Cache invalidation in novel-plus through 5.3.3 exposes an unauthenticated HTTP endpoint protected only by a hardcoded default password embedded in the application's source-controlled configuration file, allowing any remote attacker who supplies the known default value in the URL path to forcibly invalidate portal caches at will. The root cause (CWE-1392: Use of Default Credentials) means the credential is fully disclosed in the public GitHub repository and a VulnCheck-reported Python POC, reducing exploitation to a trivial one-liner. No vendor-released patch exists as of the latest tagged release v5.3.3, leaving all deployments that have not manually rotated the credential exposed with a publicly available exploit.
OS command injection via prompt injection in GH05TCREW PentestAgent's LocalRuntime allows a malicious target host to execute arbitrary shell commands on the operator's workstation. When the agent scans an adversary-controlled target, response content such as HTTP bodies, SSH banners, or DNS records flows unfiltered into the LLM's prompt context; a crafted payload steers the LLM into generating reverse-shell or persistence commands that LocalRuntime.execute_command() then runs with full operator-level privileges. A publicly available exploit exists (GitHub issue #91), and the upstream fix (PR #100) remains unmerged at time of analysis.
PentestAgent's MCP HTTP Server (up to commit cf882dabea3ed91cef016cdd115e5426315665a2) bound to all network interfaces (0.0.0.0) by default with zero authentication, allowing any remote attacker to call the `run_task` function in `interface/main.py` and execute arbitrary OS commands on the host running the agent. A public proof-of-concept is available via GitHub issue #90, and the fix (PR #101) adds bearer token auth and changes the default bind address to 127.0.0.1, but the pull request had not yet been merged at time of analysis. The CVSS 4.0 score of 6.9 substantially understates impact given that full unauthenticated OS command execution is achievable.
OS command injection in HexStrike AI's Execute Endpoint allows remote unauthenticated attackers to execute arbitrary operating system commands on the server by manipulating the `code` or `script` parameters in `hexstrike_server.py`. The affected product is the rolling-release version of 0x4m4 HexStrike AI up to commit d689933ff579d839c676c82b231f8e98326c5f04. A public exploit has been disclosed via a GitHub issue report; the vendor has not yet responded, and no patch is available.
OS command injection in 0x4m4 HexStrike AI allows unauthenticated remote attackers to execute arbitrary shell commands by supplying metacharacter-laden values in the additional_args, target, username, password, scan_type, or payload fields of the /api/tools/* API endpoints, which pass these values directly into subprocess.Popen(shell=True) without sanitization. The PR diff confirms the flaw spans at least 97 API endpoints covering nmap, gobuster, nuclei, nikto, ffuf, and feroxbuster executors in hexstrike_server.py. A publicly available proof-of-concept exploit exists (GitHub issue #224) and a partial fix is in progress via PR #266, though PR #266 only addresses the additional_args parameter and may leave other injectable fields (target, username, password, scan_type, payload) unpatched.
Out-of-bounds read in memcached versions 1.6.41-1.6.43 allows a remote, unauthenticated attacker to crash the ASCII authentication handler by sending an empty or undersized authentication request line to the mcmc tokenizer. The vulnerability resides in `try_read_command_asciiauth()` within `proto_text.c` and results in a low-severity availability impact with no confirmed confidentiality or integrity exposure. A public proof-of-concept exploit has been released, and vendor-confirmed remediation is available in version 1.6.44.
Memory corruption in GPAC's BIFS Text (BT) scene parser allows a remote attacker to crash the MP4Box process or corrupt process memory by supplying a crafted BT scene file. The primary defect in `gf_bt_parse_bifs_command()` (loader_bt.c:2812) is a format-string mismatch: the variable `str` is embedded in the format literal passed to `gf_bt_report` rather than supplied as a variadic argument, causing the `%s` specifier to dereference an uncontrolled stack or heap value. The patch (commit afca1f1181668d85941d51ed1adf647807d5d975, release abi-16.23) bundles several related fixes across the codebase; a public proof-of-concept exists but no confirmed active exploitation has been recorded.
