Denial of service in Apache Thrift's Python bindings (all versions before 0.25.0) allows remote, unauthenticated clients to force unbounded memory allocation by sending crafted messages that declare oversized containers or strings, crashing or hanging the affected service. The flaw pairs a missing resource limit with an insecure default configuration in which the bindings apply no read or container size cap unless the application explicitly sets one, so any network-reachable Thrift service that accepts untrusted traffic while running on those defaults is exposed. Impact is confined to availability with no confidentiality or integrity effect, and the CVSS 4.0 AT:P component reflects that a specific, not fully attacker-controlled deployment condition must be met; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV.
Denial of service in the Apache Thrift Java bindings before 0.25.0 allows remote, unauthenticated attackers to crash or exhaust resources on a service that deserializes attacker-controlled Thrift messages, because exceptional conditions on the message-handling path are not handled correctly and resource allocation is not bounded or throttled. Only deployments running affected Thrift Java server code on a network-reachable endpoint are at risk; impact is confined to availability (service crash / resource exhaustion) with no loss of confidentiality or integrity, and a specific precondition must hold - the crafted input must reach the vulnerable exception-handling or allocation path rather than any arbitrary request. There is no public exploit identified at time of analysis, and no confirmed active exploitation (CISA KEV); vendor-released patch: 0.25.0.
Denial of service in Apache Thrift's c_glib (C/GLib) language bindings, affecting all versions before 0.25.0, where a crafted or malformed Thrift message can drive the decoder into an infinite loop with an unreachable exit condition (CWE-835). The issue is remotely reachable and requires no authentication per the published CVSS 4.0 vector (PR:N), though the AT:P attack-requirements flag and our independent CVSS 3.1 assessment (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) both indicate a specific input condition must be satisfied rather than arbitrary traffic. Impact is confined to availability - a hung thread, pinned CPU, or resource exhaustion that can stall or crash the service - with no data exposure, modification, or code execution; only applications that compile and use the c_glib bindings are affected, and no public exploit code has been identified at time of analysis. Upgrading to 0.25.0 removes the condition.
Denial of service in Apache Thrift Python bindings before 0.25.0 allows unauthenticated remote attackers to hang the service by sending crafted Thrift messages that drive the parser into an infinite loop (CWE-835). Exploitation is network-based but requires a specific condition, such as a particular protocol/transport or malformed message structure, to trigger the loop (AT:P / AC:H). The impact is limited to availability-no data disclosure or code execution-and only services exposing a Thrift endpoint that processes untrusted input using the Python bindings are affected; no public exploit code has been identified at time of analysis.
Server-side request forgery in the OAuth2 discovery handling of Loom for AWS (awslabs/loom) before 1.7.0 lets an authenticated user who can register a tool server or remote agent supply a crafted discovery document address, causing the backend to make requests to arbitrary internal network locations and - in deployments using delegated authentication - to leak another user's access token. The prerequisites are meaningful: the attacker needs high privileges to register the tool server/remote agent (PR:H) and the token-disclosure outcome requires passive interaction from a victim user (UI:P), so this is a credible, above-average-priority issue rather than an emergency, and it only affects deployments actually using the OAuth2/OIDC delegated-authentication discovery feature. There is no public exploit identified at time of analysis; the vendor has released Loom 1.7.0, which adds a deployment-trusted issuer host requirement before any token exchange and applies an IP-validated, DNS-pinned fetcher to all outbound OAuth2/OIDC calls.
Denial of service in the Zcash Foundation's Zebra full node before 6.1.0 lets remote unauthenticated peers stall node synchronization by poisoning the stale parent_error_map used by the state write task, after which the next canonical block is rejected for roughly 2,000 blocks. Exploitation is gated by a narrow race window: the attacker must act as a network peer and deliver a coinbase-malleated block that shares a legitimate canonical block's hash before that canonical block propagates, an AC:H/AT:P timing condition, so reliable on-demand abuse is materially limited. Impact is availability-only (CVSS 4.0 8.2, VA:H with no confidentiality or integrity effect), unauthenticated per the PR:N vectors, and no public exploit code has been identified at time of analysis; a vendor-released patch is available in Zebra 6.1.0.
