Unauthenticated remote command execution with root privileges affects Cisco Secure Email Gateway running affected AsyncOS builds (13.x, 14.x, 15.x and 16.x), where crafted inbound email can inject SQL into the mail-parsing pipeline and ultimately achieve OS-level code execution. Exploitation requires no authentication, no user interaction, and no non-default configuration per the assessed CVSS vector (AV:N/AC:L/PR:N/UI:N), so any internet-facing or mail-receiving appliance - the product's normal deployment role - is exposed. This is confirmed actively exploited (CISA KEV) with publicly available exploit code exists, and while EPSS is a moderate 2.16% (81st percentile), the KEV listing and total technical impact per SSVC make this a genuine top-priority issue rather than an inflated high-CVSS artifact.
Authentication bypass in ESPHome Device Builder (the esphome-device-builder package powering the `dashboard` subcommand of the ghcr.io/esphome/esphome container) versions before 1.0.12 silently disables dashboard authentication on upgrade for operators who had protected it with the legacy bare $USERNAME/$PASSWORD environment variables. A rename to $ESPHOME_USERNAME/$ESPHOME_PASSWORD (PR #265) dropped the old names with no fallback, so `using_password` becomes false and both the REST auth middleware and WebSocket login gate switch off, leaving the dashboard open to anyone who can reach its port. Because a compromised dashboard caller can compile arbitrary code and read/write config and data directories, this is effectively unauthenticated RCE; publicly available exploit/PoC code exists, though it is not in CISA KEV (SSVC exploitation: none).
Server-side request forgery and root-level code execution in IBM Langflow OSS 1.0.0 through 1.10.0 lets an authenticated user smuggle arbitrary Python through submitted flow components. Because the component validation scanner fails to block socket and urllib imports yet still returns "validated": true, attackers run code as UID=0 to steal AWS credentials via IMDSv1 SSRF, exfiltrate container files, and pivot to internal PostgreSQL and Redis services. Public exploit code exists, though the flaw is not on the CISA KEV list.
Stack-based buffer overflow in the D-Link DIR-823G router (firmware 1.0.2B05_20181207) lets a remote attacker corrupt stack memory via the HNAP1 SetStaticRouteSettings handler. The vulnerable strcpy call copies attacker-supplied PAddress, SubnetMask, and Gateway values without bounds checking, enabling denial of service and potential code execution on the device. Publicly available exploit code exists (VulDB and a GitHub advisory), though it is not listed in CISA KEV; EPSS was not provided.
Casdoor through 4.4.0 exposes its instance-wide built-in JWT signing private key unmasked through the /api/get-certs and /api/get-cert endpoints, letting an authenticated organization administrator retrieve a key that should never leave the server. Because a single shared key signs tokens for the entire deployment, any one org admin can forge valid JWTs for arbitrary users in any organization - including global administrators - turning a tenant-scoped role into a full cross-tenant authentication bypass (CWE-863, improper authorization). Publicly available exploit code exists (a detailed write-up for finding 3 is linked, described as an incomplete fix of issue #3003), and VulnCheck rates the technical impact as total; EPSS is low at 0.21% (11th percentile), and the flaw is not confirmed as actively exploited. Exploitation requires a prior authenticated org-admin account and is not reachable anonymously.
Authenticated OS command injection in D-Link DWR-M921 firmware 1.1.52 allows a remote attacker with administrative credentials to execute arbitrary system commands on the router by injecting shell metacharacters into the `folderpath` parameter of the `/boafrm/formDiskCreateShare` endpoint, which passes the value unsanitized to a `system()` call. The affected endpoint handles USB disk share creation via the BoA embedded web server. A public proof-of-concept exploit has been disclosed on GitHub by researcher H3rmesk1t, though no active exploitation has been confirmed by CISA KEV at time of analysis.
