Unauthenticated SQL injection in the Bluff Post WordPress plugin (versions through 1.1.1) lets remote attackers inject into a SQL query and read sensitive data from the underlying WordPress database. The assessed vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms no authentication or user interaction is needed, but the attacker-supplied parameter is placed in a SQL identifier position rather than a quoted value, so exploitation requires blind/inference-based extraction and is consequently slower and more complex (AC:H); impact is confidentiality-only, with no integrity or availability effect assessed. Publicly available exploit code exists (WPScan references the issue as an exploit), but there is no CISA KEV entry and exploitation is not confirmed as active; EPSS is low at 0.17% (6th percentile), and SSVC records Exploitation: none, Automatable: no, Technical Impact: partial.
Stored cross-site scripting in the Optimole WordPress plugin (versions 4.0.0 through 4.2.12) allows an authenticated user with the WordPress Author role or higher to inject an event-handler attribute into the wrapper element of the plugin's video-player block; because that unrecognized attribute is rendered without escaping, the payload executes in the browser of any higher-privileged user - such as an administrator - who views the crafted post. Publicly available exploit code exists, and the vendor has released Optimole 4.2.13 to fix it. Risk is bounded: EPSS is only 0.15% (4th percentile), there is no CISA KEV listing, and CISA's SSVC assessment records no observed exploitation and no automatable vector, so this is a genuine but contained stored-XSS issue rather than a top-tier emergency.
WP Delicious versions before 1.10.8 are affected by a stored cross-site scripting flaw that lets Contributor-level and higher accounts inject arbitrary HTML, including script tags, through unescaped HTML tag names in recipe block data, with execution occurring when a victim views the recipe page. Publicly available exploit code exists, the vendor has released a patch in version 1.10.8, and EPSS is low at 0.15% (4th percentile); no KEV listing or active exploitation has been confirmed.
SQL injection in the WordPress plugin WP Review Slider Pro (wp-review-slider-pro) before 12.7.12 allows any authenticated user - including a low-privileged Subscriber - to inject arbitrary SQL into a plugin AJAX handler and read data from the site's database; because the queried results are then rendered to unauthenticated visitors, the extracted data can be exposed publicly rather than being confined to the attacker's own session. Exploitation requires a valid account on the target site (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, 6.5), which is trivial on sites that permit self-registration but blocked where registration is closed, and publicly available exploit code exists (no CISA KEV entry and no confirmed active exploitation; EPSS 0.16%, 5th percentile). Impact is confidentiality-only - no integrity or availability effect - but the leak-to-anonymous-visitors behavior makes this a genuine moderate-priority issue rather than a purely theoretical one.
Unauthenticated information disclosure in the File Manager WordPress plugin (versions 7.2.2 through before 8.0.5) lets remote attackers download database backup archives that the plugin leaves reachable in its directory, leaking every user's email address and password hash. The flaw only lands on servers that do not honor the plugin directory's .htaccess protection - nginx hosts or Apache with AllowOverride disabled - and it also depends on a backup archive having been generated and being reachable at a predictable or fixed filename, which is why the vendor and the independent assessment both score it AC:H and confidentiality-only (CWE-200, CVSS 5.9). Publicly available exploit code exists per WPScan, but there is no confirmed active exploitation (CISA SSVC: Exploitation none) and EPSS is low at 0.14% (3rd percentile), so exposure is best modeled as a realistic targeted/lateral-movement risk on non-compliant web server configurations rather than a mass-exploitation event.
Server-side request forgery (SSRF) in the Testimonials Widget WordPress plugin through version 4.0.4 allows unauthenticated remote attackers to make the server fetch arbitrary URLs and store the responses as publicly accessible files. This enables reading responses from internal services reachable from the WordPress server, though the impact is confidentiality-only and practical value depends on internal network reachability. Publicly available exploit code exists, and the EPSS score is 0.14% (3rd percentile), indicating a low predicted likelihood of exploitation.
SQL injection in CloudClassroom-PHP-Project allows remote, unauthenticated attackers to manipulate the myfid parameter in mydetailsfaculty.php, resulting in limited confidentiality, integrity, and availability impact. Publicly available exploit code exists, but there is no confirmed active exploitation and no vendor-released patch because the project is unversioned and the maintainer did not respond. This is a genuine but low-priority issue that requires manual source-code remediation.