Server-side request forgery in tarzan-cms 1.0.0 allows remote attackers to force the application server to initiate arbitrary outbound HTTP connections by manipulating the `httpUrl` argument passed to the `openConnection()` method in `ThemeService.java`. The Theme Download Function passes user-supplied URL input directly to a connection handler without adequate validation, enabling internal network reconnaissance, cloud metadata endpoint access, or pivoting to backend services. A proof-of-concept has been publicly disclosed via a Gitee issue report; no vendor patch exists and the project maintainer has not responded to the disclosure.
Path traversal in HexStrike AI's `FileOperationsManager` API endpoint allows unauthenticated remote attackers to read, write, modify, and delete files outside the intended sandbox directory by supplying `..` sequences in the `filename` parameter. All four file-operation handlers (read, create, modify, delete) constructed paths via simple `self.base_dir / filename` concatenation with no canonicalization or boundary enforcement, making every file operation on the server accessible to callers who can reach the API. A public proof-of-concept exploit exists in GitHub issue #135; no CISA KEV listing is present, suggesting exploitation has not yet been observed at scale.
Reachable assertion in the flatcc FlatBuffers schema compiler (versions 0.6.0-0.6.3) crashes the compiler process when a crafted schema file containing duplicate symbol declarations is processed. The `align_order_members` function in `src/compiler/semantics.c` proceeds into member-ordering logic after the parser has already recorded a failure state due to duplicate symbols, violating the function's internal invariant that no duplicates exist and triggering an assertion abort (CWE-617). A proof-of-concept exploit is publicly available via GitHub issue #387, enabling reliable reproduction of the crash with no public exploit code beyond a malformed schema file.
SQL injection in the doctor login page (doctorlogin.php) of the subhajitkhan online-clinic-management-system allows remote unauthenticated attackers to manipulate the doc_mail and doc_pswd parameters and execute arbitrary SQL against the backend database, potentially bypassing authentication or exfiltrating patient and staff records. Publicly available exploit code exists, and the project maintainer has not responded to the issue report; no patched version is available as the product uses a rolling release model.
ZITADEL 4.0.0 through 4.15.3 (and EOL 3.0.0 through 3.4.12) fails to fully revoke role assignments on Project Grants when an administrator deletes two or more project roles at the same time, letting affected users keep permissions that were supposed to be removed. The flaw is an off-by-one style error (CWE-193) in the cross-organization cascade cleanup that iterates a user's role list for User Grants on Granted Projects, so one or more deletions can be skipped and, if the retained role was administrative, the user may keep elevated rights inside that shared project. Publicly available exploit code exists (a public gist referencing the issue), but there is no CISA KEV listing; vendor patch 4.16.0 ships a database migration that automatically repairs residue left in the eventstore.
Unauthenticated SQL injection in itsourcecode Leave Management System 1.0 lets a remote attacker manipulate the user_email argument of /login.php to alter the authentication query and read or subvert backend data. Exploit code has been made publicly available (reflected as exploit maturity E:P in the CVSS 4.0 vector and referenced from a GitHub issue), so any internet-reachable deployment should be treated as immediately attackable. The flaw is not listed in CISA KEV and no EPSS score was supplied, so active in-the-wild exploitation is not confirmed — but the low attack complexity and zero authentication requirement make opportunistic scanning likely.
Privilege escalation in Soarkey StudentManagement allows unauthenticated remote attackers to self-assign arbitrary privilege levels during account registration by manipulating the `level` POST parameter in the Registration Workflow handled by `RegisterServlet.doPost`. An attacker can register a standard user account but set their privilege level to administrator, gaining unauthorized access to elevated functionality such as student record management. A publicly available proof-of-concept exists via GitHub issue #35, and SSVC classifies this as automatable with partial technical impact.