OS command injection in D-Link DWR-M920 firmware version 1.1.7 allows a network-adjacent or remote authenticated attacker to execute arbitrary operating system commands by manipulating the newPin parameter submitted to the /boafrm/formPinManageSetup endpoint. The vulnerability resides in the sub_41E60C function, which fails to sanitize user-supplied input before passing it to a system call. A publicly available proof-of-concept exploit exists. No public exploit identified at time of analysis as confirmed by CISA KEV, but exploit code is publicly available per VulDB and the GitHub reference.
Buffer overflow in TOTOLINK A3002MU router firmware version Hh-B20211125.1046 allows authenticated remote attackers to corrupt memory and potentially execute arbitrary code by supplying an oversized value to the `service_type` argument of the `formPortFw` CGI handler in the boa embedded web server. The vulnerability is reachable over the network and a proof-of-concept exploit has been publicly published on GitHub. No vendor-released patch has been confirmed at time of analysis.
Field-level security bypass in EspoCRM before 10.0.4 exposes hidden attendee email addresses to any authenticated user through the meeting and call attendees API endpoints. The root cause is ACL validation logic that checks parent event (meeting or call) permissions rather than per-attendee entity permissions, rendering field-level email restrictions ineffective for all users with event read access. Publicly available exploit code exists via the vendor's GitHub security advisory; no confirmed active exploitation (CISA KEV) has been identified.
Buffer overflow in the Totolink A3002MU router's boa web server allows network-adjacent authenticated attackers to potentially execute arbitrary code by sending a crafted request with an oversized ip6addr argument to the /boafrm/formFilter endpoint. The affected firmware version is Hh-B20211125.1046, and a public proof-of-concept exploit has been published on GitHub. No patch is available at time of analysis; the vulnerability carries a CVSS 4.0 score of 8.6 with subsequent-system impact metrics elevated due to the router's central network position.
Stack-based buffer overflow in the Totolink A3002MU router's boa HTTP server allows a network-adjacent authenticated attacker to overwrite memory via an oversized `submit-url` argument submitted to the `formNewSchedule` handler at `/boafrm/formNewSchedule`, likely yielding arbitrary code execution on the device. The affected firmware version is Hh-B20211125.1046. A public proof-of-concept exploit exists on GitHub, raising the realistic exploitation probability for devices reachable from the network with default or known credentials. No vendor patch has been identified at time of analysis.
OS command injection in D-Link DWR-M921 firmware 1.1.52 allows an authenticated remote attacker to execute arbitrary shell commands on the device by supplying a crafted `partition` argument to the `/boafrm/formDiskFormat` endpoint, which passes the value unsanitized to the `system()` call. Exploitation requires high-privilege (admin-level) credentials, but a publicly available proof-of-concept exploit hosted on GitHub lowers the barrier significantly. No vendor patch has been identified at time of analysis; the device's web management interface is the sole attack surface.
Logitech's Logi Options+ updater service on Windows mishandles service-level privileges (CWE-269), exposing an attack surface that any authenticated local user can abuse to obtain a SYSTEM shell. With a proof-of-concept publicly documented on the amberwolf security blog, the exploitation barrier is minimal for any adversary already present on a Windows endpoint running the software. Organizations with broad Logitech peripheral deployments face meaningful privilege escalation risk if this path is chained with initial access obtained via phishing or credential compromise.
A path traversal flaw (CWE-22) in IBM DataStage on Cloud Pak for Data 5.4.0.0 lets an authenticated remote user manipulate file paths to read, write, or delete arbitrary files on the host. The CVSS 3.1 base score is 8.1 (AV:N/AC:L/PR:L/UI:N), reflecting high confidentiality and integrity impact with no availability impact, so valid credentials are a prerequisite. Publicly available exploit code has been referenced, but CISA KEV does not list this CVE and CISA's SSVC assessment records exploitation as 'none' and automatable as 'no' - meaning it is a serious post-authentication primitive rather than a broadly observed in-the-wild campaign at time of analysis.