RSA PKCS#1 v1.5 key transport in the Bouncy Castle C# (bc-csharp) CMS implementation before 2.7.0 is vulnerable to a Bleichenbacher-style adaptive chosen-ciphertext attack that can recover the content-encryption key - and hence the plaintext - of a captured CMS EnvelopedData message. The observable discrepancy is that a key-transport ciphertext with invalid PKCS#1 v1.5 padding is rejected inside KeyTransRecipientInformation.UnwrapKey with a distinct 'bad padding in message' CmsException, instead of being silently replaced by a random key, so a malformed ciphertext can be distinguished from a well-padded one that only fails later during content decryption. The attack is unauthenticated (PR:N in both the CVSS 4.0 and the assessed CVSS 3.1 vectors) but highly conditional: the attacker must already hold a captured message, must have access to an application that decrypts attacker-submitted messages with the recipient's RSA private key, and must be able to observe the padding-versus-content error distinction across a very large number of adaptively modified ciphertexts - no public exploit code was identified at time of analysis, and the vendor fixed the issue in 2.7.0.
Information disclosure in Bouncy Castle C# (bc-csharp) versions before 2.7.0 allows unauthenticated remote attackers to obtain plaintext from forged ciphertexts when an application decrypts into a caller-supplied buffer and subsequently observes that buffer after a failed authentication-tag check (e.g., through buffer reuse or logging). The vulnerability affects CcmBlockCipher and KCcmBlockCipher (DSTU 7624 CCM) only; methods returning newly allocated arrays are not vulnerable. No public exploit code or active exploitation has been identified, and the practical risk is conditional on the application exposing the failed decryption buffer, narrowing the attack surface despite the vendor-assigned CVSS 4.0 score of 8.2.
Timing side-channel leakage in Bouncy Castle for Java (bc-java) versions before 1.86 exposes private-key information from NTRU post-quantum KEM operations because three modular-reduction helpers used the '%' operator, which compiles to an integer division whose latency depends on the secret operand. Affected call paths include key generation (secret polynomials f and g), encapsulation (message polynomials r and m), and decapsulation (coefficients recovered from the private key), and the CVSS 4.0 base score is 8.2 (assessed as CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - confidentiality only). Exploitation requires the application to actually invoke NTRU KEM operations with a persistent/reused key and an attacker able to repeatedly measure operation timing with low jitter, so practical risk is limited to deployments that use NTRU and expose those operations to a co-located or low-latency timing observer; no public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (no CISA KEV listing), but a vendor patch is available and should be applied.
Uncontrolled resource allocation in Apache Thrift versions before 0.25.0 allows remote unauthenticated attackers to exhaust memory, CPU, or worker/connection capacity in services built on the C++, Java, Go, netstd, Python, and Delphi bindings (CWE-770), disrupting availability. The impact is availability-only - no confidentiality or integrity loss - rated CVSS 8.2 under CVSS 4.0, with the 4.0 AT:P flag and the independent CVSS:3.1 assessment (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) both indicating a specific condition must hold for the allocation to trigger, so exploitation is not guaranteed against every message or deployment. No public exploit code and no CISA KEV listing were identified at time of analysis; upgrading to 0.25.0 removes the condition entirely.
Certificates that should be rejected by PKIX name constraints are accepted by Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0, allowing an attacker who controls or can obtain end-entity certificates from a name-constrained intermediate CA to bypass excluded-subtree restrictions for email addresses, DNS names, and URI hosts by appending a trailing dot (e.g., 'victim.example.'), which the vulnerable PkixNameConstraintValidator compared without stripping the RFC 1034 root-label dot. Exploitation requires that the victim relying party performs PKIX path validation with bc-csharp and actually enforces name constraints on that intermediate CA, so this is not remote exploitation of an arbitrary default deployment; the impact is integrity-only (a forged or impermissible certificate is accepted rather than data being leaked or destroyed). No public exploit code was identified at time of analysis, and no confirmed active exploitation (CISA KEV) is associated.
PKIX certificate path validation in the Bouncy Castle C# library (bc-csharp) before 2.7.0 accepts certificates whose subject distinguished name, or directoryName subjectAltName, falls outside a name-constrained intermediate CA's permitted subtrees, breaking the RFC 5280 name-constraint trust boundary. An unauthenticated attacker who controls, or can obtain certificates from, a name-constrained intermediate CA already present in a chain the victim validates can craft a DN that prepends extra RDNs ahead of a copy of the permitted RDN sequence and have it accepted by PkixNameConstraintValidator.WithinDNSubtree. Vendor-released patches are available in the 2.7.0 codebase (commits 606e9153b97a265c70ca8293d21ec859344d7de8 and 75c3c576602886180ed92a63c89419e3bd63b392), and no public exploit code has been identified at time of analysis; exploitation is gated by the precondition that a name-constrained CA must already be positioned in the validated chain, so environments that do not enforce directoryName name constraints are unaffected.
