Cross-domain authenticated request bypass in the connect-xcors (connect-cors) Node.js middleware lets an attacker defeat origin verification so that a victim's browser issues credentialed cross-origin requests the application would otherwise reject. The flaw is remotely reachable without attacker authentication (CVSS 4.0 PR:N) but requires the victim to be logged in to the affected application and to load attacker-controlled web content (UI:P); impact is bounded to low confidentiality and low integrity with no availability effect, giving low-to-moderate real-world risk. No public exploit code has been identified at time of analysis, and no CISA KEV entry exists for this CVE.
Memory-safety defect in Meta's Proxygen C++ HTTP library lets the HTTPTransaction::onWebTransportUniStream and HTTPTransaction::onWebTransportBidiStream callbacks return stream handles that the stream handler had already freed, after which HQSession installs those stale handles as transport read callbacks and can read through freed memory. Only servers built on affected releases (v2024.10.28.00 up to but not including v2026.09.28.00) that actually enable and terminate WebTransport over HTTP/3 are exposed; remote, unauthenticated peers able to drive that stream-setup path can trigger the fault, but the assessed impact is availability only (CVSS 5.3, A:L, no C/I loss) and reliable triggering depends on winning the free-then-reuse timing window. No public exploit code has been identified and there is no confirmed active exploitation; EPSS is very low at roughly 0.14% (3rd percentile).
Cross-site request forgery in Cotonti CMS through 1.0.0 lets an attacker who lures an authenticated administrator to a malicious page delete custom user groups and their associated permissions without any token verification. The vulnerable logic sits in system/admin/admin.users.php (around lines 136-140), where the user-group deletion action executes without the framework's anti-CSRF (xg) check, so a forged request simply rides the administrator's live session. From the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) the attacker needs no credentials of their own but cannot succeed without an administrator's valid session and interaction, which keeps this a low-to-moderate priority issue; no public exploit code has been identified at time of analysis, there is no evidence of confirmed active exploitation, and the vendor has published fix code.
Uncaught exception handling in the A2A middleware of ag-ui-protocol ag-ui (all versions up to 2026-09-07) allows an attacker who can control the arguments of a tool call to crash or permanently hang an agent run stream. Supplying malformed JSON, or valid JSON that is not a usable object (null, a bare number, a string, or an array), reaches an unguarded JSON.parse path in the middleware's conversion logic and throws before any error-catching exists, leaving the run neither completed nor errored. The issue is network-reachable but requires low-level/authenticated privilege to inject the crafted tool-call arguments (CVSS 4.0 base 5.3, PR:L; independent assessment CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L), and impact is limited to availability of the affected run with no confidentiality or integrity effect. There is no public exploit identified at time of analysis; the vendor fixed the flaw in release 2026-09-08.
Incomplete cleanup of per-run state in the ag-ui TypeScript client SDK's FilterToolCallsMiddleware allows disallowed tool-call events from one agent run to escape filtering - or valid events from another run to be wrongly blocked - when a single middleware instance or subscription serves more than one run. Affected deployments are those using ag-ui (ag-ui-protocol) client SDK builds up to 2026-09-07 that rely on FilterToolCallsMiddleware with a disallowedToolCalls list as a real security control, in a pattern where runs overlap, stall, or reuse runId/toolCallId values. The issue is rated CVSS 4.0 5.3 (assessed as CVSS 3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L) - an authenticated, low-privileged party who can start agent runs is the relevant actor; impact is bounded to filter bypass and mis-blocking rather than code execution, and no public exploit identified at time of analysis. Vendor-released patch: 2026-09-08.
Unbounded request-body reads in the ag-ui Java community server SDK (JdkAgentHttpHandler, used by applications that instantiate the two-argument handler constructors) allow a remote attacker to exhaust server heap memory by posting an oversized body - or a chunked body without a Content-Length header - to the agent context path, causing a denial of service. The issue affects ag-ui releases up to 2026-09-23 and is rated low-to-moderate (CVSS 4.0 base 5.3; our independent assessment CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L), with impact confined to availability and no confidentiality or integrity effect. No public exploit code or confirmed active exploitation was identified at time of analysis, and the handler's lack of built-in authentication means the practical privilege requirement depends on how each deployment fronts the endpoint; an upstream fix exists as pull request #2671 but is not yet merged/accepted.
