Cross-tenant record tampering in HomeBox versions prior to 0.26.0 allows an authenticated low-privileged user to overwrite or permanently delete another group's maintenance entries by supplying a maintenance-entry UUID that belongs to a different tenant. The flaw is a CWE-639 broken object-level authorization (IDOR) in the maintenance-entry update and delete repository paths, which act on the caller-supplied ID without confirming the record belongs to the caller's active group; exploitation requires a valid session plus knowledge of a non-enumerable random UUID, so it is access-gated rather than trivially reachable and is practically limited to multi-group/multi-tenant deployments. Impact is blind write/delete only with no data disclosure, and there is no public exploit identified at time of analysis and no indication of active exploitation. Vendor-released patch: 0.26.0.
HomeBox versions prior to 0.26.0 allow an authenticated low-privilege user to read and overwrite another tenant's notification configuration via PUT /v1/notifiers/{id}, exposing plaintext Shoutrrr credentials (Slack, SMTP, Telegram, Pushover, Discord) that are stored inside the notifier URL. The primary assessed impact is credential disclosure (high confidentiality), with a more limited integrity impact from the ability to point the victim's notifications at an attacker-controlled webhook. Exploitation requires a multi-tenant HomeBox deployment, a valid account, and knowledge of the victim's notifier UUID - UUIDs are not enumerable, which is the main real-world limiting factor; no public exploit has been identified at time of analysis, and the vendor fixed the issue in 0.26.0.
An authorization flaw in the pki-core v2 REST ACL filter lets an authenticated member of the default Certificate Manager Agents group invoke profile-management operations reserved for Administrator-level accounts, so a request to POST /v2/profiles/raw that should require profiles.create is instead authorized under the lower-privileged profiles.approve permission. The root cause is that when a literal ACL key (profiles.create) and a wildcard ACL key (profiles.approve) both match, the filter picks the winner by lexicographic string comparison rather than by specificity, allowing the wildcard mapping to override the more specific literal one; CVSS 3.1 rates this 8.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), with the highest threat to the confidentiality and integrity of the CA's issuance policy. Exploitation requires valid agent-level credentials and the default ACL configuration, and no public exploit code has been identified at time of analysis, so this is a privilege escalation inside an existing trusted role rather than unauthenticated access.
A path traversal (CWE-22) vulnerability in CRI-O's container checkpoint/restore feature allows a highly privileged, remote attacker to perform unintended operations on the host filesystem by supplying a malicious checkpoint archive during container restoration. Exploitation requires the non-default checkpoint/restore functionality to be enabled and the attacker to have high privileges (PR:H) to trigger restoration of untrusted content, resulting in a scope change from container to host with full confidentiality, integrity, and availability impact (CVSS 8.0). No public exploit identified at time of analysis. Affected products include Red Hat OpenShift Container Platform 4 as per CPE data.
SQL injection in Chartbrew versions prior to 5.2.3 allows an unauthenticated remote attacker to break out of an intended string literal and execute arbitrary ClickHouse SQL whenever a ClickHouse-backed chart uses variable binding and the attacker controls the variable value; the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms no privileges or user interaction are required, and the subsequent scope increase (SC:H/SI:H/SA:H) reflects impact landing on the ClickHouse data source rather than Chartbrew itself. The vulnerable path is fully exposed through public dashboards, while non-public dashboards require an authenticated session. Exploitation can disclose data stored in the ClickHouse instance and, where the ClickHouse configuration permits file or URL table functions, reach local files or internal network resources; vendor-released patch: 5.2.3, and no public exploit code has been identified at time of analysis. This is a genuine, high-priority CWE-89 issue with a credible unauthenticated path, though its reachability depends on the deployment using the ClickHouse plugin with variable bindings.
Command injection in CrossWire Xiphos 4.3.2 and earlier lets a local attacker execute arbitrary shell commands with the privileges of the user running the application by placing shell metacharacters in data that Xiphos later interpolates into unsanitized popen() shell pipelines. Two code paths are involved: the personal-commentary rename action (on_rename_perscomm_activate in src/gtk/menu_popup.c), where the module section name is spliced into a cd/sed command, and the separate-image viewer (show_separate_image in src/main/url.cc), where an image filename is spliced into an external viewer's command line. Exploitation requires the victim to trigger one of those actions on attacker-supplied data (a crafted module or image file), the impact is confined to the victim's own account because no privilege escalation is demonstrated, and publicly available exploit code exists (SSVC records exploitation as 'poc'), although the issue is not in CISA KEV and EPSS is low at 0.15% (5th percentile).
