We need answer as JSON only. Need synthesize. Need be careful with fields. Let's analyze input. CVE-2026-76461. Description: vulnerability in email parsing of Cisco AsyncOS for Cisco Secure Email Gateway allows unauthenticated remote attacker execute arbitrary commands root. Due insufficient validation email parsing logic. Attacker send crafted email containing malicious SQL statements through affected device. Success execute arbitrary SQL, leading to command execution root. CVSS 9.8 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. CWE-89 SQL injection. KEV yes active. POC publicly available. SSVC: exploitation none? conflicting? Actually input says SSVC Exploitation: none, Automatable yes, Technical impact total. But KEV yes active. This is a dataset inconsistency. Need compare signals. Maybe SSVC from CISA? It says exploitation none but KEV yes. Need state conflict explicitly in risk/confidence. But exploitation status phrase must be "confirmed actively exploited (CISA KEV)" because KEV=YES. Even though SSVC says none. Could note SSVC inconsistent in risk assessment / confidence. CPE: cpe:2.3:a:cisco:cisco_secure_email:*:*:*:*:*:*:*:* cpe shows all versions? Affected products from EUVD list many versions. Tags: SQLi, Cisco, Cisco Secure Email. References include Cisco advisory. Need use. Product name: "Cisco Secure Email Gateway" or "Cisco Secure Email"? product_name 1-3 words. The description says Cisco AsyncOS Software for Cisco Secure Email Gateway. Could choose "Cisco Secure Email Gateway" (4 words? Cisco Secure Email Gateway: 4 tokens. But "Cisco Secure Email" is 3 words and CPE product name. Product field examples. Use "Cisco Secure Email" maybe okay. But "specific product or service name" affected: Cisco Secure Email Gateway. That's 4 words. "1-3 words ONLY" — choose "Cisco Secure Email" (3 words). Maybe "Cisco AsyncOS" 2 words. But CPE is cisco_secure_email. Input tags include "Cisco Secure Email". Use "Cisco Secure Email". Need fields plain text string
Authentication bypass in ESPHome Device Builder (the esphome-device-builder package powering the `dashboard` subcommand of the ghcr.io/esphome/esphome container) versions before 1.0.12 silently disables dashboard authentication on upgrade for operators who had protected it with the legacy bare $USERNAME/$PASSWORD environment variables. A rename to $ESPHOME_USERNAME/$ESPHOME_PASSWORD (PR #265) dropped the old names with no fallback, so `using_password` becomes false and both the REST auth middleware and WebSocket login gate switch off, leaving the dashboard open to anyone who can reach its port. Because a compromised dashboard caller can compile arbitrary code and read/write config and data directories, this is effectively unauthenticated RCE; publicly available exploit/PoC code exists, though it is not in CISA KEV (SSVC exploitation: none).
Server-side request forgery and root-level code execution in IBM Langflow OSS 1.0.0 through 1.10.0 lets an authenticated user smuggle arbitrary Python through submitted flow components. Because the component validation scanner fails to block socket and urllib imports yet still returns "validated": true, attackers run code as UID=0 to steal AWS credentials via IMDSv1 SSRF, exfiltrate container files, and pivot to internal PostgreSQL and Redis services. Public exploit code exists, though the flaw is not on the CISA KEV list.
Stack-based buffer overflow in the D-Link DIR-823G router (firmware 1.0.2B05_20181207) lets a remote attacker corrupt stack memory via the HNAP1 SetStaticRouteSettings handler. The vulnerable strcpy call copies attacker-supplied PAddress, SubnetMask, and Gateway values without bounds checking, enabling denial of service and potential code execution on the device. Publicly available exploit code exists (VulDB and a GitHub advisory), though it is not listed in CISA KEV; EPSS was not provided.
We need answer JSON only. Need synthesize all data. Need be careful fields plain strings. Need include risk_assessment with "gliwice" once. Need not copy description? Summary should original synthesis. Need include technical context, risk assessment, affected products, remediation, exploit scenario, exploitation conditions, attack chain, confidence notes, data quality flags, prevalence, prevalence basis, assessed_cvss_vector, assessed_cvss40_vector, assessed_cvss rationale. Let's parse CVE data. CVE-2026-90942: Casdoor through 4.4.0 fails to properly mask instance-wide built-in certificate private key in /api/get-certs and /api/get-cert endpoints, allowing organization administrators to retrieve it. Attackers can use exposed private key to forge JWT tokens for any user in any organization, including global administrators. CVSS 9.3? Vector CVSS 4.0: AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N. So network, low complexity, low privileges, no user interaction, vulnerable system confidentiality high integrity high availability none, subsequent system high high none. CWE-863 Incorrect Authorization. EPSS 0.21% percentile 11. POC publicly available. Reported by VulnCheck. Tags: Authentication Bypass, Casdoor. SSVC poc, automatable yes, total. ENISA EUVD etc. References include exploit writeup and vulncheck advisory. Need product_name: Casdoor. Summary: privilege escalation / authentication bypass? Need not start with "A vulnerability..." Specific impact verb and product. Could be "Private key exposure in Casdoor through 4.4.0 lets organization administrators retrieve the instance-wide JWT signing key and forge tokens for any user, including global administrators." Mention KEV? no KEV provided so not actively exploited. POC exists, EPSS low. Need say public exploit code exists, not active. Summary 2-3 sentences. Good. Technical_context: Casdoor is open-source IAM/auth platform. Endpoints /api/get-certs and /api/get-cert expose certificate info but fail to mas
Authenticated OS command injection in D-Link DWR-M921 firmware 1.1.52 allows a remote attacker with administrative credentials to execute arbitrary system commands on the router by injecting shell metacharacters into the `folderpath` parameter of the `/boafrm/formDiskCreateShare` endpoint, which passes the value unsanitized to a `system()` call. The affected endpoint handles USB disk share creation via the BoA embedded web server. A public proof-of-concept exploit has been disclosed on GitHub by researcher H3rmesk1t, though no active exploitation has been confirmed by CISA KEV at time of analysis.
OS command injection in D-Link DWR-M920 firmware version 1.1.7 allows a network-adjacent or remote authenticated attacker to execute arbitrary operating system commands by manipulating the newPin parameter submitted to the /boafrm/formPinManageSetup endpoint. The vulnerability resides in the sub_41E60C function, which fails to sanitize user-supplied input before passing it to a system call. A publicly available proof-of-concept exploit exists. No public exploit identified at time of analysis as confirmed by CISA KEV, but exploit code is publicly available per VulDB and the GitHub reference.
