Cross-site request forgery in the Froxlor hosting control panel through 2.3.10 lets an unauthenticated attacker silently strip a logged-in panel user's two-factor authentication by luring them into following a crafted GET link such as /customer_index.php?page=2fa&action=delete, with no confirmation prompt, re-authentication, or CSRF token required; both the customer and admin 2FA handlers are affected. The practical impact is bounded: the attack only removes the second factor, and full account takeover additionally requires the victim's password to already be compromised, so this is a genuine but modest-severity CSRF rather than a standalone authentication bypass. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor addressed the flaw in Froxlor 2.3.12.
Authenticated API users in Froxlor before 2.3.12 can retrieve bcrypt password hashes for htpasswd-protected directories via the DirProtections.listing API command, enabling offline cracking and potential exposure of reused credentials. This credential disclosure affects installations that have configured protected directories; if none exist, no hashes are exposed. No public exploit identified at time of analysis, and the impact is confidentiality-only, limited by bcrypt's cost.
Froxlor through 2.3.10 fails to enforce the mail.allow_external_domains policy in the EmailSender.add API command, letting an authenticated customer with API access register an arbitrary external sender address for their mailbox even when the administrator has explicitly disabled external allowed-sender domains. The bypass only matters when the administrator has enabled the allowed-sender feature (mail.enable_allow_sender=1) while disabling external domains (mail.allow_external_domains=0), and the sender-spoofing impact materializes only if the generated mail configuration consumes the allowed-sender table; there is no public exploit identified at time of analysis, and exploitation requires valid low-privilege API credentials rather than being unauthenticated. A vendor-released patch is available in Froxlor 2.3.12, and our independent assessment rates this as a genuine but modest-severity authorization/policy-enforcement flaw rather than a high-urgency one.
Local privilege escalation to full root compromise on Froxlor panel hosts (2.3.10 and earlier) is achievable by an authenticated Froxlor customer holding a shell account, but only where the non-default setting system.allow_customer_shell=1 is enabled, which is a prerequisite for the attack to be reachable at all. The attacker wins a TOCTOU race in the root-run SSH key synchronization cron (lib/Froxlor/Cron/System/SshKeys.php, SshKeys::generateFiles) by atomically swapping their ~/.ssh directory for a symlink in the window between FileDir::makeCorrectDir()/makeCorrectFile() validation and the root-privileged file_put_contents/chown, causing the customer's public key to be appended to /root/.ssh/authorized_keys and /root/.ssh to be chowned to the customer; the cron re-runs every interval, so attempts are effectively unlimited until the race lands. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; it is a genuine root-compromise primitive but tightly gated by the non-default shell setting and by race timing, making it a moderate real-world priority rather than an emergency. The issue is fixed in Froxlor 2.3.12.
Privilege escalation in the Capgo Backend npm package (@capgo/backend) before 12.127.5 allows an authenticated attacker who already holds the org_admin role (priority rank 90) to demote org_super_admin role bindings (rank 95) down to a lower-privileged role such as org_member (rank 75) through the PATCH /private/role_bindings/:binding_id endpoint. Because the handler fails to verify the rank of the role currently bound to the target - and the prevent_last_super_admin_binding_delete safeguard fires only BEFORE DELETE, not on UPDATE - the attacker can strip every super administrator from the organization, leaving it without a super admin and enabling further governance/integrity abuse. Authentication with high privileges is required (CVSS vector PR:H), scope is limited to the attacker's own organization, and no public exploit has been identified at time of analysis; this is a bounded privileged-insider authorization defect rather than a remote unauthenticated compromise.
Authenticated organization admins in capgo.app can corrupt the organization's Stripe billing pointer (customer_id) by sending a direct UPDATE to the Supabase PostgREST API, bypassing the official organization update endpoint that excludes this column. The flaw requires an org admin with org.update_settings but without org.update_billing, and only affects the attacker's own organization's plan/billing state, not broader system data. No vendor patch was available at the time of the advisory, and no public exploit code has been identified.
Budibase Server before 3.45.0 fails to redact plaintext datasource credentials before broadcasting external table updates to the Builder collaboration websocket room, allowing anyone already holding Builder-level access to a workspace to passively capture database passwords and API keys whenever a collaborator saves or deletes a table on an external datasource. The exposure is confidentiality-dominant (CVSS 4.0 base 7.0; VC:H/VI:L/VA:N) and requires the privileged Builder role (PR:H) - it is not reachable by unauthenticated users or by low-privilege consumers of published apps. No public exploit code was identified at time of analysis and the flaw is not in CISA KEV; a vendor patch is available in 3.45.0.