Local privilege escalation in BleachBit on Windows lets an unprivileged local user turn an elevated cleaning operation into arbitrary privileged file deletion and, via Windows Installer rollback behavior, full SYSTEM privileges. The flaw affects BleachBit versions prior to 6.0.1 and is exploitable by an authenticated, unprivileged interactive user who wins a TOCTOU race while BleachBit runs with elevated rights in privileged Windows cleaning mode; the vector is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (7.8). No public exploit code was identified and there is no CISA KEV listing at time of analysis, so the practical risk is a genuine local privilege-escalation issue worth prioritizing on Windows hosts that run BleachBit with elevation.
Local privilege escalation in Dell Inventory Collector Client versions prior to 15.0.0 allows a low-privileged Windows user to place a malicious executable along an unquoted service search path, resulting in code execution in the context of the affected service and elevation of privileges. The attack is not network-reachable and requires an existing local foothold plus write access to a directory that precedes the legitimate binary on the unquoted path, with the vulnerable component restarted or re-launched so the path is re-resolved. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor rates the issue 7.8 High (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H); vendor-released patch: 15.0.0.
Local privilege escalation in Zephyr RTOS allows an unprivileged user-mode thread that holds access to the Intel time-aware GPIO (TGPIO) device object to perform two uncontrolled 8-byte supervisor-mode writes to attacker-chosen kernel addresses via the tgpio_pin_read_ts_ec() syscall. The syscall's verification handler omitted the K_SYSCALL_MEMORY_WRITE() check that the sibling handlers in the same file already perform, converting a benign timestamp read-back into a write-what-where primitive that can corrupt kernel data structures, escalate the calling thread to supervisor privilege, or crash the system. Exposed builds are narrow: CONFIG_USERSPACE=y and CONFIG_TIMEAWARE_GPIO=y must both be set, and because the affected source file failed to compile from v3.6.0 until after it was repaired past v4.4.0, the realistically exposed population is v3.5.0 builds plus downstream trees that locally patched that build breakage; no public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV), though it is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Dell Command PowerShell Provider (DCPP) versions prior to 2.10.2 write sensitive information - specifically credentials passed to its cmdlets - into the Windows PowerShell event log, where they can be harvested by a low-privileged local user who can read that log. Exploitation requires an authenticated local presence on the Windows host (CVSS vector AV:L/PR:L) and depends on privileged automation having actually run through DCPP so that secrets were logged first; no user interaction is required. There is no public exploit code identified at time of analysis and the issue is not in CISA KEV, but the vendor assigns it a 7.8 severity while our independent assessment treats the impact as confidentiality-only (C:H/I:N/A:N), materially lowering real-world risk given the local-only vector, the dependency on prior DCPP use, and the niche deployment footprint.
Missing authorization checks on Warpgate's recording-stream WebSocket let any authenticated user with an ordinary account watch live terminal input and output from other people's proxied sessions. Specifically, api_get_recording_stream in warpgate-admin/src/api/recordings_detail.rs guards /@warpgate/admin/api/recordings/{uuid}/stream with session authentication only and never calls require_admin_permission for AdminPermission::RecordingsView, so an attacker who can identify an active recording's UUID receives, in real time, the keystrokes and output of proxied SSH, MySQL, and PostgreSQL sessions - including credentials and commands belonging to regular users and administrators. Warpgate versions prior to 0.25.6 are affected and the flaw is fixed in 0.25.6 (CVSS 3.1 7.7, AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N); the attack is authenticated and timing-dependent because the recording must be actively streaming, and no public exploit code was identified at time of analysis.
Stored cross-site scripting in Joplin's Fountain screenplay rendering path lets a malicious Fountain code block execute script in the note viewer whenever Fountain rendering is active. Affected are Joplin desktop and mobile clients prior to 3.6.15 and 3.7.2, plus Joplin Server deployments where published notes are rendered with Fountain enabled by default; the injected script can read content later loaded into the reused note viewer, and when published notes share the server's origin it can reach data available to an authenticated browser session in that origin. Exploitation requires the attacker to plant the malicious Fountain block in a note the victim renders (consistent with the PR:L vector), and no public exploit code was identified at time of analysis - the risk is real but gated on Fountain rendering being enabled. Fixed versions 3.6.15 and 3.7.2 are available.
