Local privilege escalation in Acunetix 25.11.251107123 for Windows enables low-privileged local users to execute arbitrary code as SYSTEM by exploiting CWE-427 (Uncontrolled Search Path Element) in the wvsc.exe Web Vulnerability Scanning Engine. The SYSTEM-level wvsc.exe process searches for OpenSSL-related files at a hardcoded directory path that does not exist by default; an attacker creates the missing directory and plants a malicious file, which the service subsequently loads and executes, yielding full SYSTEM-level control. A public proof-of-concept is available via the Full Disclosure mailing list and corroborated by a VulnCheck advisory, making this trivially reproducible by any local user on affected Windows installations.
Arbitrary physical memory write via a hard-coded cryptographic key in the shared Windows kernel driver DirectIo64.sys affects PassMark PerformanceTest (before 11.1 build 1012), BurnInTest (before 11.1 build 1000), and OSForensics (before 11.1 build 1016). An attacker with local low-privilege access can extract the 8-byte key embedded as a hardcoded literal in the distributed binary, compute valid MD5 authentication tags for arbitrary IOCTL write requests, and additionally use the driver's own bit-clear IOCTL to permanently disable all MAC verification, size checks, and Vendor ID checks - enabling unrestricted writes to arbitrary physical memory locations. A publicly available proof-of-concept exploit exists on GitHub; no confirmed active exploitation (CISA KEV) has been identified at time of analysis, though the published PoC significantly lowers the exploitation bar.
Full physical memory disclosure in PassMark's shared kernel driver DirectIo64.sys affects PerformanceTest (before 11.1 build 1012), BurnInTest (before 11.1 build 1000), and OSForensics (before 11.1 build 1016) on Windows. A low-privileged local attacker can issue a single IOCTL call supplying an attacker-controlled output path, causing the driver to enumerate all physical memory ranges via MmGetPhysicalMemoryRanges and map each page through ZwMapViewOfSection on the PhysicalMemory section object, writing a complete RAM image to disk in SYSTEM context and bypassing user-mode ACLs. Exposed data includes LSASS working-set memory, per-process heap contents, and in-use cryptographic keying material from all running processes. A public proof-of-concept is available at GitHub and no active exploitation (KEV) has been confirmed at time of analysis.
Privilege escalation in PassMark's shared DirectIo64.sys kernel driver, bundled with PerformanceTest (before 11.1 build 1012), BurnInTest (before 11.1 build 1000), and OSForensics (before 11.1 build 1016), allows any low-privileged local user to gain complete hardware-level control over the host. The driver exposes IOCTLs without validating the target device, register offset, or value, enabling arbitrary PCI configuration space reads and writes. An attacker can leverage this to enable Bus Master DMA on any PCI device, remap Base Address Registers to attacker-controlled physical memory addresses, or halt storage controller I/O - all without kernel exploits. A public proof-of-concept is available; no active exploitation (CISA KEV) confirmed at time of analysis.
Unprivileged local users can issue privileged hardware IOCTLs through PassMark's DirectIo64.sys kernel driver across three PassMark products - PerformanceTest (before 11.1 build 1012), BurnInTest (before 11.1 build 1000), and OSForensics (before 11.1 build 1016) - because the driver's device object is created without a security descriptor, allowing Windows to apply a permissive default ACL. Any standard Windows user account can open a handle to the device and invoke kernel-level hardware operations regardless of their privilege or integrity level, effectively bypassing Windows privilege boundaries. A public proof-of-concept is available on GitHub, and vendor patches have been released for all three affected products.
Physical memory disclosure and arbitrary SYSTEM-context file write in PassMark PerformanceTest (before 11.1 build 1012), BurnInTest (before 11.1 build 1000), and OSForensics (before 11.1 build 1016) are caused by the shared DirectIo64.sys kernel driver accepting a single IOCTL with no caller-identity validation. Any unprivileged local Windows user can invoke the handler to dump all physical memory in PAGEDU64 crash-dump format to an attacker-chosen path, with the write executed in SYSTEM context - enabling cross-process memory extraction, credential harvesting, and writes to otherwise-inaccessible filesystem locations. Publicly available exploit code exists (GitHub repository confirmed by VulnCheck); no active exploitation has been confirmed in CISA KEV at time of analysis.