A race condition in the Linux kernel cgroup task iterator (css_task_iter_next) can hand back a task_struct whose reference count has already dropped to zero, resulting in a use-after-free that a local attacker can turn into kernel memory corruption. Only systems running affected kernels built with cgroups are exposed, and the attacker must be able to read a cgroup.procs file while concurrently spawning and tearing down multi-threaded process groups - a low-privileged but purely local position (CVSS:3.1/AV:L/AC:H/PR:L). Exploitation is gated by an extremely narrow timing window tied to RCU grace periods and task teardown ordering, so the flaw is high-severity on paper but difficult to trigger reliably; EPSS is only 0.18% (7th percentile) and no public exploit code was identified at time of analysis.
Quota exhaustion in the ClawHub backend (openclaw/clawhub) lets a remote, unauthenticated caller drain the single shared default allowance that all direct anonymous HTTP API requests draw from, degrading or denying API access for unrelated anonymous visitors. Because anonymous requests are never bound to a trusted caller identity, there is no per-caller isolation to absorb the abuse; a secondary path exists when the non-default TRUST_FORWARDED_IPS option is enabled without an authenticated edge or proxy in front of the service, allowing forged forwarded-IP headers (such as X-Forwarded-For or CF-Connecting-IP) to select arbitrary quota identities and evade rate limiting. The issue is availability-only (no data read or write), was confirmed at revision cbfee7343ddc867316dd9b3de6fa8856730f9f41 with the complete historical affected range left undetermined, and is fixed in revision 8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650 (PR #3684); assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, no public exploit identified at time of analysis, and the npm CLI and OpenClaw runtime are separate products that are not affected.
Unauthenticated senders can temporarily disable OpenClaw's Synology Chat webhook integration by exhausting a shared invalid-token rate-limit budget on versions 2026.3.25 through 2026.8.1. Because the limiter is applied before authentication and keyed on the raw proxy socket address, any deployment where OpenClaw sits behind a reverse proxy or tunnel causes all external clients to share one counter, so junk webhook calls from a single source can cause legitimate Synology Chat callbacks to be rejected until the rate-limit window resets. The attacker gains no token and no message data - this is a scoped, temporary availability loss (CVSS 4.0 base 6.9, AV:N/PR:N/VA:L) with no public exploit identified at time of analysis, and it is assessed as a genuinely low-priority DoS issue; the vendor-released fix is 2026.8.1.
Denial of inbound SMS message ingestion in the OpenClaw npm package (versions 2026.6.6 up to but not including 2026.8.1) allows an unauthenticated remote sender to exhaust the shared pre-authentication rate-limit budget on the Twilio SMS webhook with invalid requests, so that legitimate, correctly signed Twilio callbacks are subsequently answered with HTTP 429 and inbound SMS is temporarily dropped. The issue only manifests in deployments where the SMS/Twilio webhook sits behind a trusted reverse proxy or tunnel such that many external clients collapse to a single raw proxy socket address, because OpenClaw keys that pre-signature limit on the raw socket address rather than a verified or forwarded client identity. Impact is availability only: the attacker cannot forge a signed Twilio callback, cannot read message data, and service recovers automatically once the rate-limit window resets. No public exploit identified at time of analysis, and the vendor-released patch is version 2026.8.1.
Denial of service in OpenClaw's Browser extension relay allows unauthenticated network attackers to exhaust the pool of pending-authentication slots by holding silent WebSocket upgrade connections open, which blocks legitimately paired browser extensions from completing Browser Relay Authentication v2. All OpenClaw builds before 2026.8.2 are affected per the vendor advisory and CPE cpe:2.3:a:openclaw:openclaw, with no public exploit identified at time of analysis and no confirmed actively exploited (CISA KEV) status. Impact is availability-only and limited to authentication slot exhaustion - scored 6.9 under CVSS 4.0 (AV:N/AC:L/AT:N/PR:N/UI:N/VA:L) and assessed independently as CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - meaning the Gateway itself is not crashed, data is neither corrupted nor disclosed, and service resumes once held connections are released or the pending-auth window expires.
