2026-09-16
Token generation in EspoCRM through 10.0.8 relies on PHP's non-cryptographic rand() function, producing roughly 31-bit identifiers for lead-capture opt-in links, event invitations, and campaign URLs. Remote unauthenticated attackers who can reach those public endpoints can guess or enumerate valid tokens, allowing them to confirm opt-ins, accept or decline event invitations on behalf of other contacts, and read event details. Publicly available exploit code exists (a vendor commit and a public write-up), but there is no evidence of confirmed active exploitation in the wild, and the CVSS 6.3 rating reflects high attack complexity and only low confidentiality/integrity impact.
HTML injection in the Royal Elementor Addons WordPress plugin before version 1.7.1067 lets unauthenticated visitors inject arbitrary HTML into the administrator notification emails generated by the plugin's form widget. Because form submissions are not sanitized before being embedded in the email body, an attacker can place crafted markup, malicious links, or spoofed content in mail that lands in the site administrator's inbox. Publicly available exploit code exists, and exploitation hinges on the administrator opening the notification email (CVSS UI:R), giving a base score of 6.1; no CISA KEV listing or EPSS score was supplied with the source data.
Missing authorization in yshop-crm through 2.1.3 allows any authenticated back-office user to read CRM approval-workflow data through GET /admin-api/crm/flow/flow-users, disclosing approval chain topology, step ordering, approver identifiers, and personal information such as login names, nicknames, departments, email addresses, mobile numbers, and last-login IP addresses. The endpoint does enforce authentication but omits any role or permission check, so a single low-privilege admin-panel account is sufficient - no elevated privileges, user interaction, or special configuration are required. Publicly available exploit code exists for this issue, although the CVE is not listed in CISA KEV; the practical barrier to exploitation is the requirement to hold or obtain a valid back-office session.
Missing authorization in the StoreProductController onSale handler of Yshop CRM through 2.1.3 allows any authenticated back-office user (regardless of assigned role) to toggle product sale status by calling GET /admin-api/product/store-product/sale with sequential product IDs, letting them withdraw entire catalogs from sale or re-enable withdrawn products. The flaw is an integrity-only issue (CVSS 3.1 base 5.3, PR:L) - it is not reachable anonymously and causes no data disclosure or service outage. Publicly available exploit code exists (a Python PoC published alongside the request), but there is no confirmed active exploitation (not in CISA KEV); this is a genuinely low-to-moderate risk issue despite the CRITICAL-sounding CWE-862 label.
Authenticated back-office users can abuse yshop-crm through 2.1.3 to send SMS and email to arbitrary customers via POST /admin-api/crm/customer/send-sms and /send-mail, because CrmCustomerController does not enforce authorization on those actions. Publicly available exploit code exists, but exploitation requires a valid back-office account (PR:L), is remote with no user interaction, and yields only limited integrity impact; no confidentiality or availability impact is assessed. The practical risk is therefore concentrated on malicious insiders or attackers who have already obtained CRM credentials, not pre-auth compromise of default installations.
Unauthenticated attackers can book time slots in the Appointment Hour Booking WordPress plugin (before 1.5.95) that have already reached their configured capacity, because each appointment in a multi-appointment booking submission is not validated against the capacity limit of its own slot. The plugin assigns a CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N, integrity-only impact), meaning any anonymous visitor can submit a crafted booking form and overwrite or occupy fully booked slots, denying legitimate customers their reservations. Publicly available exploit code exists per WPScan, but the issue is not listed in CISA KEV and EPSS-style mass exploitation signals are absent, so this is best treated as a business-logic abuse and booking-integrity risk rather than a code-execution emergency.
Unauthenticated visitors can mark unpaid Eventin orders of any value as paid by replaying a single genuine low-value payment transaction, because the plugin only checks that the gateway reports success and never validates the amount, currency, or which order the transaction belongs to. The flaw affects WordPress sites running the Eventin event-management plugin before version 4.1.24, and exploit detail is publicly available via the WPScan advisory. There is no indication in the supplied data that this is being actively exploited (no CISA KEV listing), and EPSS data was not provided.