Server-side request forgery in self-hosted draw.io (jgraph/drawio) prior to 30.3.8 lets an unauthenticated remote attacker point the /embed2.js?fetch= endpoint at internal IPv6 Unique Local Address (ULA) resources and read the reflected response, including AWS instance metadata served on the fd00:ec2::/32 range, which can expose IAM credentials and other sensitive internal data. The flaw is a filter bypass rather than a missing check: the private-address guard compared the JDK's fully expanded IPv6 text form against the compressed prefixes 'fc00::' and 'fd00::', so the entire fc00::/7 ULA space slipped through. Exploitation requires a reachable self-hosted draw.io instance and an internal target genuinely addressable over IPv6 ULA - IPv4 private ranges remain blocked, and neither authentication nor the ENABLE_DRAWIO_PROXY=1 flag nor DNS rebinding is needed on the primary /embed2.js path. No public exploit code was identified at time of analysis, and the issue is not confirmed actively exploited (no CISA KEV listing); the CVSS 4.0 base score is 7.7 (High), reflecting a network-vector, scope-changing confidentiality impact.
Unauthenticated remote attackers can exhaust memory and trigger an out-of-memory kill of Envoy Proxy by sending HTTP/2 requests that include a large Host header alongside an existing :authority pseudo-header, since the discarded Host value is copied but never charged against header size or count limits, and HPACK dynamic-table indexing lets an attacker repeatedly reference that large value across a bounded number of streams. All Envoy releases before 1.36.10, 1.37.6, 1.38.4, and 1.39.1 are affected, including both the nghttp2 and oghttp2 HTTP/2 codec implementations, and the flaw is reachable on any listener that terminates HTTP/2 with no authentication or user interaction required (CVSS 3.1 base 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, CWE-401). No public exploit code and no confirmed active exploitation have been identified at time of analysis, but the low complexity and lack of prerequisites make this a practical availability risk for internet-facing edge proxies; note the supplied "Authentication Bypass" tag is misleading - the impact is availability-only, with no confidentiality or integrity loss.
Envoy Proxy releases prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1 can be crashed by a remote, unauthenticated attacker through its HTTP/3 datagram and Capsule Protocol handling (prerequisites: PR:N, no user interaction). When a request enters a stream-recreation path such as an internal redirect, the HttpDatagramHandler keeps a cached pointer to the original RequestDecoder; a subsequent HTTP/3 datagram invokes decodeData through that freed decoder, producing invalid virtual dispatch and process termination (CWE-416 use-after-free, CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H). Exploitation is gated on a non-default configuration - HTTP/3 (QUIC) downstream plus Capsule Protocol enabled, e.g. MASQUE connect-udp tunneling - combined with an internal-redirect route and precise frame sequencing; no public exploit code or CISA KEV entry was identified at time of analysis.
Unauthenticated remote clients can crash Envoy Proxy by sending a path-less CONNECT request when the ext_authz HTTP filter is configured to apply query_parameters_to_set or query_parameters_to_remove mutations and the external authorization service returns such a mutation. The crash is a null-pointer dereference in the ext_authz filter's Filter::onComplete path, producing a denial of service (CVSS 7.5, A:H) against the affected proxy process; impact is limited to availability, with no confidentiality or integrity loss. Exploitation is gated by two non-default configuration prerequisites - accepting path-less CONNECT and enabling ext_authz query-parameter mutation - and no public exploit code has been identified at time of analysis.
Stored cross-site scripting in Joplin Server before 3.7.7 allows an authenticated, low-privileged user to publish an empty-title resource whose attacker-controlled MIME type (image/svg+xml) is served inline, so a crafted SVG executes in a victim's browser when the public share link is opened. The flaw lives in the GET /shares/:id?resource_id= route, which reflects the user-supplied MIME and omits Content-Disposition when the resource title is empty; under the default configuration user content shares the Joplin Server application origin, so the script can read same-origin administrative data and anti-CSRF tokens and, against an authenticated victim, act with that victim's session. Installations that set a separate USER_CONTENT_BASE_URL still execute the script, but confined to the user-content origin; the issue is fixed in 3.7.7 and no public exploit code was identified at time of analysis.
Denial of service in Envoy Proxy releases prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, where the optional oghttp2 upstream HTTP/2 codec accepts a response trailer HEADERS frame that lacks the END_STREAM flag, causing Envoy to complete and deferred-delete the ActiveRequest while oghttp2 keeps the stream open. The resulting dangling reference in ClientStreamImpl (response_decoder_) can be dereferenced by a subsequent frame on that stream, freeing-then-using memory and crashing the Envoy process (CWE-20, CVSS 3.1 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - assessed independently at AC:H). Exploitation is remote and unauthenticated once preconditions hold, but it is limited to non-default configurations: the oghttp2 upstream codec must be explicitly enabled, the malformed trailers must be emitted by the upstream server Envoy proxies to (an attacker-controlled or compromised upstream, or injected frames on that connection), and the default nghttp2 codec rejects the malformed trailers outright. Vendor patches are available (1.36.10, 1.37.6, 1.38.4, 1.39.1); no public exploit code was identified and the issue is not in CISA KEV at time of analysis.