Infinite-loop denial-of-service in smol-toml (npm, squirrelchat) before version 1.7.1 allows remote unauthenticated attackers to permanently hang any Node.js service that parses attacker-controlled TOML. The trigger is a crafted value inside a TOML array or inline table followed by a comment character with no trailing newline - when this input reaches the parser, skipUntil() in src/util.ts receives -1 from indexOfNewline() and resets the cursor to position zero instead of terminating, spinning indefinitely and consuming all processing capacity. No public exploit has been identified at time of analysis, but the CVSS 4.0 score of 8.2 and the trivially constructible trigger make this straightforward to weaponize against any exposed TOML-parsing endpoint.
Fail-open password validation in Chew, Kean Ho's Actualizer v1.2.0 installer allows a build host with an incompatible mkpasswd implementation to produce Debian images with empty root and alpha account password fields. The installer script Shell/debian-minbase-install.sh invokes mkpasswd to generate yescrypt hashes but never validates whether the output is a valid yescrypt hash or even non-empty, proceeding unconditionally when mkpasswd silently fails. Deployed images built under this condition may permit passwordless authentication to the root and alpha accounts, depending on the PAM configuration of the target system. No public exploit is required; the flaw is self-triggering under a specific but plausible build-host misconfiguration. Vendor-released patch is available in v1.2.1.
Cross-workspace IDOR authorization bypass in AppFlowy-Cloud 0.9.64 allows authenticated users to read, modify, or delete documents and database rows belonging to other users' workspaces. The Casbin-based access control layer in `libs/access-control/src/casbin/collab.rs` validates a user's membership in their own workspace but fails to confirm that the requested collab object actually belongs to that workspace, enabling object ID substitution attacks across the HTTP API. No public exploit code has been identified at time of analysis, though the flaw is fully documented in a public GitHub issue.
Privilege escalation with arbitrary code execution in the Hummingbird Performance WordPress plugin (versions 3.15.0 through before 3.21.2) allows any site-level administrator on a WordPress multisite network to access and modify a network-wide configuration setting that should be gated to super admins, achieving code execution across all sites on the network. The vulnerability stems from missing capability enforcement (CWE-94) on a sensitive network-scope action. A publicly available proof-of-concept exists, and the vendor has released a patched version (3.21.2) addressing the access control gap.
Broken object-level authorization in the Classified Listing WordPress plugin (versions 5.3.0 through pre-6.1.1) allows any authenticated subscriber-level user to permanently delete media attachments from, or attach arbitrary files to, listings owned by other users by invoking the plugin's AI image-editing AJAX action with a victim's listing ID. The handler performs no ownership or capability verification before acting on the supplied identifier (CWE-639), meaning the lowest default WordPress role is sufficient to tamper with any listing on the platform. A publicly available proof-of-concept exists per WPScan; no active exploitation has been confirmed in the CISA KEV catalog at time of analysis.
Privilege escalation in Inductive Automation Ignition 8.1.53 and earlier allows any authenticated user who can execute gateway scripts to create SCADA/HMI projects without restriction, because the Gateway 'Create Project Role(s)' setting shipped with a blank default - effectively disabling the access control gate entirely. In industrial control system (ICS) environments, unauthorized project creation is operationally significant: projects define the logic, tags, and screens that interact with physical process equipment. Ignition 8.1.54 closes the gap by restricting project creation to Designer sessions, removing reliance on the misconfigured role setting. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Missing authorization enforcement in Tycon Systems TPDIN-Monitor-WEB3 versions 2.2.9 and prior allows low-privilege authenticated users to access restricted endpoints and extract system credentials, device configurations, and raw flash memory contents. Disclosed by CISA ICS-CERT under advisory ICSA-26-246-08, this affects an OT-class DC power monitoring appliance where credential extraction could enable full device takeover. No active exploitation or public proof-of-concept has been identified at time of analysis, but the straightforward exploitation path and ICS context elevate real-world risk.