Remote denial of service in vLLM versions before 0.29.0 allows unauthenticated clients to bypass the configured multimodal audio clip size limit (VLLM_MAX_AUDIO_CLIP_FILESIZE_MB) by submitting oversized audio through chat endpoints, causing excessive memory and CPU consumption during decoding. The CVSS vector confirms this is remotely reachable with no privileges (PR:N) and no user interaction, but impact is availability-only (VA:L) - there is no data exposure, integrity loss, or code execution. No public exploit code has been identified at time of analysis, and a vendor-released patch (0.29.0) is available, making this a genuine but low-severity resource-exhaustion issue rather than a high-impact breakout. Exploitability in practice depends on whether the audio-capable chat endpoint is exposed without an authenticating reverse proxy, request-size limits, or rate limiting, and on the host's memory/CPU headroom.
Server-side request forgery in ClawHub's public profile preview allows unauthenticated remote attackers to supply an image URL whose hostname passes the textual private-address check but whose DNS resolution points to an internal, loopback, or rebinding-controlled destination, causing the backend to issue outbound requests to attacker-chosen internal targets. The flaw affects self-hosted ClawHub (openclaw/clawhub) application/backend deployments at revision cbfee7343ddc867316dd9b3de6fa8856730f9f41 or unfixed ancestors; the hosted clawhub.ai instance was patched on 2026-09-11, so only unpatched self-hosted instances remain exposed, and the npm CLI and OpenClaw runtime are separate, unaffected products. No public exploit code and no CISA KEV entry were identified at time of analysis, and the reporting researcher demonstrated only a loopback listener connection - access to production internal services, credential disclosure, and code execution were not demonstrated.
Denial of service in vLLM releases before 0.29.0 allows unauthenticated remote attackers to stall the single EngineCore scheduler thread by sending HTTP requests with multi-hundred-megabyte cache_salt values to the OpenAI-compatible or Anthropic-compatible API endpoints. The oversized salt value is pickle-serialized and SHA-256 hashed on the scheduler thread, so a single request blocks scheduling and inference for all concurrent requests, degrading or halting service. No public exploit code was identified at time of analysis and the issue is not in CISA KEV, so real-world risk is concentrated on internet-facing or multi-tenant vLLM deployments that expose these endpoints without an authenticating gateway or upstream request-size limits.
A two-factor authentication bypass in the Grav Login plugin (grav-plugin-login) versions 3.8.7 through 3.9.6 allows a remote attacker who already knows a member's password to read content that the site gates behind the no-argument authenticated() Twig function, the group form authenticated(null, 'group'), or the [authenticated] shortcode, because Login::isAuthenticated() checked only the session flag showing the password step had succeeded rather than the flag showing login had fully completed. The flaw (CWE-304, missing critical step in authentication) does not grant a completed session: the attacker cannot reach pages protected by an access: rule, cannot act as the member, and cannot use the permission-based authenticated('some.permission') form, so impact is confined to disclosure of that gated content. No public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (not in CISA KEV), though the vendor has released a fix in 3.9.7.
Server-side request forgery in Adminer's optional Elasticsearch driver (plugins/drivers/elastic.php) lets unauthenticated remote attackers force the Adminer host to issue HTTP GET requests to arbitrary reachable hosts and ports, because include/auth.inc.php calls Driver::connect() before it validates the submitted login result. Versions 4.16.0 through 6.0.1 are affected and the issue is conditional: it requires that the optional Elasticsearch driver be explicitly deployed (via the adminer/elastic.php template or an adminer_object() configuration) and that PHP allow_url_fopen be enabled so get_url()/file_get_contents() can send the outbound request. Impact is limited to low-confidentiality reconnaissance - a port-scanning oracle built from leaked JSON error fields and connection-failure text rendered on the login page - with no integrity or availability impact, and the independent assessment rates the issue MEDIUM, consistent with the vendor's CVSS 4.0 base score of 6.9; fixed in 6.0.2 and no public exploit identified at time of analysis.
Server-side request forgery in Adminer 5.5.1 through 6.0.1 lets a remote, unauthenticated attacker force the server to open outbound TCP connections to arbitrary internal hosts and privileged ports before any credentials are validated, by supplying a crafted login 'server' value such as '127.0.0.1:80/x'. The flaw is a regression that re-opens the privileged-port bypass originally fixed in 5.5.0, and because the connection is blind - the attacker only observes refused/handshake/timeout states - impact is limited to internal port scanning and SSRF probing rather than data disclosure or code execution. No public exploit code has been identified at time of analysis and there is no evidence of active exploitation; the vendor-released fix is Adminer 6.0.2.