Authentication bypass in Kaon AR2140X routers (firmware versions up to 4.2.17) allows unauthenticated attackers on the adjacent network to obtain a valid session cookie and access upgrade-related functionality, which can be abused to force the device to issue GET requests to arbitrary domains. The flaw requires local LAN or Wi-Fi adjacency (AV:A) and carries low confidentiality/integrity impact with no availability impact; no public exploit has been identified, and the status of firmware newer than 4.2.17 remains unknown.
mH-DEVELOPER smart home modules running firmware before 3.0.30 start up without loading any firewall rules, leaving SSH, HTTP, WebSocket, and Node-RED listening on the LAN with no access control, so any client on the same network segment can reach every service unauthenticated (CVSS 4.0 5.3; CVSS 3.1 AV:A/AC:L/PR:N/UI:N, low confidentiality and integrity impact). Exploitation requires network adjacency - the module is not reachable from the internet unless another device bridges access - and meaningful device takeover typically depends on chaining one of the sibling vulnerabilities covered by the same CERT-PL advisory. No public exploit identified at time of analysis, and the issue is a design/hygiene weakness (CWE-923) rather than a memory-corruption or code-execution flaw; the vendor fixed it in version 3.0.30.
Reflected cross-site scripting in multiple Dayforce Payroll endpoints lets an unauthenticated attacker craft a URL that, once opened by a logged-in payroll user, runs arbitrary JavaScript in that user's browser session. Confirmed only in Dayforce Payroll R2026.2.0, with applicability to other versions unverified because repeated attempts to reach the vendor were unsuccessful, and with no public exploit identified at time of analysis. The real-world risk is genuine but modest: exploitation is gated by a mandatory victim click (UI:A/UI:R) and impact is confined to the victim's browser session, with no server-side compromise - no CISA KEV listing and no evidence of active exploitation in the available data.
Authorization bypass in fuzui StudentInfo lets an authenticated remote attacker change another user's password by tampering with the sid/tid argument sent to the /StudentInfo/StudentHandler/moditypasswordstu endpoint, an insecure direct object reference (CWE-639) in the Password Change handler. The product ships as a rolling release, so no version boundary can be drawn and the affected set is effectively every deployment of the codebase up to commit fcc42a639ec7cef620651bfd0f07ebb660529e3f; the vendor was contacted early but never responded, and no public exploit code is identified at time of analysis. Scoring diverges sharply between sources: the vendor's CVSS 4.0 rating is 5.1 (medium) with all impacts rated Low and user interaction asserted, whereas our assessment rates the same issue as an unauthenticated-interaction, high confidentiality and integrity impact flaw (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L), so account-takeover risk should be treated as the governing concern rather than the vendor's medium score.
Malicious or compromised X servers can crash X clients linked against libX11 before 1.8.14 by supplying crafted byte-oriented codeset/locale data that triggers an out-of-bounds read in the client's codeset parser. The flaw is a client-side denial of service with only incidental memory disclosure, not code execution, and it works in the reverse of the usual trust direction: the server attacks the client, so exposure requires a victim application to open an X11 connection to an X server the attacker controls or has compromised (such as a hostile remote or forwarded display). The local attack vector and the requirement for an untrusted display keep realistic risk low; no public exploit code or confirmed active exploitation was identified at time of analysis, and vendor patches are available (upstream fix merged for the 1.8.14 release).
Unauthenticated physical attackers with access to a server's internals can exploit an improperly protected on-chip debug and test interface on the SMCU of Dell BOSS-N1 17G controllers (firmware prior to 2.2.13.2038) to gain unauthorized access, primarily threatening integrity. This is a low-priority, high-friction vulnerability requiring physical presence, high attack complexity, and user interaction, and no public exploit has been identified. Dell has released firmware version 2.2.13.2038 to address the issue.