SQL injection in the 'eno' parameter handled by updatedetailsfromstudent.php in mathurvishal's CloudClassroom-PHP-Project lets remote attackers inject arbitrary SQL into the application's database queries, with limited confidentiality, integrity, and availability impact (CVSS 4.0 base 6.9; our independent assessment scores it 6.1 under CVSS 3.1). The project uses rolling releases with no version tags, so no fixed build or specific affected release can be pinned, and the maintainer was contacted but did not respond, leaving no vendor patch. Publicly available exploit code exists, including a GitHub advisory with a proof-of-concept; there is no confirmation of active exploitation (not in CISA KEV). This is a genuine but low-priority issue confined to a niche, non-commercial PHP application.
Unauthenticated information disclosure in the Team Members WordPress plugin (versions through 9.2) lets remote attackers pull full team-member records - including email addresses and phone numbers - for entries the administrator never published. The plugin's AJAX action performs no authorization or visibility check, so an attacker only needs to reach the site's admin-ajax.php endpoint and enumerate record IDs; no login or user interaction is required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, 5.3). Publicly available exploit code exists and the WPScan advisory is public, but there is no evidence of confirmed active exploitation (CISA SSVC exploitation: none) and EPSS is low at 0.14% (3rd percentile), consistent with a genuine but low-severity confidentiality issue whose impact is bounded by how many unpublished member records with contact details exist on a given site.
Quota exhaustion in the ClawHub backend (openclaw/clawhub) lets a remote, unauthenticated caller drain the single shared default allowance that all direct anonymous HTTP API requests draw from, degrading or denying API access for unrelated anonymous visitors. Because anonymous requests are never bound to a trusted caller identity, there is no per-caller isolation to absorb the abuse; a secondary path exists when the non-default TRUST_FORWARDED_IPS option is enabled without an authenticated edge or proxy in front of the service, allowing forged forwarded-IP headers (such as X-Forwarded-For or CF-Connecting-IP) to select arbitrary quota identities and evade rate limiting. The issue is availability-only (no data read or write), was confirmed at revision cbfee7343ddc867316dd9b3de6fa8856730f9f41 with the complete historical affected range left undetermined, and is fixed in revision 8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650 (PR #3684); assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, no public exploit identified at time of analysis, and the npm CLI and OpenClaw runtime are separate products that are not affected.
Unauthenticated senders can temporarily disable OpenClaw's Synology Chat webhook integration by exhausting a shared invalid-token rate-limit budget on versions 2026.3.25 through 2026.8.1. Because the limiter is applied before authentication and keyed on the raw proxy socket address, any deployment where OpenClaw sits behind a reverse proxy or tunnel causes all external clients to share one counter, so junk webhook calls from a single source can cause legitimate Synology Chat callbacks to be rejected until the rate-limit window resets. The attacker gains no token and no message data - this is a scoped, temporary availability loss (CVSS 4.0 base 6.9, AV:N/PR:N/VA:L) with no public exploit identified at time of analysis, and it is assessed as a genuinely low-priority DoS issue; the vendor-released fix is 2026.8.1.
Denial of inbound SMS message ingestion in the OpenClaw npm package (versions 2026.6.6 up to but not including 2026.8.1) allows an unauthenticated remote sender to exhaust the shared pre-authentication rate-limit budget on the Twilio SMS webhook with invalid requests, so that legitimate, correctly signed Twilio callbacks are subsequently answered with HTTP 429 and inbound SMS is temporarily dropped. The issue only manifests in deployments where the SMS/Twilio webhook sits behind a trusted reverse proxy or tunnel such that many external clients collapse to a single raw proxy socket address, because OpenClaw keys that pre-signature limit on the raw socket address rather than a verified or forwarded client identity. Impact is availability only: the attacker cannot forge a signed Twilio callback, cannot read message data, and service recovers automatically once the rate-limit window resets. No public exploit identified at time of analysis, and the vendor-released patch is version 2026.8.1.
Denial of service in OpenClaw's Browser extension relay allows unauthenticated network attackers to exhaust the pool of pending-authentication slots by holding silent WebSocket upgrade connections open, which blocks legitimately paired browser extensions from completing Browser Relay Authentication v2. All OpenClaw builds before 2026.8.2 are affected per the vendor advisory and CPE cpe:2.3:a:openclaw:openclaw, with no public exploit identified at time of analysis and no confirmed actively exploited (CISA KEV) status. Impact is availability-only and limited to authentication slot exhaustion - scored 6.9 under CVSS 4.0 (AV:N/AC:L/AT:N/PR:N/UI:N/VA:L) and assessed independently as CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - meaning the Gateway itself is not crashed, data is neither corrupted nor disclosed, and service resumes once held connections are released or the pending-auth window expires.