On-path attackers who can intercept and modify CMS messages can silently tamper with AES-CCM-protected content that Legion of the Bouncy Castle Inc.'s bc-csharp library (versions before 2.7.0) decrypts. The root cause is that CcmParameters accepted any aes-ICVlen value from an untrusted AlgorithmIdentifier while CcmBlockCipher enforced the tag length only on the encryption path, so a decryption carrying a zero-length or very short tag compared an empty or truncated tag and accepted forged ciphertext without any detectable integrity failure; the same fix also hardens the AES-GCM CMS parameter handling. The reachable paths are ParameterUtilities.GetCipherParameters as used by CmsEnvelopedData and CmsEnvelopedDataParser for AES-CCM EnvelopedData, plus any caller that forwards an unchecked tag length into CcmBlockCipher for decryption. A vendor patch is available in 2.7.0 and the change is published as two commits plus a wiki advisory; no public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and because exploitation requires an attacker to already hold a network interception position (no remote-from-anywhere access, no authentication, no user interaction), the practical risk is a genuine but precondition-gated integrity/tampering issue rather than a broadly exploitable one.
Uniform Resource Identifier name-constraint bypass in Bouncy Castle .NET (bc-csharp) before 2.7.0 allows a name-constrained subordinate CA - or anyone able to obtain a certificate with an attacker-chosen subjectAltName URI from that CA - to evade permitted or excluded uniformResourceIdentifier constraints during RFC 5280 certification path validation. Because the PkixNameConstraintValidator helper ExtractHostFromURL slices the host out of the URI string without first isolating the RFC 3986 authority component, a crafted URI containing '@' (userinfo), ':' (port) or path/query/fragment delimiters produces a host value that differs from the URI's true host, so the leaf is judged unconstrained when it should not be; the vendor rates this CVSS 4.0 8.2, exploitation is unauthenticated per the vector (PR:N) but strongly conditional, and no public exploit code has been identified at time of analysis. Deployments that do not rely on bc-csharp for path validation or that never enforce URI-type name constraints on a subordinate CA are not affected.
Forgery of encrypted messages is possible in Legion of the Bouncy Castle Inc.'s bc-csharp (Bouncy Castle C#) before 2.7.0 when an IesEngine is constructed without a block cipher and initialised in static-static mode, because the keystream produced by the key-derivation function reveals the message authentication key for any message shorter than one the attacker has already observed. An unauthenticated remote attacker who possesses one ciphertext together with its known plaintext can therefore compute the MAC key and submit a crafted ciphertext and tag that the recipient accepts as authentic, although the forgery is confined to messages strictly shorter than the observed message and applications using standard ECIES with ephemeral sender keys or a block-cipher mode are unaffected. Vendor patch available: the defect is corrected in bc-csharp 2.7.0 via upstream commit f881400b761134160ec2a05fd27c3e569453788d, and no public exploit code was identified at time of analysis.
Unauthenticated arbitrary file read, write, and deletion in the Ninja Forms - File Uploads WordPress plugin (versions up to and including 3.3.34) can be triggered by supplying a malicious file_path through the external Amazon S3 upload flow, enabling remote code execution when the External File Upload (Amazon S3) action is configured. Exploitation is remote and unauthenticated (CVSS 8.1, AC:H) but gated by deployment conditions: the S3 external upload action must be in use, and the read variant additionally requires a form Email action that attaches the uploaded file. No public exploit code or confirmed active exploitation was identified at time of analysis; EPSS is not provided, and the main risk is to sites using the gated configuration.
Stored cross-site scripting in YesWiki before 4.6.7 lets unauthenticated attackers append raw HTML or JavaScript to any wiki page-including pages protected by write ACLs-by POSTing pagetag, title, and description fields to the {{pointimage}} action handler. Exploitation requires that the target instance have at least one page rendering {{pointimage}}, and the injected payload executes only when a victim, most damagingly an administrator, views the poisoned page. The vendor has released a patch in 4.6.7, and no public exploit code has been identified at time of analysis.