Stored cross-site scripting in the Items Management Module of amirsanni Mini Inventory and Sales Management System allows an authenticated low-privileged user to inject script through the itemName argument in application/controllers/Items.php, which executes in another user's browser when the affected item page is viewed. The issue affects all versions under the project's rolling-release model (CPE wildcard), with no vendor response or released fix identified, and no public exploit code identified at time of analysis. Risk is integrity-focused client-side script execution requiring victim interaction; CVSS 4.0 scores it 5.1 while the 3.1 assessment is consistent with low-to-moderate real-world impact.
CPU-exhaustion denial of service in PyJWT versions prior to 2.14.0, where the lazy PEM-detection regular expression used by is_pem_format() backtracks without bound on certificate-like input containing repeated '-----BEGIN <label>-----' markers and no matching END marker. The flaw is reachable only through the key-preparation path (the key/secret material supplied to PyJWT for verification/signing), which in normal deployments is operator- or configuration-controlled; the assessed vector accordingly requires high privileges (PR:H) and a specifically crafted input (AC:H), and impact is limited to availability with no confidentiality or integrity effect. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), but a vendor fix exists and the issue was publicly disclosed, so unpatched instances should be upgraded promptly given the trivial resource-consumption nature of ReDoS bugs once a trigger is known.
Untrusted input routed into agentverus-scanner's security-defense-skill analyzer can override the classification decision made by isSecurityDefenseSkill in dist/scanner/analyzers/context.js, allowing an attacker to weaken or falsify the scanner's own detection results for versions up to 0.8.1. Exploitation requires an authenticated local foothold and passive user interaction, and the impact is limited to low integrity loss with no confidentiality or availability effect; the CVSS 4.0 score of 2.4 reflects that narrow scope and is appropriately calibrated rather than deflated. Publicly available exploit code exists, and the project was notified via an issue report but has not responded, so no vendor-released patch has been identified at time of analysis.
Local path traversal in Tencent AI-Infra-Guard (versions up to 4.5.2 and the 4.6.2 line referenced by the vendor report) lets an attacker who can influence the file or directory path arguments processed by the scanner's skill-scan and mcp-scan file tools escape the configured working directory, reading or writing files outside the intended root. The defect is a directory-containment check that used a plain string prefix comparison rather than a canonical-path comparison, so both traversal sequences and sibling directories with a shared name prefix bypass it; exploitation requires local access with low privileges plus passive user interaction, since an operator must run a scan over attacker-influenced paths or content. Publicly available exploit code exists (referenced through the vendor's GitHub issue tracker), and the vendor has shipped a fix in the v4.6.0 release; the CVSS 4.0 score of 0.9 reflects the heavily constrained local attack path, and this analysis agrees with the independent assessment that the practical risk is low.
Stored cross-site scripting in TPVEnlanube enables an authenticated backend user to store malicious JavaScript in the 'Apellido 1' field of the Joomla/VirtueMart administrator user-add endpoint '/administrator/index.php?page=admin.user_add&user_id=45&option=com_virtuemart'; the payload executes in the browser of a privileged user or administrator who later views the affected user record. The flaw is not self-triggering and requires two actors-an authenticated low-privileged account to store the payload and an administrator to render it-so the assessed impact is low-to-moderate, limited to script execution in the victim's admin session, with no public exploit identified at time of analysis and no direct server-side code execution.
Stored cross-site scripting in TPVEnlanube allows an authenticated user with access to the VirtueMart store administration function to persist arbitrary script through the 'vendor_store_name' parameter at the '/administrator/index.php?pshop_mode=admin&page=store.store_add&option=com_virtuemart&vendor_id=[ID]' endpoint; the payload then executes in the browser of any administrator or user who later renders the poisoned store record. Exploitation is high-friction: it requires valid backend credentials (CVSS PR:L), reachability of the store-management feature, and a separate privileged victim who opens the affected record (UI:A), which caps the realistic impact at low-confidentiality/low-integrity for the victim's session. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV; severity is low (CVSS 4.0 base 4.8).
Stored cross-site scripting (XSS) in TPVEnlanube, a Joomla/VirtueMart payment gateway extension, allows an authenticated attacker to inject malicious script into the 'Nombre Completo' field, which then executes in the browser of any privileged user viewing the VirtueMart administrator user-list page (admin.user_list). The vulnerability affects all versions of the extension (CPE wildcard) and requires the victim to interact with the page. No public exploit has been identified, and the overall risk is assessed as low-to-moderate due to the need for authentication and user interaction, with impact limited to browser-based script execution rather than server compromise.