An access-control bypass in Envoy Proxy (all versions prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1) allows unauthenticated remote clients to reach routes that HTTP RBAC policies were configured to deny, resulting in disclosure of protected content. The flaw only materializes when a NEGATIVE (DENY) policy uses a safe_regex matcher against header values and a byte-oriented route matcher independently reads the raw header bytes; positive ALLOW regexes fail closed and exact, prefix, suffix, and contains matchers are unaffected. No public exploit code has been identified at time of analysis, and the vendor has released fixed versions, so real-world risk is driven almost entirely by whether a deployment uses that specific safe_regex-in-negative-policy configuration.
Request smuggling in Envoy Proxy allows an unauthenticated HTTP/2 client to embed a complete HTTP/1.1 request inside the data payload of an extended CONNECT (a generic, non-WebSocket HTTP upgrade) so that Envoy forwards that payload upstream before the upstream has accepted the upgrade, writes it unframed to a keep-alive HTTP/1.1 upstream, and returns the upstream socket to the shared pool with a smuggled response still queued - meaning a different, unrelated downstream client can subsequently be served the attacker's response. Every Envoy release prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1 is affected, but exploitation is configuration-dependent: the listener must proxy a generic non-WebSocket upgrade to an HTTP/1.1 upstream with backend keep-alive enabled, shared (non-per-downstream) connection pools, and max_requests_per_connection not set to 1; WebSocket upgrades, plain CONNECT, disabled backend keep-alive, per-downstream pools, and max_requests_per_connection=1 are explicitly out of scope for the demonstrated path. No public exploit code has been identified at time of analysis, and this CVE is not listed in CISA KEV.
Authenticated x-ui panel users (including low-privilege ones) can broaden the network exposure of the panel's xray management gRPC listener in version 0.3.2 by editing the xray configuration template in the settings interface and then triggering a panel restart, which regenerates that listener bound to a non-loopback address instead of its intended loopback-only binding. The flaw is an improper access control issue (CWE-284) that lets any panel account change a network-exposure boundary it should not control; practical impact depends on a second party being able to reach the newly exposed gRPC endpoint, and exploitation requires valid panel credentials plus the ability to restart the panel (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L per independent assessment). There is no confirmed active exploitation (not in CISA KEV), no public exploit code identified at time of analysis, and EPSS is very low at 0.15% (5th percentile), so the risk signals are mixed and lean toward moderate-but-not-urgent priority.
Path-based RBAC authorization bypass in Envoy Proxy lets an unauthenticated remote client reach protected backends such as /admin by appending a semicolon path parameter (e.g. /admin;x), because the router strips that suffix before route matching while the RBAC url_path matcher evaluates the untouched raw path. Exploitation is tightly gated rather than default: it requires a route configured with ignore_path_parameters_in_path_matching, a path-based RBAC rule (PathMatcher or UriTemplateMatcher) guarding the protected path, and a crafted request that still selects the protected route after stripping. All releases prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1 are affected; the vendor has published fixed releases, and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Memory exhaustion in Apache MINA's CompressionFilter lets unauthenticated remote attackers crash the affected JVM by sending ZLib-compressed data that inflates to an unbounded size, since the pre-fix filter allocates an output buffer proportional to the decompressed result without enforcing any limit (CWE-409, CVSS 3.1 7.5, AV:N/AC:L/PR:N/UI:N with availability-only impact). The flaw is reachable only in deployments that instantiate the filter for inbound decompression (compressInbound=true) and expose that endpoint to untrusted network peers; applications that never enable CompressionFilter, or that already configure a maxDecompressedSize bound, are not affected. Our assessment rates this a genuine but bounded availability risk rather than a critical priority, and no public exploit code was identified at time of analysis; there is no KEV listing or confirmed in-the-wild activity.
Denial of service in FalkorDB v4.20.1, the Redis-module graph database, where the GRAPH.EFFECT replication handler in src/effects/effects_apply.c enforced graph-state assumptions with ASSERT() calls instead of proper error handling. Remote attackers who can reach the Redis endpoint and issue GRAPH.EFFECT with an effects buffer referencing a node ID or label schema that does not exist locally trip a reachable assertion and crash the process (CVSS 3.1 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), with impact confined to availability and no data disclosure or integrity effect. No public exploit code or active exploitation has been confirmed at time of analysis, though the attack primitive is simple: a single crafted command against an unauthenticated or credentialed Redis instance. The vendor has published an upstream fix in commit 17cb1f8f0 (PR #2247).