Denial of service in the Zcash Foundation's Zebra full node implementation before 6.1.0 allows an unauthenticated remote attacker to stall block validation on every validating node for more than 52 seconds. The root cause is quadratic behaviour in the remaining_transaction_value routine, which clones the entire block-level spent-UTXO map once per transaction during contextual verification, so roughly 26,000 minimal single-input transactions placed in a single block or widely seeded into the mempool are enough to freeze validation work. Exploitation is not trivial: the attacker must get that crafted transaction set mined or broadly propagated (reflected in CVSS AC:H and AT:P), and no public exploit code has been identified at time of analysis; the assessed impact is availability-only (CVSS 3.1 A:H) with no confidentiality or integrity loss.
Dogtag PKI (pki-core) and its commercial counterpart, Red Hat Certificate System 9/10/11, contain a fail-open authentication flaw in the CMCAuthForEST plugin that lets an authenticated, low-privileged EST enrollment user obtain CA-signed certificates bearing arbitrary subject names. The bug is triggered when an EST fullcmc enrollment request is sent over BasicAuth without an end-user TLS client certificate; the SSL_CLIENT_CERT session attribute then retains the EST subsystem's agent certificate, so downstream authorization logic wrongly grants agent-level privileges. Exploitation is assessed as requiring only a valid EST user account (CVSS 8.1, PR:L, unauthenticated by client certificate, no user interaction), making it a realistic privilege-escalation path for any provisioned EST user or insider; however, no public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited (not in CISA KEV).
Cross-organization agent hijacking in SuperAGI 0.0.14 and earlier lets any authenticated user on a shared multi-tenant instance schedule and run agents owned by a different organization through the /api/agentexecutions/schedule endpoint, which accepts an agent_id but never verifies that the referenced agent belongs to the caller's organization. The result is high confidentiality and integrity impact (CVSS 8.1, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) with no availability impact, and an attacker only needs a valid low-privileged account plus knowledge or enumeration of a target agent_id - single-tenant or single-organization deployments have no other tenant to victimize and are effectively unaffected. Publicly available exploit code exists (SSVC Exploitation: poc) and no patch is documented, but EPSS is low at 0.16% (4th percentile) and there is no confirmed active exploitation or CISA KEV listing, making this a genuine second-tier risk rather than an emergency.
Path traversal in the TaskingAI QR Code Generator plugin v0.3.0 allows an authenticated, low-privileged attacker to write image files to arbitrary locations on the server filesystem by manipulating the project_id parameter, affecting deployments where the plugin is enabled. Publicly available exploit code exists, and CISA's SSVC framework classifies the attack as non-automatable. Impact is primarily integrity (file overwrite) and availability (disk consumption or service disruption), with a CVSS of 8.1; the write is constrained to image-format content but may enable further compromise if sensitive paths are writable.
Code execution in Sapling SCM versions prior to v0.2.20260929-102736 can be triggered by cloning a maliciously crafted Git repository whose subtree URLs contain embedded control characters; simply running an otherwise read-only command such as 'sl log', 'sl blame', or 'sl annotate' against that clone is enough to execute attacker-controlled code. Exploitation is not remote or automatic: the CVSS vector (AV:L/PR:N/UI:R) requires the victim to clone an untrusted repository and then invoke one of the affected commands, so an attacker must first socially engineer the clone. At time of analysis there is no public exploit identified, CISA SSVC records Exploitation as 'none', the issue is not in CISA KEV, and no EPSS signal was provided; nonetheless the potential technical impact is total (confidentiality, integrity, and availability all High), so patched installations (v0.2.20260929-102736 and later) should be treated as the only safe configuration.
Privilege escalation in Ghost 4.39.0 before 6.64.0 allows an authenticated staff user who has invite-viewing permission to read the secret token of a pending higher-privileged staff invite through the Admin API and then accept that invite to bind the elevated role to their own account. The issue is rated CVSS 4.0 base 7.7 High and is gated on a pending invite for a higher role being outstanding; no public exploit identified at time of analysis. Affected deployments should upgrade to Ghost 6.64.0 or later, as the vendor has released a patch.