Buffer overflow in TOTOLINK A3002MU router firmware version Hh-B20211125.1046 allows authenticated remote attackers to corrupt memory and potentially execute arbitrary code by supplying an oversized value to the `service_type` argument of the `formPortFw` CGI handler in the boa embedded web server. The vulnerability is reachable over the network and a proof-of-concept exploit has been publicly published on GitHub. No vendor-released patch has been confirmed at time of analysis.
Field-level security bypass in EspoCRM before 10.0.4 exposes hidden attendee email addresses to any authenticated user through the meeting and call attendees API endpoints. The root cause is ACL validation logic that checks parent event (meeting or call) permissions rather than per-attendee entity permissions, rendering field-level email restrictions ineffective for all users with event read access. Publicly available exploit code exists via the vendor's GitHub security advisory; no confirmed active exploitation (CISA KEV) has been identified.
Buffer overflow in the Totolink A3002MU router's boa web server allows network-adjacent authenticated attackers to potentially execute arbitrary code by sending a crafted request with an oversized ip6addr argument to the /boafrm/formFilter endpoint. The affected firmware version is Hh-B20211125.1046, and a public proof-of-concept exploit has been published on GitHub. No patch is available at time of analysis; the vulnerability carries a CVSS 4.0 score of 8.6 with subsequent-system impact metrics elevated due to the router's central network position.
Stack-based buffer overflow in the Totolink A3002MU router's boa HTTP server allows a network-adjacent authenticated attacker to overwrite memory via an oversized `submit-url` argument submitted to the `formNewSchedule` handler at `/boafrm/formNewSchedule`, likely yielding arbitrary code execution on the device. The affected firmware version is Hh-B20211125.1046. A public proof-of-concept exploit exists on GitHub, raising the realistic exploitation probability for devices reachable from the network with default or known credentials. No vendor patch has been identified at time of analysis.
OS command injection in D-Link DWR-M921 firmware 1.1.52 allows an authenticated remote attacker to execute arbitrary shell commands on the device by supplying a crafted `partition` argument to the `/boafrm/formDiskFormat` endpoint, which passes the value unsanitized to the `system()` call. Exploitation requires high-privilege (admin-level) credentials, but a publicly available proof-of-concept exploit hosted on GitHub lowers the barrier significantly. No vendor patch has been identified at time of analysis; the device's web management interface is the sole attack surface.
Logitech's Logi Options+ updater service on Windows mishandles service-level privileges (CWE-269), exposing an attack surface that any authenticated local user can abuse to obtain a SYSTEM shell. With a proof-of-concept publicly documented on the amberwolf security blog, the exploitation barrier is minimal for any adversary already present on a Windows endpoint running the software. Organizations with broad Logitech peripheral deployments face meaningful privilege escalation risk if this path is chained with initial access obtained via phishing or credential compromise.
A path traversal flaw (CWE-22) in IBM DataStage on Cloud Pak for Data 5.4.0.0 lets an authenticated remote user manipulate file paths to read, write, or delete arbitrary files on the host. The CVSS 3.1 base score is 8.1 (AV:N/AC:L/PR:L/UI:N), reflecting high confidentiality and integrity impact with no availability impact, so valid credentials are a prerequisite. Publicly available exploit code has been referenced, but CISA KEV does not list this CVE and CISA's SSVC assessment records exploitation as 'none' and automatable as 'no' - meaning it is a serious post-authentication primitive rather than a broadly observed in-the-wild campaign at time of analysis.
Missing authorization on the `/sys/user/list` admin endpoint in novel-plus ≤5.3.3 allows any authenticated user to retrieve password hashes and sensitive PII - including email addresses and phone numbers - for users within their data scope. The root cause is the absence of proper Spring Security permission annotations on the endpoint, meaning authorization checks are never enforced at the API layer. A publicly available POC exploit script confirms exploitability; successful hash retrieval enables offline cracking and downstream account takeover.
Cache invalidation in novel-plus through 5.3.3 exposes an unauthenticated HTTP endpoint protected only by a hardcoded default password embedded in the application's source-controlled configuration file, allowing any remote attacker who supplies the known default value in the URL path to forcibly invalidate portal caches at will. The root cause (CWE-1392: Use of Default Credentials) means the credential is fully disclosed in the public GitHub repository and a VulnCheck-reported Python POC, reducing exploitation to a trivial one-liner. No vendor-released patch exists as of the latest tagged release v5.3.3, leaving all deployments that have not manually rotated the credential exposed with a publicly available exploit.