Cross-site request forgery in Tycon Systems TPDIN-Monitor-WEB3 versions 2.2.9 and prior allows a remote unauthenticated attacker to perform unauthorized state-changing operations on an industrial DC power monitoring device by tricking an authenticated administrator into visiting a malicious webpage. Reported via CISA ICS-CERT advisory ICSA-26-246-08, the vulnerability is rooted in a missing anti-CSRF mechanism in the device web interface; a firmware upgrade to v2.4.2 is available. No public exploit code or confirmed active exploitation has been identified at time of analysis, though the OT deployment context elevates operational consequence.
Hard-coded credentials in Tycon Systems TPDIN-Monitor-WEB3 firmware versions 2.2.9 and prior expose the device to unauthorized access from network-adjacent attackers. An attacker with access to the same network segment can leverage the embedded credentials - extractable from the firmware binary - to authenticate to the device and retrieve sensitive configuration data, credentials, or monitoring telemetry. CISA issued ICS advisory ICSA-26-246-08 for this vulnerability; no active exploitation has been identified, and firmware v2.4.2 is available as a remediation.
CRLF injection in Laravel Framework (CWE-93) enables unauthenticated remote attackers to manipulate outbound email processing in any application that passes user-supplied email addresses to Laravel's mail functions. An attacker who can provide an email address to an application flow - such as registration, password reset, or contact forms - can embed carriage-return/line-feed sequences to inject additional SMTP headers, reroute messages to unintended recipients, or abuse the application's mail infrastructure as an open relay. The vendor has released patches in versions 12.60.0 and 13.10.0; no public exploit code or CISA KEV listing has been identified at time of analysis.
Arbitrary file write and deletion in datalab-to/marker through v2.0.0 exposes servers to full filesystem compromise via the FastAPI /marker/upload handler. Unauthenticated remote attackers can supply directory traversal sequences in the `file.filename` parameter - unsanitized before use in path construction - to write attacker-controlled content to or delete files at any location reachable by the server process. No public exploit code has been confirmed at time of analysis, but the VulnCheck advisory and GitHub issue #1047 reference the vulnerable code path in `marker/scripts/server.py`, making independent reproduction straightforward.
Remote code execution in IBM Langflow OSS 1.0.0 through 1.11.2 is reachable by any low-privileged authenticated attacker through an authorization bypass in the platform's flow build process. The flaw (CWE-94, Code Injection) allows a user with minimal credentials to submit flow build requests that exceed their authorized scope, causing the server to execute attacker-supplied code with full confidentiality, integrity, and availability impact. No CISA KEV listing and no public exploit code have been identified at time of analysis.
Stack-based buffer overflow in PJSIP's SRTP/SDES media transport allows a remote unauthenticated attacker to crash or potentially hijack control flow in any pjproject-based application with SRTP/SDES keying enabled. The flaw in `sdes_encode_sdp()` (transport_srtp_sdes.c) collects `a=crypto` attributes from a remote SDP offer into a fixed-size stack array without bounding the count, so a malicious SIP peer can overflow that array by including more attributes than it can hold. The vulnerability is reachable from an incoming SIP INVITE before application-level authentication, and a fix is available as upstream commit a1b707c; no public exploit or CISA KEV listing has been identified at time of analysis.
Credential theft and privilege escalation in IBM ContextForge MCP Gateway v1.0.7 and earlier allow a remote low-privilege authenticated attacker to extract sensitive credentials and elevate to higher access tiers by submitting maliciously crafted jq filter expressions that the gateway fails to properly validate. The jq filter injection bypasses input controls within the Model Context Protocol (MCP) gateway layer, giving authenticated-but-low-privilege users a direct path to confidentiality and integrity compromise of the entire gateway service. No public exploit code has been identified at time of analysis, and IBM has released a patch via advisory 7286052.