Incorrect authorization in the LangGraph Python SDK (langgraph-sdk) versions 0.1.45 through 0.4.3 lets an authenticated user read, update, or delete resources belonging to other users, because the resource-scoped decorators @auth.on.threads, @auth.on.assistants, and @auth.on.crons ignore their actions= argument and register the handler as a wildcard for every action on that resource. That wildcard handler is matched ahead of broader fallback handlers, so any action, ownership, or permission checks implemented in those fallbacks are silently skipped. The flaw is conditionally scoped: a deployment is only exposed if it uses these decorators together with actions= and relies on separate fallback handlers for enforcement, and authentication requirements are confirmed as authenticated (CVSS PR:L) with no public exploit identified at time of analysis. This is fixed in langgraph-sdk 0.4.4.
Session fixation in YesWiki before 4.6.7 allows an attacker who can set or learn a victim's pre-authentication YesWiki-* session cookie to reuse that same session after the victim logs in, gaining access to private content and performing actions with the victim's privileges. The root cause is CWE-384: the AuthController login logic authenticates the user without regenerating the PHP session ID, so the pre-login identifier stays valid after authentication. Exploitation is conditional rather than trivial - it requires the attacker to first control the cookie and the victim to subsequently complete a login (CVSS 4.0 7.6 with AC:H/AT:P; independently assessed as CVSS 3.1 AV:N/AC:H/PR:N/UI:R, C:H/I:H/A:N), and no public exploit code has been identified at time of analysis. The vendor has released 4.6.7, which regenerates the session ID on login and removes the condition.
Local file inclusion in the SiteOrigin Widgets Bundle WordPress plugin, in all versions up to and including 1.73.2, lets authenticated attackers with contributor-level access or higher (PR:L per the assessed vector) include and execute server-side .php files, bypassing access controls and exposing sensitive data; full attacker-controlled code execution is conditional on also having a way to place a .php file on the server that can then be included. The flaw is reached remotely by POSTing a crafted widgetData payload containing a legacy top-level 'theme' key together with a non-empty 'columns' array to the /wp-json/sowb/v1/widgets/previews REST endpoint, a structure that slips past validation because update_fields() only processes declared form fields. No public exploit code and no confirmed active exploitation were identified at time of analysis, but the low privilege bar (any contributor account) and the fact that the vulnerable endpoint is REST-reachable without UI interaction make this a conditional priority rather than a drop-everything emergency.
Denial of service in Seroval versions prior to 1.6.3 allows unauthenticated remote attackers to exhaust CPU and memory by submitting a small crafted JSON payload whose TypedArray node declares an oversized element count, which the deserializer then allocates synchronously and unbounded while starving the event loop. Exploitation requires the target application to route attacker-controlled data into seroval's fromJSON or fromCrossJSON; the library is a JavaScript value-serialization dependency, so the practical exposure is limited to services that deserialize untrusted input with it. Impact is availability-only (CVSS 3.1 7.5, AV:N/AC:L/PR:N/UI:N/C:N/I:N/A:H) with no confidentiality or integrity loss, and no public exploit code has been identified at time of analysis.
Crafted Telephone Number attribute values can pin an entire CPU core indefinitely on LDAP servers that use the Apache Directory LDAP API, giving unauthenticated remote attackers a sustained availability impact. Per the assessed vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), any network-reachable server running the API between version 2.1.0 and 2.1.8 that parses a Telephone Number syntax attribute is exposed, with no authentication, user interaction, or non-default configuration required. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, EPSS is low at 0.20% (9th percentile), and CISA SSVC rates exploitation as none with automatable but only partial technical impact; a vendor patch is available in 2.1.9, making this a moderate-priority availability flaw rather than an emergency, though the affected LDAP service is frequently critical directory infrastructure.
CPU exhaustion in Apache Directory LDAP API versions 2.1.0 through 2.1.8 allows an attacker who can cause a password to be stored as a bcrypt hash with an attacker-chosen high cost factor (for example 30) to force the LDAP server to burn hours of CPU time on a single credential verification, producing a denial of service (CWE-405, Asymmetric Resource Consumption). Because the expensive hash must first be stored, the effective precondition is write access to the credential or an operator action rather than a purely default-configuration remote trigger, which keeps the assessed vector authenticated (PR:L) despite the vendor's PR:N framing; availability is the only impacted property, with no data exposure. No public exploit code has been identified at time of analysis and EPSS is low at 0.20 percent (9th percentile), so the issue is a moderate, not urgent, priority; the fix is the vendor-released 2.1.9.