Missing authorization on the `/sys/user/list` admin endpoint in novel-plus ≤5.3.3 allows any authenticated user to retrieve password hashes and sensitive PII - including email addresses and phone numbers - for users within their data scope. The root cause is the absence of proper Spring Security permission annotations on the endpoint, meaning authorization checks are never enforced at the API layer. A publicly available POC exploit script confirms exploitability; successful hash retrieval enables offline cracking and downstream account takeover.
Cache invalidation in novel-plus through 5.3.3 exposes an unauthenticated HTTP endpoint protected only by a hardcoded default password embedded in the application's source-controlled configuration file, allowing any remote attacker who supplies the known default value in the URL path to forcibly invalidate portal caches at will. The root cause (CWE-1392: Use of Default Credentials) means the credential is fully disclosed in the public GitHub repository and a VulnCheck-reported Python POC, reducing exploitation to a trivial one-liner. No vendor-released patch exists as of the latest tagged release v5.3.3, leaving all deployments that have not manually rotated the credential exposed with a publicly available exploit.
Authenticated arbitrary file write in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote attacker who already holds valid DataStage credentials to write files to attacker-chosen locations on the server, because a feature that accepts a file path fails to properly validate it. The vendor scores this 9.9, but our independent assessment rates it as a scope-unchanged high-severity issue (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H), since the attacker must already be authenticated and the immediate confidentiality impact is limited although integrity and availability can be fully compromised. There is no evidence of active exploitation: CISA's SSVC rates exploitation as 'none', EPSS is low at 0.61% (48th percentile), and no public exploit code has been identified at time of analysis. A vendor patch is available per IBM's advisory.
An out-of-bounds write (CWE-787) in Apple's operating system family - iOS/iPadOS, macOS (Sequoia, Tahoe, and Golden Gate), tvOS, visionOS, and watchOS - lets a remote attacker corrupt memory in an affected process, with the confirmed outcome being an application crash and the potential outcome being arbitrary code execution. Exploitation requires no authentication and no user interaction per the CVSS vector (AV:N/PR:N/UI:N), but the independent assessment rates attack complexity as High and the confirmed technical impact as limited to denial of service, because the specific component or content-processing surface that must be reached has not been documented and reliable code execution is unproven. Apple has released fixed builds for every affected platform, and no public exploit code or active exploitation has been identified at time of analysis; EPSS is a modest 0.99% (61st percentile), which is consistent with a patched, non-weaponized memory-safety defect rather than a top-tier emergency.
PraisonAI's optional standalone async-jobs HTTP server can be driven by any unauthenticated network client that can reach its listener, which binds 0.0.0.0:8005 by default, because every route under /api/v1/runs lacks authentication and per-job ownership checks. An attacker can submit jobs carrying attacker-controlled prompts and agent YAML/configuration, causing the operator's process to execute agents with access to its environment variables, service credentials, and connected tool capabilities, and can also list, read, stream, cancel, or delete any job system-wide. Rated CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), with publicly available exploit code exists per SSVC exploitation: poc, an EPSS of 0.97% (60th percentile), and no CISA KEV listing; the vendor has published patched releases.
Authentication bypass in PraisonAI's `recipe serve` command: when an operator selects `auth: api-key` or `auth: jwt` in a recipe YAML but omits the matching `api_key:`/`jwt_secret:` value and does not export PRAISONAI_API_KEY or PRAISONAI_JWT_SECRET, APIKeyAuthMiddleware and JWTAuthMiddleware take a fail-open branch and forward every non-`/health` request unauthenticated to the recipe execution, input, and output surfaces, potentially triggering connected tools. Remote unauthenticated attackers who can reach an exposed recipe-serve endpoint (CVSS:3.1/AV:N/PR:N/UI:N) can therefore act as if authenticated, though independent analysis raises attack complexity to AC:H because the rawe 9.8 vendor score only manifests under a specific operator mis-deployment - the fail-open does not occur when the secret is set or when authentication was never enabled. Publicly available exploit code exists per the SSVC exploitation signal (poc), EPSS is 0.90% (58th percentile), and the issue is not listed in CISA KEV; it is fixed in 4.6.58.