Remote denial of service in vLLM versions before 0.29.0 allows unauthenticated clients to bypass the configured multimodal audio clip size limit (VLLM_MAX_AUDIO_CLIP_FILESIZE_MB) by submitting oversized audio through chat endpoints, causing excessive memory and CPU consumption during decoding. The CVSS vector confirms this is remotely reachable with no privileges (PR:N) and no user interaction, but impact is availability-only (VA:L) - there is no data exposure, integrity loss, or code execution. No public exploit code has been identified at time of analysis, and a vendor-released patch (0.29.0) is available, making this a genuine but low-severity resource-exhaustion issue rather than a high-impact breakout. Exploitability in practice depends on whether the audio-capable chat endpoint is exposed without an authenticating reverse proxy, request-size limits, or rate limiting, and on the host's memory/CPU headroom.
Server-side request forgery in ClawHub's public profile preview allows unauthenticated remote attackers to supply an image URL whose hostname passes the textual private-address check but whose DNS resolution points to an internal, loopback, or rebinding-controlled destination, causing the backend to issue outbound requests to attacker-chosen internal targets. The flaw affects self-hosted ClawHub (openclaw/clawhub) application/backend deployments at revision cbfee7343ddc867316dd9b3de6fa8856730f9f41 or unfixed ancestors; the hosted clawhub.ai instance was patched on 2026-09-11, so only unpatched self-hosted instances remain exposed, and the npm CLI and OpenClaw runtime are separate, unaffected products. No public exploit code and no CISA KEV entry were identified at time of analysis, and the reporting researcher demonstrated only a loopback listener connection - access to production internal services, credential disclosure, and code execution were not demonstrated.
Denial of service in vLLM releases before 0.29.0 allows unauthenticated remote attackers to stall the single EngineCore scheduler thread by sending HTTP requests with multi-hundred-megabyte cache_salt values to the OpenAI-compatible or Anthropic-compatible API endpoints. The oversized salt value is pickle-serialized and SHA-256 hashed on the scheduler thread, so a single request blocks scheduling and inference for all concurrent requests, degrading or halting service. No public exploit code was identified at time of analysis and the issue is not in CISA KEV, so real-world risk is concentrated on internet-facing or multi-tenant vLLM deployments that expose these endpoints without an authenticating gateway or upstream request-size limits.
A two-factor authentication bypass in the Grav Login plugin (grav-plugin-login) versions 3.8.7 through 3.9.6 allows a remote attacker who already knows a member's password to read content that the site gates behind the no-argument authenticated() Twig function, the group form authenticated(null, 'group'), or the [authenticated] shortcode, because Login::isAuthenticated() checked only the session flag showing the password step had succeeded rather than the flag showing login had fully completed. The flaw (CWE-304, missing critical step in authentication) does not grant a completed session: the attacker cannot reach pages protected by an access: rule, cannot act as the member, and cannot use the permission-based authenticated('some.permission') form, so impact is confined to disclosure of that gated content. No public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (not in CISA KEV), though the vendor has released a fix in 3.9.7.
Server-side request forgery in Adminer's optional Elasticsearch driver (plugins/drivers/elastic.php) lets unauthenticated remote attackers force the Adminer host to issue HTTP GET requests to arbitrary reachable hosts and ports, because include/auth.inc.php calls Driver::connect() before it validates the submitted login result. Versions 4.16.0 through 6.0.1 are affected and the issue is conditional: it requires that the optional Elasticsearch driver be explicitly deployed (via the adminer/elastic.php template or an adminer_object() configuration) and that PHP allow_url_fopen be enabled so get_url()/file_get_contents() can send the outbound request. Impact is limited to low-confidentiality reconnaissance - a port-scanning oracle built from leaked JSON error fields and connection-failure text rendered on the login page - with no integrity or availability impact, and the independent assessment rates the issue MEDIUM, consistent with the vendor's CVSS 4.0 base score of 6.9; fixed in 6.0.2 and no public exploit identified at time of analysis.