Unauthenticated visitors can inject arbitrary WordPress shortcodes, including attacker-chosen attributes, into Formidable Forms versions before 6.35 because a request-derived value is substituted into a form's custom HTML and then passed through the shortcode parser server-side. Any page rendering an affected form will execute the injected shortcode, which can expose data or alter site behaviour depending on which shortcodes are installed on the target. Publicly available exploit code exists per WPScan, but CISA KEV does not list this issue and the CVSS score is moderate (4.8, AV:N/AC:H/PR:N/UI:N/C:L/I:L/A:N), reflecting configuration-dependent preconditions and limited impact.
A stored/cross-context cross-site scripting flaw (CWE-79) in GitLab CE/EE's Content Editor allows an unauthenticated attacker to run arbitrary JavaScript in a targeted user's session, because pasted HTML is not sanitized properly. All GitLab Community and Enterprise Edition versions from 19.0 up to (but not including) 19.1.8, 19.2.6, and 19.3.2 are affected. Publicly available exploit information exists via a HackerOne report, but the issue is not listed in CISA KEV and its low EPSS-relevant profile (CVSS 4.7, AC:H, UI:R) places it in the moderate rather than emergency tier.
Improper authorization checks in GitLab CE/EE's Generic Package Registry (CWE-862) allow an authenticated user holding developer-role permissions to substitute the content of an existing package file and to hide packages from their legitimate owners. The flaw affects all GitLab Community and Enterprise Editions from 13.9 up to the fixed releases 19.1.8, 19.2.6 and 19.3.2, meaning the exposure window spans multiple major release lines and any long-lived install not patched in this cycle. Impact is integrity-only (CVSS 4.3, AV:N/PR:L/UI:N) - an attacker cannot read or delete data or crash the instance, but they can silently corrupt or conceal artifacts that downstream users and CI pipelines trust; publicly available exploit detail has been published via a HackerOne report.
GitLab CE/EE 13.0 and later (before 19.1.8, 19.2.6 and 19.3.2) fails to properly validate group URL slugs during namespace transfers, allowing any authenticated user to induce a slug collision that leaves the legitimate owners of another group unable to modify that group's settings. The flaw is an availability-only issue (CVSS 4.3, C:N/I:N/A:L) rather than a data-disclosure or code-execution bug, but publicly available exploit detail exists via the linked HackerOne report, and the CWE-862 classification indicates the transfer workflow bypasses the authorization checks that should protect the target namespace. No CISA KEV listing or EPSS score was supplied, so active exploitation is not confirmed.
Improper authorization controls in GitLab Enterprise Edition's compliance framework management allow an authenticated user holding the Security Manager role to execute arbitrary CI/CD jobs and reach protected CI/CD variables inside group projects. Affected are GitLab EE 18.11 through 19.1.7, 19.2.x before 19.2.6, and 19.3.x before 19.3.2, with fixes published in 19.1.8, 19.2.6, and 19.3.2. Exploit details are publicly available via a HackerOne report, and GitLab is credited as the reporter, though the issue is not listed in CISA KEV and no EPSS estimate was supplied.
Loose-mode Unicast Reverse Path Forwarding (uRPF) on certain Arista EOS platforms can fail to drop traffic that the configured source-address verification should have rejected, so packets that ought to be filtered are still processed and forwarded by the switch or router. Only devices running Arista EOS on one of the specific (unnamed) affected platforms and explicitly configured with loose uRPF are exposed - default deployments that do not enable uRPF are not affected, and there is no confidentiality or availability impact, only a loss of filter integrity. No public exploit code and no confirmed active exploitation have been identified at time of analysis; the vendor CVSS score of 5.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N) is well calibrated to this narrow, configuration-dependent filtering failure.
Local attackers with authenticated access can retrieve cleartext-stored credentials from the Fermax DuoxMe Android app versions prior to 4.3.4 and impersonate the user account. This CWE-312 vulnerability requires local access to the device, and on non-rooted devices the app sandbox normally protects the data, so root or device-level access is the practical prerequisite. No public exploit code has been identified at time of analysis, and the risk is assessed as a modest-severity local issue.
An incorrect authorization policy can become active on Arista EOS devices through the gRPC Network Security Interface (gNSI) Authz Rotate RPC, allowing a high-privilege authenticated remote attacker to alter the device's active Authz policy. This integrity-only issue is rated CVSS 4.0 6.9 (Medium; CVSS 3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N) and requires privileged gNSI management credentials; the Bootz service is explicitly unaffected. No public exploit identified at time of analysis, and Arista reports the issue was discovered internally with no known malicious use in customer networks.