A memory leak in SmallRye Fault Tolerance, the fault-tolerance library used by Quarkus for retries, circuit breakers, and related resilience patterns, allows unauthenticated remote attackers to steadily exhaust application heap and cause denial of service on services that expose endpoints using the @ApplyGuard or @ApplyFaultTolerance annotations. Each request routed through those fault-tolerance guards allocates internal tracking objects that are never released, so sustained traffic grows memory usage until the JVM slows and crashes with an out-of-memory condition. The vendor CVSS 3.1 base of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) rates this as high-severity availability-only impact, consistent with the CWE-400 uncontrolled resource consumption classification and the 'Denial Of Service' tag; no public exploit identified at time of analysis, and applications that do not use these annotations are unaffected.
A stack overflow in the _ValidateUnion_Clauses routine of FalkorDB (a Redis graph module) versions 4.20.1 through 4.20.4 lets a crafted graph query containing a malicious UNION clause crash the database process, producing a denial of service. Per the CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) the flaw is network-reachable, low-complexity, and requires no privileges or user interaction, with impact confined to availability - no confidentiality or integrity loss. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; exploitation nonetheless requires network reachability to the FalkorDB/Redis endpoint, and in hardened deployments with Redis AUTH or ACLs the PR:N assumption may not hold in practice.
A crafted graph query submitted to FalkorDB (Redis module) versions 4.20.1 through 4.20.4 drives an out-of-bounds read in the node_token_count/relation_token_count code path, crashing the module and the Redis process that hosts it - a purely availability-impacting denial of service with no data exposure or code execution. The flaw is network reachable and low complexity; per our independent assessment the practical authentication requirement depends on the deployment, since exploitation is effectively unauthenticated when Redis is exposed without requirepass or ACLs, but requires an attacker to already hold valid query privileges wherever Redis authentication or ACLs are enforced. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and impact is confined to service availability (base 7.5, NVD vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
OpenBao versions prior to 2.6.0 fail to reject syntax-significant characters when templated identity data is substituted into ACL, PKI, and SSH policies, allowing an authenticated principal who can write that identity data to broaden path matching, obtain certificates for unauthorized domains, or add unauthorized SSH principals. Exploitation is gated on a non-default configuration: the policy must use templates that substitute attacker-modifiable identity metadata (for example {{identity.entity.metadata.domains}} or {{identity.entity.metadata.sans}}), and the attacker must already hold the capability to update that identity record (such as update on identity/entity), consistent with the assessed CVSS 3.1 vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N. Deployments whose templates rely solely on the randomly generated identity.entity.id value are not affected, there is no user interaction, and no public exploit code was identified at time of analysis.
Stored cross-site scripting in GoCD's Compare Pipeline page affects versions 18.3.0 through 25.x and allows an attacker holding commit access to a tracked material to inject URI or HTML special characters into a commit comment that GoCD later renders as an unescaped tracking-tool link. Successful exploitation within a victim's browser session can expose a privileged user's session or permit changes performed with that victim's credentials and privileges, though the CVSS 4.0 vector (AC:H/AT:P/PR:L/UI:P) and the layered prerequisites make this a non-trivial, non-drive-by issue. The flaw is fixed in GoCD 26.1.0, and no public exploit has been identified at time of analysis.
Heap-based buffer overflow in libX11 before 1.8.14 allows a malicious or compromised X server to corrupt memory in connecting X11 clients via a crafted XkbGetMap reply that overflows the key_sym_map. This client-side vulnerability has an inverted threat model: the attacker must control the X server the victim connects to, with exploitation requiring user interaction (UI:R) and high attack complexity (AC:H). CVSS 3.1 score is 7.5 High; no public exploit code has been identified at time of analysis.
Stored cross-site scripting in Envoy Proxy's admin statistics page lets an attacker run script in the admin interface's origin: the /stats?format=html endpoint (StatsHtmlRender) sanitizes statistic values but emits statistic names raw, so a data-plane component that folds attacker-supplied request path segments into dynamic stat names - notably grpc_stats with stats_for_all_methods enabled - can persist a script-bearing name that fires when an operator opens the page in a browser. Every release before 1.36.10, 1.37.6, 1.38.4, and 1.39.1 is affected; the independently assessed vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N (7.4), i.e. unauthenticated remote influence over the injected text but multiple gating prerequisites plus required operator interaction, with impact scoped to the admin origin where privileged same-origin requests can then be issued. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV; exploitation is realistic only where the admin HTML endpoint is browser-reachable and a dynamic-stat-generating component is enabled.