Reachable assertion in the flatcc FlatBuffers compiler (versions 0.6.0-0.6.3) allows remote attackers to crash the compiler process by supplying a crafted schema file containing circular struct references. The `analyze_struct()` function in `semantics.c` proceeds into assertion-protected code paths even after the parser has already flagged a failure state, triggering an abort. No public exploit identified at time of analysis is contradicted by the input: a publicly available proof-of-concept exists on the project's GitHub issue tracker. Impact is limited to denial-of-service of the compiler itself, with no code execution or data exfiltration possible.
Integer overflow in the Gravity scripting language's embedded JSON parser (gravity_json.c ≤ 0.9.7) allows remote attackers to cause heap allocation size miscalculation via crafted JSON input, resulting in an undersized buffer allocation and subsequent heap memory corruption or crash. The root flaw is a `unsigned long` truncation to 32 bits on LLP64 targets (64-bit Windows) when accumulating object key-string byte counts across a two-pass JSON parse, meaning any application embedding Gravity and feeding it attacker-controlled JSON is at risk on affected platforms. A public proof-of-concept exists at GitHub issue #447 and version 0.9.8 resolves all identified paths; no active exploitation (CISA KEV) has been recorded.
SQL injection in the `searchtext` parameter of `listdoctor.php` in subhajitkhan's online-clinic-management-system exposes the backend database to unauthenticated remote attackers. The flaw allows direct manipulation of SQL queries, potentially enabling full database enumeration and data modification. A public proof-of-concept exists via GitHub issue, the maintainer has not responded to disclosure, and no patch has been released for this rolling-release project.
The BookController download endpoint in novel-plus (all versions through 5.3.3) omits authorization verification, allowing any authenticated backend admin account to export complete book text - including paid chapters - by supplying only a bookId and bookName parameter pair. This endpoint skips the VIP subscription and per-chapter purchase enforcement that the rest of the admin interface correctly applies, enabling unauthorized monetized-content extraction. A public proof-of-concept Python script is confirmed available; no active exploitation has been confirmed by CISA KEV.
HTTP response splitting in a2a-java 1.2.0 allows attackers who control push notification authentication credentials to inject arbitrary HTTP headers by embedding CR/LF characters in the Authorization header assembled by `BasePushNotificationSender.dispatchNotification()`. The root cause is direct concatenation of client-supplied `scheme` and `credentials` fields into an outbound HTTP header without CRLF sanitization. No public exploit has been identified at time of analysis; vendor-confirmed patch is available as v1.3.0.Final.
HTTP CONNECT tunnel authentication bypass in goproxy through v15.3 permits unauthenticated remote clients to establish arbitrary TCP tunnels through a proxy that has basic authentication configured, completely nullifying the access control mechanism. Attackers send CONNECT requests without an Authorization header and the proxy accepts them unconditionally, enabling relay of arbitrary TCP traffic to otherwise-restricted destinations. No public exploit code or active exploitation has been identified at time of analysis, but the attack requires no credentials, no user interaction, and only basic HTTP client capability.
GrowthBook through version 5.0.1 leaks raw warehouse SQL queries, schema details, table names, filter values, and datasource identifiers via unauthenticated public report and experiment endpoints. Any party who obtains a publicly shared report or experiment identifier can retrieve these internal data warehouse details without authentication. No public exploit or active exploitation has been identified, but the exposed SQL and schema intelligence can directly inform subsequent attacks against the underlying data warehouse infrastructure.
Path traversal in MikroTik RouterOS's container package OCI/tar image extraction enables an authenticated administrator to be induced into importing a crafted container image that writes arbitrary files outside the container root onto the device's persistent data partition with root privileges. The vulnerability fires entirely at import time via the `/container/add` endpoint - the container never needs to start - enabling file creation, deletion via overlayfs whiteout, directory creation, and hardlink creation on the host filesystem. No public exploit has been identified and SSVC rates exploitation as none, but the 7.23.x long-term branch remains unpatched indefinitely, with container-7.23.3.npk and container-7.23.4.npk confirmed byte-identical.
