefixed with v_del_ before appending them to the base configuration directory path. No public exploit code or active exploitation has been identified at the time of analysis, and exploitation is constrained to Admin-privileged accounts.
Off-by-one buffer overflow in pjproject's SIP message serialization function allows a remote peer to trigger a single-byte out-of-bounds write by sending crafted SIP requests to a proxy, SBC, or B2BUA that parses and re-serializes messages using the PJSIP library. The vulnerable function `pjsip_generic_array_hdr_print()` in `sip_msg.c` omitted bounds checking before writing the colon and space characters that follow generic array header names (Allow, Require, Supported, Unsupported), resulting in CWE-193 off-by-one writes at exact buffer boundaries. No public exploit has been identified at time of analysis; the vendor explicitly states that code execution and information disclosure have not been demonstrated, and pool-based allocator slack typically absorbs the errant byte harmlessly.
Remote denial of service and data integrity compromise in IBM i (formerly OS/400) releases 7.3, 7.4, 7.5, and 7.6 stems from a critical function that ships without an authentication check (CWE-306), letting a network attacker invoke it without credentials. IBM has released a fix, and no public exploit has been identified at time of analysis; EPSS is low at 0.36% (29th percentile), indicating no observed exploitation pressure yet.
CAPTCHA validation in phpMyFAQ before 4.1.8 is completely skipped when the `store` parameter is set to `now` in question submission requests, exposing any publicly accessible instance to unauthenticated spam automation. Attackers exploiting this bypass can flood the FAQ database with arbitrary question entries and force outbound email notifications to administrators for each submission. No public exploit code or active exploitation has been identified, but the bypass is trivially reproducible through a single parameter manipulation.
Zip-slip path traversal in Emlog versions 2.6.29 and prior allows authenticated administrators to overwrite arbitrary server-side files, including config.php, achieving remote code execution. The emUnZip() function passes attacker-supplied ZIP archives to ZipArchive::extractTo() without sanitizing path components across all entries - only the first entry's subdirectory is inspected, leaving all subsequent entries unchecked. No publicly known patch exists at time of publication, making this an unmitigated risk for all deployed instances.
Stored cross-site scripting in Emlog versions 2.6.29 and prior allows persistent JavaScript injection via crafted tag names rendered in the article editor. The underlying flaw is that PHP's addslashes() escapes backslash-sensitive characters but does not HTML-encode entities, so an attacker can store the HTML entity ' (representing a single quote) which the browser later decodes back to a literal quote at render time, breaking out of a JavaScript string literal and executing arbitrary code in the victim's session. No vendor-released patch was publicly available at time of publication, and no public exploit code beyond the security advisory proof-of-concept has been identified.
Remote denial of service and integrity compromise in IBM i 7.3, 7.4, 7.5, and 7.6 arises from an out-of-bounds write (buffer overflow) reachable by a remote attacker. Per IBM's CVSS 3.1 vector the flaw is network-reachable with no privileges or user interaction, corrupting memory to crash affected services and tamper with data integrity (C:N/I:H/A:H). There is no public exploit identified at time of analysis, EPSS is low (0.32%), and the CISA SSVC framework records exploitation status as none.
Unauthenticated full-read SSRF in Openpanel before 2.3.0 enables remote attackers to issue arbitrary server-side HTTP requests through the /tools/site-checker endpoint, with no authentication, IP allowlisting, or SSRF mitigation in place. The endpoint's url query parameter is passed directly to fetchWithRedirects() in apps/api/src/controllers/tools.controller.ts, allowing attackers to reach cloud instance metadata services (e.g., AWS IMDS at 169.254.169.254), enumerate internal ports, and retrieve response content including status codes, page sizes, and parsed HTML metadata. A secondary leakage path via getIPInfo() exfiltrates internal IP addresses to a third-party service, exposing network topology data beyond the attacker's direct channel. No public exploit code has been identified at time of analysis.
Server-side request forgery in Marqo ≤ 2.26.0 allows unauthenticated remote attackers to force the server to issue HTTP requests to arbitrary internal or external URLs by supplying attacker-controlled values in media fields of the add_documents API endpoint. The vulnerability originates in the inference orchestrator's image download component - specifically the download_image_from_url and fetch_content_sample functions in image_download.py - which perform no host validation or destination filtering before fetching user-supplied URLs. In cloud-hosted deployments, this enables access to instance metadata endpoints (e.g., AWS IMDSv1 at 169.254.169.254) that can yield IAM role credentials, substantially amplifying the practical impact beyond the moderate CVSS 4.0 base score of 6.9. No public exploit code has been identified and the vulnerability is not in the CISA KEV catalog.