Unauthenticated remote attackers can force Siemens WTV676-HB6035 and WTV776-HB6035 industrial web interface devices into protection mode by sending crafted input that exploits improper validation of data received from backend services. Once triggered, the device loses remote connectivity and web access, effectively causing an operational disruption. No public exploit code exists at time of analysis, and this is not listed in CISA KEV.
Unbounded buffering of unacknowledged KV-transfer acknowledgements in the MoRIIO connector of vLLM 0.26.0 and 0.27.0 allows a remote, unauthenticated client to grow worker memory indefinitely and degrade or crash LLM inference serving. The root cause is CWE-400 uncontrolled resource consumption in moriio_connector.py, where acknowledgements whose transfer mapping is not yet populated are appended to _pending_unmapped_acks with no TTL or size cap across request_finished, get_finished and _handle_release_message. Impact is availability-only (CVSS 4.0 base 6.9, AV:N/AC:L/PR:N/UI:N/VA:L); no public exploit code and no CISA KEV
Server-side request forgery in the a2ui agent SDK's FileResolver (a2ui 0.10.0 through 0.10.7) allows a remote, unauthenticated attacker to make the agent process issue attacker-influenced outbound HTTP requests via the httpx.get call in file_resolver.py, enabling access to internal services, cloud metadata endpoints, and other resources reachable from the agent host. Exploitation requires that the deployment actually uses the FileResolver extension's HTTP path and that an attacker can supply or influence the file reference (file_id/URL) the agent resolves; the impact is bounded to server-initiated requests rather than code execution, and the affected product's deployment footprint is very small. Vendor patching is available as an upstream commit/PR, and no public exploit code was identified at time of analysis; the assessed CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N (CVSS 4.0 base 6.9).
Hard-coded cryptographic key exposure in Qualitysoft QND's Windows client allows any local authenticated user to decrypt and recover administrator credentials - including login ID and password - stored or processed by the PC management software. All three product lines (QND Advance, QND Premium, QND Standard) through their respective current versions are affected. No public exploit or active exploitation has been identified, but the attack is low-complexity and requires only a standard Windows session on a machine where the QND client is installed.
Unbound versions 1.22.0 through 1.26.1 built with DNS-over-QUIC support (--with-libngtcp2) can be driven to an abnormal exit by an unauthenticated remote attacker who manipulates QUIC stream state. The attacker sends a DoQ query, withholds ACKs, issues RESET_STREAM to free the per-stream output buffer, then waits for a PTO timeout so ngtcp2 re-encodes a STREAM frame from the freed memory; a spray of roughly 20 such queries forces the daemon down. Default builds compiled without QUIC support are not affected, and exploitation also requires precise timing against the QUIC state machine, making this a moderate, configuration-gated availability threat rather than a top-tier priority. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the authoritative assessment rates it AV:N/AC:H/PR:N/UI:N/S:U with low confidentiality and high availability impact, so the practical outcome is denial of service against the resolver rather than broad data compromise.
Password hash disclosure in Pepperl+Fuchs ICE2/ICE3 IO-Link Master devices and Phoenix Contact IOL MA8 PN DI8 (plus OEM variants) exposes all user credential hashes to any authenticated low-privileged user. The PHP-based diagnostics endpoint `/index.php/diagnostics_tab/ajax_diag_table_rows` accepts a manipulable `schema` path parameter that, when tampered with using a valid session cookie, causes the server to return the device's full user credential hash store. No public exploit or active exploitation has been identified at time of analysis; three separate CERTVDE advisories (VDE-2026-014, VDE-2026-027, VDE-2026-028) indicate the same underlying vulnerability spans multiple vendor product lines sharing common firmware.
Blind SQL injection in the WP Directory Kit WordPress plugin, affecting all versions up to and including 1.5.4, lets an authenticated attacker with 'custom-level access and above' append arbitrary SQL to an existing query through the unescaped 'order_by' parameter and extract sensitive data from the site's database. The flaw carries a CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) because exploitation is network-reachable and low-complexity but gated behind a valid low-privilege account; confidentiality is the only impacted pillar, as the injection is blind and does not permit direct read-out or data modification. No public exploit code or confirmed active exploitation was identified at time of analysis, so the practical risk is concentrated on sites that expose low-privilege accounts and run a vulnerable plugin version.