Argument injection in HKUDS nanobot's ExecTool shell execution guard allows remote unauthenticated attackers to bypass the command allowlist/denylist filter by embedding newline or carriage-return characters in a command string, causing injected shell segments to execute without inspection. Affected versions are nanobot 0.2.0 and 0.2.1; the root cause is that `_split_shell_segments()` recognized `;` and `|` as command-chain delimiters but not `\n` or `\r`, so a payload on its own line was never checked against allow/deny patterns. No public exploit or CISA KEV listing is identified; patch commit af582246 is available.
Unauthenticated server-side request forgery in Suite Numérique Docs through 5.6.1 allows any anonymous attacker who knows a public document UUID to make the application's cors-proxy endpoint issue outbound HTTP requests to arbitrary hosts, including internal network resources. By abusing DNS time-of-check-time-of-use race conditions and shared address-space bypasses, an attacker can reach internal services and exfiltrate image content that the proxy fetches on their behalf. No public exploit code or CISA KEV entry is associated with this issue at time of analysis, and the confidentiality impact is assessed as limited, so this is a moderate-priority SSRF rather than a catastrophic one — but open, unauthenticated Docs instances should be treated as internet-facing proxies into their own networks until patched.
Missing directory confinement in SP Page Builder's media upload endpoint allows high-privileged authenticated users to write files into arbitrary directories beneath the Joomla web root. The `folder` request parameter bypasses the extension's own boundary checks and is passed directly to `Folder::create()` and `File::upload()`, enabling file placement in sensitive paths such as `administrator/`, `templates/`, and `cli/`. Exploitation is bounded by Joomla's PATH input filter, which prevents traversal above the web root, and the component does not overwrite existing files. No public exploit or active exploitation has been identified at time of analysis.
Unauthenticated CAPTCHA bypass in SP Page Builder Pro (Joomla extension, versions 5.1.4-6.9.0) allows any remote attacker to defeat form bot-protection by supplying attacker-controlled CAPTCHA parameters directly in the HTTP request. The optin_form addon reads the CAPTCHA type, expected answer, and enabled flag from user-supplied request data instead of the server-stored configuration, reducing verification to a trivially solvable md5($captcha_question) == $captcha_answer check where the attacker supplies both operands. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though SSVC classifies it as automatable, making large-scale scripted abuse realistic.
CAPTCHA verification in SP Page Builder Pro's Contact, Opt-in, and Form Builder addons can be defeated on any Joomla site running versions 3.2.6 through 6.9.0 by submitting the parameter view_type=module alongside any non-empty token string. The addon silently discards the CAPTCHA plugin's actual onCheckAnswer verification result and substitutes a trivially-satisfied non-empty-string check whenever this attacker-controlled parameter is present, rendering all configured CAPTCHA types ineffective for forms placed inside SP Page Builder modules. No public exploit has been identified at time of analysis, but the bypass is trivially automatable per SSVC assessment, requiring only a single parameter change in a standard form POST.
Use-after-free in Open5GS AMF component versions 2.0.x through 2.7.x allows network-reachable attackers to corrupt memory in the Access and Mobility Management Function process by triggering the old AMF discovery fallback handler with a crafted interaction. The root cause is premature deallocation of the SBI transaction structure (`ogs_sbi_xact_remove`) before the `discovery_option` argument derived from that structure is fully consumed; the fix relocates the free call past all dependent uses. No public exploit code has been identified; an upstream patch commit is available.