Stoatchat releases prior to 0.15.5 hand unauthenticated remote attackers an account-existence oracle: POST /api/auth/session/login returns error responses whose 'location' fields differ for registered versus unregistered email addresses, and those same fields leak internal source file paths. The root issue is a CWE-209 sensitive-information-in-error-message flaw that yields email enumeration and path disclosure rather than authentication bypass or data modification, and no public exploit code was identified at time of analysis. The vendor has released a fix, and the independent assessment treats the practical risk as a low-severity information-disclosure issue even though the vendor-published CVSS 4.0 score is 6.9.
Unauthenticated remote attackers can desynchronize HTTP/1.1 response parsing in Netty's HttpServerCodec (io.netty:netty-codec-http) versions 4.2.0.Final through 4.2.16.Final and all versions up to and including 4.1.136.Final by pipelining a GET carrying 'Expect: 100-continue' immediately followed by a HEAD request on the same keep-alive connection. Because the codec pairs each outbound response - including the 100 Continue informational response - with a queued inbound method via pollMethod(), the GET's 200 OK is matched to HEAD and its entity body is dropped, while the following 200 OK (intended for HEAD) is emitted with a body; this misattributes content across responses, enabling response splitting and unsafe reuse of the connection. It is a genuine but moderate-priority integrity flaw (vendor CVSS 4.0 score 6.9; independent assessment CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N), with no public exploit identified at time of analysis and vendor-released patches available in 4.2.17.Final and 4.1.137.Final.
Routing and access-control bypass in Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.0.Final through 4.2.17.Final allows a remote unauthenticated attacker to send a single HEADERS frame with conflicting :authority and host header values, causing different components in a multi-component request path to make inconsistent decisions. This moderate-severity integrity issue is fixed in 4.2.18.Final; no public exploit code or active exploitation has been identified at time of analysis.
OpenClaw LINE before 2026.8.1 silently falls back to the DM allowFrom configuration for group authorization whenever groupAllowFrom is left unset, letting group participants trigger the agent despite an intended group allowlist. Exploitation requires the bot deployment to run in group allowlist mode with groupAllowFrom unset and a broader DM allowFrom, plus the attacker being a member of a LINE group the bot participates in; deployments that explicitly set groupAllowFrom or whose DM allowFrom is no broader than the intended group scope are not exposed. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV), though a vendor patch is available in 2026.8.1.
Remote, unauthenticated attackers can exploit mis-parsing of recipient addresses in Nodemailer versions 9.1.0 through 10.0.8 to inject extra attacker-controlled domain text into the SMTP envelope, but only when the hosting application forwards externally supplied recipient addresses without its own strict validation. The flaw combines a quoted local-part with trailing RFC 5322 comments, yielding normalized values such as 'user@example.com evil.com'; the advisory does not confirm that real SMTP servers would actually deliver to an unintended recipient, and the impact is integrity-only with no confidentiality or availability effect. No public exploit identified at time of analysis (no CISA KEV, no POC observed).
Froxlor through 2.3.10 exposes DKIM private signing keys through its customer-facing API: the Domains.get, Domains.listing, SubDomains.get, and admin SubDomains.listing methods run an unfiltered wildcard SELECT over the panel_domains table and return the dkim_privkey column verbatim to the caller. An authenticated admin who is not a superadmin but has been granted the delegated customers_see_all flag can retrieve the DKIM private keys of every domain visible to them across tenants, and a single listing call discloses the keys for all such domains. Compromising those keys lets the holder forge DKIM signatures that pass DKIM verification and DMARC alignment for the affected domains; the issue is a follow-on to an earlier incomplete fix that scrubbed password and data_2fa but left dkim_privkey in the response. There is no public exploit identified at time of analysis, and the risk is real but bounded because it requires a high-privilege delegated admin role in a multi-tenant deployment; the vendor has released the fix in 2.3.12.
OpenClaw versions 2026.7.1 through 2026.7.2 can disclose local files outside the session working directory when an operator connects `openclaw acp client` to an untrusted or compromised Agent Client Protocol (ACP) peer. Alternate but valid `file:` URL spellings are misclassified as relative paths, bypassing the approval prompt normally required for out-of-scope reads, while mutation and command-capable tool classes remain unaffected, so the demonstrated impact is limited to file confidentiality. No public exploit code has been identified at time of analysis, the vendor-released fix is OpenClaw 2026.8.1, and the assessed risk is low-priority because exploitation requires the operator to establish the ACP connection to a malicious peer.