Authentication bypass in Joplin Server prior to 3.7.2 allows an unauthenticated remote attacker who can control or influence a SAML identity assertion to obtain a valid session for an existing local password-based account purely by matching the asserted email address, granting read and write access to that user's notes, files, and settings without knowledge of the local password. The defect is gated to deployments running mixed authentication - local password accounts and SAML SSO enabled together (SAML_ENABLED=true) - so SAML-only, local-only, and default single-auth installations are not exposed. The issue is fixed in version 3.7.2 via a check that rejects SSO login for non-external accounts; no public exploit identified at time of analysis.
Password reset link poisoning in Gladys Assistant before 5.1.0 lets unauthenticated remote attackers obtain valid password reset tokens for arbitrary accounts by sending a crafted request with an attacker-controlled origin parameter to the forgot_password endpoint. The flaw requires victim interaction-the targeted user must click the poisoned reset link delivered to their mailbox-so it is a targeted, phishing-dependent account-takeover vector rather than a hands-off exploit; successful abuse can compromise administrator accounts. No public exploit code was identified at time of analysis, and the vendor has released Gladys Assistant 5.1.0 as the fix.
Signature verification bypass in Red Hat's openshift/oc-mirror tool allows an attacker who can intercept or manipulate traffic to the release-signature endpoint to have a forged PGP-signed release payload accepted and mirrored into a disconnected OpenShift 4 registry. The defect (CWE-347) causes oc-mirror to evaluate signature errors before the full signed body has been processed, so a message carrying a legitimate Red Hat release key ID but an invalid signature can pass validation during a normal mirror operation. Exploitation is gated by a demanding precondition: the attacker must already hold a man-in-the-middle/on-path position on the network path and the victim must be actively running an oc-mirror signature-verifying operation; no credentials against oc-mirror are required (PR:N) and no user interaction beyond running the mirror process is needed (UI:N). The realistic impact is integrity-only, since the assessed vector scores C:N/I:H/A:N, and no public exploit has been identified at time of analysis.
Cross-workspace read and modification of model parameter defaults in MaxKB 2.10.3-lts and earlier is possible for an authenticated user who holds model-read permission in a workspace they control, simply by supplying a model_id that belongs to a victim workspace. The model parameter form route checks authorization against the workspace in the URL path, but the underlying ModelSerializer.ModelParams fetches the Model by id alone without filtering on workspace_id, so the object-level check is bypassed (CWE-639, CVSS 3.1 base 7.4, AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L). Impact is bounded: it is limited to reading or overwriting the victim's model_params_form, which can indirectly alter the default behavior of workflows that consume that model, and practical exploitation requires a multi-tenant deployment plus knowledge or guessing of a valid victim model_id; no public exploit identified at time of analysis and no fixed version is available as of this review.
Unrestricted file upload in CuteNews 2.1.2 allows an authenticated user who can reach the Media Manager panel to upload a file of a dangerous type - typically a PHP script - through core/modules/media.php and then request that file to execute arbitrary code in the web application's context; the researcher's disclosure notes this can be driven to a reverse shell and remote server access. The flaw is rated CVSS 3.1 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), meaning total confidentiality, integrity, and availability impact once triggered, but it is gated behind high privileges: the attacker must already hold a Media Manager-capable (administrative/editor-tier) account. There is no public exploit identified at time of analysis, CISA's SSVC assessment records exploitation as 'none' and automatable as 'no', and no vendor-released patch has been identified at time of analysis.
Temporal Server releases 1.30.0 and later let an authenticated caller holding write permission in only one namespace trick the server into issuing attacker-chosen, state-changing HTTP POSTs against its own administrative frontend API, enabling cross-namespace workflow termination, namespace registration, configuration tampering, and full namespace deletion. The caller exploits confused-deputy logic (CWE-807) by attaching a Workflow completion callback whose URL passes the configured address allowlist and whose header map contains a non-empty 'source' header, which the History service interprets as evidence the callback is internal; no network access to the internal frontend is required because the server makes the request itself. Releases 1.25.0 through 1.29.7 carry the same defect but require the 'source' header to exactly match a configured cluster-ID UUID that a namespace-scoped caller cannot read through the API, making exploitation materially harder; no public exploit code was identified at time of analysis, and exploitation is gated on non-default deployment settings. Vendor-released patches exist in 1.30.7, 1.31.3, and 1.32.0.