Keycloak's first broker login flow leaves a temporary account-linking proof behind after a federated identity link is established or manually removed (CWE-613), allowing an attacker who controls the external identity to silently re-establish the link and authenticate as the victim without any further confirmation. The flaw affects Red Hat Build of Keycloak and Red Hat Single Sign-On 7 deployments that use identity brokering, and carries high confidentiality and integrity impact despite a moderate CVSS base of 6.4. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV.
Stored cross-site scripting in the Bold Page Builder plugin for WordPress, affecting all versions up to and including 5.9.6, lets authenticated users with Contributor-level access plant persistent JavaScript that executes in the browser of anyone who views the injected page. The plugin's bt_bb_save_pre filter is bypassable via null-byte injection, and the bt_bb_raw_content shortcode handler outputs base64-decoded content without adequate sanitization, so payloads survive the intended checks. No public exploit code or CISA KEV entry was identified at time of analysis; the supplied Trac changeset indicates an upstream fix has been committed, but no patched release version is confirmed in the available data.
Stored cross-site scripting in the Advanced Popups WordPress plugin (all versions up to and including 1.2.3) lets an authenticated attacker holding author-level rights or above inject arbitrary JavaScript through the popup 'Notification Button Link' field, which is then rendered unsanitized to every visitor of the affected page. Because the payload is persisted in the site's database, any visitor — including administrators — who opens the injected page will execute the script in their own browser session. No public exploit code and no CISA KEV entry were reported at the time of analysis, and the maintainers shipped a fix in version 1.2.4.
Duplicate-submission gate bypass in the Tempo payment method of ZenHive mpp (versions 0.2.0 through 0.16.1) lets an unauthenticated remote client pass the pre-broadcast dedup reservation twice using a single signed transaction - once with recovery id v=27 and once with v=0 - because the reserve key is derived from the caller-supplied raw transaction hex rather than a canonical form of the transaction. The post-broadcast mark then writes the canonical hash key that the raw-keyed reserve never reads, so the two encodings never collide. Impact is real but bounded and conditional: a node that rejects nonce reuse fails closed and produces no harm, while a node that returns the canonical hash for an already-known transaction can issue a second valid Payment-Receipt for a single on-chain payment; confidentiality and availability are unaffected, and no public exploit code has been identified at time of analysis.
ZenHive mpp (MPP.Plug payment middleware for Elixir/Phoenix) versions 0.1.0 through 0.16.1 can allow a shared HTTP cache - a CDN or reverse proxy - to store a paid 200 response together with its Payment-Receipt header and replay both to clients that never paid, because the library's own Cache-Control: private is silently replaced when the mounting application sets its own cache directive on the same connection. An unauthenticated remote client that reaches such a cache can therefore obtain paid content and a valid receipt for free, and a related weaker case has a downstream non-2xx response still carrying a Payment-Receipt for a resource that was never delivered (CWE-524). The real-world risk is tightly bounded: the library's default behavior (private on success, no-store on 402) is safe, so the leak requires an application-level caching misconfiguration plus a shared cache in the response path, and no public exploit code was identified at time of analysis.
Reflected cross-site scripting in the Better Messages WordPress plugin (Chat Rooms, Group Chat, Private Messages & AI Chat Bots) affects all versions up to and including 2.15.22, where the 'icn' parameter is neither sanitized on input nor escaped on output. An attacker who can craft a link with a malicious 'icn' value and persuade a logged-in or anonymous visitor to click it can execute arbitrary JavaScript in that victim's browser context on the affected site. No public exploit code or active exploitation has been reported, but the flaw is trivially automatable and the fix is already published in the 2.15.23 tag.
Malformed PIM Sparse Mode messages can crash the Pimsm agent on Arista EOS switches, causing a sustained denial of service when an unauthenticated, network-adjacent attacker repeatedly sends the triggering traffic. Exploitation is constrained to devices where both PIM Sparse Mode and MLAG are configured simultaneously - a non-default combination, and the attacker must be Layer-2 adjacent rather than Internet-reachable. Impact is availability-only: the Pimsm agent auto-restarts, so a single malformed message causes only a brief multicast-routing interruption, while continuous repetition is required to keep the agent in a restart loop. No public exploit code has been identified at time of analysis, and the issue is not confirmed as actively exploited (no CISA KEV listing); risk is bounded rather than urgent.