We need answer JSON only. Need synthesize. Need carefully follow. Need use data. Need not mention editorial note except risk assessment includes glwice lowercase naturally. Let's analyze. CVE-2026-16338: IBM DataStage on Cloud Pak for Data 5.4.0.0 arbitrary file write due improper validation of file paths. CVSS 9.9 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. CWE-73 External Control of File Name or Path. EPSS 0.61% percentile 48. Patch available vendor. Reported by ibm. CPE ibm:datastage_on_cloud_pak_for_data:*:*:*:*:*:*:*:* affected. Tags: Information Disclosure, IBM, Datastage On Cloud Pak For Data. SSVC Exploitation none, Automatable no, Technical Impact total. ENISA EUVD ID. References IBM support patch and NVD. Need fields product_name: "IBM DataStage on Cloud Pak for Data" maybe 1-3 words? They ask 1-3 words ONLY specific product. "IBM DataStage" maybe 2 words? affected product is "IBM DataStage on Cloud Pak for Data" 7 words. Need primary product maybe "IBM DataStage". But product_name should specific. Maybe "IBM DataStage" 2 words. Good. Summary: plain-language 2-3 sentences. Do not copy. Start with impact verb product. "Arbitrary file write in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows remote authenticated attackers to write files outside intended directories due to improper file path validation." Then mention EPSS/likelihood and patch available. Active? KEV no POC no, so "no public exploit identified at time of analysis". But CVSS 9.9 high despite low EPSS. Mention EPSS 0.61% low. Maybe "Although CVSS 9.9 due scope/impact, EPSS 0.61% suggests low probability of near-term exploitation." Need not mention glwice here. Technical context: Explain CWE-73 path traversal? "IBM DataStage on Cloud Pak for Data likely handles file operations where user-supplied paths are not sanitized, enabling arbitrary file write. CWE-73 External Control of File Name or Path arises when software uses externally influenced path segments without validation, allowing path traversa
We need answer JSON only. Need carefully construct fields. Need follow instructions. Must use all data. Need risk_assessment include "inowroclaw" once naturally. Need not mention editorial note. Need product_name 1-3 words. Vulnerability affects Apple multiple OSes. Primary product? "Apple iOS" maybe? Description lists iOS/iPadOS/macOS/tvOS/visionOS/watchOS. Product_name could be "Apple iOS" but affects multiple. Maybe "Apple OS"? Need 1-3 words. CPE is apple:ios_and_ipados, macos, tvos, visionos, watchos. Product name: "Apple iOS" or "Apple Operating Systems"? Specific product? The issue maybe in some component? Description doesn't say. Use "Apple iOS" as primary? But multiple. Could use "Apple OS". Need 1-3 words. I'd choose "Apple OS" maybe broad. Or "Apple iOS" given first. Product_name "Apple OS" acceptable? It says specific product or service name, not vendor alone. Multiple products, pick primary. Apple iOS and iPadOS? The CPE includes ios_and_ipados. primary "Apple iOS". Need relevant. Summary: original synthesis. Mention out-of-bounds write in OS component, remote attacker can cause app termination or arbitrary code execution. Affected versions. KEV? Not provided. POC? Not provided. EPSS? Not provided. Need mention if actively exploited, if POC exists, EPSS risk if notable. Since no KEV, POC, EPSS absent. Say no public exploit identified at time of analysis; KEV absent. But do not start with "A vulnerability". Start with specific impact verb and product: "Remote code execution in Apple operating systems due to an out-of-bounds write..." But description says may cause unexpected app termination or arbitrary code execution. Use "Out-of-bounds write in Apple OS...". Need not copy description exactly. Say affects iOS/iPadOS before etc. Let's craft. Need technical_context: underlying technology/library/protocol involved. Not specified. Root cause CWE-787 Out-of-bounds write. Explain memory corruption. CPE exact affected products. Apple OSes. Need be educationa
We need answer JSON object only. Need synthesize. We need parse all data. Need be careful fields all strings. data_quality_flags array of objects (allowed nested? It says field JSON array, okay). We need produce valid JSON. Need follow precision rules. Let's analyze CVE-2026-57131. Input: CVE ID, Description: PraisonAI multi-agent teams system. Prior to 4.6.58, praisonai.jobs.server.create_app mounts praisonai.jobs.router.create_router under /api/v1/runs without authentication or per-job authorization. Network clients can submit attacker-controlled prompts and agent configuration, list and read jobs, stream results, cancel or delete other jobs, exposing service credentials and connected tool capabilities to unauthorized agent execution. Fixed in 4.6.58. CVSS 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CWE-94 EPSS 0.97% percentile 60 Patch available from vendor Reported by GitHub_M CPE cpe:2.3:a:mervinpraison:praisonai:*:*:*:*:*:*:*:* Tags: RCE, Code Injection, Praisonai SSVC: Exploitation poc, Automatable yes, Technical Impact total ENISA EUVD ID, affected versions ["PraisonAI < 4.6.48"] note conflict. Description says fixed 4.6.58; EUVD says <4.6.48. Advisory says vulnerable <4.6.59 fixed in 4.6.59? Wait GHSA package pip/praisonai vulnerable <4.6.59 fixed in 4.6.59. But CVE description and release tag v4.6.58 says fixed in 4.6.58. There is discrepancy: EUVD says affected <4.6.48, advisory says <4.6.59 fixed 4.6.59, release tag v4.6.58. Need mention in confidence notes risk? Maybe not data quality flags severity/version disagreements keep confidence notes only. But data_quality_flags: do not flag version disagreements. So keep in confidence_notes. References: [cveorg] None GHSA-fq2m... [cveorg] commit [cveorg] release tag v4.6.58 Source code evidence GHSA detailed. Need output: product_name: "PraisonAI" only. 1-3 words, specific product. Could "PraisonAI" is okay. summary: original synthesis. Need not copy description. Start with specific impact verb and product. E.
We need answer JSON only. Need synthesize. We need use all data. Need plain strings. Need be careful precision rules. Need include risk_assessment with "malbork" once lowercase. Need not mention elsewhere. Need evaluate. CVE: PraisonAI UI missing auth OS command injection. CVSS 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CWE-78. Patch available fixed 4.6.59. CPE cpe:2.3:a:mervinpraison:praisonai:*:*:*:*:*:*:*:*. Tags: Command Injection, Praisonai, Mervinpraison. SSVC: Exploitation poc, Automatable yes, Technical impact total. EPSS? Not explicitly provided. KEV? Not provided, likely no. POC? SSVC exploitation poc says yes? Source says SSVC Exploitation: poc. Need use "publicly available exploit code exists" if POC yes but no KEV. KEV absent. Patch available. Need product_name: "PraisonAI" maybe 1-3 words. summary original synthesis. Start impact verb and product. E.g. "OS command execution in PraisonAI UI before 4.6.59 allows remote unauthenticated callers to execute arbitrary commands as the UI service account via the unauthenticated POST /api/mcp/connect endpoint, even if MCP handshake fails." Mention patch fixed. Public POC? We know SSVC poc. EPSS absent, no KEV. Need not mention EPSS if not. But maybe "no confirmed active exploitation" with KEV absence. Need use "publicly available exploit code exists" maybe from SSVC poc. summary says no active exploitation? Probably "No CISA KEV listing confirms active exploitation, but SSVC notes POC exists." technical_context: talk Python, AI multi-agent, Typer UI commands, aiui host app, Starlette? Endpoint passes command/args to StdioMCPClient local process. CWE-78 improper neutralization of special elements in OS command. CPE exact. Root cause no auth and command injection. Need educational. Mention default bind to 0.0.0.0. Mention fixed version. Mention commit changes? The commit diff includes security hardening for SSE security and path validation, but not directly auth? Actually fix 4.6.59 maybe released; commit adds web