Credential exposure in the npm-distributed OpenClaw agent framework (versions 2026.4.25 through 2026.8.0) lets an attacker-controlled workspace .env file set AZURE_SPEECH_ENDPOINT and redirect Azure Speech traffic so that the operator's Azure Speech API key is sent in a request header to a host of the attacker's choosing. OpenClaw's workspace environment-variable filter failed to block variables ending in the `_ENDPOINT` suffix, and Azure Speech prefers an explicit endpoint over the configured region, so a subsequent voice-synthesis or voice-list request leaks the key, which can then be reused against the operator's Azure Speech resource. The CVSS:4.0 score is 6.8 with AV:L/PR:N/UI:P - exploitation requires the operator to launch OpenClaw inside hostile workspace content with Azure Speech configured by key and region and no trusted endpoint override set; no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Cleartext storage of Gateway credentials in OpenClaw for iOS before 2026.8.11 lets anyone who obtains an unencrypted device backup or extracts the app's App Group container recover valid Gateway tokens and passwords and authenticate with operator authority. The weakness (CWE-312) is a data-protection failure rather than a remotely reachable flaw: exploitation requires local or forensic access to the device or its backup, consistent with the assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), so confidentiality is fully lost while integrity and availability are unaffected. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and a vendor fix is available in 2026.8.11.
Contributor-level users on WordPress sites running the MCP Server for WordPress plugin before 1.8.2 can enumerate the title and publication status of any post, page, or custom post type - including other users' private, draft, pending, and scheduled content - by calling a workflow REST route that performs no object-level authorization check. The impact is read-only metadata disclosure (CWE-200): no post bodies, no write access, and no availability impact, and EPSS is 0.14% (3rd percentile) with no KEV listing, though publicly available exploit code exists. Exploitation requires an authenticated account with at least the Contributor role on an affected site, and one metric disagreement is worth flagging: the published CVSS vector rates PR:H (score 2.7) while our independent assessment rates PR:L, matching the publicly documented Contributor-level access path and raising the assessed base score accordingly.
The MCP Server for WordPress plugin before 1.8.2 exposes workflow create, update, and delete REST routes that fail to enforce ownership or sufficient capability checks, allowing an authenticated Contributor-level user to create, modify, or delete site-wide workflow configuration, including workflows originally created by administrators. Attackers need valid low-privilege WordPress credentials but no user interaction and no special configuration beyond an active plugin, making this an integrity-only authorization bypass with no confidentiality or availability impact; publicly available exploit code exists and proof-of-concept details are referenced in the WPScan advisory. EPSS is very low at 0.13% (2nd percentile), CISA SSVC reports no known exploitation, and the vendor has released a fix in 1.8.2.
Authenticated denial of service in Elasticsearch lets a valid low-privilege account drive the node or cluster into uncontrolled resource consumption through an allocation-heavy request path, degrading or halting availability (CVSS 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Only users holding at least a low-privileged, network-reachable API account can trigger it - an unauthenticated remote attacker cannot, and there is no confidentiality or integrity impact. Elastic rates this a genuine but modest-severity availability issue rather than a top-tier priority: no public exploit code has been identified at time of analysis, no CISA KEV listing applies, and the advisory does not name the specific endpoint or query construct that acts as the allocation sink. Vendor-released patches exist in Elasticsearch 8.19.22, 9.4.7, and 9.5.4 (ESA-2026-183).
Denial of service in Elasticsearch is possible because of uncontrolled resource consumption (CWE-400) that allows an authenticated user to drive excessive allocation and exhaust cluster resources. Elasticsearch deployments prior to 9.4.7 and 9.5.4 are affected; the issue is remote and low-complexity but requires valid low-privilege credentials or an API key (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), and the impact is limited to availability with no data disclosure or modification. There is no public exploit identified at time of analysis and no confirmed active exploitation, and the vendor-scored severity of 6.5 places this as a moderate availability-only issue rather than a top-tier priority.