Denial of service in Apache Directory LDAP API versions 1.2.0 through 1.2.8 allows a malicious LDAP peer or man-in-the-middle to crash a client JVM by causing a huge heap allocation before any response payload is delivered. A tiny crafted BER-encoded message declares an oversized length value, and the client's decoder allocates accordingly, producing an OutOfMemoryError that bypasses the decoder's exception handling and pins memory per stalled connection; a handful of such connections can exhaust the heap of any embedding application that failed to set MAX_PDU_SIZE_ATTR. The flaw is remotely triggerable by an unauthenticated peer (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) and requires the victim to connect to, or be intercepted by, an attacker-influenced LDAP server; EPSS is low at 0.19% (8th percentile), there is no CISA KEV listing, and no public exploit code has been identified at time of analysis.
Unauthenticated denial of service in the OMGF WordPress plugin before 6.3.11 allows remote attackers to invoke an action that issues a slow server-side loopback request, exhausting the site's PHP worker pool and potentially making the entire site unavailable. The affected action requires neither authentication nor a valid nonce, so no login or user interaction is needed on a default install. No public exploit identified at time of analysis, and a vendor patch (6.3.11) is available per the advisory.
GV-Eye V3.6.0 transmits a sensitive key as a URL parameter over unencrypted HTTP, so the key travels across the network in cleartext and can be captured by anyone positioned to observe that traffic. With AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N, the impact is a high-confidence confidentiality loss with no integrity or availability effect - the assessed vector differs from the reported 7.5 score only in attack complexity (High instead of Low), because exploitation requires an on-path/man-in-the-middle vantage point rather than a directly reachable server-side trigger. There is no CISA KEV listing and no public exploit identified at time of analysis, so this is a context-limited confidentiality weakness rather than an actively exploited emergency; the EPSS-derived urgency is not elevated by any confirmed exploitation signal in the supplied data.
A hardcoded API key ships inside the GeoVision GV-Eye Android application (V3.6.0) and can be recovered by reverse engineering the publicly distributed APK, allowing anyone who extracts it to invoke whatever GeoVision backend API operations that key authorizes. The impact is confidentiality-only (C:H, I:N, A:N) scoped to a single embedded credential, and the independent assessment scores it as a local-vector issue (AV:L) because the attacker must first obtain and analyze the client package. No public exploit code identified at time of analysis, and the CVE is not listed in CISA KEV; the practical damage ceiling depends on whether GeoVision rotates or revokes the leaked key on the server side.
Hardcoded API key exposure in the GeoVision GV-Eye Android application (V3.6.0) allows unauthenticated remote attackers to extract the key from the publicly distributable APK via reverse engineering and use it to access backend or third-party services, resulting in high confidentiality impact. With a CVSS score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) and CWE-798 classification, the vulnerability requires no user interaction or special privileges, though the actual blast radius is limited by the permissions associated with the single exposed key. No public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis.
Cleartext exposure of directory data in Apache Directory LDAP API 2.1.0 through 2.1.8 occurs when an application sends a Search request and only afterwards starts a StartTLS extended operation, allowing response data to be returned in plain text before the TLS handshake completes. Exploitation requires the attacker to already hold a network interception position (passive eavesdropping or active man-in-the-middle) between the LDAP client and the directory server; no authentication or user interaction is needed on the target application itself, but the on-path prerequisite substantially limits realistic exploitation. There is no public exploit identified at time of analysis, EPSS is only 0.13% (2nd percentile) with no CISA KEV entry, and a vendor-released fix is available in version 2.1.9.
Denial of service in probe-image-size before 7.4.0 lets remote, unauthenticated attackers pin a Node.js process at full CPU and block its event loop by feeding crafted SVG-like data through probe.sync(), probe(stream), or probe(url). The SVG parser's searching regular expression /<[-_.:a-zA-Z0-9][^>]*>/ rescans to the end of the input whenever attacker-controlled data contains many '<' characters with no closing '>', and the synchronous path converts and scans an entire uncapped buffer while the streaming path reparses the full accumulated SVG prefix on every chunk, so attacker-controlled chunking amplifies the cost. No public exploit code was identified at time of analysis, but the attack is trivial to trigger in any application that passes untrusted image bytes or URLs to the library, and the vendor-released patch is version 7.4.0.
SuperAGI v0.0.14 contains an unauthenticated access control flaw that allows remote attackers to delete arbitrary knowledge objects via the POST /knowledges/delete/{knowledge_id} endpoint. The route lacks authentication and does not verify organization ownership, so any attacker who can reach the service and supply a valid knowledge_id can remove knowledge entries, impacting integrity only. No public exploit code or active exploitation has been identified, but the flaw is remotely exploitable without credentials, and instances exposed to untrusted networks are at risk.