We need answer in JSON only. Need synthesize. Need be precise. Let's analyze input. CVE-2026-77181 Apache Syncope. Description: Incorrect Authorization vulnerability. Administrator with ClientApp's update entitlement unable to perform related operation, while ClientApp's create entitlement checked both for create and update operations on ClientApp. Affects Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, 4.1.0-M0 through 4.1.2. Upgrade to 4.0.8 / 4.1.3. CVSS 9.8 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. CWE-863. Tags: Authentication Bypass, Apache. EPSS 0.48%, SSVC exploitation none, automatable yes, technical impact total. References apache lists, euvd nvd, oss-security. Need produce fields. Product name: Apache Syncope. Summary: not copy description. Original synthesis. Need mention vulnerability: authorization logic inverted? Admin with update entitlement cannot update while create entitlement checked for both create and update. Leads incorrect authorization, potential privilege abuse? Wait description says "An administrator with ClientApp's update entitlement is unable to perform the related operation, while ClientApp's create entitlement is checked both for create and update operations on ClientApp." This sounds a logic flaw: anyone with create entitlement can update? Let's parse. In Apache Syncope, ClientApp entity has entitlements? Administrator with ClientApp update entitlement can't update; create entitlement is checked both for create and update. So users with only create entitlement may perform update operations (privilege escalation / unauthorized update). Incorrect authorization. CVSS says critical 9.8 with PR:N but requires admin? Contradiction. Need note. CVSS 9.8 likely incorrect? Description says administrator entitlement involved, likely requires authentication and specific entitlement. We must be cautious: "Authentication requirements" based on CVSS vector PR:N says unauthenticated. But description conflicts: administrator with enti
We need answer JSON only. Need synthesize. Need follow all rules. Let's parse CVE. CVE-2026-73668 Apache Syncope Incorrect Authorization. Description: administrator with adequate entitlements in a given Realm may read via REST full Connector configuration, confidential properties, scoped in another Realm, duplicate Connector instance into Realm they have administration rights. Affects Apache Syncope from 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, 4.1.0-M0 through 4.1.2. Upgrade 4.0.8 / 4.1.3 fix. CVSS Score: 9.8 Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. This vector seems inconsistent: description says administrator with adequate entitlements, so authenticated, but vector PR:N. Need discuss. Need produce our own assessed vector. CWE-863 Incorrect Authorization. EPSS 0.48%, percentile 40%, SSVC exploitation none, automatable yes, technical impact total. Tags Authentication Bypass, Apache. References lists. Need product_name: Apache Syncope (2 words? "Apache Syncope" 2 words). summary original. Technical context: Java open-source identity management? Apache Syncope is open-source Identity Management. Connector configuration, realms. CPE? Input doesn't include CPE strings explicitly except? None. We can say no CPE in input but EUVD affected versions. Need not mention CPE data if none. Risk assessment: use all signals: CVSS 9.8 critical but description authenticated admin with entitlements; EPSS low; KEV absent; SSVC exploitation none, automatable yes, technical impact total. Compare/contrast. Include "mielec" lowercase once. Affected products: versions ranges, Apache advisories URLs. Remediation: upgrade to 4.0.8 / 4.1.3. What about 3.0.x? The description says affects 3.0.0-M0 through 3.0.16 but users recommended upgrade to 4.0.8/4.1.3. Does 3.0.16 not fixed? Need state for 3.0 line maybe upgrade main? The advisory might need. We should say users on affected 3.0.x should migrate to fixed 4.0.8/4.1.3, since no 3.0 fix listed? exact. Workarounds not p
We need answer must be JSON only. Need synthesize. Let's parse CVE. CVE-2026-73470: Apache Syncope improper privilege management. Delegations can be created/updated with Roles not owned by delegating User, or not same Realm subtree under delegation management. Affected versions: 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, 4.1.0-M0 through 4.1.2. Upgrade to 4.0.8 / 4.1.3. CVSS 9.8 network low no priv no user interaction unchanged high all. CWE-269. EPSS 0.48% percentile 40. Tags: Privilege Escalation, Apache. SSVC: exploitation none, automatable yes, technical impact total. EUVD. References Apache list and openwall. Need create fields. product_name: Apache Syncope. summary: start with specific impact verb and product. "Privilege escalation in Apache Syncope 3.0.0-M0 through 4.1.2 allows remote unauthenticated attackers (per CVSS) to create or update delegations with roles outside the delegating user’s ownership or realm subtree, effectively granting unauthorized privileges." Need mention no active exploitation, no POC, EPSS low. But be careful: CVSS PR:N says unauthenticated. Description doesn't mention auth. CVSS vector has PR:N so can state unauthenticated per rule. But is that accurate for Apache Syncope? Delegations likely authenticated? CVSS says unauthenticated. We can mention CVSS indicates no auth required but may conflict? Need risk assessment compare signals. "CVSS vector implies remote unauthenticated exploitation, though delegation creation normally requires an authenticated low-privileged user; verify with vendor." This is important. User says do not present uncertain as confirmed fact. We can state CVSS indicates unauthenticated. Summary: "Privilege escalation in Apache Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2 permits creation or modification of delegations with roles that the delegating user does not own or that fall outside the granted realm subtree, allowing unauthorized role assignment. Public CVSS