Server-side request forgery in Adminer 5.5.1 through 6.0.1 lets a remote, unauthenticated attacker force the server to open outbound TCP connections to arbitrary internal hosts and privileged ports before any credentials are validated, by supplying a crafted login 'server' value such as '127.0.0.1:80/x'. The flaw is a regression that re-opens the privileged-port bypass originally fixed in 5.5.0, and because the connection is blind - the attacker only observes refused/handshake/timeout states - impact is limited to internal port scanning and SSRF probing rather than data disclosure or code execution. No public exploit code has been identified at time of analysis and there is no evidence of active exploitation; the vendor-released fix is Adminer 6.0.2.
Stoatchat releases prior to 0.15.5 hand unauthenticated remote attackers an account-existence oracle: POST /api/auth/session/login returns error responses whose 'location' fields differ for registered versus unregistered email addresses, and those same fields leak internal source file paths. The root issue is a CWE-209 sensitive-information-in-error-message flaw that yields email enumeration and path disclosure rather than authentication bypass or data modification, and no public exploit code was identified at time of analysis. The vendor has released a fix, and the independent assessment treats the practical risk as a low-severity information-disclosure issue even though the vendor-published CVSS 4.0 score is 6.9.
Unauthenticated remote attackers can desynchronize HTTP/1.1 response parsing in Netty's HttpServerCodec (io.netty:netty-codec-http) versions 4.2.0.Final through 4.2.16.Final and all versions up to and including 4.1.136.Final by pipelining a GET carrying 'Expect: 100-continue' immediately followed by a HEAD request on the same keep-alive connection. Because the codec pairs each outbound response - including the 100 Continue informational response - with a queued inbound method via pollMethod(), the GET's 200 OK is matched to HEAD and its entity body is dropped, while the following 200 OK (intended for HEAD) is emitted with a body; this misattributes content across responses, enabling response splitting and unsafe reuse of the connection. It is a genuine but moderate-priority integrity flaw (vendor CVSS 4.0 score 6.9; independent assessment CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N), with no public exploit identified at time of analysis and vendor-released patches available in 4.2.17.Final and 4.1.137.Final.
Routing and access-control bypass in Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.0.Final through 4.2.17.Final allows a remote unauthenticated attacker to send a single HEADERS frame with conflicting :authority and host header values, causing different components in a multi-component request path to make inconsistent decisions. This moderate-severity integrity issue is fixed in 4.2.18.Final; no public exploit code or active exploitation has been identified at time of analysis.
OpenClaw LINE before 2026.8.1 silently falls back to the DM allowFrom configuration for group authorization whenever groupAllowFrom is left unset, letting group participants trigger the agent despite an intended group allowlist. Exploitation requires the bot deployment to run in group allowlist mode with groupAllowFrom unset and a broader DM allowFrom, plus the attacker being a member of a LINE group the bot participates in; deployments that explicitly set groupAllowFrom or whose DM allowFrom is no broader than the intended group scope are not exposed. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV), though a vendor patch is available in 2026.8.1.
Remote, unauthenticated attackers can exploit mis-parsing of recipient addresses in Nodemailer versions 9.1.0 through 10.0.8 to inject extra attacker-controlled domain text into the SMTP envelope, but only when the hosting application forwards externally supplied recipient addresses without its own strict validation. The flaw combines a quoted local-part with trailing RFC 5322 comments, yielding normalized values such as 'user@example.com evil.com'; the advisory does not confirm that real SMTP servers would actually deliver to an unintended recipient, and the impact is integrity-only with no confidentiality or availability effect. No public exploit identified at time of analysis (no CISA KEV, no POC observed).
Froxlor through 2.3.10 exposes DKIM private signing keys through its customer-facing API: the Domains.get, Domains.listing, SubDomains.get, and admin SubDomains.listing methods run an unfiltered wildcard SELECT over the panel_domains table and return the dkim_privkey column verbatim to the caller. An authenticated admin who is not a superadmin but has been granted the delegated customers_see_all flag can retrieve the DKIM private keys of every domain visible to them across tenants, and a single listing call discloses the keys for all such domains. Compromising those keys lets the holder forge DKIM signatures that pass DKIM verification and DMARC alignment for the affected domains; the issue is a follow-on to an earlier incomplete fix that scrubbed password and data_2fa but left dkim_privkey in the response. There is no public exploit identified at time of analysis, and the risk is real but bounded because it requires a high-privilege delegated admin role in a multi-tenant deployment; the vendor has released the fix in 2.3.12.