A crafted OSPFv2 packet delivered by an adjacent OSPF neighbor can force an unexpected restart of the OSPF process on Arista EOS devices that run both OSPFv2 and OSPFv2 segment routing, producing an availability-only denial of service (CVSS 6.5, AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Only deployments with segment routing enabled under OSPF are exposed, since this is not a default OSPF setting, and the attacker must already be positioned on the same routing segment or link (typically a compromised or rogue device inside the OSPF domain) rather than an arbitrary internet host. No authentication or user interaction is required once adjacency is achievable, repeated packets can sustain the outage, and no public exploit code or confirmed active exploitation has been identified at time of analysis.
An authenticated user with gRPC/gNSI access on Arista EOS can retain permissions that a security policy rotation was supposed to revoke, because a race condition in the gNSI Authz service causes the policy rotation to fail silently when multiple gNSI transports are configured on the device. Only non-default deployments with more than one gNSI transport are affected, Bootz is explicitly out of scope, and the flaw does not grant new privileges - it merely preserves access the attacker already legitimately held, so the outcome is a stale authorization state rather than a privilege escalation. Exploitation requires the revocation and the race to coincide, making it opportunistic rather than attacker-triggerable on demand; Arista discovered the issue internally and reports no malicious exploitation, and no public exploit code has been identified at time of analysis. The vendor's CVSS 4.0 score of 6.0 is well-calibrated for a genuinely moderate, not critical, issue.
An authorization bypass in the Ash framework (Elixir) lets authenticated, lower-privileged actors recover values they are not permitted to see by using filtered calculations or aggregates as a yes/no oracle. Ash field policies are designed to protect against filter-based disclosure by rewriting references to forbidden attributes into an expression that evaluates to nil, but prior to 3.33.4 that rewriting only matched Ash.Resource.* structs and not Ash.Query.Calculation or Ash.Query.Aggregate structs, so filters on those ran against real values. Any application that uses Ash.Policy.Authorizer with field policies on calculations or aggregates and exposes filter arguments (commonly via AshGraphql or AshJsonApi) is affected; no public exploit identified at time of analysis, and the disclosure is gradual - one probe at a time - with no integrity or availability impact.
Unauthenticated HTTP/2 requests to Fastify routes that register response trailers crash the entire Node.js process, dropping all in-flight requests and repeating the outage on every restart. The flaw affects Fastify versions before 5.12.5 and requires two non-default, application-specific conditions: the server must have HTTP/2 enabled and at least one route must call reply.trailer(). No public exploit code or confirmed active exploitation is identified at time of analysis, and the 5.9 CVSS score reflects a bounded availability-only impact rather than a high-severity compromise. Fastify 5.12.5 contains the fix.
Denial of service in NLnet Labs Unbound 1.12.0 through 1.26.0 arises from a use-after-free in the DNS-over-HTTPS (DoH) code path, reachable only in builds compiled with --with-libnghttp2 when failure conditions such as an RPZ drop action or heavy-traffic stream jostling occur. A remote, unauthenticated attacker can trigger the flaw with a single DoH connection and appropriate traffic, causing memory corruption that, under a hardened allocator, results in controlled termination of the Unbound process. No public exploit code has been identified at time of analysis; the impact is confined to availability (CVSS 5.9, C:N/I:N/A:H) with no confidentiality or integrity effect.
CPU exhaustion denial of service in jwcrypto's JWK.import_key() allows a remote unauthenticated attacker to supply a crafted JWK with an arbitrarily large key_ops array and trigger O(n²) duplicate-detection work, consuming CPU proportional to the square of the array length. Any Python application that passes externally-supplied JWK material to this API - via ECDH-ES key agreement, OIDC dynamic client registration, DPoP proof parsing, or ACME account key registration - is vulnerable. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; CVSS rates this at 5.9 (Medium) with AC:H reflecting the requirement that attacker-controlled key material must reach the vulnerable code path.
Information disclosure in the a2ui agent-to-UI rendering library (versions 0.8, 0.9, and 1.0) lets a caller that can drive an A2UI surface read JavaScript prototype-chain members - such as __proto__, constructor, toString, and valueOf - through the Model Processor's data-binding path resolver, leaking internal object structure rather than application data. The flaw is an unauthenticated-of-the-network-but-role-limited (CVSS PR:L) defect in model-processor.ts, where path segments are evaluated as current[segment] without an own-property check; impact is limited to low confidentiality loss with no integrity or availability effect, and there is no public exploit identified at time of analysis. Vendor risk is low-to-moderate: a fix exists upstream as commit 1b3bff23 (PR #2355), but no tagged patched release has been independently confirmed.