Denial of service in Elastic Kibana allows an authenticated low-privilege user with network access to the Kibana HTTP interface to exhaust server resources and render the instance unavailable. The flaw is an uncontrolled resource consumption issue (CWE-400, CAPEC-130 Excessive Allocation) rated CVSS 3.1 base 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), meaning availability impact only, with no confidentiality or integrity loss and no user interaction required. Exploitation requires a valid session at low privilege (PR:L), so a fully unauthenticated attacker cannot trigger it per the assessed vector; no public exploit code and no confirmed in-the-wild exploitation were identified at time of analysis. Elastic has published fixed versions in 8.19.22, 9.4.7, and 9.5.3.
Authenticated denial of service in Elasticsearch lets a low-privilege user with network reachability to the cluster API exhaust node or cluster resources through a crafted request that triggers uncontrolled allocation (CWE-400 / CAPEC-130), driving availability-only degradation rather than data theft or code execution. The vendor-assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 6.5) confirms the attacker must first hold valid low-privilege credentials (or reach an improperly exposed/authenticated API endpoint), that no user interaction is needed, and that confidentiality and integrity are unaffected while scope remains unchanged to the single affected deployment. Practical exposure is greatest in multi-tenant clusters or environments where the Elasticsearch HTTP API is broadly reachable; properly segmented single-tenant clusters face lower risk, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Authenticated denial of service in Elasticsearch allows a remote attacker holding only low-privilege credentials to drive uncontrolled resource consumption, exhausting node memory and degrading or halting cluster availability (CVSS 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Impact is confined to availability - there is no confidentiality or integrity loss - and exploitation requires a valid account, API key, or service token, so fully unauthenticated attackers cannot trigger it against a properly secured cluster. No public exploit code or confirmed active exploitation has been identified at time of analysis, and vendor fixes are available in Elasticsearch 8.19.22, 9.4.7, and 9.5.4 (ESA-2026-179).
Denial of service in Elasticsearch allows a network-reachable, low-privilege authenticated user to exhaust cluster resources through excessive allocation, degrading availability down to a full outage while leaving data confidentiality and integrity intact (CVSS 6.5, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). The flaw is an uncontrolled resource consumption bug (CWE-400 / CAPEC-130 Excessive Allocation), and the CPE record lists elastic:elasticsearch without version constraints, so every unpatched Elasticsearch deployment is presumed affected pending the vendor advisory ESA-2026-176. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; exploitation requires valid low-privilege credentials (a low-tier user, service account, or API key), which limits the population of attackers able to trigger it. The specific endpoint, query type, or configuration that produces the excessive allocation is not named in the available data describing the flaw and must be confirmed against the Elastic advisory.
Denial of service in Elasticsearch allows a network-reachable, low-privileged authenticated user (PR:L) to exhaust server resources and take the cluster's availability down by triggering uncontrolled resource allocation; no user interaction is required (AC:L, UI:N) and the impact is availability-only (C:N/I:N/A:H, base score 6.5). Because a valid account with minimal privileges is a prerequisite, clusters that enforce authentication and limit network exposure are materially less exposed, and the attack cannot be launched fully unauthenticated. No public exploit code and no confirmed active exploitation were identified at time of analysis, so the practical risk is concentrated in multi-tenant or broadly reachable clusters where low-privilege access is easy to obtain; Elastic has published fixed versions in 8.19.21, 9.4.6 and 9.5.3 under advisory ESA-2026-170.
Authenticated Kibana users who hold Synthetics privileges scoped to just one space can permanently delete Synthetics monitors that are shared into other spaces they are not authorized to access, because the space-scoped authorization check is missing on the delete path (CVSS 6.5, PR:L, I:H). When a targeted monitor is tied to a private location, the same action also tears down the underlying Elastic Agent integration configuration, bypassing the authorization controls Fleet would normally enforce. The flaw is limited to space-to-space abuse inside a single Kibana/Elastic deployment rather than cross-tenant compromise, and no public exploit identified at time of analysis; Elastic has published a security update (ESA-2026-139) addressing it.
Stored cross-site scripting in the Automatic.css WordPress plugin 4.0.0 lets an attacker write an unsanitized REQUEST_URI into the plugin's Activity Log, which is then rendered without escaping on the Activity Log settings page, executing arbitrary script in the browser of any administrator who opens that page. The flaw is confined to a single plugin version and only fires when the Activity Log feature is enabled and an admin actually reviews the log, so reliability and timing are attacker-controlled constraints; the vendor-assigned CVSS 3.1 base score is 6.4. No public exploit code was identified at time of analysis and there is no CISA KEV entry, and the analyst-assessed vector (PR:N/UI:R) differs from the supplied vector (PR:L/UI:N), so the exact authentication prerequisite for the injection step remains disputed in the available data.