Arbitrary file write through a path traversal flaw affects NotebookLM MCP versions 1.6.0 through 2.0.2, allowing an authenticated caller of the POST /batch-to-vault endpoint - or, since 1.7.0, of the batch_to_vault MCP tool - to steer generated Markdown and JSON files outside the intended vault into any directory writable by the server process. The vendor rates it 7.1 under CVSS 4.0, and the independent assessment confirms integrity-only impact (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N): files can be written but not read or deleted through this vector. Containment only activates when NOTEBOOKLM_VAULT_ROOT is set, so default deployments are fully exposed, and there is no public exploit identified at time of analysis and no CISA KEV listing.
CPU exhaustion in Temporal Server before v1.30.7 and v1.31.3 allows an authenticated caller holding namespace write permission (PR:L) to persist a Schedule whose fine-grained cadence is fully negated by an exclusion calendar, forcing the next-action-time search to evaluate excluded candidates without any per-search work budget and burning CPU in the Frontend and Schedule worker components. Because the abusive specification is stored, consumption continues through repeated backing-Workflow failures and retries even after the initial request finishes, until the Schedule is deleted or its backing Workflow terminated; repeated or parallel Schedules can degrade or deny service to shared infrastructure. The impact is availability-only with no exposure or modification of Workflow data, no public exploit code has been identified at time of analysis, and vendor-released patches are available in v1.30.7 and v1.31.3. This is a genuine but bounded availability issue whose severity is highest in multi-tenant clusters where one namespace's write access can degrade shared Frontend and Schedule-worker capacity.
Missing write-command registration for graph.UDF in the FalkorDB Redis module versions 4.20.1 through 4.20.4 allows a client that is already authenticated and authorized to issue module commands (CVSS PR:L, unauthenticated external attackers are not sufficient) to invoke a command that Redis does not treat as a write, producing incorrect behavior in deployments whose correctness depends on write-command semantics such as replication propagation, persistence, and replica handling. The assessed impact is primarily availability (A:H) with a minor integrity effect (I:L) and explicitly no confidentiality impact (C:N), giving a CVSS of 7.1; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the exposed version range is narrow. Note that the supplied 'Information Disclosure' tag is not supported by the assessed vector, which sets C:N and attributes risk almost entirely to availability.
Improper header handling in Canva Mobile App for HarmonyOS before v1.15.1 allows an unauthenticated remote attacker who controls content loaded in a privileged WebView to hijack a logged-in user's session by capturing sensitive headers sent to an external origin. Exploitation requires the victim to interact with the malicious content, and only the HarmonyOS build is affected; iOS and Android are not impacted. No public exploit has been identified at time of analysis, and the assessed risk is conditional rather than a mass-exploitation priority.
Cross-tenant disclosure of durable workflow callback results in Hatchet before 0.95.3 lets an authenticated tenant worker receive another tenant's durable callback result payload. The V1 DurableTask stream handler stores worker-supplied task_external_id values in the durableInvocations routing map before tenant ownership is verified, and callback delivery resolves that map by task UUID alone with no tenant identity, so a tenant worker that knows a victim's durable task UUID and holds a stream open on the same dispatcher process can be handed the victim's payload. Exploitation requires out-of-band knowledge of a non-enumerable UUIDv4 plus same-process co-location, giving an assessed CVSS of 3.1 (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N); no public exploit identified at time of analysis, and single-tenant deployments are unaffected in practice.
NooBaa's S3 presigned URL verification fails to reject unsigned x-amz- headers, allowing an attacker who holds a valid SigV4 presigned PUT URL to inject an x-amz-copy-source header and convert an upload into a CopyObject operation. This can lead to unauthorized copying of any data the original signer can access within the NooBaa / OpenShift Data Foundation 4 storage system. The issue affects noobaa-core and is rated 7.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N); no public exploit or active exploitation has been identified at time of analysis.
Cross-site scripting in idccms V1.70 lets a remote, unauthenticated attacker inject script that is rendered by the administrative endpoint /admin/makeDiy_deal.php, executing in the browser of an administrator who is induced to load the crafted request or link (CVSS 3.1 base 7.1; assessed vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). The consequence is confined to script execution inside the victim's admin session - cookie/session theft, forged administrative actions, credential or token harvesting - rather than direct server compromise, and successful abuse requires both a live idccms V1.70 instance and a targeted, logged-in administrator who interacts with the payload. No active exploitation has been confirmed (the CVE is not in CISA KEV), EPSS is low at 0.14% (3rd percentile), and no public exploit code has been independently confirmed at time of analysis, though a public GitHub repository documents the flaw; the product's very small deployment footprint further limits realistic exposure.