Stack buffer overflow in PJSIP's PJSUA library allows a malicious or compromised SIP registrar to crash applications - or potentially corrupt memory - by returning an excessive number of Service-Route headers in a 2xx registration response. The vulnerability affects all applications using the PJSUA/PJSUA2 account API (the default registration path) prior to commit acc03b5 in pjproject. The most likely outcome is denial of service via unexpected termination; however, because the overflow writes internal stack pointers rather than attacker-controlled bytes, arbitrary code execution is considered less probable though not excluded. No public exploit code or CISA KEV listing is present at time of analysis.
Stack buffer overflow in PJSIP's GnuTLS TLS backend allows a network-positioned attacker to corrupt memory or hijack control flow by presenting a crafted X.509 certificate with an oversized Subject Alternative Name entry during TLS handshake. Only builds compiled with GnuTLS (--with-gnutls) are affected; OpenSSL and Apple SecureTransport/Network.framework builds are explicitly unaffected. The vulnerability triggers before any SIP-level authentication, making it exploitable against both clients (connecting to a malicious server) and servers that request client certificates, with impact ranging from application termination to potential arbitrary code execution. No public exploit has been identified at time of analysis; upstream fix is available via commit c4a151a.
Blind SQL injection in GOLDENHORN ONEIT, an enterprise trade management platform by TAC Information Services Internal and External Trade Inc., allows low-privileged authenticated attackers to enumerate and extract the full database contents. The CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N) reflects network-accessible exploitation requiring only a valid low-privilege account, with full confidentiality, integrity, and availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis; the flaw was disclosed by TR-CERT (TR-26-0990).
Arbitrary file upload via the `/cgi-bin/ugwupload.cgi` endpoint in MBS-Solutions X-Serie Gateway firmware V6_00_05 permits an authenticated administrator to write files of arbitrary content to hardcoded filesystem paths. The CWE-434 flaw can be used to plant backdoors, overwrite critical device configuration, or corrupt the operating environment, potentially resulting in full device compromise. A public proof-of-concept repository exists on GitHub (SilviaMun/vulnerability-research), though current EPSS exploitation probability is low at 0.24% (15th percentile), consistent with a niche embedded device with limited deployment footprint.
Command injection in MBS-Solutions X-Serie Gateway firmware V6_00_05 enables an authenticated low-privileged Standard-role user to execute arbitrary OS commands as root by exploiting the ugw-restart method in /cgi-bin/wwwugw.cgi. Unsanitized user input is passed directly to the dpcheck system utility, which runs with root privileges, yielding full device compromise from a minimal trust level. Publicly available exploit code exists via a GitHub proof-of-concept repository; EPSS is low (0.24%, 15th percentile), consistent with a niche product, though the public PoC substantially lowers the barrier for targeted attacks.
Authenticated remote code execution in seacms v13.6 allows a low-privileged attacker to execute arbitrary OS commands by sending a crafted POST request to the admin_config.php component, exploiting a CWE-78 OS command injection flaw. The vulnerability achieves full system compromise (C:H/I:H/A:H) over the network with no user interaction required beyond authentication. No public exploit has been identified at time of analysis and EPSS sits at 0.24% (15th percentile), indicating minimal observed exploitation pressure currently.
Session hijacking in the Canva Android App before version 2.376.0 arises from an unrestricted header-reflection flaw in a privileged WebView component. An attacker who can control an external origin loaded within that WebView receives sensitive HTTP headers - including session tokens - that the app fails to suppress, exposing the authenticated user's session and enabling full account takeover. No public exploit has been identified at time of analysis; the flaw is patched in v2.376.0 per the Canva trust advisory.
