OS command injection in Langflow's MCP stdio transport allows an attacker who can reach the MCP server configuration endpoint (POST/PATCH /api/v2/mcp/servers/{server_name}) or add an MCP Tools component to a flow to execute arbitrary operating-system commands on the Langflow host, running with the privileges of the Langflow process user. The vulnerability affects Langflow before 1.10.3, langflow-base before 0.10.3, and lfx before 1.10.3, and is reachable without any account on an exposed instance left in its default LANGFLOW_AUTO_LOGIN=true configuration because GET /api/v1/auto_login issues a token without credentials; when AUTO_LOGIN is disabled, any authenticated non-admin user is sufficient (CVSS vector PR:L), so no administrative role is required. The command fires automatically as soon as Langflow tries to connect to the configured server (listing servers, loading tools, or running a flow), and the resulting execution is not confined to the Langflow process security context per the S:C scope metric. No public exploit code was identified at time of analysis, and vendor-released fixes are available in Langflow 1.10.3, langflow-base 0.10.3, and lfx 1.10.3.
Stack-based buffer overflow in the TOTOLINK A3002MU router's QoS Rule Handler allows remote attackers to corrupt memory on the device by supplying oversized addQos, comment, or entry_name arguments to /boafrm/formIpQoS, with high confidentiality, integrity, and availability impact. Only firmware 1.0.0-B20230403.1455 is identified as affected, and publicly available exploit code exists (a published proof-of-concept gist), so anyone who can reach the management interface can attempt it. The published CVSS 4.0 vector scores 9.3 as network-reachable, low-complexity, and unauthenticated (PR:N/UI:N); note however that TOTOLINK /boafrm/ handlers commonly require an authenticated web session, so the realistic risk is concentrated where the admin interface is exposed to the WAN or reachable from an untrusted LAN segment.
Improper authorization in the boa web server on TOTOLINK A3002MU firmware 1.0.0-B20230403.1455 lets remote, unauthenticated attackers reach protected administrative functionality without a valid session, giving them full control over the device's web management interface (high confidentiality, integrity and availability impact). Publicly available exploit code exists against the authentication-check function sub_40FCFC in /bin/boa, so weaponisation effort is low, although no CISA KEV listing or other confirmation of active exploitation was present in the available intelligence at time of analysis. Exposure is the practical limiter: units with WAN-side management enabled are directly internet-exploitable, whereas units whose admin interface is LAN-only require an on-network attacker or a LAN-side pivot.
Unauthenticated network attackers can gain the highest application privileges on Perforce P4 Search container images prior to 2026.4.2 because the service authentication token is reset to a publicly documented default value (CWE-1392). Successful exploitation can lead to arbitrary code execution and compromise of any connected P4 Server, but full impact requires that the P4 Search container be network-reachable and that a P4 Server be connected to it. No public exploit identified at time of analysis, yet this is a genuine top-priority vulnerability because the default-token flaw is trivial to exploit once the service is exposed and the potential scope change to the connected P4 Server is severe.
Authenticated users of Langflow versions prior to 1.9.0 can achieve remote code execution on the underlying host by adding an MCP server that uses the Stdio transport, because the user-supplied command field is passed directly to a shell with no validation, allowlisting, or sandboxing; the injected command executes immediately when the MCP server list is fetched, requiring no further victim interaction, and the env field additionally permits environment-variable injection (for example LD_PRELOAD or PATH overrides) for a second code-execution path. The vendor has issued a fix in 1.9.0 that restricts MCP stdio commands to an allowlist and blocks dangerous environment variables, and no public exploit code has been identified at time of analysis. The 9.9 CVSS score reflects the vector's scope change (S:C) and high confidentiality, integrity, and availability impact, though practical exploitability depends on the attacker holding a valid authenticated Langflow account with access to MCP server configuration.
Authenticated command injection in the Penpot SVG exporter prior to 2.18.0 allows a user with edit rights on a design file to place shell metacharacters in a text object's fill-color value, which the exporter interpolates unsanitized into a ppmcolormask command string and runs via child_process.exec, resulting in arbitrary command execution with the exporter service's privileges. The CVSS 3.1 score of 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) reflects a scope change that crosses from the Penpot application into the underlying exporter host, with high confidentiality, integrity, and availability impact there. A second reachability path exists through a valid public share link to a malicious file, which lets anyone holding the link trigger the export without being an authenticated editor; no public exploit code has been identified at time of analysis, and the issue is fixed in 2.18.0.