Resource exhaustion in the a2ui component framework versions 0.9 and 0.9.1 allows remote attackers with low-privilege authenticated access to degrade availability by invoking the updateComponents function of basic_functions.ts with manipulated input. Impact is confined to a low availability effect (VA:L) with no confidentiality or integrity loss, and the vendor was notified through a public issue report but has not responded or produced a fix. No public exploit code and no confirmed active exploitation were identified at time of analysis, and because a2ui is a niche, early-version open-source project with minimal deployment, the practical risk is low to moderate despite the CVSS 4.0 base score of 5.3.
Algorithmic complexity attacks against DNSSEC validation in NLnet Labs Unbound 1.26.0 and earlier let remote unauthenticated attackers degrade resolver performance by steering queries to malicious zones that amplify validation work - TagTrap (floods of mismatched DNSKEY/RRSIG/DS records), DelegationTrap (deeply nested chain-of-trust validation), NsecTrap (excessive invalid NSEC records), and AdditionalTrap (Unbound's default DNSSEC validation of the ADDITIONAL section). Exploitation requires a DNSSEC-validating Unbound resolver and attacker control of the zone being resolved, and impact is limited to resource exhaustion (CVSS 5.3, availability Low) rather than compromise or a guaranteed crash. No public exploit identified at time of analysis, and the attacker must be able to drive query volume through the resolver for meaningful effect.
Sustained high-rate streams of distinct uncached names over TCP or DNS-over-TLS can monopolize a single NLnet Labs Unbound worker's event loop, degrading resolver availability for other clients in Unbound versions up to and including 1.26.0. The issue is remotely reachable and unauthenticated (assessed CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L), but the attacker must hold a connection and keep write throughput ahead of the server's drain/processing so the unbounded consecutive-read loop never yields; impact is confined to the affected worker, is degradation rather than a crash, and ends once the traffic stops, while connection caps, query-rate limits, and upstream rate-limiting reduce feasibility. No public exploit identified at time of analysis, and no evidence of confirmed actively exploited (CISA KEV) status; the vendor's CVSS of 5.3 is consistent with this modest degradation-of-service profile.
The Ad Inserter – Ad Manager & AdSense Ads WordPress plugin (all versions up to and including 2.8.16) exposes administrator-configured header and footer code blocks to unauthenticated visitors through the `ai-debug-code` URL parameter, because the debug handler performs no capability check. An attacker who can reach a site running the vulnerable plugin can simply append that parameter to a request and read code fragments — ad scripts, analytics snippets, custom CSS/JS — that the site owner deliberately disabled from public display. The impact is confidentiality-only (CVSS 5.3, PR:N/UI:N), and there is no public exploit code or CISA KEV listing identified at time of analysis.
Mass assignment (CWE-915) in the a2ui message-processing component lets an authenticated remote attacker inject arbitrary, dynamically-determined object attributes by submitting crafted messages to the message processor, producing limited confidentiality, integrity and availability effects. All a2ui versions up to and including 0.10.6 are affected according to the CPE range, and the upstream maintainers have not responded to the reported issue (#2297), so no patched release exists. No public exploit code and no CISA KEV entry were identified at time of analysis; the EPSS probability was not supplied with the input data.
Open redirect in the A2UI web rendering library (a2ui-project a2ui) through version 0.10.7 lets an attacker craft a URL that the Binder component's openUrl handler forwards to the
Server-side request forgery in the AWS Strands Python integration of ag-ui (ag_ui_strands) 0.3.0 allows a user who can submit a chat message to make the agent backend fetch an arbitrary URL through urllib.request.urlopen, reaching loopback, RFC1918, link-local and cloud metadata addresses from the server's network position. The flaw lives in the multimodal content path, where image, document or video attachments can be supplied as URLs rather than inline data, and the pre-patch code applied no scheme, host or redirect validation. Impact is bounded rather than devastating (CVSS 4.0 base 5.3, PR:L), and no public exploit code or CISA KEV entry was identified at time of analysis; the upstream fix commit bf0c34df34cbb4b1992bc37c9bfffe6dd54bb189 is public and referenced by issue #2432 and pull request #2491.