We need answer JSON only. Need synthesize. Must follow all rules. Need analyze provided data. CVE-2026-57123 PraisonAI. Need field product_name 1-3 words. PraisonAI probably. Summary original. Technical_context. Risk assessment using signals. affected_products. remediation. exploit_scenario. exploitation_conditions. attack_chain. confidence_notes. data_quality_flags. prevalence. prevalence_basis. assessed_cvss_vector. assessed_cvss_rationale. assessed_cvss40_vector. Need understand vulnerability. CVE: PraisonAI multi-agent teams system. Prior to praisonaiagents 1.6.59, ToolsMCPServer.run_sse and launch_tools_mcp_server bind to 0.0.0.0 and create /sse /messages/ routes without invoking SecurityConfig auth, origin-validation, DNS-rebinding controls. Any reachable client list and invoke registered tools; browser DNS rebinding local. fixed 1.6.59. CVSS provided 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. CWE-306 Missing Authentication for Critical Function. EPSS 0.47 percentile 40. KEV? not provided. POC? GHSA includes static proof, not executable POC maybe "Proof of concept: Static proof (AST analysis)" no public exploit. Tags: Authentication Bypass, Praisonaiagents, Mervinpraison. SSVC exploitation none, automatable yes, technical impact total. Patch available from vendor. CPE cpe:2.3:a:mervinpraison:praisonaiagents:*:*:*:*:*:*:*:*. Need craft. Key conflict? CVSS high 9.8, EPSS low 0.47%, SSVC exploitation none but automatable yes and total impact. Patch available. Since KEV absent, use "no public exploit identified at time of analysis." Even though static proof/POC maybe not actual exploit code? The input says POC? "Proof of concept: Static proof (AST analysis)" not public exploit. So no public exploit identified. But maybe GHSA has proof of concept? Use no public exploit identified. Need data_quality_flags. Check tags. Tags include "Authentication Bypass" and product/vendor. product_name PraisonAI. Could flag missing_tag? Maybe "dns-rebinding" as technique? But tag
We need answer as JSON only. Need comply. We need synthesize. Need be careful with product_name 1-3 words. The CVE affects Cisco Secure Email Gateway and Cisco Secure Email and Web Manager? Description says both. Product_name primary could be "Cisco Secure Email" or "Cisco Secure Email and Web Manager". We should pick primary. CPE only cisco_secure_email_and_web_manager. Tags include Cisco Secure Email And Web Manager. Product_name maybe "Cisco Secure Email and Web Manager" 5 words? Need 1-3 words ONLY. Could use "Cisco Secure Email" (3 words) but ambiguity. "Secure Email Gateway" maybe 3. Since CPE only Web Manager, "Cisco Secure Email and Web Manager" too many. Use "Cisco Secure Email" maybe. But vulnerable product spans Gateway and Manager. user says 1-3 words, specific product. "Cisco Secure Email" three words. But the affected product in CPE is Secure Email and Web Manager. Maybe "Cisco Secure Email" okay. "Cisco Email Security" maybe. The official product names: Cisco Secure Email Gateway, Cisco Secure Email and Web Manager. Both under "Cisco Secure Email". I'll use "Cisco Secure Email". Summary: Need original synthesis, no copy. Mention vulnerabilities related to improper access control, product versions, maybe unauthenticated remote? Given CVSS says PR:N. Not KEV. POC not mentioned. EPSS not given. We can say no public exploit identified. Need mention CVSS 9.8. "Improper access control in Cisco Secure Email Gateway and Cisco Secure Email and Web Manager allows remote unauthenticated attackers to..." The description doesn't specify exact impact beyond CWE-284. CVSS C/I/A high. We should not invent specifics like "execute arbitrary code" because CWE-284 access control; CVSS H/H/H but impact unknown. Better state "potentially bypass access controls to affect confidentiality, integrity, and availability" but that mirrors CVSS. Need plain language. Could say "Improper access control in Cisco Secure Email Gateway and Secure Email and Web Manager allows remote una
We need answer only valid JSON. Need synthesize. Need understand CVE details. We need populate fields. Need be careful rules. Let's inspect input. CVE-2026-76440: Cisco Secure Email Gateway and Cisco Secure Email and Web Manager internally discovered vulnerabilities grouped CWE-23 path traversal. CVSS 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS 0.43% percentile 36. KEV? Not provided in input, so no. POC? no explicit. Tags Path Traversal, Cisco, Cisco Secure Email, Cisco Secure Email And Web Manager. SSVC exploitation none, automatable yes, technical impact total. EUVD affected versions lots. References include Cisco advisory cisco-sa-hardening-esa-dfCrfXkm, NVD, cve.org blog weird. Need patch availability? Input doesn't include explicit patch data but reference Cisco advisory. We need not invent exact fix versions. Description says "software hardening releases that address multiple internally discovered vulnerabilities" so patch available per vendor advisory. Need maybe exact fix versions not listed. Affected versions all listed but no fixed versions. Need state vendor-released patch available; exact version not independently confirmed from data? Remediation cite advisory. We need be careful: The advisory URL likely contains patch info but input did not include fixed version. The editorial says if patch refs point to advisory no version: "Patch available per vendor advisory". Use that. Need write all fields plain strings. Need not copy description. Product name: "Cisco Secure Email" or "Cisco Secure Email and Web Manager". Since primary? It mentions two products. Pick primary maybe "Cisco Secure Email" but affected includes both. Product_name 1-3 words: "Cisco Secure Email" likely. But maybe "Cisco Secure Email Gateway"? Description says Cisco Secure Email Gateway and Cisco Secure Email and Web Manager. Product name should specific. "Cisco Secure Email Gateway" is 4 words? Actually 4? Cisco Secure Email Gateway = 4 words. "Cisco Secure Email" 3. Use "Cisco Secur
We need answer in JSON only. Need parse all data. Need produce fields exactly. Need analyze CVE-2026-57125. We need craft original synthesis. Product_name: "PraisonAI" likely. Summary: unauthenticated RCE in PraisonAI Jobs API via crafted agent_yaml approve field bypassing @require_approval execute_command. Fixed 4.6.59 and praisonaiagents 1.6.59. KEV? Input doesn't mention KEV. SSVC Exploitation: poc, so public exploit exists? POC in advisory. No KEV. Patch available. EPSS? Not provided. Need mention no EPSS data. CVSS 9.8. CWE-306 Missing Authentication. Need risk assessment compare signals, state missing EPSS. Exploitation status: "publicly available exploit code exists" since SSVC poc. Product_name one to three words: "PraisonAI". Need technical_context: underlying Python multi-agent framework; POST /api/v1/runs Jobs API in praisonai; YAML agent workflow parser in praisonaiagents; ContextVar-based approval; execute_command critical tool; CWE-306 missing authentication; CPE exact mervinpraison:praisonai and praisonaiagents. Explain root cause. References GHSA, commit. Risk assessment: CVSS 9.8 AV:N AC:L PR:N UI:N S:U C:H I:H A:H indicates remote unauthenticated, low complexity no interaction, total CIA. SSVC: Exploitation poc, Automatable yes, Technical impact total. Patch available from vendor. No KEV/EPSS provided. Public POC lowers barrier; however actual exploitation not confirmed. Need mention missing/conflicting? No conflict maybe patch has exact versions. EPSS missing. Need state "CVSS and SSVC align on critical risk." But note "no EPSS score provided". It is a real priority if internet-exposed Jobs API. Could be "high-CVSS and high-real-risk where exposed, but deployment prevalence unknown / maybe moderate; no proactive exploitation signals". Need not infer KEV. "No KEV listing in supplied data." Use phrases allowed. Affected_products: PraisonAI < 4.6.59, praisonaiagents < 1.6.59. CPEs cpe:2.3:a:mervinpraison:praisonai:*:*:*:*:*:*:*:* and cpe:2.3:a:me