Unauthenticated remote attackers can exhaust GPU memory on vLLM deployments before 0.29.0 that accept video inputs, by requesting different sampler subclasses whose decoder-allocation counters increment independently and thus sidestep the shared PyNvVideoCodec decoder limit. The result is availability degradation (GPU memory exhaustion) rather than data disclosure or code execution, and success is not deterministic - it depends on repeated requests that win allocation and timing conditions (AC:H, AT:P), with additional practical constraints where the API is gated by an API key or network gateway. No public exploit code has been identified and the issue is not confirmed as actively exploited (CISA KEV); a vendor patch is available per the upstream GitHub security advisory.
Unauthenticated server-side request forgery in Budibase's Microsoft Teams webhook endpoint (all Budibase Server releases before 3.45.0) lets remote attackers submit a forged Bot Framework activity containing an arbitrary serviceUrl that the server persists and then reuses for every subsequent outbound bot reply. Those replies carry live Microsoft OAuth access tokens in their Authorization headers, so the server ultimately transmits credentials to the attacker's host and can also be steered into blind requests against internal network resources. The flaw is network-reachable and needs no authentication or user interaction (CVSS 4.0 PR:N/UI:N/AV:N), but exploitation is tempered by high attack complexity (AC:H) because a structurally valid activity payload is required and the attacker must win the persistence-then-reply flow; the endpoint is only exposed where the Microsoft Teams bot integration is configured and reachable, and no public exploit has been identified at time of analysis.
Cross-user authorization bypass in Elastic Kibana lets an authenticated user who holds the Timeline feature privilege in a Kibana space enumerate, read, modify, and delete draft Timeline objects that belong to other users in that same space, because object ownership is enforced through a user-controlled key rather than through a proper ACL check. Only Timeline read privilege is needed to enumerate and disclose other users' drafts, while the Timeline write privilege is additionally required to alter or delete them; the issue is therefore meaningful only in multi-user, shared Kibana spaces where Timeline privileges are granted to more than one principal, and it is rated CVSS 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L), indicating moderate confidentiality, integrity, and availability impact. No public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV); the vendor advisory referenced for this CVE points to the Kibana 8.19.22 and 9.4.6 security update (ESA-2026-103).
Cross-site scripting (CWE-79) in the mathurvishal CloudClassroom-PHP-Project, reachable through the queryx parameter of updatequery.php, allows a remote unauthenticated attacker to have arbitrary script execute in a victim's browser session once that victim is induced to open a crafted request. The flaw affects the project through commit 5dadec098bfbbf3300d60c3494db3fb95b66e7be; because the project follows a rolling-release model, no discrete affected or fixed version numbers are published. Publicly available exploit code exists (a GitHub advisory with a stored-XSS write-up) and the vendor did not respond to disclosure, but there is no confirmed actively exploited (CISA KEV) status; EPSS is not reported and the assessed CVSS:3.1 score is 5.3, making this a genuine-but-low-priority issue.
SQL injection in mathurvishal CloudClassroom-PHP-Project lets a low-privilege authenticated remote attacker manipulate the gname or editassid parameters of /updateguest.php to execute arbitrary SQL against the application's backend database, with low confidentiality, integrity and availability impact. Publicly available exploit code exists, and the CVSS 4.0 base score is 5.3 with an E:P (proof-of-concept exploit) temporal qualifier, but there is no evidence of confirmed active exploitation (not in CISA KEV). The practical risk is constrained by the project's niche, self-hosted footprint, the requirement for an authenticated session, and the absence of any vendor fix - the project ships as a rolling release and the maintainer did not respond to the disclosure.
OpenClaw npm package versions 2026.7.2 through 2026.9.1 contain a race condition in the Discord realtime voice transcript path that can cause an utterance from a non-owner participant to be processed at the downstream agent boundary as if it came from the session owner. The flaw is exploitable only in Discord agent-proxy voice sessions that use the realtime voice control path with an agent configured to distinguish owner from non-owner senders, and an admitted non-owner participant must produce concurrent control-classified transcripts that win a non-deterministic timing race against a legitimate owner's context. No public exploit identified at time of analysis; the vendor has fixed the issue in 2026.9.2, and while the CVSS 4.0 base score is 6.1 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N per independent assessment), real-world risk is LOW-to-MODERATE because exploitation is gated by precise timing, the specific realtime control path, and which owner-sensitive tools are actually exposed.