In rhukster/dom-sanitizer versions prior to 1.0.15, a data: URL containing Base64-encoded active markup (for example data:text/html;base64,… or data:image/svg+xml;base64,… with an onload handler) survives the isDangerousUrl() check and is emitted intact inside href and xlink:href attributes of sanitized HTML/SVG/MathML, allowing a sanitizer bypass that turns sanitized output into an injection vector when the application renders it. Exploitation is unauthenticated by the sanitizer itself (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, assessed), but requires victim interaction - the victim must follow or trigger the surviving link - and is further constrained because modern browsers block top-level navigation to data:text/html URLs, which neutralizes the most common payload form; data: payloads consumed in other contexts (for example SVG <image> or embedded resource loading) remain more viable. There is no public exploit identified at time of analysis and no KEV listing; EPSS data was not provided, and the vendor has released a patched version.
Log-download path traversal (Zip Slip) in Dozzle before 11.1.2 allows attackers who control container display names to embed directory-traversal sequences such as '../../etc/cron.d/evil' into ZIP entry names, so that files are written outside the intended extraction directory when a user downloads and unpacks the log archive. The flaw affects the web log-download endpoint (/api/containers/.../download), which previously sanitized only the 'name' query parameter while writing unsanitized container names into archive entries; the assessed CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:N, 4.6 in the CVE's CVSS 4.0 scoring) reflects that exploitation requires an attacker who can name/label containers plus a legitimate user who downloads and extracts the archive with a traversal-unsafe tool, and the resulting integrity impact lands on the extracting user's machine (SI:H) rather than on the Dozzle server. There is no indication of active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, but a vendor patch is available: Dozzle 11.1.2 ships a sanitizeFileName helper that reduces entry names to alphanumerics, hyphens, underscores and dots and trims leading dots. Because the traversal is written into the archive rather than triggered server-side, this is a client-side/Zip Slip write primitive, not a direct remote code execution path against the Dozzle instance itself.
Replay of HMAC confirmation tokens in Zscaler MCP Server 0.7.0 and 0.7.1 lets an authenticated MCP client or agent reuse a confirmation token minted for one resource to authorize a destructive delete against a different resource of the same type. Because the affected delete handlers called check_confirmation() with empty parameters ({}), the resulting HMAC-SHA256 tokens carried no binding to the target resource identifier, making them fungible across 31 delete operations in the ZPA, ZIA, and ZTW service modules. The vendor addressed the issue by binding the resource identifier into the HMAC payload and shipping regression tests (including AST-based static analysis) in version 0.7.2; there is no KEV listing, and no public exploit identified at time of analysis, with the moderate CVSS score of 4.6 (AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L) reflecting that exploitation requires prior authenticated access, a legitimately issued token, and is limited to same-type resources.
Out-of-bounds memory access in Google Chrome's video codec handling - fixed in the 147.0.7727.55 desktop release - can be triggered when a victim loads a crafted video file, resulting in a bounded memory over-read that leaks limited process data rather than enabling code execution. The issue is network-reachable without authentication (CVSS PR:N) but strictly requires the user to load attacker-controlled media (UI:R), and CISA's SSVC assessment classifies it as non-automatable with only partial technical impact; no public exploit code identified at time of analysis and it is not listed in CISA KEV. With a CVSS base of 4.3 and Chromium's own rating of 'Low', this is a low-priority, routine-patching issue, notable mainly because Chrome's ubiquity makes even low-severity memory-safety defects worth closing promptly.
Path traversal in the Canonical LXD CLI image export and copy code (client/lxd_images.go) lets a malicious or machine-in-the-middle image server steer the filename used for a downloaded image outside the local destination directory via a crafted Content-Disposition header, allowing arbitrary local file overwrite that can lead to code execution as the invoking user. Affected releases are LXD 4.0.2 through 4.0.13, 5.0.x before 5.0.10, 5.21.x before 5.21.8, and 6.x before 6.10; exploitation requires the victim to actively run `lxc image export` or `lxc image copy` into a local directory while pulling from an attacker-controlled or intercepted remote (CVSS 3.1 base 4.2, AV:N/AC:H/PR:N/UI:R, unauthenticated network attacker but with required user interaction). No public exploit code has been identified at time of analysis, and the issue is publicly documented with vendor-released patches and upstream pull requests already merged.