OpenClaw versions 2026.7.1 through 2026.7.2 can disclose local files outside the session working directory when an operator connects `openclaw acp client` to an untrusted or compromised Agent Client Protocol (ACP) peer. Alternate but valid `file:` URL spellings are misclassified as relative paths, bypassing the approval prompt normally required for out-of-scope reads, while mutation and command-capable tool classes remain unaffected, so the demonstrated impact is limited to file confidentiality. No public exploit code has been identified at time of analysis, the vendor-released fix is OpenClaw 2026.8.1, and the assessed risk is low-priority because exploitation requires the operator to establish the ACP connection to a malicious peer.
Credential exposure in the npm-distributed OpenClaw agent framework (versions 2026.4.25 through 2026.8.0) lets an attacker-controlled workspace .env file set AZURE_SPEECH_ENDPOINT and redirect Azure Speech traffic so that the operator's Azure Speech API key is sent in a request header to a host of the attacker's choosing. OpenClaw's workspace environment-variable filter failed to block variables ending in the `_ENDPOINT` suffix, and Azure Speech prefers an explicit endpoint over the configured region, so a subsequent voice-synthesis or voice-list request leaks the key, which can then be reused against the operator's Azure Speech resource. The CVSS:4.0 score is 6.8 with AV:L/PR:N/UI:P - exploitation requires the operator to launch OpenClaw inside hostile workspace content with Azure Speech configured by key and region and no trusted endpoint override set; no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Cleartext storage of Gateway credentials in OpenClaw for iOS before 2026.8.11 lets anyone who obtains an unencrypted device backup or extracts the app's App Group container recover valid Gateway tokens and passwords and authenticate with operator authority. The weakness (CWE-312) is a data-protection failure rather than a remotely reachable flaw: exploitation requires local or forensic access to the device or its backup, consistent with the assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), so confidentiality is fully lost while integrity and availability are unaffected. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and a vendor fix is available in 2026.8.11.
Authenticated denial of service in Elasticsearch lets a valid low-privilege account drive the node or cluster into uncontrolled resource consumption through an allocation-heavy request path, degrading or halting availability (CVSS 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Only users holding at least a low-privileged, network-reachable API account can trigger it - an unauthenticated remote attacker cannot, and there is no confidentiality or integrity impact. Elastic rates this a genuine but modest-severity availability issue rather than a top-tier priority: no public exploit code has been identified at time of analysis, no CISA KEV listing applies, and the advisory does not name the specific endpoint or query construct that acts as the allocation sink. Vendor-released patches exist in Elasticsearch 8.19.22, 9.4.7, and 9.5.4 (ESA-2026-183).
Denial of service in Elasticsearch is possible because of uncontrolled resource consumption (CWE-400) that allows an authenticated user to drive excessive allocation and exhaust cluster resources. Elasticsearch deployments prior to 9.4.7 and 9.5.4 are affected; the issue is remote and low-complexity but requires valid low-privilege credentials or an API key (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), and the impact is limited to availability with no data disclosure or modification. There is no public exploit identified at time of analysis and no confirmed active exploitation, and the vendor-scored severity of 6.5 places this as a moderate availability-only issue rather than a top-tier priority.
Denial of service in Elastic Kibana allows an authenticated low-privilege user with network access to the Kibana HTTP interface to exhaust server resources and render the instance unavailable. The flaw is an uncontrolled resource consumption issue (CWE-400, CAPEC-130 Excessive Allocation) rated CVSS 3.1 base 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), meaning availability impact only, with no confidentiality or integrity loss and no user interaction required. Exploitation requires a valid session at low privilege (PR:L), so a fully unauthenticated attacker cannot trigger it per the assessed vector; no public exploit code and no confirmed in-the-wild exploitation were identified at time of analysis. Elastic has published fixed versions in 8.19.22, 9.4.7, and 9.5.3.