Unauthenticated OS command execution in PraisonAI's UI host applications (all versions before 4.6.59, confirmed on 4.6.48) lets remote attackers run arbitrary local commands as the PraisonAI UI service account by sending a single POST to /api/mcp/connect with attacker-chosen command and args values, because those values are handed to the MCP stdio client which spawns a local process. The default 'praisonai ui', 'praisonai ui agents' and 'praisonai claw' commands bind to 0.0.0.0 with no authentication, so the issue is exploitable against default configurations (CVSS 3.1 9.8, AV:N/AC:L/PR:N/UI:N, CWE-78) without credentials or user interaction, and the process is spawned even if the subsequent MCP handshake fails. It is not confirmed actively exploited (no CISA KEV listing) and EPSS is modest at 0.64% (49th percentile), but publicly available exploit code exists per CISA SSVC (Exploitation: poc, Automatable: yes, Technical Impact: total), and the vendor has released 4.6.59 which adds authentication and origin middleware.
Missing authorization in Apache Syncope (3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2) lets an administrator who holds task-execution entitlements mass-provision or de-provision group members even for groups the administrator is not entitled to manage, because the authorization check binding task execution to group-scoped administration rights is absent. Impact is limited to the integrity of identity/provisioning data - group membership state - rather than confidentiality or availability, and it is only reachable by an already-privileged administrative insider or a compromised admin account. The published CVSS 9.8 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) materially overstates the risk and is inconsistent with both the description and our independent assessment (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N); no public exploit code has been identified at time of analysis, EPSS is 0.58% (46th percentile), and CISA's SSVC records Exploitation: none with Automatable: yes and Technical Impact: total.
Incorrect authorization in Apache Syncope allows a delegated administrator who holds only the ClientApp CREATE entitlement to also carry out ClientApp UPDATE operations, with the mirror-image defect wrongly blocking an administrator who legitimately holds the ClientApp UPDATE entitlement - an integrity-only flaw confined to the trusted, authenticated administrative population rather than an anonymous attack path. The flaw affects Apache Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2, and is neutralized by upgrading to 4.0.8 or 4.1.3. There is no public exploit identified at time of analysis, EPSS is low at 0.48% (40th percentile), and CISA's SSVC records Exploitation as 'none' (though Automatable as 'yes'); the NVD-assigned CVSS of 9.8 with PR:N is substantially overstated relative to the assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, which reflects an authenticated admin prerequisite and low integrity-only impact.
Cross-realm authorization bypass in Apache Syncope allows an administrator who already holds delegated entitlements in one Realm to read, through the REST API, the full Connector configuration of a different Realm - including confidential properties - and then effectively clone that Connector instance into the Realm they control. The flaw affects the 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2 lines, and is exploitable only by an authenticated delegated administrator, not by anonymous remote users; no public exploit code has been identified at time of analysis, EPSS is a low 0.48% (40th percentile), and CISA's SSVC assessment records Exploitation: none. Note that the published CVSS 9.8 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) overstates the issue: our independent assessment scores it CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, i.e. a confidentiality-only privilege-boundary weakness rather than an unauthenticated, integrity- and availability-destroying flaw.
Incorrect authorization in Apache Syncope (3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2) allows an authenticated principal that holds a search entitlement to retrieve identity and entity records outside its authorized realms by issuing a non-recursive search request. The Realms filter that normally constrains results to the requester's permissions can be rendered empty for non-recursive queries, effectively removing the privilege restriction before the search is translated into SQL, Neo4j, or Elasticsearch/OpenSearch queries; recursive searches are not affected. The exposure is backend-agnostic but gated by authentication and an existing search entitlement, so it is a data-confidentiality bypass rather than anonymous remote code execution - no public exploit code has been identified at time of analysis, EPSS is low (0.48%, ~40th percentile), and there is no CISA KEV listing. Vendor fixes are available in 4.0.8 and 4.1.3.