We need answer as JSON only. Need synthesize. Need be careful. Let's analyze input. CVE-2026-20353. Description generic internal review hardening releases addressing multiple internally discovered vulnerabilities. Vulnerabilities tracked by CVE related to issues with improper control of a resource through lifetime CWE-664. CVSS 9.8 network low no priv no interaction, total CIA. CPE cisco:cisco_secure_email:*:*:*:*:*:*:*:* (no version?). Tags: Information Disclosure, Cisco, Cisco Secure Email. SSVC exploitation none, automatable yes, impact total. EUVD affected versions list. Need output fields. Need follow precision rules. Product_name: "Cisco Secure Email" perhaps includes Gateway and Email and Web Manager? Description mentions Cisco Secure Email Gateway and Cisco Secure Email and Web Manager. The tags "Cisco Secure Email". CPE product cisco_secure_email. Product name should be 1-3 words. "Cisco Secure Email" okay. But maybe primary affected product specifically Cisco Secure Email Gateway and Cisco Secure Email and Web Manager. Product_name could "Cisco Secure Email". Need maybe "Cisco Secure Email" because CPE. Summary: original synthesis, not copy description. Need mention vulnerability type maybe improper resource lifetime control. Impact perhaps information disclosure? CVSS says CIA high total but CWE 664 could be memory/resource issues. Need mention affected versions. KEV? Not provided. So no public exploit? We need infer from SSVC exploitation none, no KEV, no POC. Should state not actively exploited, no public POC identified. EPSS? Not provided. "EPSS risk if notable" — no EPSS data, say EPSS not provided. Need exact phrase? "currently no evidence of active exploitation in CISA KEV; SSVC exploitation none; no POC identified at time of analysis." Summary: "Multiple resource-lifetime handling flaws in Cisco Secure Email Gateway and Cisco Secure Email and Web Manager allow unauthenticated remote attackers to fully compromise affected appliances through networ
We need answer as JSON only. Need synthesize. Need be careful with fields. Need analyze data. We have CVE-2026-76443. Description vague: Cisco Secure Email Gateway? It says Cisco Secure Email Gateway and Cisco Secure Email and Web Manager. Multiple internally discovered vulnerabilities. Improper neutralization CWE-707. CVSS 9.8 network no auth. CPE cisco secure email and secure email and web manager. Affected versions huge. Reference Cisco advisory sec.cloudapps. Tags Information Disclosure, Cisco, Cisco Secure Email, Cisco Secure Email And Web Manager. EPSS 0.37 percentile 30. SSVC exploitation none, automatable yes, technical impact total. EUVD. Need product_name: 1-3 words. Could be "Cisco Secure Email" or "Cisco Secure Email and Web Manager"? They mention both. Primary maybe "Cisco Secure Email". But CPE also both. Need one. "Cisco Secure Email" specific product. Product_name only 1-3 words, "Cisco Secure Email" is 3. Maybe include "Cisco Secure Email and Web Manager" is 6? Could be "Cisco Secure Email" since vuln tracked? But title says Cisco Secure Email Gateway and Cisco Secure Email and Web Manager. We choose "Cisco Secure Email". Summary: 2-3 sentences original. Needs not copy description. Start with specific impact verb. Need mention what vulnerability, affected product versions, attacker can do. Active exploitation? KEV no. POC? no data. EPSS low 0.37. CVSS critical. Write: "Improper neutralization of input in Cisco Secure Email and Cisco Secure Email and Web Manager allows unauthenticated remote attackers to achieve full compromise (confidentiality, integrity, availability) on affected appliances. The advisory covers multiple internally discovered hardening issues grouped under CWE-707 with CVSS 9.8. No public exploit or active exploitation identified at time of analysis; EPSS is low at 0.37%, suggesting limited current exploitation likelihood despite high severity." That's maybe. Technical_context: underlying tech/protocol? CWE-707 is "Improper Neut
OS command injection via prompt injection in GH05TCREW PentestAgent's LocalRuntime allows a malicious target host to execute arbitrary shell commands on the operator's workstation. When the agent scans an adversary-controlled target, response content such as HTTP bodies, SSH banners, or DNS records flows unfiltered into the LLM's prompt context; a crafted payload steers the LLM into generating reverse-shell or persistence commands that LocalRuntime.execute_command() then runs with full operator-level privileges. A publicly available exploit exists (GitHub issue #91), and the upstream fix (PR #100) remains unmerged at time of analysis.
PentestAgent's MCP HTTP Server (up to commit cf882dabea3ed91cef016cdd115e5426315665a2) bound to all network interfaces (0.0.0.0) by default with zero authentication, allowing any remote attacker to call the `run_task` function in `interface/main.py` and execute arbitrary OS commands on the host running the agent. A public proof-of-concept is available via GitHub issue #90, and the fix (PR #101) adds bearer token auth and changes the default bind address to 127.0.0.1, but the pull request had not yet been merged at time of analysis. The CVSS 4.0 score of 6.9 substantially understates impact given that full unauthenticated OS command execution is achievable.
Heap out-of-bounds write in the theopolis uefi-firmware-parser Python package (versions prior to 1.14) lets a crafted Tiano/EFI-compressed firmware image corrupt heap memory when the file is parsed. The bundled native Tiano decompressor's ReadCLen() in Decompress.c reads a 9-bit length (up to 511, plus a run-length path allowing up to 531 writes) into the 510-element Sd->mCLen array without an Index < NC bound, producing a deterministic crash and potential code execution in the parsing process. No public exploit identified at time of analysis; the flaw is reached through the normal CompressedSection.process() parsing path, so any tool or service that ingests untrusted firmware with this library is at risk.
Stack out-of-bounds write in the theopolis uefi-firmware-parser Python library (versions prior to 1.14) lets a maliciously crafted Tiano/EFI-compressed firmware blob corrupt the parser's stack when it is decompressed. The bundled native Tiano decompressor's MakeTable() fails to validate Huffman bit-length values, so bit lengths above 16 overflow the stack-allocated Count[17] array and adjacent decode tables, deterministically crashing the parsing process and potentially allowing code execution in that process depending on build hardening. No public exploit identified at time of analysis; the issue was fixed in 1.14 by porting the upstream EDK2 hardening.