Authenticated denial of service in Elasticsearch lets a low-privilege user with network reachability to the cluster API exhaust node or cluster resources through a crafted request that triggers uncontrolled allocation (CWE-400 / CAPEC-130), driving availability-only degradation rather than data theft or code execution. The vendor-assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 6.5) confirms the attacker must first hold valid low-privilege credentials (or reach an improperly exposed/authenticated API endpoint), that no user interaction is needed, and that confidentiality and integrity are unaffected while scope remains unchanged to the single affected deployment. Practical exposure is greatest in multi-tenant clusters or environments where the Elasticsearch HTTP API is broadly reachable; properly segmented single-tenant clusters face lower risk, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Authenticated denial of service in Elasticsearch allows a remote attacker holding only low-privilege credentials to drive uncontrolled resource consumption, exhausting node memory and degrading or halting cluster availability (CVSS 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Impact is confined to availability - there is no confidentiality or integrity loss - and exploitation requires a valid account, API key, or service token, so fully unauthenticated attackers cannot trigger it against a properly secured cluster. No public exploit code or confirmed active exploitation has been identified at time of analysis, and vendor fixes are available in Elasticsearch 8.19.22, 9.4.7, and 9.5.4 (ESA-2026-179).
Denial of service in Elasticsearch allows a network-reachable, low-privilege authenticated user to exhaust cluster resources through excessive allocation, degrading availability down to a full outage while leaving data confidentiality and integrity intact (CVSS 6.5, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). The flaw is an uncontrolled resource consumption bug (CWE-400 / CAPEC-130 Excessive Allocation), and the CPE record lists elastic:elasticsearch without version constraints, so every unpatched Elasticsearch deployment is presumed affected pending the vendor advisory ESA-2026-176. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; exploitation requires valid low-privilege credentials (a low-tier user, service account, or API key), which limits the population of attackers able to trigger it. The specific endpoint, query type, or configuration that produces the excessive allocation is not named in the available data describing the flaw and must be confirmed against the Elastic advisory.
Denial of service in Elasticsearch allows a network-reachable, low-privileged authenticated user (PR:L) to exhaust server resources and take the cluster's availability down by triggering uncontrolled resource allocation; no user interaction is required (AC:L, UI:N) and the impact is availability-only (C:N/I:N/A:H, base score 6.5). Because a valid account with minimal privileges is a prerequisite, clusters that enforce authentication and limit network exposure are materially less exposed, and the attack cannot be launched fully unauthenticated. No public exploit code and no confirmed active exploitation were identified at time of analysis, so the practical risk is concentrated in multi-tenant or broadly reachable clusters where low-privilege access is easy to obtain; Elastic has published fixed versions in 8.19.21, 9.4.6 and 9.5.3 under advisory ESA-2026-170.
Authenticated Kibana users who hold Synthetics privileges scoped to just one space can permanently delete Synthetics monitors that are shared into other spaces they are not authorized to access, because the space-scoped authorization check is missing on the delete path (CVSS 6.5, PR:L, I:H). When a targeted monitor is tied to a private location, the same action also tears down the underlying Elastic Agent integration configuration, bypassing the authorization controls Fleet would normally enforce. The flaw is limited to space-to-space abuse inside a single Kibana/Elastic deployment rather than cross-tenant compromise, and no public exploit identified at time of analysis; Elastic has published a security update (ESA-2026-139) addressing it.
Stored cross-site scripting in the Automatic.css WordPress plugin 4.0.0 lets an attacker write an unsanitized REQUEST_URI into the plugin's Activity Log, which is then rendered without escaping on the Activity Log settings page, executing arbitrary script in the browser of any administrator who opens that page. The flaw is confined to a single plugin version and only fires when the Activity Log feature is enabled and an admin actually reviews the log, so reliability and timing are attacker-controlled constraints; the vendor-assigned CVSS 3.1 base score is 6.4. No public exploit code was identified at time of analysis and there is no CISA KEV entry, and the analyst-assessed vector (PR:N/UI:R) differs from the supplied vector (PR:L/UI:N), so the exact authentication prerequisite for the injection step remains disputed in the available data.
Unauthenticated remote attackers can exhaust GPU memory on vLLM deployments before 0.29.0 that accept video inputs, by requesting different sampler subclasses whose decoder-allocation counters increment independently and thus sidestep the shared PyNvVideoCodec decoder limit. The result is availability degradation (GPU memory exhaustion) rather than data disclosure or code execution, and success is not deterministic - it depends on repeated requests that win allocation and timing conditions (AC:H, AT:P), with additional practical constraints where the API is gated by an API key or network gateway. No public exploit code has been identified and the issue is not confirmed as actively exploited (CISA KEV); a vendor patch is available per the upstream GitHub security advisory.