Privilege escalation in Apache Syncope allows an authenticated account that holds delegation-management rights to create or update delegations assigning Roles it does not own or Roles belonging to a realm subtree outside the scope it was authorized for, granting access beyond the intended administrative boundary. The flaw affects Apache Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2, and is remediated by upgrading to 4.0.8 or 4.1.3. No public exploit identified at time of analysis, no CISA KEV listing, and EPSS is 0.48% (40th percentile); exploitation is post-authentication and depends on the delegation feature being in use, despite the published CVSS vector showing PR:N.
Unauthenticated tool invocation and potential remote code execution in PraisonAI Agents (praisonaiagents) before 1.6.59, where the MCP SSE transport started by ToolsMCPServer.run_sse() or launch_tools_mcp_server(transport='sse') binds to 0.0.0.0 and builds its Starlette application with no authentication middleware and no Origin validation. Any client that can reach the listening port (default 8080) can list and invoke every registered tool without credentials, and because the bundled SecurityConfig, origin-validation and DNS-rebinding checks in mcp/mcp_security.py are never called, a malicious web page can rebind a hostname to 127.0.0.1 and drive the same JSON-RPC calls against a developer's local instance; the practical impact scales with the registered toolset and becomes full RCE where file, shell, or code-execution tools are exposed. Exposure is gated on an operator actually launching the SSE transport - merely importing the library is not sufficient - and no public exploit code has been identified at time of analysis (EPSS 0.47%, SSVC exploitation: none), with a vendor patch available in 1.6.59.
Improper access control in Cisco Secure Email and Web Manager could allow an attacker to bypass intended authorization on the management or administrative interface, with the published CVSS 9.8 vector claiming unauthenticated network exploitation and high confidentiality, integrity, and availability impact. The independent assessment is more measured: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N, meaning low privileges are likely required and availability impact is not established, while the exact endpoint or configuration precondition is not documented by Cisco. Affected builds span the EUVD-listed 12.8.1-002 through 16.0.4-010 trains; no public exploit has been identified at time of analysis, EPSS is 0.46% (39th percentile), and CISA SSVC records exploitation as none.
Path traversal vulnerabilities (CWE-23) in Cisco Secure Email Gateway (ESA) and Cisco Secure Email and Web Manager (SMA) allow a remote attacker to break out of an intended directory and read files the application should not expose. Affected builds span the 12.8.x through 16.x release trains listed in the EUVD record (EUVD-2026-77622), including ESA 13.0.5-007, 14.x, 15.0.x, 15.5.x and 16.0.x builds, and corresponding SMA 12.8.1, 13.x, 14.x, 15.x and 16.x builds; Cisco addressed the issues in internal-hardening software releases documented in advisory cisco-sa-hardening-esa-dfCrfXkm. Cisco's advisory carries a 9.8 score, but our assessment is lower (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) because the advisory does not disclose the vulnerable endpoint or confirm that the flaw is reachable without an authenticated session; exploitation also requires network reachability to a management interface that is normally not internet-exposed. There is no public exploit identified at time of analysis, EPSS is low at 0.43% (36th percentile), and the issue is not in CISA KEV, although CISA SSVC rates it automatable with total technical impact.
Unauthenticated remote code execution in the PraisonAI multi-agent framework lets any network-reachable caller run arbitrary operating-system commands on servers exposing the Jobs API. The attack chains two defects: the POST /api/v1/runs endpoint ships without the verify_token dependency used by the authenticated agent_invoke endpoint (PR:N, no credentials or session required), and an attacker-supplied top-level 'approve' field in the submitted agent_yaml is loaded into a ContextVar that the @require_approval decorator consults before any risk-level check, so listing 'execute_command' makes the critical-tool approval gate a no-op with no operator interaction (CVSS 3.1 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, CWE-306). Affected releases are praisonai through 4.6.48 and praisonaiagents prior to 1.6.59, both fixed in 4.6.59 and 1.6.59 respectively; publicly available exploit code exists (a curl-based PoC is published in the GHSA advisory) and CISA's SSVC assessment rates the issue automatable with total technical impact, although no confirmed active exploitation (CISA KEV) has been reported and the current EPSS score is low at 0.41% (35th percentile).