Unauthenticated REST API access on Contec's CPSN-MCB271 series Remote I/O Coupler Unit (Server Type) allows any network-reachable attacker to read industrial I/O sensor values and issue output control commands without credentials. The vulnerability arises from a complete absence of authentication on the device's REST interface, exposing physical process control functions directly over the network. No public exploit code or active exploitation has been identified at time of analysis, though the CVSS 4.0 base score of 6.9 (AV:N/AC:L/AT:N/PR:N/UI:N) reflects a straightforward, condition-free exploitation path.
Database field disclosure in four Regular Labs Joomla extensions - Advanced Module Manager, Conditional Content, Content Templater, and ReReplacer - allows an authenticated high-privilege user to read arbitrary database fields outside the intended scope. The Conditions editor feature accepts user-supplied database table and column names from the HTTP request, which are quoted as SQL identifiers (preventing SQL injection) but are not restricted to the tables and columns supported by Regular Labs integrations. An attacker with administrative access can therefore query unrelated database fields, potentially exposing sensitive Joomla database content such as user records or configuration values. No public exploit code or active exploitation is identified at time of analysis.
XML External Entity (XXE) injection in IBM MQ's mqweb MFT REST API allows network-accessible, low-privileged attackers holding MFT publish authority to read sensitive files from the MQ server filesystem or cause denial of service. Affected deployments span seven release trains across LTS and CD channels from version 9.1 through 10.0.0.0. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; exploitation is constrained by both authentication and a specific MFT publish privilege requirement.
Out-of-bounds write in the Zephyr RTOS ITE it51xxx I2C target driver allows a malicious or compromised I2C master to corrupt embedded controller firmware memory by sending a write transaction exceeding 256 bytes while the controller operates in buffer mode. The FIFO interrupt handler target_i2c_isr_fifo() accumulated bytes into a fixed-size buffer without a pre-write bounds check, enabling overflow into the adjacent target_out_buffer and following static device data in the interrupt handler context. No software privilege on the victim controller is required; the attacker needs physical or electrical access to the I2C bus with both CONFIG_I2C_TARGET and CONFIG_I2C_TARGET_BUFFER_MODE enabled. No public exploit exists and this vulnerability is not listed in CISA KEV at time of analysis.
A use-after-free write in the Zephyr RTOS ITE IT82xx2 USB device-controller driver (drivers/usb/udc/udc_it82xx2.c) affects Zephyr 4.0.0 through 4.4.1 and allows a malicious USB host to create a kernel heap-corruption primitive on the device side. When a multi-packet OUT transfer is received on a non-control endpoint, the driver re-arms the endpoint to keep filling the same net_buf while simultaneously handing that buffer to the upper USB device stack, which may free and recycle it while DMA continues; the completing packet is also submitted a second time, corrupting the event slist and causing a double net_buf_unref(). Exploitation is physical (USB attach) with no authentication or user interaction required, giving a reliable denial of service and plausible adjacent-pool memory corruption; no public exploit code or CISA KEV listing was identified for this CVE at time of analysis.
OAuth redirect URI allowlist bypass in Mattermost's Dynamic Client Registration allows remote unauthenticated attackers to register OAuth clients with attacker-controlled callback hosts. The flaw arises from glob patterns being matched against the raw redirect URI string rather than against parsed URL components, enabling an attacker to embed an allowlisted host or path inside the query string of a malicious URI (e.g., https://evil.com/callback?trusted.example.com/path). A victim who completes the OAuth authorization flow with the rogue client will have their authorization code sent to the attacker's host, enabling potential account takeover. No public exploit or active exploitation (CISA KEV) is confirmed at time of analysis.
ASRock Polychrome SYNC/RGB kernel driver improperly restricts I/O port access via its IOCTL interface, allowing any authenticated local user to force an OS reboot. The driver, installed as part of ASRock's RGB lighting control software for motherboards and VGA cards, accepts crafted IOCTL requests without sufficient validation of target I/O ports, enabling a low-privileged local attacker to cause system-wide availability failure. No public exploit or KEV listing exists at time of analysis; the TWCERT advisory is the primary disclosure source.