Unauthenticated server-side request forgery in Budibase's Microsoft Teams webhook endpoint (all Budibase Server releases before 3.45.0) lets remote attackers submit a forged Bot Framework activity containing an arbitrary serviceUrl that the server persists and then reuses for every subsequent outbound bot reply. Those replies carry live Microsoft OAuth access tokens in their Authorization headers, so the server ultimately transmits credentials to the attacker's host and can also be steered into blind requests against internal network resources. The flaw is network-reachable and needs no authentication or user interaction (CVSS 4.0 PR:N/UI:N/AV:N), but exploitation is tempered by high attack complexity (AC:H) because a structurally valid activity payload is required and the attacker must win the persistence-then-reply flow; the endpoint is only exposed where the Microsoft Teams bot integration is configured and reachable, and no public exploit has been identified at time of analysis.
Cross-user authorization bypass in Elastic Kibana lets an authenticated user who holds the Timeline feature privilege in a Kibana space enumerate, read, modify, and delete draft Timeline objects that belong to other users in that same space, because object ownership is enforced through a user-controlled key rather than through a proper ACL check. Only Timeline read privilege is needed to enumerate and disclose other users' drafts, while the Timeline write privilege is additionally required to alter or delete them; the issue is therefore meaningful only in multi-user, shared Kibana spaces where Timeline privileges are granted to more than one principal, and it is rated CVSS 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L), indicating moderate confidentiality, integrity, and availability impact. No public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV); the vendor advisory referenced for this CVE points to the Kibana 8.19.22 and 9.4.6 security update (ESA-2026-103).
OpenClaw npm package versions 2026.7.2 through 2026.9.1 contain a race condition in the Discord realtime voice transcript path that can cause an utterance from a non-owner participant to be processed at the downstream agent boundary as if it came from the session owner. The flaw is exploitable only in Discord agent-proxy voice sessions that use the realtime voice control path with an agent configured to distinguish owner from non-owner senders, and an admitted non-owner participant must produce concurrent control-classified transcripts that win a non-deterministic timing race against a legitimate owner's context. No public exploit identified at time of analysis; the vendor has fixed the issue in 2026.9.2, and while the CVSS 4.0 base score is 6.1 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N per independent assessment), real-world risk is LOW-to-MODERATE because exploitation is gated by precise timing, the specific realtime control path, and which owner-sensitive tools are actually exposed.
Path traversal in OpenClaw's filesystem sandbox allows an admitted requester-an attacker already authorized to use the tools.fs tools (PR:L)-to read files outside the configured workspace boundary, by supplying a Unicode filename whose fallback normalization resolves to a canonically equivalent sibling directory. Only installations that rely on the tools.fs.workspaceOnly restriction for isolation are affected, and exploitation yields read-only confidentiality impact with no code execution or file modification; success requires crafting a working Unicode-equivalence encoding against the specific normalization logic (AC:H, AT:P). Vendor-released patch: 2026.8.1. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV, so this is a moderate-priority, confidentiality-only path traversal rather than an active exploitation emergency, though the high confidentiality rating (VC:H) means exposure can be significant where the Gateway process can read sensitive files outside the workspace.
Out-of-policy local file disclosure in OpenClaw's Discord integration (@openclaw/discord) before 2026.9.3 allows an authenticated sender who is already permitted to invoke the guild emoji and sticker upload actions to have the integration read and upload bytes from a local host file that the sender's configured media roots would otherwise reject. The bypass is narrow: it stems from the sender-scoped media policy being dropped in the emoji/sticker upload code path before the local file is loaded, and it does not grant filesystem browsing, directory listing, or code execution - the attacker must already know or derive a useful absolute path on the OpenClaw host. CVSS 4.0 scores this 6.0 (AV:N/AC:H/AT:P/PR:L/UI:N/VC:H), and while no public exploit or confirmed active exploitation has been identified at time of analysis, the vendor has released a fix in @openclaw/discord 2026.9.3, so the real-world priority is low-to-moderate and driven by deployments that expose the guild asset action to semi-trusted senders.