Unauthenticated remote attackers who can reach a Cisco Secure Email Gateway or Secure Email and Web Manager deployment can trigger improper resource-lifetime handling (CWE-664) that degrades availability and can leak limited information. Cisco's own advisory scores the issue 9.8 (C:H/I:H/A:H), while independent assessment scores it considerably lower at C:L/I:N/A:H; the two sources conflict sharply over whether integrity and full confidentiality are actually at risk, but both agree the availability impact is high and that no privileges or user interaction are required per the CVSS vector (AV:N/AC:L/PR:N/UI:N). No public exploit code has been identified at time of analysis, no exploitation has been observed (SSVC Exploitation: none), and EPSS is low at 0.37% (31st percentile), though the flaw is classified as automatable with total technical impact in CISA's SSVC framework.
Improper-neutralization flaws (CWE-707) in Cisco Secure Email Gateway and Cisco Secure Email and Web Manager - disclosed by Cisco as an internally discovered hardening release covering affected 12.8.x through 16.x builds - could allow an attacker to compromise confidentiality or integrity of the appliances, but the published CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) is unsupported by any of the technical detail Cisco actually provides. The advisory cisco-sa-hardening-esa-dfCrfXkm names no vulnerable feature, endpoint, protocol, or configuration setting and does not state whether authentication is required, so the unauthenticated PR:N claim is unverified; our assessment lowers the vector to CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N and treats exposed management interfaces as the most plausible attack surface. There is no public exploit code and no evidence of exploitation (CISA SSVC Exploitation: none), and EPSS is low at 0.37% (30th percentile), so this should be handled as a routine patch-cadence item rather than an emergency pre-auth remote compromise.
OS command injection via prompt injection in GH05TCREW PentestAgent's LocalRuntime allows a malicious target host to execute arbitrary shell commands on the operator's workstation. When the agent scans an adversary-controlled target, response content such as HTTP bodies, SSH banners, or DNS records flows unfiltered into the LLM's prompt context; a crafted payload steers the LLM into generating reverse-shell or persistence commands that LocalRuntime.execute_command() then runs with full operator-level privileges. A publicly available exploit exists (GitHub issue #91), and the upstream fix (PR #100) remains unmerged at time of analysis.
PentestAgent's MCP HTTP Server (up to commit cf882dabea3ed91cef016cdd115e5426315665a2) bound to all network interfaces (0.0.0.0) by default with zero authentication, allowing any remote attacker to call the `run_task` function in `interface/main.py` and execute arbitrary OS commands on the host running the agent. A public proof-of-concept is available via GitHub issue #90, and the fix (PR #101) adds bearer token auth and changes the default bind address to 127.0.0.1, but the pull request had not yet been merged at time of analysis. The CVSS 4.0 score of 6.9 substantially understates impact given that full unauthenticated OS command execution is achievable.
Heap out-of-bounds write in the theopolis uefi-firmware-parser Python package (versions prior to 1.14) lets a crafted Tiano/EFI-compressed firmware image corrupt heap memory when the file is parsed. The bundled native Tiano decompressor's ReadCLen() in Decompress.c reads a 9-bit length (up to 511, plus a run-length path allowing up to 531 writes) into the 510-element Sd->mCLen array without an Index < NC bound, producing a deterministic crash and potential code execution in the parsing process. No public exploit identified at time of analysis; the flaw is reached through the normal CompressedSection.process() parsing path, so any tool or service that ingests untrusted firmware with this library is at risk.
Stack out-of-bounds write in the theopolis uefi-firmware-parser Python library (versions prior to 1.14) lets a maliciously crafted Tiano/EFI-compressed firmware blob corrupt the parser's stack when it is decompressed. The bundled native Tiano decompressor's MakeTable() fails to validate Huffman bit-length values, so bit lengths above 16 overflow the stack-allocated Count[17] array and adjacent decode tables, deterministically crashing the parsing process and potentially allowing code execution in that process depending on build hardening. No public exploit identified at time of analysis; the issue was fixed in 1.14 by porting the upstream EDK2 hardening.