Polynomial-time regular expression denial of service (CWE-1333) in the crmne/ruby_llm Ruby gem's Mistral provider capability matching allows unauthenticated remote attackers to exhaust CPU and stall requests by feeding a crafted model-identifier string into the modalities_for/capabilities_for code path, but only on hosts running Ruby 3.1.x, whose regex engine lacks the linear-time matching optimization. Availability is the sole impacted property (CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5), and the practical limiter is deployment context: the host application must route untrusted, attacker-influenced model IDs into this matching logic, since hardcoded or whitelisted model IDs neutralize the vector. CISA SSVC records Exploitation: none and there is no public exploit identified at time of analysis; an upstream fix exists in commit dd3c84812598def03d4aff77b5447c41d8f5c34e.
Improper certificate validation (CWE-295) in HAVELSAN's Sef AI Chatbot Platform before version 2.1 lets an attacker sitting on the network path between client and server impersonate the server in an Adversary-in-the-Middle attack. The flaw is not remotely reachable by a passive attacker: it only becomes exploitable once the adversary already holds an on-path position (untrusted Wi-Fi, shared network, compromised gateway or malicious transit infrastructure), which is why CVSS rates it AC:H despite PR:N and UI:N. Successful interception yields high confidentiality and integrity impact - chat content, credentials and session material traversing the TLS channel can be read or manipulated - with no availability impact; no public exploit code has been identified and the issue is not listed as confirmed actively exploited (CISA KEV), giving an assessed score of 7.4.
User impersonation in the ProcessOne ejabberd XMPP server, affecting all releases from the initial version through 26.04, allows any party that holds valid credentials for a single account to authenticate as an arbitrary other user by supplying an unchecked authzid value in the SASL-PLAIN exchange. Because the server fails to bind the requested authorization identity to the authenticated one, a low-privileged, authenticated attacker can act with the confidentiality and integrity privileges of any targeted account - including administrative or federated identities - across the XMPP service. The flaw is not listed in CISA KEV (no confirmed active exploitation), although the reported CVSS 4.0 vector carries an exploit-maturity metric of Proof-of-Concept (E:P), indicating proof-of-concept-level exploit code maturity; the independent assessment rates it CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N, framing it as a credentialed authentication/authorization flaw rather than a fully unauthenticated takeover.
Code injection in FinRobot v1.0.0 via CodingUtils.modify_code allows an attacker who can control input reaching that function to have their content executed as code by the host Python process, with the independent assessment scoring the worst case as high confidentiality, integrity and availability impact (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). FinRobot is an AI agent framework rather than a network service, so real-world exposure depends on whether the embedding application feeds untrusted prompts, agent tasks or data fields into modify_code without sanitization; there is no evidence of a default network listener, and NVD's 7.3 score (AV:N/AC:L/PR:N/UI:N/C:L/I:L/A:L) most likely reflects a worst-case integration rather than an out-of-the-box remote service. No public exploit code identified at time of analysis, no confirmed active exploitation (not in CISA KEV), and EPSS is low at 0.21% (10th percentile), so practical priority is modest despite the High base score.
Stack-based buffer overflow in Apache LDAP API 1.2.0 through 1.2.8 allows unauthenticated remote attackers to crash server-side LDAP filter decoders by sending deeply nested search filters before the bind step, producing a denial-of-service condition. No public exploit code or CISA KEV listing was identified at time of analysis and no EPSS score was provided; the independently assessed CVSS vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, so the primary risk is remote availability loss rather than code execution.