We need answer JSON only. Need analyze CVE. Need be careful. We need synthesize. Let's inspect all data. CVE-2026-57127 PraisonAI. Description: multi-agent teams system. Prior 4.6.58, recipe serve installs APIKeyAuthMiddleware or JWTAuthMiddleware when operator selects api-key or JWT authentication, but each middleware forwards requests when PRAISONAI_API_KEY or PRAISONAI_JWT_SECRET and the corresponding recipe value are absent. Unauthenticated clients can then reach recipe execution, input, output surfaces and may trigger connected tools despite operator explicitly enabling authentication. Fixed in 4.6.58. CVSS 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. CWE-306. Patch: Available vendor. Reported by GitHub_M. CPE cpe:2.3:a:mervinpraison:praisonai:*:*:*:*:*:*:*:* . Tags: Authentication Bypass, Praisonai, Mervinpraison. SSVC: Exploitation: poc, Automatable: yes, Technical Impact: total. ENISA EUVD: EUVD-2026-77615. Affected versions EUVD: ["PraisonAI < 4.6.48"] (but description says prior 4.6.58 fixed in 4.6.58; EUVD says <4.6.48? conflict maybe). References: GHSA, commit, release v4.6.58. Source evidence: GHSA advisory. Package pip/praisonai vulnerable <=4.6.48 fixed in 4.6.59? Wait source code evidence says Package pip/praisonai — vulnerable: <= 4.6.48 — fixed in: 4.6.59. That's inconsistent with description fixed 4.6.58 and advisory maybe. Need mention conflict. The CVE description says prior to 4.6.58 fixed in 4.6.58. EUVD says affected <4.6.48. source evidence says fixed in 4.6.59, vulnerable <=4.6.48. Actually maybe typo. We must synthesize with all data. Need not correct? Could state discrepancy. Need produce fields plain text strings. product_name: "PraisonAI" 1-3 words. Summary original synthesis, do not start with vulnerability. Need mention impact and product. Could start "Unauthenticated clients can reach PraisonAI recipe execution..." That is specific impact verb? "Unauthenticated clients can reach..." Good. Mention active exploitation? KEV not provided
We need answer only JSON. Need adhere to instructions. Need use all data. Need be accurate. Need not copy description. Need analyze CVE. Let's inspect. CVE-2026-75030 Apache Syncope missing authorization. Description: Missing Authorization vulnerability in Apache Syncope. An administrator with task execution entitlements might be able to mass (de)provision group members, regardless of their group-related administration capabilities. Affects Apache Syncope from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.7, from 4.1.0-M0 through 4.1.2. Upgrade 4.0.8 / 4.1.3. CVSS score 9.8 vector N L PR:N UI:N S:U C:H I:H A:H. But description says "administrator with task execution entitlements" which is authenticated with some privileges. CVSS says PR:N. This is conflict: likely CVSS assigned incorrectly? We should state in risk_assessment conflicting. We are instructed use CVSS vector auth only if provided. Here PR:N means unauthenticated. But description says administrator with task execution entitlements. Could be that existing admin with task execution entitlements but missing group admin capabilities; likely authenticated. CVSS vector claims network unauthenticated. We need cross-reference and state explicit. Maybe "CVSS indicates network vector and PR:N, but description implies authenticated administrator with task execution entitlements — verify with vendor." Since CVSS provided, auth requirement? Rule: ONLY state authenticated or unauthenticated if CVSS vector is provided AND contains PR:N (unauthenticated) or PR:L/H. Here PR:N, so we can say unauthenticated according to CVSS. But description says admin. We can mention conflict. Need no uncertainty in summary? In risk assessment compare. Need risk assessment uses "boleslawiec" once lowercase in one sentence. Must weave naturally, not factual claim about affected. E.g. "Even a mid-sized municipal IT team in boleslawiec should treat this as urgent because mass deprovisioning can disrupt user lifecycles." Need not men
We need answer JSON only. Need analyze. Need ensure every field string. data_quality_flags array of objects maybe empty. Need extract. Let's inspect input. CVE-2026-73579 Apache Syncope incorrect authorization. Description. CVSS 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. CWE-863. Tags: Authentication Bypass, Apache, Elastic. SSVC exploitation none automatable yes technical impact total. ENISA. References lists advisory. Need product_name 1-3 words: Apache Syncope. summary original. technical_context. risk_assessment. affected_products. remediation. exploit_scenario. exploitation_conditions. attack_chain. confidence_notes. data_quality_flags. prevalence. prevalence_basis. assessed_cvss_vector. assessed_cvss40_vector. Need be careful: "Reported by security@apache.org". Tags include Elastic maybe because search backend? Authentication Bypass. Need use all data. KEV not present, POC not explicit. Need not mention POC as public. EPSS not provided. Could say EPSS not available. CVSS provided NVD? but references nvd none? We can reference. Need assess CVSS ourselves. Description says incorrect authorization: non-recursive search requests possible Realms filter rendered empty, voiding restrictions on requester privileges. This is an authorization bypass allowing search results beyond permissions. CVSS from input 9.8: AV:N AC:L PR:N UI:N. But is it truly PR:N? Description says "requester's permissions" maybe authenticated user? Search requests likely authenticated? Let's investigate. Apache Syncope is identity management. Any search requests are transformed... Realms filter ensures results matching requester's permissions. For non-recursive search requests possible filter empty. Attack vector network. Does exploit require authentication? If any requester? Incorrect authorization could be authenticated low privilege. But input CVSS has PR:N. We must not contradict maybe assess. Need "CVSS vector (attack vector, complexity, privileges)" compare. We can note CVSS says unauthent
SQL injection in Apache Syncope's Task search endpoint allows an authenticated administrator to execute arbitrary SQL through unsanitized sort clause parameters via stacked queries, affecting all 3.0.x releases through 3.0.16, 4.0.x through 4.0.7, and 4.1.x through 4.1.2. The vulnerability (CWE-89) enables stacked-query injection that can read, modify, or delete identity governance data, and may allow schema manipulation or OS-level operations depending on the database engine and driver configuration. No public exploit has been identified at time of analysis, and exploitation is constrained to administrators with sufficient entitlements.
Unauthenticated remote code execution in Maxim AI's Bifrost LLM gateway (transports v2.0.0 and earlier) allows any network caller to run arbitrary programs as the gateway process user. Bifrost's management API registers MCP stdio clients as a raw command-plus-args pair and launches that program immediately upon registration with no MCP handshake, and because governance.auth_config.is_enabled defaults to false, a single POST /api/mcp/client requires no credentials. A vendor patch exists (transports/v2.1.0), which refuses unauthenticated stdio registration with HTTP 403; no public exploit is identified at time of analysis, though the attack is trivially scriptable.
OS command injection in HexStrike AI's Execute Endpoint allows remote unauthenticated attackers to execute arbitrary operating system commands on the server by manipulating the `code` or `script` parameters in `hexstrike_server.py`. The affected product is the rolling-release version of 0x4m4 HexStrike AI up to commit d689933ff579d839c676c82b231f8e98326c5f04. A public exploit has been disclosed via a GitHub issue report; the vendor has not yet responded, and no patch is available.