Integer underflow leading to heap-based buffer overflow in IBM i 7.3 through 7.6 allows a remote attacker with low-privilege authenticated access to corrupt memory, potentially achieving arbitrary code execution or full system compromise. IBM has released patches for all four affected major versions; no active exploitation is recorded in CISA KEV and EPSS sits at 0.20% (10th percentile), placing real-world exploitation probability low despite the high CVSS score. SSVC rates this non-automatable with partial technical impact, suggesting the authentication barrier and service specificity meaningfully constrain mass exploitation.
Arbitrary local file read in firecrawl-mcp-server 3.20.2 allows any caller of the firecrawl_parse MCP tool to extract sensitive host files - including credentials, SSH keys, and environment variables - by supplying absolute paths or directory traversal sequences as the unconstrained filePath argument. Retrieved file contents are uploaded and injected directly into the AI model's context window, making this both a direct exfiltration risk and a prompt-injection amplifier. No CISA KEV listing or public exploit code has been identified at time of analysis, but the attack mechanics are trivially reproducible from the GitHub issue report and the CVSS 4.0 score of 8.7 makes this an urgent remediation target.
Privilege escalation on MBS-Solutions X-Serie Gateway firmware V6_00_05 allows an authenticated low-privileged service user to gain full root access on the device. The firmware grants passwordless sudo execution of /usr/bin/tcpdump as root; by supplying the -z post-rotate flag, the attacker triggers execution of an arbitrary command with root privileges, achieving complete system compromise. A public proof-of-concept is available via the researcher's GitHub repository; no CISA KEV listing has been identified at time of analysis.
SQL injection in Apache Griffin's Hive Metastore Module exposes all versions of this retired data quality platform to authenticated network exploitation. Low-privileged users can inject arbitrary SQL into Hive Metastore queries, achieving full confidentiality, integrity, and availability compromise of the underlying metadata store. Critically, the Apache Software Foundation has officially retired this project and will not release a patch, leaving deployments permanently unmitigated at the software level.
SQL injection in DreamMaker by Interinfo allows low-privileged authenticated remote attackers to inject arbitrary SQL commands, granting full read, modify, and delete access to the underlying database. Disclosed via TWCERT with a CVSS 4.0 score of 8.7, the flaw affects all known versions per the wildcard CPE. No public exploit code or CISA KEV listing has been identified at time of analysis.
Server-side request forgery in Douyin_TikTok_Download_API through version 4.1.2 exposes internal network resources and cloud instance credentials to unauthenticated remote attackers. The /api/download and /api/hybrid/video_data endpoints accept a user-supplied url query parameter without validation, allowing any caller to instruct the server to fetch arbitrary URLs - including cloud metadata services (e.g., AWS IMDSv1 at 169.254.169.254) - and read back full response bodies or error messages containing sensitive credentials. No vendor-released patch has been identified at time of analysis, and the GitHub issue tracker confirms the disclosure is public.
Remote code execution in Grav CMS (versions ≤2.0.17) lets authenticated users holding only page-write rights achieve arbitrary PHP execution on the web server by exploiting a Twig sandbox bypass in the |sort filter. The sortFunc wrapper in GravExtension.php incorrectly hardcodes isSandboxed=false-unlike |map, |filter, and |reduce-allowing |sort to resolve plain PHP callable names including spl_autoload, which is absent from the function denylist and performs a PHP include operation. A content editor can deliver a crafted payload through mechanisms such as form frontmatter rendered by the Email plugin, resulting in code execution as the web server user. A vendor-released patch is available in version 2.0.19, and no active exploitation appears in CISA KEV at time of analysis.
Insecure Direct Object Reference (IDOR) in Blinko 1.8.7 allows any authenticated user to read, modify, and delete AI chat history belonging to other accounts by supplying arbitrary sequential integer IDs to five tRPC API procedures. The affected endpoints - message.list, message.update, message.delete, message.clearAfter, and conversation.clearMessages - enforce authentication but perform no ownership verification against the caller's identity before querying the database. Version 1.8.8 appears to resolve the issue based on GitHub references pointing to corrected source files; no public exploit code has been identified at time of analysis.