Missing update-signature verification in Joplin Desktop for Windows (versions prior to 3.7.2) lets an attacker who controls the update delivery path substitute both the app-update.yml metadata and the installer, because the absent publisherName field causes electron-updater's NsisUpdater.verifySignature() to skip comparing the downloaded installer's Authenticode signer against Joplin's own. The attacker is positioned adjacent/on-path (MITM or compromised update server) and unauthenticated per the CVSS vector (PR:N), but exploitation requires the victim to approve the installation prompt (UI:R); successful abuse runs attacker-controlled code with the user's privileges and can compromise notes, credentials, and local data. No public exploit has been identified at time of analysis, and the 7.1 score with AC:H and UI:R indicates this is a meaningful supply-chain integrity flaw rather than a mass-exploitation priority.
Cross-site request forgery in MISP's AttributesController::editField allows an attacker to silently alter threat-intelligence data - an attribute's value, type, category, comment, distribution settings or related timestamps - in any MISP instance where a user is currently logged in, simply by luring that user to an attacker-controlled web page. All MISP builds before 2.5.47 are affected because the editField action had been placed in CakePHP's Security->unlockedActions list, which switched off the framework's forged-request and form-tampering protection; the attacker needs no MISP account of their own (the CVSS vector carries PR:N, i.e. unauthenticated from the attacker's perspective), but the forged request executes with the victim's session and is bounded by that victim's own edit permissions on the target attribute. Impact is integrity-only - no data disclosure or service disruption - rated 7.1 under both the vendor's CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:P/VI:H) and the independently assessed CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N); a vendor fix is available via commit dfbae33f9 and no public exploit code has been identified at time of analysis.
Path traversal in Joplin's sync resource handling lets an attacker who can write to a synchronized target (a shared notebook or a compromised/shared sync backend) plant a resource item with a malformed id or file_extension, causing the client to write the attacker-controlled blob outside the resource directory at an attacker-chosen existing path. Affected clients are Joplin versions before 3.6.15 and 3.7.2; exploitation occurs during routine background synchronization, with no user interaction, and integrity impact is high while confidentiality and availability impacts are low. This is a genuine but conditionally-gated integrity issue rather than a mass-exploitation priority: the attacker must already be inside the sync trust boundary (as a shared-notebook collaborator or with credentials to the sync store), and there is no public exploit identified at time of analysis.
Stored cross-site scripting in GoCD (versions 13.3.0 through 26.1.0) allows an authenticated user who holds write access to a material tracked by the server to embed arbitrary HTML or JavaScript in a modification comment crafted to imitate the special package-material trackback JSON format. The payload executes in the browser of a privileged user who later views a page that renders that comment - Stage Detail, Job/Build Detail, Value Stream Map, or Pipeline History - potentially exposing the victim's session or permitting actions with the victim's privileges; not every material comment is rendered in every view, so victim interaction and payload placement are required. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV, but a public upstream fix commit and the release of GoCD 26.1.0 are available, and the EPSS-style risk is bounded: this is a genuine but contained stored-XSS risk rather than a drop-everything emergency. The CVSS 4.0 vector (PR:L, UI:P, VC:L/VI:H/VA:L) confirms the authenticated, victim-interaction-dependent nature of exploitation.
Path traversal in Tautulli's configuration and database import handlers allows an authenticated administrator or anyone holding the instance API key to write files outside the intended CACHE_DIR by supplying a multipart filename containing parent-directory ('../') segments, enabling configuration tampering, service disruption, or potentially code execution before any file-content validation occurs. All Tautulli releases prior to 2.17.2 are affected (CPE cpe:2.3:a:tautulli:tautulli:*:*:*:*:*:*:*:*), and the flaw is reachable over the network without user interaction, though the high privilege requirement (PR:H in the CVSS 4.0 vector, PR:H in the independent CVSS 3.1 assessment) sharply narrows the attacker population. No public exploit identified at time of analysis and no CISA KEV listing; vendor-released patch: 2.17.2.
Denial of service in vLLM through 0.29.0 allows remote, unauthenticated attackers to exhaust the Mooncake connector's sender task pool by submitting prefill requests that are rejected before engine admission, causing legitimate KV-cache transfers to be delayed by up to roughly 480 seconds while the service's health checks keep reporting success. The issue only affects deployments running disaggregated prefill/decode with the MooncakeConnector KV-transfer backend (kv_producer/kv_consumer roles), which is a specialized, non-default topology rather than a standard single-node vLLM serve; a standard vLLM installation is not exposed. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis - the VulnCheck advisory and an upstream GitHub pull request (PR #51236) that adds an orphan-transfer timeout constitute the primary public signals, and impact is bounded to availability degradation rather than crash, data disclosure, or code execution.