Arista EOS devices that run OpenConfig-based management services (gNMI, gNSI, RESTCONF, NETCONF) can inadvertently write sensitive request and response payloads into logs that persist on the local switch or are forwarded to remote accounting/AAA servers. The leaked material includes plaintext CLI secrets such as 'username bob secret myPass' and sensitive OpenConfig YANG leafs like system/aaa/global/tacacs/config/secret-key, so the exposure is a credential/secret disclosure problem rather than an integrity or availability issue. Exploitation requires that those services be enabled, that secrets actually transit them, and that an attacker obtain read access to the resulting log or accounting sinks; triggering also requires an authenticated actor (PR:L) and some user interaction (UI:P) per the assessed vector. The issue was found internally by Arista, which states it has no evidence of malicious exploitation in customer networks, and no public exploit code has been identified at time of analysis. gRPC-based streaming telemetry from the Streaming Telemetry Agent to CloudVision is explicitly not affected.
Cross-site scripting in the a2a-chat-canvas markdown rendering component of a2ui (a2ui-project) up to version 0.10.7 allows a low-privileged authenticated user to plant script that executes in another user's browser when the chat canvas renders the crafted content. The defect lives in samples/community/client/angular/projects/a2a-chat-canvas/src/lib/services/sanitizer-markdown-renderer-service.ts, where markdown is converted to HTML without fully neutralizing dangerous markup, yielding an integrity/behavior impact (VI:L) rather than data disclosure (VC:N). There is confirmed CISA KEV status: no active exploitation has been reported, no public exploit code exists, and tracking is currently handled through a public GitHub issue rather than a formal vendor security bulletin.
CSS injection in the A2UI Angular Renderer (a2ui-project/a2ui through 0.10.6) lets a party who controls server-to-client messages embed arbitrary strings in the theme.primaryColor field, which the renderer writes unvalidated into the host element's --a2ui-color-primary CSS custom property. Because the theme is declared with z.any() in renderers/web_core/src/v0_9/schema/server-to-client.ts, values such as url(https://attacker.example/beacon) bypass validation and reach the DOM style layer, enabling UI spoofing, outbound request beacons and potential data exfiltration from affected Angular applications. Exploitation requires the ability to inject or manipulate the message stream consumed by the renderer (PR:L) plus a passive user action (UI:P); the vendor has published fix commit fb8e85aec78d04e81feb9992a57638ca1ec4dc1b (PR #2367). There is no CISA KEV listing and no public exploit identified at time of analysis.
An out-of-bounds read in the HTTP Cache-Control response header parser of the QtNetwork module lets a hostile or compromised HTTP server crash 64-bit client applications built on Qt 6.0.0-6.8.8 or 6.9.0-6.11.1 that use QNetworkAccessManager. The trigger is an excessively large Cache-Control header value returned to the requesting client; because the over-read is read-only, the outcome is limited to a denial of service (application crash) with no information disclosure and no code execution, and only the client side of the connection is affected - 32-bit builds are not affected. No public exploit code has been identified at time of analysis, and exploitation is not on-demand against an arbitrary target: the victim application must be induced to connect to an untrusted, attacker-controlled, or compromised server (reflected as AT:P in the CVSS 4.0 vector), which keeps real-world risk at a low-to-moderate level despite the presence of RCE and Information Disclosure tags in some feeds.
Unbound 1.13.2 through 1.26.1 can serve tampered contents of a ZONEMD-checked zone that sits below - but not at - a DNSSEC trust anchor, because the DS/DNSKEY chain resolution needed to validate the zone must complete asynchronously and the zone data is released (and, with the zonefile: option, written to disk) before the ZONEMD digest check concludes. In memory the exposure is self-correcting: once verification fails the data stops being served, but a tampered copy written to disk persists and is reloaded at the next startup until verification again concludes. Per the independent assessment this is a low-to-moderate integrity/authenticity issue (CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N; vendor score 4.4) requiring a non-default zone/trust-anchor topology and precise timing, with no confidentiality or availability impact and no public exploit identified at time of analysis.
Protected environment deployment approval bypass in GitLab Enterprise Edition allows authenticated users holding Owner or Maintainer role to silently disable deployment approval requirements under certain conditions, enabling unapproved changes to reach production environments. Affected versions span 17.1 through 19.3.1. No public exploit has been identified and the issue is not listed in CISA KEV, but the integrity impact is business-significant for organizations relying on these gates for change-control or compliance purposes.