Authenticated users who can create a workspace in Plane can force the application's background worker to fetch internal-only resources - including cloud instance metadata endpoints - by registering a webhook whose URL points at an attacker-controlled public host that returns a 302 redirect to a private, loopback, or link-local address. Because the pre-1.4.0 webhook delivery task calls requests.post() without disabling redirects and only validates the originally submitted URL, the fetched response body is written into webhook_logs and can be read back through the workspace webhook-logs API, turning the SSRF into a practical internal-data exfiltration channel. All Plane versions prior to 1.4.0 are affected; the issue is fixed in 1.4.0, no public exploit code has been identified at time of analysis, and exploitation requires authentication plus workspace-creation privileges rather than being anonymous.
Unauthenticated remote attackers can forge Django-signed session cookies, CSRF tokens, and password-reset tokens, and bypass live-service authentication, against Plane installations that shipped with publicly known default secrets. Plane versions prior to 1.4.0 distributed fixed SECRET_KEY (60gp0byfz2dvffa45cxl20p1scy9xbpf6d8c5y0geejgkyp1b5) and LIVE_SERVER_SECRET_KEY (htbqvBJAgpm9bzvf3r4urJer0ENReatceh) values in the deployments/aio/community/ and deployments/cli/community/ manifests, while the top-level setup.sh randomized secrets only for the development Docker Compose path, leaving AIO and CLI community deployments with shared production secrets by default. Rated CVSS 9.8 (AV:N/AC:L/PR:N/UI:N, C/I/A:H) and classified CWE-798; no public exploit identified at time of analysis, although the default key values are published in the vendor repository and are therefore trivially usable by anyone who reads it. Exposure is limited to network-reachable instances deployed via those community manifests whose operators never overrode the secrets; deployments created through the development Compose path, operator-hardened installs with unique secrets, and instances upgraded to 1.4.0 are not exploitable.
Workspace invitation hijacking in Plane prior to 1.4.0 lets an unauthenticated attacker take over a pending workspace invitation by registering an account with a victim's email address. Because the signup flow creates a logged-in User row for any submitted address without an out-of-band ownership check and User.email is unique, the attacker can call GET /api/users/me/workspaces/invitations/ to enumerate invites matching that address, read the acceptance token exposed by WorkSpaceMemberInviteSerializer (fields = "all"), and then accept the invitation - joining the target workspace at the invited role. CVSS 3.1 scores this 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H); no public exploit code or CISA KEV entry was identified at time of analysis, and exploitation depends on a live pending invitation plus an instance that permits open self-signup.
SQL injection in GouGuOA 6.0.5 and earlier allows an attacker who can reach the /home/message/rubbish endpoint to inject arbitrary SQL through the keywords parameter, yielding full compromise of confidentiality, integrity and availability of the backend database (CWE-89, CVSS 3.1 base 9.8 as reported). The MITRE-supplied vector rates it unauthenticated (PR:N/UI:N), but our independent assessment lowers the privilege metric to PR:L because /home/message/rubbish is a message trash/recycle-bin function that in typical OA deployments is only reachable after login, so a valid session may in practice be a prerequisite - this materially changes the realistic attack surface and should be verified against the referenced write-up. No public exploit code has been confirmed and the CVE is not listed in CISA KEV, though a public technical write-up exists at the referenced GitHub repository; no EPSS score was available in the input, so no probability estimate is asserted.
OGNL expression injection in Apache Struts can lead to remote code execution, but only when an application is explicitly configured with the legacy RESTful action mapper - a non-default setting that standard deployments do not use. All version branches are affected in the abstract (2.0.0 through 2.3.37, 2.5.0 through 2.5.33, 6.0.0 through 6.11.0, and 7.0.0 through 7.3.0), and on the Struts 7 branch exploitation additionally requires the OGNL allowlist to have been disabled, which is not the default. NVD rates this 9.8 (AV:N/AC:L/PR:N/UI:N), while our independent assessment lowers it to AC:H because the decisive limiting factor is the non-default mapper configuration; where that mapper is absent the flaw is not reachable. No public exploit code or CISA KEV entry has been identified at time of analysis, and EPSS is low at 0.36% (28th percentile), so exposure is driven principally by configuration review rather than by observed exploitation. Fixes are available in Struts 6.12.0 and 7.4.0.