Cross-site scripting (XSS) in Enocta Platform allows authenticated users to inject script into HTML attribute contexts, potentially modifying the appearance or behavior of pages viewed by other users. The flaw affects all versions through 2026-09-28 according to TR-CERT, and exploitation requires an authenticated account (PR:L) plus a victim who views the crafted content (UI:R), yielding only limited integrity impact (CVSS 4.1). No public exploit identified at time of analysis.
Incorrect permissions on temporary repository cache directories in Flatpak before 1.18.4 allow a local, unprivileged user to read data left behind in /var/tmp/flatpak-cache-* while another user's app or runtime is being downloaded from an OCI repository. Exploitation requires a pre-existing local account on a multi-user host and the transient cache directory to still exist before Flatpak cleans it up, and the result is low-confidentiality information disclosure only - no privilege escalation, code execution, or file modification is possible, and no public exploit identified at time of analysis. The same 1.18.4 release addresses several more serious sibling issues (CVE-2026-97023, CVE-2026-97024, CVE-2026-97025, CVE-2026-97027, CVE-2026-97029), so a single upgrade remediates all of them.
Power8-optimized strncasecmp in the GNU C Library (glibc) 2.24 and later can read one byte past the caller-supplied length limit, faulting only when the compared strings match up to the final byte of a memory page and the adjacent page is unmapped or non-readable, which crashes the calling process. Per the assessed vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L), the flaw is reachable by unauthenticated remote attackers only in applications that pass attacker-controlled strings into strncasecmp, and impact is confined to a low-availability denial of service of that process - no code execution, data disclosure, or modification. Exploitation additionally requires the specific IBM POWER8 CPU family and precise page-boundary alignment, making triggering non-deterministic; no public exploit has been identified at time of analysis and there is no evidence of confirmed active exploitation (CISA KEV). Overall this is a low-severity availability-only bug that is not a priority for most environments.
Uncaught exceptions raised inside server method handlers in @grpc/grpc-js leak their error message text back to the calling client, exposing internal details such as file paths, SQL fragments, or connection strings. The flaw affects the pure-JavaScript gRPC implementation for Node.js in versions before 1.13.6 and before 1.14.5, and remote clients can trigger it without authentication (CVSS 3.7, AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N), though disclosure is opportunistic because the attacker cannot control what the handler throws. No public exploit code has been identified and the issue is not reported as actively exploited, but it is a straightforward logic flaw with a trivially reachable trigger for any server whose handlers throw unguarded errors.
Keycloak's Micrometer user-event metrics listener can be forced to create unbounded metric time series by unauthenticated remote requests to the identity broker login endpoint with arbitrary provider aliases, leading to memory exhaustion and performance degradation. This is a low-priority issue because exploitation requires the non-default configuration of including the 'idp' tag in the listener, and the impact is limited to a gradual availability degradation (A:L). No public exploit code has been identified at the time of analysis.
Flatpak versions prior to 1.18.4 export .desktop and D-Bus .service files from installed applications to the host without filtering their fields against an allowlist, enabling a malicious Flatpak app to cause denial of service or unintended interactions with host services. Exploitation is local and requires the victim to install a malicious app (from a Flatpak remote or sideloaded bundle); no public exploit code or active exploitation is identified in the available data. The vendor-released patch is Flatpak 1.18.4.
Flatpak before 1.18.4 exposes OCI authentication tokens to other local users when a victim performs an authenticated download of an app or runtime from an OCI repository, allowing a co-located attacker to capture the token and potentially misuse it. The flaw affects multi-user Linux systems and was fixed in Flatpak 1.18.4; no public exploit code or active exploitation is known at this time, and the assessed impact is limited to information disclosure (CVSS 3.1: AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
Opening a specially crafted PCX image in FastStone Image Viewer 8.3 or earlier triggers an out-of-bounds read in the PCX decoder, causing a crash or limited memory disclosure. The vulnerability requires user interaction and affects only the client-side application; an attacker can exploit it remotely by delivering a malicious file. No public exploit identified at time of analysis, and the vendor has not released a patch.