SQL injection in Apache Syncope's Task search endpoint allows an authenticated administrator to execute arbitrary SQL through unsanitized sort clause parameters via stacked queries, affecting all 3.0.x releases through 3.0.16, 4.0.x through 4.0.7, and 4.1.x through 4.1.2. The vulnerability (CWE-89) enables stacked-query injection that can read, modify, or delete identity governance data, and may allow schema manipulation or OS-level operations depending on the database engine and driver configuration. No public exploit has been identified at time of analysis, and exploitation is constrained to administrators with sufficient entitlements.
Unauthenticated remote code execution in Maxim AI's Bifrost LLM gateway (transports v2.0.0 and earlier) allows any network caller to run arbitrary programs as the gateway process user. Bifrost's management API registers MCP stdio clients as a raw command-plus-args pair and launches that program immediately upon registration with no MCP handshake, and because governance.auth_config.is_enabled defaults to false, a single POST /api/mcp/client requires no credentials. A vendor patch exists (transports/v2.1.0), which refuses unauthenticated stdio registration with HTTP 403; no public exploit is identified at time of analysis, though the attack is trivially scriptable.
OS command injection in HexStrike AI's Execute Endpoint allows remote unauthenticated attackers to execute arbitrary operating system commands on the server by manipulating the `code` or `script` parameters in `hexstrike_server.py`. The affected product is the rolling-release version of 0x4m4 HexStrike AI up to commit d689933ff579d839c676c82b231f8e98326c5f04. A public exploit has been disclosed via a GitHub issue report; the vendor has not yet responded, and no patch is available.
OS command injection in 0x4m4 HexStrike AI allows unauthenticated remote attackers to execute arbitrary shell commands by supplying metacharacter-laden values in the additional_args, target, username, password, scan_type, or payload fields of the /api/tools/* API endpoints, which pass these values directly into subprocess.Popen(shell=True) without sanitization. The PR diff confirms the flaw spans at least 97 API endpoints covering nmap, gobuster, nuclei, nikto, ffuf, and feroxbuster executors in hexstrike_server.py. A publicly available proof-of-concept exploit exists (GitHub issue #224) and a partial fix is in progress via PR #266, though PR #266 only addresses the additional_args parameter and may leave other injectable fields (target, username, password, scan_type, payload) unpatched.
Out-of-bounds read in memcached versions 1.6.41-1.6.43 allows a remote, unauthenticated attacker to crash the ASCII authentication handler by sending an empty or undersized authentication request line to the mcmc tokenizer. The vulnerability resides in `try_read_command_asciiauth()` within `proto_text.c` and results in a low-severity availability impact with no confirmed confidentiality or integrity exposure. A public proof-of-concept exploit has been released, and vendor-confirmed remediation is available in version 1.6.44.
Memory corruption in GPAC's BIFS Text (BT) scene parser allows a remote attacker to crash the MP4Box process or corrupt process memory by supplying a crafted BT scene file. The primary defect in `gf_bt_parse_bifs_command()` (loader_bt.c:2812) is a format-string mismatch: the variable `str` is embedded in the format literal passed to `gf_bt_report` rather than supplied as a variadic argument, causing the `%s` specifier to dereference an uncontrolled stack or heap value. The patch (commit afca1f1181668d85941d51ed1adf647807d5d975, release abi-16.23) bundles several related fixes across the codebase; a public proof-of-concept exists but no confirmed active exploitation has been recorded.
Path traversal in HexStrike AI's `FileOperationsManager` API endpoint allows unauthenticated remote attackers to read, write, modify, and delete files outside the intended sandbox directory by supplying `..` sequences in the `filename` parameter. All four file-operation handlers (read, create, modify, delete) constructed paths via simple `self.base_dir / filename` concatenation with no canonicalization or boundary enforcement, making every file operation on the server accessible to callers who can reach the API. A public proof-of-concept exploit exists in GitHub issue #135; no CISA KEV listing is present, suggesting exploitation has not yet been observed at scale.