Object injection in the WordPress plugin Advanced Post Manager (all releases through version 4.5.5) lets remote attackers push attacker-controlled serialized data into PHP's unserialize() routine, potentially instantiating arbitrary objects and, where a usable POP gadget chain exists, achieving code execution with full confidentiality, integrity and availability impact. The NVD vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) treats the flaw as unauthenticated and network-reachable, whereas our independent assessment raises attack complexity to High because real-world impact hinges on a reachable gadget chain in the plugin, WordPress core or another active plugin; no public exploit identified at time of analysis and there is no CISA KEV entry for this CVE.
Unauthenticated input injection in ViewSonic vCast, the wireless screen-casting service bundled with ViewBoard interactive displays, lets a remote attacker push crafted HTTP requests at exposed service endpoints and have that data accepted without validation, which public research chains onward to remote code execution. Affected builds span vCast v0.0.0 through v3.2.715 and are reachable over the network with no credentials and no user interaction (CVSS 9.8, AV:N/PR:N/UI:N), so every ViewBoard whose vCast endpoints are network-reachable is exposed; a public technical write-up describing the exploit chain exists (blog.l3afs.space), while no CISA KEV entry confirms active exploitation at time of analysis. All available signals point to genuinely high real-world risk, with the practical limiting factor being network reachability of the vCast service rather than any missing precondition.
Remote code execution in dormakaba evolo Service (all versions) allows an unauthenticated network attacker to execute arbitrary code as SYSTEM via a .NET deserialization flaw, per a 9.8 CVSS vector. The service is typically deployed on internal access-control administration hosts, so exploitation generally requires access to the management network segment, and pre-auth reachability is asserted by the CVSS vector rather than the description. No CISA KEV entry or public exploit was identified at time of analysis; EPSS is 0.29% (20th percentile), while SSVC rates exploitation as none and technical impact as total.
Unauthenticated remote code execution affects dromara/northstar (a quantitative trading platform) through version 9.1.1 and earlier, because the application enables the embedded H2 Console while its authentication interceptor only guards the /northstar/** path, leaving /h2-console reachable with no credentials. Because the embedded H2 database also ships with the default 'sa' account and an empty password, any network-reachable attacker (CVSS 3.1: AV:N/AC:L/PR:N/UI:N, 9.8) can use the H2 console's CREATE ALIAS capability to execute arbitrary Java and thereby run arbitrary system commands on the host. Exploitation requires only that the Northstar instance be reachable over the network; there is no public exploit identified at time of analysis, though the cited GitHub reference is a technical write-up of the flaw, and this issue is not confirmed actively exploited (CISA KEV).
SQL injection in FineAdmin v1.0 allows attackers to reach the /Permissions/Button/List endpoint and inject crafted SQL through the field/order (sort) parameter handled by ButtonService.GetListByFilter(), exposing sensitive database contents. Publicly available exploit code exists (an author-published proof-of-concept write-up is referenced), but there is no confirmed active exploitation (CISA KEV), and EPSS is very low at 0.15% (4th percentile), reflecting the product's obscure, small deployment footprint. The vendor-supplied CVSS of 9.8 (PR:N) conflicts with the assessed vector of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N, which assumes the attacker realistically needs an authenticated admin or back-office session because the affected function is an administrative permissions/button-management feature - that authentication prerequisite is the key limiting factor defenders should verify rather than the headline score.
Remote code execution in WookTeam 1.6.6 and earlier lets an attacker inject arbitrary PHP into an eval() call reached through the task export API at /api/project/task/export, granting full server-side code execution. The CVSS 3.1 vector rates the flaw 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), i.e. unauthenticated and network-reachable with total impact, although the assessor cautions that project/task export routes commonly sit behind a login session, so a valid authenticated session or an otherwise exposed/mis-protected route may be the real prerequisite and the PR:N rating should be verified against WookTeam's auth middleware. Publicly available exploit code exists and SSVC rates the attack automatable with total technical impact, while EPSS remains low at 0.15% (4th percentile) - signals conflict on urgency, and overall risk is bounded mainly by WookTeam's limited deployment footprint rather than by exploit difficulty.
Plaintext IMAP, SMTP, and CalDAV passwords belonging to other workspace members are disclosed to any authenticated low-privilege member of Twenty CRM versions 1.20.10 up to (but not including) 2.7.0 through the /metadata GraphQL connectedAccounts query, which returned the full ConnectedAccountDTO object - including the connectionParameters field - without hiding the password or enforcing the calling user's identity or account visibility. A normal workspace member can harvest those external-service credentials and use them to access other users' mail and calendars, and potentially to reset third-party accounts. Workspaces configured solely with Google or Microsoft OAuth connections store no plaintext password and are unaffected, and no public exploit code has been identified at time of analysis. Exploitation requires an authenticated account (CVSS PR:L), so realistic risk centers on malicious insiders, over-provisioned members, or compromised member accounts rather than unauthenticated external attackers.