Opening a maliciously crafted TGA image in FastStone Image Viewer 8.3 or earlier triggers an out-of-bounds read in the TGA Image Handler implemented in FSViewer.exe, allowing a remote attacker to disclose process memory or crash the application. The CVSS 4.0 vector rates this 5.3 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L) and carries E:P, indicating proof-of-concept exploit maturity; there is no CISA KEV entry, so confirmed active exploitation is not established. The vendor was contacted about the disclosure but did not respond, so no fixed version is available and the practical risk is a low-priority, client-side memory-safety issue that depends on the victim opening the crafted file (UI:P).
Out-of-bounds write in FastStone Image Viewer through 8.3 lets an attacker corrupt memory - and potentially achieve code execution - when a victim opens or previews a crafted 1bpp RLE image, with impact rated Low across confidentiality, integrity, and availability (CVSS v3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L). The vulnerable component is the viewer's 1bpp RLE decoder, reachable remotely only through user-initiated file opening, so exploitation requires social engineering or a drive-by download against Windows desktop users rather than any server-side reach; the CVSS v4.0 vector carries an exploit-maturity metric of Proof-of-Concept (E:P), meaning publicly available exploit code exists per that metric, although the independent assessment found no linked working exploit and the issue is not listed in CISA KEV. The vendor was contacted early but did not respond and no patch is available, so priority is LOW-to-MEDIUM with risk mitigated primarily by user-interaction requirements, client-side-only triggering, and consumer desktop deployment.
Out-of-bounds write in FastStone Image Viewer up to version 8.3 allows remote attackers to corrupt memory when a user opens or previews a crafted TGA image file. The vulnerability requires user interaction (UI:P/UI:R) and is rated CVSS 4.0 5.3 (moderate severity). Publicly available exploit code exists (indicated by E:P in the CVSS vector), but no evidence of active exploitation in the wild; the vendor was contacted but did not respond, and no patch is available.
Authenticated attackers can read other employees' expense claims, shift requests, and attendance records in Frappe HR up to 16.15.0 by exploiting an incorrect authorization flaw in the get_expense_claims, get_shift_requests, and get_attendance_requests API endpoints. The vulnerability requires a valid low-privilege session but no special permissions, and the vendor has confirmed the issue is fixed. No public exploit identified at time of analysis; the impact is limited to information disclosure (CVSS 5.3, MEDIUM).
Authenticated users of Langflow instances prior to 1.12.0 can convert crafted component input options into arbitrary Python code execution because schema.py interpolates those options into a Literal type string that is handed directly to eval() without safe-evaluation controls (CWE-95). The sink fires when an affected component is turned into a LangChain tool via ComponentToolkit.get_tools(), which also occurs during custom-component saves through the API, so an attacker must already hold a valid account able to create or save components (PR:L in the assessed CVSS 3.1 vector; PR:H in the vendor's CVSS 4.0 vector) and must satisfy the high-complexity object-crafting and interpolation path (AC:H/AT:P). No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; practical marginal risk is limited because the privileges required to reach the sink typically already allow legitimate Python execution through Langflow's custom-component feature.
Bagisto up to 2.4.6 fails to enforce authorization on the invoice mass status update endpoint, allowing an authenticated admin-panel user to alter invoice states. The impact is limited to integrity changes (CVSS 2.0 / 3.1 3.9), and although publicly available exploit code exists, the need for valid admin-context credentials reduces the overall risk to low. The vendor was contacted early about the disclosure, but no patched version has been identified.
Local information disclosure in deepseek-ai DeepSeek Harness through 0.1.5-rc.3 allows an authenticated local attacker with low privileges to manipulate the E2B_API_KEY argument in packages/e2b/e2b/src/index.ts (dsh component), causing the application to rely on untrusted input in a security decision. Publicly available exploit code exists, and the vendor was contacted early but did not respond; the issue is assessed as low severity with only limited confidentiality impact and no integrity or availability effect.