Authenticated local attackers on Windows systems running ASRock Polychrome SYNC/RGB can crash the operating system by submitting a specially crafted IOCTL request to the product's installed kernel-mode driver, which dereferences an attacker-supplied pointer without validation (CWE-822). Both the Motherboard (MB) and VGA variants of the software are affected, as confirmed by TWCERT. No public exploit code or active exploitation has been identified; impact is strictly denial of service with no confidentiality or integrity dimension, consistent with the CVSS 4.0 vector scoring VA:H with all other impact metrics at N.
Buffer overflow in the Panasonic Industry USB Driver for MINAS A5/A6 servo drives allows a local low-privileged attacker to crash Windows on machines running PanaTerm or RTEX LogReader software. The root cause is classic unchecked buffer copy (CWE-120) in the driver component bundled with the affected Panasonic software titles. Impact is limited to availability - a successful exploitation stops the Windows OS, but no confidentiality or integrity impact has been identified.
Kernel memory corruption in Apple macOS lets a locally running application crash the operating system or corrupt kernel memory, with the potential for further kernel-level compromise. The flaw is a memory-bounds handling defect (CWE-119) present in macOS versions before Golden Gate 27, Sequoia 15.8, and Tahoe 26.7, and is fixed in those releases per Apple's advisories. Exploitation requires the ability to execute code as a local user (CVSS AV:L/PR:L), EPSS is low at 0.19% (9th percentile), and there is no public exploit code or CISA KEV listing at time of analysis.
Processing a maliciously crafted file on Apple macOS versions below Golden Gate 27 can crash the affected component, causing a denial-of-service, and may potentially leak partial memory contents. The bug is an integer overflow (CWE-190) corrected through improved input validation, and exploitation requires a local victim to actually open or handle the attacker-supplied file, so both a local attack vector and user interaction are prerequisites. Severity is assessed as moderate (assessed CVSS 6.6-level, availability-high with limited-confidentiality impact); EPSS is low at 0.17% (7th percentile), CISA SSVC records no exploitation, and no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Apple macOS contains an improper input validation flaw (CWE-20) that a remote attacker can leverage to crash affected system components, producing a denial-of-service condition on the host. Apple addressed the issue in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7, so all earlier builds of those release trains remain vulnerable. Exploitation requires the victim to interact with attacker-supplied content (CVSS UI:R), and there is no public exploit identified at time of analysis, though the CVSS 3.1 base score of 6.5 reflects a high availability impact with no confidentiality or integrity loss.
Uncontrolled resource consumption in IBM Cloud Pak for Business Automation enables authenticated network users to exhaust service resources and trigger a denial of service condition. Affected versions span the 24.0.0, 24.0.1, 25.0.0, and 26.0.0 release lines, each capped at specific interim fix levels. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
A remote denial-of-service flaw in Apple iOS and iPadOS (all versions before 27) stems from insufficient input validation in a code path that processes remotely supplied content, allowing an attacker to crash or hang the affected feature. Exploitation requires the victim to interact with the malicious input (CVSS UI:R) and yields only availability impact - confidentiality and integrity are unaffected. Apple addressed the issue with improved input validation in iOS 27 and iPadOS 27; there is no evidence of active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, so the practical priority is routine patching rather than emergency response.
An attribute-read sandbox bypass in the PraisonAI multi-agent framework (pip package praisonaiagents before 1.6.59) lets prompt-influenced Python code reach blocklisted dunder attributes such as __class__, __bases__, __globals__ and __dict__, exposing in-process objects and secrets to the attacker. Exploitation requires the execute_code tool's sandbox mode with approval automatically granted (for example via PRAISONAI_AUTO_APPROVE or the YAML auto-approval path), after which two CPython semantics are chained: runtime string assembly evades the AST blocklist and str.format/str.format_map resolve dotted fields through C-level attribute access that never consults the Python-level _safe_getattr wrapper. The result is a high-confidentiality read primitive rather than a complete in-process execution chain; the vendor has published a fixed release (1.6.59) plus a public GitHub advisory containing a reproducer, and there is no CISA KEV listing indicating active exploitation.