Improper authorization in Plane before 1.4.0 lets an authenticated workspace Guest hijack file assets from other projects in the same workspace through ProjectBulkAssetEndpoint.post. By supplying valid asset UUIDs from a foreign project and reassigning issue_id, comment_id, page_id, draft_issue_id, or project_id to an entity they control, the attacker causes Plane to treat their project as owner and return a presigned download URL for the hijacked file. The flaw is assessed as CVSS 9.6 (PR:L, scope changed) and is fixed in 1.4.0; no public exploit identified at time of analysis.
Unauthenticated remote code execution is possible in Perforce P4 Search container images prior to 2026.4.2 due to an exposed Java Debug Wire Protocol (JDWP) interface. An attacker with network access to the JDWP port can execute arbitrary code as the P4 Search service account, potentially compromising the connected P4 Server. No public exploit code has been identified at time of analysis, but the issue is rated critical (CVSS 9.5 in CVSS 4.0, assessed as CVSS 3.1 with scope change) and requires the debug interface to be reachable (attack prerequisite AT:P), making it a genuine high-priority issue rather than a high-CVSS-but-low-risk artifact.
Perforce P4 Search before 2026.4.2 fails open when its service authentication token is blank, so an unauthenticated remote attacker with network access to the service can obtain the highest application privilege, potentially compromising both P4 Search and the P4 Server it is connected to (CWE-636). The vendor rates this CVSS 4.0 9.5; our independent assessment is CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H because the attack requires the victim deployment to be running in the blank-token configuration (Attack Requirements: Present), meaning deployments that set a non-blank service authentication token are not exploitable. No public exploit code has been identified at time of analysis, and there is no confirmed actively exploited (CISA KEV) status; the issue is nonetheless a genuine high-priority authentication bypass rather than a CVSS-inflated paper risk, and impact extends to the connected P4 Server.
Unauthenticated SQL injection in OrdaSoft Joomla CCK before 8.3.16 allows remote attackers to execute arbitrary SQL via the user-supplied order column for records, compromising the confidentiality, integrity, and availability of the Joomla database. The flaw affects only sites that have installed this third-party CCK extension, so prevalence is the main limiting factor; no public exploit code was identified at time of analysis, and there is no KEV confirmation of active exploitation. With a CVSS 4.0 score of 9.3 and an independent CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N/S:N/C:H/I:H/A:H, this is a high-priority issue for affected deployments.
Unauthenticated blind SQL injection in the WordPress plugin WP BASE Booking (wp-base-booking-of-appointments-services-and-events) in all versions up to and including 6.4.0 lets remote attackers inject arbitrary SQL into database queries by manipulating request parameters handled by the plugin. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no credentials, user interaction, or special configuration are required - any site with the plugin installed and reachable over the network is exposed, and exploitation is limited only by the fact that the injection is blind, so data must be extracted through boolean or time-based inference rather than direct query output. Patchstack rates this Critical (9.3) with a scope change, and the upstream advisory is the only public reference; no public exploit code and no CISA KEV entry were identified at time of analysis.
An authenticated user holding openSIS Classic 9.3's built-in teacher role can reset the password of any other staff account by supplying an arbitrary staff_id value to the School Information update path, giving a low-privileged operator full control of higher-privileged accounts. The flaw is a classic user-controlled key (CWE-639) authorization bypass: the application trusts the staff_id request parameter when populating the session's staff context and then uses that context to authorize a password change without confirming it matches the caller's own user_id. Only a valid teacher-level session is required; no admin rights, user interaction, or non-default configuration is needed, and severity is rated 9.3 (CVSS:4.0 AV:N/AC:L/AT:N/PR:L/UI:N with high confidentiality and integrity impact plus scope change), consistent with an independent assessment of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N. No public exploit code and no confirmed active exploitation were identified at time of analysis, but the vendor reports a patch and the affected code path is trivially reachable for any authenticated teacher.