Path traversal in Google Cloud Agent Development Kit (ADK) Python versions 1.9.0 through 1.21.0 exposes arbitrary server files to unauthenticated remote attackers via a crafted `file_path` query parameter on the builder endpoint. The root cause, confirmed by the upstream commit diff, is that `fast_api.py` passed the user-supplied path directly into filesystem operations without sanitization or boundary enforcement, allowing `../` sequences to escape the agents directory. No public exploit code or active exploitation has been identified; vendor-released fix is available in v1.22.0.
Server-side request forgery in OGX's (formerly Llama Stack) OpenAI-compatible POST /v1/responses endpoint allows remote unauthenticated attackers to force the server to open connections to arbitrary internal addresses, including cloud instance metadata services at 169.254.169.254, and relay attacker-controlled headers and bearer tokens to those destinations. MCP tool definitions accept a server_url parameter that is fetched server-side without applying the existing validate_url_not_private() guard that protects other URL inputs. On OGX's default starter configuration - which runs without any authentication - exploitation requires only a crafted HTTP request, exposing cloud credentials and internal network topology to any remote attacker. No public exploit has been identified at time of analysis.
Arbitrary command execution in goose v1.37.0 allows an attacker to embed shell commands inside recipe stdio extension definitions and retry.check fields that are silently executed under the victim user's OS privileges. The built-in recipe security scanner does not inspect these fields, providing a false safety guarantee and a clear bypass path. No public exploit is identified at time of analysis, but exploitation is low-complexity once a target user loads a malicious recipe.
Authenticated remote code execution in OpenPanel before 2.3.0 allows any project member with read access to escape the mathjs formula sandbox by traversing matrix object prototypes to recover the native JavaScript Function constructor. Once recovered, the constructor enables loading Node.js core modules such as child_process, granting full OS command execution with the privileges of the API process. The vulnerability crosses organization authorization boundaries, meaning a low-privileged member of one project can pivot to affect all organizations co-hosted on the same OpenPanel instance. No public exploit has been identified at time of analysis.
SQL injection in ILIAS e-learning platform versions before 9.22, 10.10, and 11.3 allows authenticated users holding write permission on any repository container to achieve full database compromise and administrator account takeover. The repository trash table's sort parameter is passed unsanitized into an ORDER BY clause, and because the ILIAS database layer has multi-statement execution enabled, stacked queries permit arbitrary DML and DDL - not merely data enumeration. Patch versions are available from the vendor; no public exploit code or CISA KEV listing has been identified at time of analysis.
Unbounded memory consumption in SiYuan's request-concurrency middleware allows unauthenticated remote attackers to permanently exhaust process memory by flooding the application with unique request paths. The root cause is a mutex-entry map that grows without bound - each distinct URL path creates a new mutex entry that is never evicted, causing memory and synchronization overhead to accumulate indefinitely. All SiYuan deployments prior to v3.8.2 are affected; no public exploit or CISA KEV listing has been identified at time of analysis.
Memory exhaustion in Chroma 1.5.9 allows unauthenticated remote attackers to crash the vector database server by supplying arbitrarily large HNSW index parameter values (max_neighbors, ef_construction, ef_search) in collection-create requests. Because no upper-bound validation exists in the Rust-based HNSW configuration layer, the server allocates memory proportional to attacker-supplied values during index compaction, causing denial of service. No public exploit code or active exploitation has been identified at time of analysis, but the zero-complexity unauthenticated network path makes this a straightforward availability risk for any internet-facing Chroma deployment.
Unauthenticated cross-tenant document disclosure in QAnything 2.0.0 allows any network attacker to retrieve base64-encoded files or parsed document chunks from any knowledge base without credentials or ownership verification. The /api/local_doc_qa/get_file_base64 and /api/local_doc_qa/get_doc endpoints lack authentication guards entirely (CWE-306), and file identifiers can be enumerated via separate unauthenticated endpoints, making full corpus extraction feasible. No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack requires no technical sophistication.