OS command injection in 0x4m4 HexStrike AI allows unauthenticated remote attackers to execute arbitrary shell commands by supplying metacharacter-laden values in the additional_args, target, username, password, scan_type, or payload fields of the /api/tools/* API endpoints, which pass these values directly into subprocess.Popen(shell=True) without sanitization. The PR diff confirms the flaw spans at least 97 API endpoints covering nmap, gobuster, nuclei, nikto, ffuf, and feroxbuster executors in hexstrike_server.py. A publicly available proof-of-concept exploit exists (GitHub issue #224) and a partial fix is in progress via PR #266, though PR #266 only addresses the additional_args parameter and may leave other injectable fields (target, username, password, scan_type, payload) unpatched.
Out-of-bounds read in memcached versions 1.6.41-1.6.43 allows a remote, unauthenticated attacker to crash the ASCII authentication handler by sending an empty or undersized authentication request line to the mcmc tokenizer. The vulnerability resides in `try_read_command_asciiauth()` within `proto_text.c` and results in a low-severity availability impact with no confirmed confidentiality or integrity exposure. A public proof-of-concept exploit has been released, and vendor-confirmed remediation is available in version 1.6.44.
Memory corruption in GPAC's BIFS Text (BT) scene parser allows a remote attacker to crash the MP4Box process or corrupt process memory by supplying a crafted BT scene file. The primary defect in `gf_bt_parse_bifs_command()` (loader_bt.c:2812) is a format-string mismatch: the variable `str` is embedded in the format literal passed to `gf_bt_report` rather than supplied as a variadic argument, causing the `%s` specifier to dereference an uncontrolled stack or heap value. The patch (commit afca1f1181668d85941d51ed1adf647807d5d975, release abi-16.23) bundles several related fixes across the codebase; a public proof-of-concept exists but no confirmed active exploitation has been recorded.
Path traversal in HexStrike AI's `FileOperationsManager` API endpoint allows unauthenticated remote attackers to read, write, modify, and delete files outside the intended sandbox directory by supplying `..` sequences in the `filename` parameter. All four file-operation handlers (read, create, modify, delete) constructed paths via simple `self.base_dir / filename` concatenation with no canonicalization or boundary enforcement, making every file operation on the server accessible to callers who can reach the API. A public proof-of-concept exploit exists in GitHub issue #135; no CISA KEV listing is present, suggesting exploitation has not yet been observed at scale.
Reachable assertion in the flatcc FlatBuffers schema compiler (versions 0.6.0-0.6.3) crashes the compiler process when a crafted schema file containing duplicate symbol declarations is processed. The `align_order_members` function in `src/compiler/semantics.c` proceeds into member-ordering logic after the parser has already recorded a failure state due to duplicate symbols, violating the function's internal invariant that no duplicates exist and triggering an assertion abort (CWE-617). A proof-of-concept exploit is publicly available via GitHub issue #387, enabling reliable reproduction of the crash with no public exploit code beyond a malformed schema file.
SQL injection in the doctor login page (doctorlogin.php) of the subhajitkhan online-clinic-management-system allows remote unauthenticated attackers to manipulate the doc_mail and doc_pswd parameters and execute arbitrary SQL against the backend database, potentially bypassing authentication or exfiltrating patient and staff records. Publicly available exploit code exists, and the project maintainer has not responded to the issue report; no patched version is available as the product uses a rolling release model.
ZITADEL 4.0.0 through 4.15.3 (and EOL 3.0.0 through 3.4.12) fails to fully revoke role assignments on Project Grants when an administrator deletes two or more project roles at the same time, letting affected users keep permissions that were supposed to be removed. The flaw is an off-by-one style error (CWE-193) in the cross-organization cascade cleanup that iterates a user's role list for User Grants on Granted Projects, so one or more deletions can be skipped and, if the retained role was administrative, the user may keep elevated rights inside that shared project. Publicly available exploit code exists (a public gist referencing the issue), but there is no CISA KEV listing; vendor patch 4.16.0 ships a database migration that automatically repairs residue left in the eventstore.
Unauthenticated SQL injection in itsourcecode Leave Management System 1.0 lets a remote attacker manipulate the user_email argument of /login.php to alter the authentication query and read or subvert backend data. Exploit code has been made publicly available (reflected as exploit maturity E:P in the CVSS 4.0 vector and referenced from a GitHub issue), so any internet-reachable deployment should be treated as immediately attackable. The flaw is not listed in CISA KEV and no EPSS score was supplied, so active in-the-wild exploitation is not confirmed — but the low attack complexity and zero authentication requirement make opportunistic scanning likely.
Privilege escalation in Soarkey StudentManagement allows unauthenticated remote attackers to self-assign arbitrary privilege levels during account registration by manipulating the `level` POST parameter in the Registration Workflow handled by `RegisterServlet.doPost`. An attacker can register a standard user account but set their privilege level to administrator, gaining unauthorized access to elevated functionality such as student record management. A publicly available proof-of-concept exists via GitHub issue #35, and SSVC classifies this as automatable with partial technical impact.
Reachable assertion in the flatcc FlatBuffers compiler (versions 0.6.0-0.6.3) allows remote attackers to crash the compiler process by supplying a crafted schema file containing circular struct references. The `analyze_struct()` function in `semantics.c` proceeds into assertion-protected code paths even after the parser has already flagged a failure state, triggering an abort. No public exploit identified at time of analysis is contradicted by the input: a publicly available proof-of-concept exists on the project's GitHub issue tracker. Impact is limited to denial-of-service of the compiler itself, with no code execution or data exfiltration possible.
Integer overflow in the Gravity scripting language's embedded JSON parser (gravity_json.c ≤ 0.9.7) allows remote attackers to cause heap allocation size miscalculation via crafted JSON input, resulting in an undersized buffer allocation and subsequent heap memory corruption or crash. The root flaw is a `unsigned long` truncation to 32 bits on LLP64 targets (64-bit Windows) when accumulating object key-string byte counts across a two-pass JSON parse, meaning any application embedding Gravity and feeding it attacker-controlled JSON is at risk on affected platforms. A public proof-of-concept exists at GitHub issue #447 and version 0.9.8 resolves all identified paths; no active exploitation (CISA KEV) has been recorded.