Path traversal in OpenClaw's filesystem sandbox allows an admitted requester-an attacker already authorized to use the tools.fs tools (PR:L)-to read files outside the configured workspace boundary, by supplying a Unicode filename whose fallback normalization resolves to a canonically equivalent sibling directory. Only installations that rely on the tools.fs.workspaceOnly restriction for isolation are affected, and exploitation yields read-only confidentiality impact with no code execution or file modification; success requires crafting a working Unicode-equivalence encoding against the specific normalization logic (AC:H, AT:P). Vendor-released patch: 2026.8.1. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV, so this is a moderate-priority, confidentiality-only path traversal rather than an active exploitation emergency, though the high confidentiality rating (VC:H) means exposure can be significant where the Gateway process can read sensitive files outside the workspace.
Out-of-policy local file disclosure in OpenClaw's Discord integration (@openclaw/discord) before 2026.9.3 allows an authenticated sender who is already permitted to invoke the guild emoji and sticker upload actions to have the integration read and upload bytes from a local host file that the sender's configured media roots would otherwise reject. The bypass is narrow: it stems from the sender-scoped media policy being dropped in the emoji/sticker upload code path before the local file is loaded, and it does not grant filesystem browsing, directory listing, or code execution - the attacker must already know or derive a useful absolute path on the OpenClaw host. CVSS 4.0 scores this 6.0 (AV:N/AC:H/AT:P/PR:L/UI:N/VC:H), and while no public exploit or confirmed active exploitation has been identified at time of analysis, the vendor has released a fix in @openclaw/discord 2026.9.3, so the real-world priority is low-to-moderate and driven by deployments that expose the guild asset action to semi-trusted senders.
Credential exposure in the OpenClaw npm package (versions >= 2026.3.28 and < 2026.8.1) causes the primary embedding provider's API key to be reused and transmitted as a bearer token to an unintended third-party vendor when remote cross-provider embedding failover is configured and the primary provider fails. The CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:P, VC:H) and the independent CVSS 3.1 assessment (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) both rate this medium-severity at 6.0, but our assessment concludes real-world risk is LOW-to-MODERATE: the leak is an accidental transmission triggered by operator configuration plus an operational failure, not an attacker-reachable endpoint. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; impact is bounded by the privileges attached to the exposed primary provider key.
Stale channel permission overrides in Capgo can let a former source-organization member repoint a destination-owned app channel after a cross-organization app transfer, causing the /updates endpoint to serve an attacker-selected OTA bundle to devices. The flaw affects all Capgo (capgo.app) versions up to and including the current release, requires an authenticated attacker (PR:L) who previously held a legitimate override and an admin-run transfer_app() operation, and is bounded to integrity impact with no data disclosure or outage. No public exploit identified at time of analysis, and no vendor-released patch was available at publication.
OpenClaw (npm package `openclaw`) before 2026.8.1 mishandles sender tool policies during session-memory filename generation: the helper embedded in that generation path can retain tools that the originating sender's policy had already removed, letting an already-admitted low-trust sender (authenticated, PR:L) reach tools outside their effective policy. Exploitation is gated on a non-default deployment-session-memory filename generation must be enabled for an agent reachable by lower-trust senders-and further depends on the model acting on an injected instruction and the embedded helper actually exposing the targeted tools, so the demonstrated impact is limited to integrity (creation of persistent scheduled work), with no confidentiality or availability effect. There is no public exploit identified at time of analysis, and the combination of feature gating, model non-determinism, and an available vendor workaround makes this a genuine but low-priority issue.
Stored cross-site scripting in mathurvishal's CloudClassroom-PHP-Project allows an authenticated faculty-level user to inject script payloads via the V_Title, V_Url, or V_Remarks arguments of managevideos2.php in the Faculty Video Management component, which then execute in the browser of any other user who views the affected video listing. Exploitation requires a valid account with video-management privileges and a victim who loads the poisoned page, so it is not remotely triggerable by an unauthenticated attacker, and the resulting impact is confined to browser-context script execution with no server-side confidentiality or availability loss. Publicly available exploit code exists, the vendor was contacted but did not respond, the project follows a rolling-release model so no fixed version is identified, and no CISA KEV entry confirms active exploitation.