Sandbox method allow-list bypass in Twig versions 1.0.0 through 3.26.x allows untrusted template authors to invoke any public method on Twig\Markup subclass objects, completely circumventing the application-configured SecurityPolicy allowedMethods list. The root cause is that SecurityPolicy::checkMethodAllowed() unconditionally skips policy enforcement for any object that is an instance of Twig\Markup - and because the class is not declared final, subclasses inherit the bypass. Applications using Twig's sandbox mode that pass Markup-derived objects into sandboxed templates (a common pattern for marking HTML as safe) inadvertently expose the full public API of those subclasses to potentially untrusted template authors. Vendor-released patch: 3.27.0. No public exploit identified at time of analysis.
Unauthenticated SSRF in MegaParse 0.0.55 allows any remote attacker to make the server issue arbitrary HTTP requests by supplying attacker-controlled URLs to the POST /v1/url endpoint, with full responses returned in the JSON reply. Because no authentication is required and the endpoint fetches URLs server-side without restriction, attackers can pivot to cloud provider metadata services (e.g., AWS IMDSv1 at 169.254.169.254), internal APIs, and other non-routable services that are reachable from the MegaParse host. No public exploit or CISA KEV listing has been identified at time of analysis, though the attack surface is trivially exploitable against any internet-exposed deployment.
Decompression bomb handling in Amazon ion-java before version 1.12.1 allows remote unauthenticated attackers to cause denial of service by submitting crafted GZIP-compressed Ion documents that expand to arbitrarily large sizes during automatic decompression. The vulnerability is a bypass of the incomplete fix for CVE-2026-75936, which introduced a GZIP auto-decompression opt-out that did not cover all decompression paths in the library. No public exploit has been identified at time of analysis, but the straightforward nature of decompression bomb construction makes the attack practically accessible to any attacker who can submit Ion data to a vulnerable application.
Memory exhaustion denial-of-service in SiYuan's publish-service Basic Auth throttle allows unauthenticated remote attackers to crash or degrade the service by submitting authentication requests with an unbounded number of unique invalid usernames. Because the throttle tracks per-username failure state in memory with no capacity limit or eviction policy, the in-memory tracking structure grows without bound until the process exhausts available heap. All SiYuan versions prior to v3.8.2 are affected; no active exploitation has been identified at time of analysis.
Unauthenticated remote memory exhaustion in SiYuan before v3.8.2 allows any network-reachable attacker to degrade or crash the service by flooding the /api/system/uiproc endpoint with unique process identifiers. The endpoint retains each submitted identifier in memory without size bounds, rate limiting, or authentication checks, making the attack trivially automatable. No public exploit code or KEV status is confirmed at time of analysis, but the simplicity of exploitation via repeated HTTP requests requires no special tooling.
Server-side request forgery in jina-ai reader allows unauthenticated remote attackers to probe internal network infrastructure and cloud metadata services by exploiting a redirect-validation gap in the URL fetching pipeline. The service validates URLs on initial submission but fails to re-validate the destination after HTTP redirects, enabling attackers to pivot from an attacker-controlled public URL to cloud instance metadata endpoints (e.g., AWS IMDS at 169.254.169.254) or RFC-1918 internal addresses, with the response body returned to the attacker. No public exploit code has been independently confirmed at time of analysis, though a VulnCheck advisory and a public GitHub issue (jina-ai/reader#1252) detail the flaw.
Unauthenticated arbitrary file read in the surya 0.22.1 screenshot server allows any network-reachable attacker to exfiltrate image and PDF files from the host filesystem by supplying attacker-controlled paths to three unprotected HTTP routes. The /info, /page, and /process endpoints pass raw file_path parameters directly to Pillow's Image.open and pypdfium2.PdfDocument, returning rendered file contents as base64-encoded HTTP responses. The /info route additionally acts as a file-existence oracle, enabling systematic enumeration of host paths before targeted exfiltration; no public exploit has been identified at time of analysis.