Server-side request forgery in PraisonAI's SpiderTools web-scraping component (praisonaiagents before 1.6.59) lets an attacker-supplied public URL pass the initial validation check and then redirect to loopback, private, link-local, or cloud metadata addresses, with the internal response body returned through scrape_page and its extract_links, crawl, and extract_text callers. Exploitation requires the agent to fetch an attacker-influenced URL, and a local-only proof of vulnerability was published in the vendor's GHSA advisory; there is no public exploit tooling and no evidence of active exploitation (not in CISA KEV, EPSS 0.26% / 17th percentile). The issue is fixed in praisonaiagents 1.6.59 (PraisonAI 4.6.59).
HTTP request smuggling in IBM WebSphere Application Server 8.5 and 9.0 (including the Liberty variant) enables unauthenticated remote attackers to manipulate shared HTTP caches, circumvent web application firewall rules, and inject malicious scripts into responses served to other users. The root cause is improper parsing of the HTTP Transfer-Encoding request header (CWE-444), a class of vulnerability that exploits disagreement between a front-end proxy and the back-end application server over where one HTTP request ends and the next begins. No public exploit code or active exploitation has been identified at time of analysis; a vendor-released patch is available.
HTTP request smuggling in IBM WebSphere Application Server 8.5, 9.0, and Liberty allows remote unauthenticated attackers to poison web caches, bypass web application firewall protections, and conduct cross-site scripting attacks by sending specially crafted Transfer-Encoding headers. The root cause is CWE-444, inconsistent interpretation of HTTP request boundaries between WebSphere and a frontend proxy component. No public exploit or confirmed active exploitation has been identified at time of analysis; a vendor patch is available from IBM.
Mattermost's data retention teams API endpoint fails to sanitize returned Team objects, exposing private teams' secret `invite_id` and email fields to any authenticated user holding only the read-only Data Retention Policy permission. An attacker exploiting CVE-2026-91181 can call `GET /api/v4/data_retention/policies/{policy_id}/teams`, harvest the `invite_id` of private teams they have no membership in, and use it to join those teams without authorization - effectively achieving lateral movement across private channels and communications. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis.
Open redirect (CWE-601) in IBM WebSphere Application Server 9.0, 8.5, and Liberty enables remote attackers to conduct phishing campaigns by crafting URLs hosted on the trusted WebSphere origin that silently forward victims to attacker-controlled sites. The vulnerability requires no authentication from the attacker but does depend on social engineering to lure victims into visiting the crafted URL. Successful exploitation allows credential harvesting, further targeted attacks, or brand abuse against organizations relying on WebSphere's trusted domain reputation. No public exploit or CISA KEV listing has been identified at time of analysis.
Server-side request forgery in IBM Langflow OSS 1.0.0 through 1.10.2 enables unauthenticated remote attackers to coerce the application server into issuing arbitrary outbound HTTP requests. Exploiting this flaw, an attacker can probe internal network topology, reach cloud metadata endpoints (e.g., AWS IMDSv1), or use the server as a proxy to bypass network access controls. No public exploit code or CISA KEV listing has been identified at time of analysis, and IBM has released a patch via their support portal.
Server-side request forgery in IBM Langflow OSS 1.0.0 through 1.11.5 permits unauthenticated remote attackers to cause the application server to issue arbitrary outbound HTTP requests. The primary risk is internal network enumeration - mapping services, ports, and hosts reachable from the Langflow deployment that are otherwise inaccessible to the external attacker - and potential use as a pivot to reach internal APIs or cloud metadata endpoints. No public exploit code exists and the CVE is not in the CISA KEV catalog; IBM has issued a patch via its support portal.