Command injection in the Nx `@nx/docker` release pipeline (nx 21.4.0 through 22.7.7 and 23.0.0 through 23.1.0) lets an attacker who can influence `release.docker.repositoryName` or `registryUrl` in repository configuration execute arbitrary shell commands with the privileges of the release job. Because the plugin builds `docker tag`, image-lookup, and `docker push` calls as shell strings passed to `/bin/sh -c`, a malicious pull request or config change that reaches a `nx release version` or `nx release publish` run can exfiltrate registry credentials and cloud tokens; dry-run publishing does NOT prevent the vulnerable image-lookup pre-check from firing. This is a genuine but conditional CI/CD supply-chain risk rather than a drive-by remote exploit, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Stored cross-site scripting in the W3 Total Cache plugin for WordPress (all versions up to and including 2.10.6) lets unauthenticated attackers submit a comment containing crafted script payload that is later rendered unsanitized in a page, executing in the browser of any user or administrator who views it - but only on sites where the 'Remove query strings from static resources' option is enabled, since the plugin's output-buffer URL rewrite must strip the '?' delimiter and the closing quote of the enclosing HTML attribute to break out of the attribute context. The issue is fixed in 2.10.7, and no public exploit code or confirmed active exploitation was identified at time of analysis. Because the required caching option is not the default configuration and execution depends on a victim subsequently viewing the injected page, the assessed vector rates this as attack complexity High (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N) even though the vendor-published score is 7.2 with AC:L.
Code injection in CTX Feed Pro (WooCommerce Product Feed Pro by Webappick) versions up to and including 7.6.12 allows an authenticated attacker with Administrator-level privileges to execute arbitrary PHP code on the server by supplying malicious input to the plugin's 'Feed Config' field, which is passed unsanitized to PHP's eval(). The vulnerability is not exploitable by anonymous or low-privileged users because it requires Administrator access, making the realistic threat model a stolen or malicious admin account or a multi-admin environment where a lower-trust admin should not have code-execution rights. No public exploit identified at time of analysis, and no confirmed active exploitation was reported.
Unauthenticated stored cross-site scripting (XSS) in Kubio AI Page Builder up to and including version 2.9.2 allows remote attackers to inject arbitrary web scripts via the 'comment' parameter, which execute when a victim visits an injected page. The vulnerability has a CVSS score of 7.2 and a scope change, but no public exploit code has been identified and there is no evidence of active exploitation. A vendor patch version is not confirmed, though an upstream code change exists.
Stored cross-site scripting in the WordPress Download Monitor plugin up to 5.2.10 lets an unauthenticated attacker initiate a cross-origin postMessage attack that injects arbitrary web scripts into Download post content, which then execute for frontend visitors when the [download_data] shortcode renders the stored payload. Exploitation is not a simple unauthenticated request: it requires tricking a logged-in Administrator who has unfiltered_html and an open Download edit screen into visiting an attacker-controlled page, and the site must use the affected shortcode for delivery. No public exploit identified at time of analysis, and the assessed severity is conditional rather than a drop-everything emergency; the published CVSS is 7.2, while our assessment uses CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.
Stored cross-site scripting in the CMB2 WordPress plugin, affecting versions through 2.13.1, lets unauthenticated attackers inject arbitrary scripts into pages that expose a public front-end CMB2 form saving a textarea_code field such as kl_code or kl_post_code. The root cause is insufficient sanitization and output escaping of that field, and the front-end save path is reachable without credentials because it requires only a CMB2 box nonce that is emitted to all visitors, including guests; the injected payload then executes when a victim loads the affected page. CVSS 3.1 rates this High (7.2, AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), but real-world exposure is limited to the non-default case of public textarea_code forms, and no public exploit identified at time of analysis or CISA KEV confirmation was provided.
Stored cross-site scripting in the BA Book Everything plugin for WordPress (all versions up to and including 1.8.28) lets unauthenticated attackers inject arbitrary JavaScript through the 'booking_service_qty' parameter of a public booking submission, which is saved inside the resulting order record. The payload is later emitted without escaping in the plugin's wp-admin order management screens, so it executes in the browser of an administrator or other privileged user the moment that order is opened - the plugin's ordinary order-review workflow - giving a scope-changing (S:C) impact despite the injection itself needing no authentication. No public exploit code and no CISA KEV entry are associated with this issue at time of analysis, and the assessed base score is 7.2 (High) under the corrected vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, reflecting that a privileged user's review action is the required trigger.
Stored cross-site scripting in the Ninja Forms WordPress plugin (versions up to and including 3.15.4) enables unauthenticated attackers to inject arbitrary web scripts into form submissions, which then execute when a victim-typically an authenticated administrator-views the stored entry. Exploitation is contingent on the targeted form containing a Paragraph Text field with the non-default Rich Text Editor (RTE) option explicitly enabled, per the independent assessment. The CVSS 3.1 score is 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), reflecting unauthenticated remote exploitation with changed scope but limited confidentiality and integrity impact; no public exploit code or CISA KEV entry was identified at time of analysis.