Reachable assertion in the flatcc FlatBuffers schema compiler (versions 0.6.0-0.6.3) crashes the compiler process when a crafted schema file containing duplicate symbol declarations is processed. The `align_order_members` function in `src/compiler/semantics.c` proceeds into member-ordering logic after the parser has already recorded a failure state due to duplicate symbols, violating the function's internal invariant that no duplicates exist and triggering an assertion abort (CWE-617). A proof-of-concept exploit is publicly available via GitHub issue #387, enabling reliable reproduction of the crash with no public exploit code beyond a malformed schema file.
SQL injection in the doctor login page (doctorlogin.php) of the subhajitkhan online-clinic-management-system allows remote unauthenticated attackers to manipulate the doc_mail and doc_pswd parameters and execute arbitrary SQL against the backend database, potentially bypassing authentication or exfiltrating patient and staff records. Publicly available exploit code exists, and the project maintainer has not responded to the issue report; no patched version is available as the product uses a rolling release model.
ZITADEL 4.0.0 through 4.15.3 (and EOL 3.0.0 through 3.4.12) fails to fully revoke role assignments on Project Grants when an administrator deletes two or more project roles at the same time, letting affected users keep permissions that were supposed to be removed. The flaw is an off-by-one style error (CWE-193) in the cross-organization cascade cleanup that iterates a user's role list for User Grants on Granted Projects, so one or more deletions can be skipped and, if the retained role was administrative, the user may keep elevated rights inside that shared project. Publicly available exploit code exists (a public gist referencing the issue), but there is no CISA KEV listing; vendor patch 4.16.0 ships a database migration that automatically repairs residue left in the eventstore.
Unauthenticated SQL injection in itsourcecode Leave Management System 1.0 lets a remote attacker manipulate the user_email argument of /login.php to alter the authentication query and read or subvert backend data. Exploit code has been made publicly available (reflected as exploit maturity E:P in the CVSS 4.0 vector and referenced from a GitHub issue), so any internet-reachable deployment should be treated as immediately attackable. The flaw is not listed in CISA KEV and no EPSS score was supplied, so active in-the-wild exploitation is not confirmed — but the low attack complexity and zero authentication requirement make opportunistic scanning likely.
Privilege escalation in Soarkey StudentManagement allows unauthenticated remote attackers to self-assign arbitrary privilege levels during account registration by manipulating the `level` POST parameter in the Registration Workflow handled by `RegisterServlet.doPost`. An attacker can register a standard user account but set their privilege level to administrator, gaining unauthorized access to elevated functionality such as student record management. A publicly available proof-of-concept exists via GitHub issue #35, and SSVC classifies this as automatable with partial technical impact.
Reachable assertion in the flatcc FlatBuffers compiler (versions 0.6.0-0.6.3) allows remote attackers to crash the compiler process by supplying a crafted schema file containing circular struct references. The `analyze_struct()` function in `semantics.c` proceeds into assertion-protected code paths even after the parser has already flagged a failure state, triggering an abort. No public exploit identified at time of analysis is contradicted by the input: a publicly available proof-of-concept exists on the project's GitHub issue tracker. Impact is limited to denial-of-service of the compiler itself, with no code execution or data exfiltration possible.
Integer overflow in the Gravity scripting language's embedded JSON parser (gravity_json.c ≤ 0.9.7) allows remote attackers to cause heap allocation size miscalculation via crafted JSON input, resulting in an undersized buffer allocation and subsequent heap memory corruption or crash. The root flaw is a `unsigned long` truncation to 32 bits on LLP64 targets (64-bit Windows) when accumulating object key-string byte counts across a two-pass JSON parse, meaning any application embedding Gravity and feeding it attacker-controlled JSON is at risk on affected platforms. A public proof-of-concept exists at GitHub issue #447 and version 0.9.8 resolves all identified paths; no active exploitation (CISA KEV) has been recorded.