Credential exposure in the OpenClaw npm package (versions >= 2026.3.28 and < 2026.8.1) causes the primary embedding provider's API key to be reused and transmitted as a bearer token to an unintended third-party vendor when remote cross-provider embedding failover is configured and the primary provider fails. The CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:P, VC:H) and the independent CVSS 3.1 assessment (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) both rate this medium-severity at 6.0, but our assessment concludes real-world risk is LOW-to-MODERATE: the leak is an accidental transmission triggered by operator configuration plus an operational failure, not an attacker-reachable endpoint. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; impact is bounded by the privileges attached to the exposed primary provider key.
Stale channel permission overrides in Capgo can let a former source-organization member repoint a destination-owned app channel after a cross-organization app transfer, causing the /updates endpoint to serve an attacker-selected OTA bundle to devices. The flaw affects all Capgo (capgo.app) versions up to and including the current release, requires an authenticated attacker (PR:L) who previously held a legitimate override and an admin-run transfer_app() operation, and is bounded to integrity impact with no data disclosure or outage. No public exploit identified at time of analysis, and no vendor-released patch was available at publication.
OpenClaw (npm package `openclaw`) before 2026.8.1 mishandles sender tool policies during session-memory filename generation: the helper embedded in that generation path can retain tools that the originating sender's policy had already removed, letting an already-admitted low-trust sender (authenticated, PR:L) reach tools outside their effective policy. Exploitation is gated on a non-default deployment-session-memory filename generation must be enabled for an agent reachable by lower-trust senders-and further depends on the model acting on an injected instruction and the embedded helper actually exposing the targeted tools, so the demonstrated impact is limited to integrity (creation of persistent scheduled work), with no confidentiality or availability effect. There is no public exploit identified at time of analysis, and the combination of feature gating, model non-determinism, and an available vendor workaround makes this a genuine but low-priority issue.
TLS certificate validation bypass in Nodemailer 5.0.0 through 10.0.1 allows an attacker who can prime a process-global DNS cache to make a victim direct-TLS/SMTPS transport connect to the attacker's SNI virtual host and accept the attacker's certificate, even with rejectUnauthorized: true, potentially disclosing SMTP credentials. Exploitation is conditional: it requires two or more secure:true transports resolving the same non-IP hostname with different tls.servername values in the same Node.js process, plus a low-privileged attacker capable of winning a cache-priming race (assessed CVSS 3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N). No public exploit code or confirmed active exploitation was identified at time of analysis; the vendor fixed the cache-key confusion in Nodemailer 10.0.2.
OpenClaw (npm package 'openclaw') versions before 2026.8.1 can disclose a configured third-party provider credential to an unrelated OpenAI-compatible endpoint. The leak occurs only under a non-default chain of conditions: a provider that uses an OpenAI-compatible API whose resolved model metadata lacks a concrete base URL, a session pinned to that provider, and a model-configuration hot reload that fires while the pinned session continues, after which the OpenAI SDK falls back to its own default endpoint while the session still holds the provider's stored key; the resulting request fails with a misleading authentication error, masking the exposure. Authentication is required to configure providers (CVSS 4.0 vector PR:L, UI:P; independent assessment PR:L), no public exploit code has been identified at time of analysis, and a vendor-released patch fixes the issue in 2026.8.1, making this a lower-priority credential-exposure misconfiguration issue rather than a remotely triggerable default-configuration flaw.
SQL injection in CloudClassroom PHP (mathurvishal project) allows remote unauthenticated attackers to read sensitive database contents by manipulating the 'seno' parameter of viewresult.php, with high confidentiality impact as assessed independently. Public exploit code exists, but the vulnerability is considered a low-priority disclosure due to limited impact beyond data disclosure. The vendor did not respond and no patched version is available because the project uses a rolling release model.
Exec allowlist bypass in OpenClaw (npm-distributed agent runtime) causes Windows hosts running in exec allowlist mode to launch the wrong binary: a PowerShell command approved by bare executable name is analyzed and allowed against the PATH-resolved path, but at execution time a same-named executable planted in an agent-writable workspace is run instead, yielding arbitrary code execution with the privileges of the Gateway or node-host user. Affected versions are 2026.2.26 through 2026.7.1; the vendor rates it CVSS 4.0 5.4, while our assessment maps to CVSS 3.1 AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H, i.e. a real but heavily gated privilege/execution issue requiring a local, low-privileged actor with an existing operator allowlist approval and the ability to steer the agent. No public exploit identified at time of analysis and no CISA KEV entry; version 2026.7.1 contains the vendor-released fix.