Incorrect authorization in the Camunda 7 Admin web application (7.24.0 through 7.24.14) lets an unauthenticated remote attacker reach the first-run setup user-create endpoint and create a new administrator account, enabling account takeover and, via admin-level process deployment or scripting, code execution as the workflow engine's service user (CWE-863, CVSS 9.2). Exploitation is not default-configuration remote takeover: the setup endpoint only becomes reachable when the camunda-admin group contains zero direct members while the deployment is nonetheless fully administered through configured authorizations, which is why the assessed CVSS 3.1 vector is AV:N/AC:H/PR:N/UI:N and the CVSS 4.0 vector carries AT:P. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has released a fixed version, 7.24.15.
Path traversal in Legcord's theme IPC handlers (versions 1.1.0 through 1.3.0) allows an attacker who already has script execution inside the embedded Discord page - for example via XSS - to supply unvalidated theme ids to themes.folder, themes.uninstall, and themes.install and escape the themes directory. That yields arbitrary file writes, recursive directory deletion, and local executable launch, i.e. host code execution; CVSS 4.0 scores it 9.2 (Critical) with full confidentiality, integrity, and availability impact, and PR:N means no further authentication is required once the script foothold exists, while AC:H and AT:P capture that prerequisite. No public exploit code was identified at time of analysis and no CISA KEV listing is present.
TLS certificate verification is silently disabled in the PHP library maclof/kubernetes-client versions 0.17.0 through 0.31.x whenever a loaded kubeconfig omits certificate-authority-data but points at an https:// API server; the library's parseKubeconfig() and parseKubeconfigFile() helpers then ignore the user's insecure-skip-tls-verify setting and turn verification off. This only matters to an attacker who already holds an on-path/man-in-the-middle position between the client and the Kubernetes API server, from which they can impersonate the API server, harvest Bearer tokens or Basic credentials, and tamper with REST or WebSocket traffic. Exploitation is conditional rather than opportunistic - there is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV does not list it); unaffected deployments are those whose kubeconfig supplies certificate-authority-data. The 9.1 CVSS score reflects the high confidentiality and integrity impact, but real-world urgency is lower than that number suggests because of the attack-position requirement and the fix available in 0.32.0.
Configuration injection in the Legcord Electron Discord client 1.1.0 through 1.3.0 lets JavaScript executing inside the loaded Discord page write arbitrary configuration keys through the exposed window.legcord settings.setConfig bridge, and the practical payload is the additionalArguments key - persistently adding the Chromium switches --proxy-server and --ignore-certificate-errors so that all client traffic is routed through an attacker-controlled interception proxy with TLS validation disabled. The flaw carries a Critical CVSS 4.0 score of 9.1, but exploitation is not self-contained: it is gated on a pre-existing, independent cross-site scripting flaw in the Discord web content the client renders (Attack Requirements: Present / AC:H), making it an impact-amplification and privilege-escalation primitive rather than a standalone remote compromise, and the attacker's writes are launch-time arguments that generally need a client restart before the proxy and certificate bypass take effect. There is no public exploit code identified at time of analysis and no CISA KEV listing, so the realistic risk is concentrated in users running the affected Legcord builds who are also exposed to a workable Discord-side XSS.
Account takeover in Plane (makeplane) versions prior to 1.4.0 allows remote unauthenticated attackers to log in as existing users by exploiting OAuth email trust in Gitea and self-managed GitLab deployments where email confirmation is disabled. The vulnerability (CWE-287) stems from Plane matching the email returned by the OAuth provider to a local account without verifying provider-side ownership; an attacker can set an OAuth identity's unverified email to the victim's address and authenticate as them without knowing the password, as confirmed by the provided independent assessment. Deployments using GitHub, GitLab.com, or Google OAuth are not affected because those providers return verified emails; no public exploit identified at time of analysis, and the flaw is gated by deployment configuration rather than being universally exploitable.
Brute-forceable magic-code email login in Plane versions prior to 1.4.0 allows unauthenticated remote attackers to guess a six-digit numeric login code and take over accounts. The verify endpoint extends django.views.View instead of DRF's APIView, so the configured AnonRateThrottle never runs, and there is no per-code attempt counter, no counter invalidation, and no Django-level throttle middleware behind it, leaving roughly 20 bits of OTP entropy with effectively unlimited guesses inside the code's Redis TTL window. There is no public exploit identified at time of analysis and no confirmed active exploitation, but the 9.1 CVSS reflects a full account takeover path (C:H/I:H) with no authentication or user interaction required, and the fix was released in Plane 1.4.0.
Remote user validation in HPE Integrated Lights-Out (iLO) 7 firmware can be subverted by unauthenticated network attackers, giving them high-impact confidentiality, integrity, and availability effects on the baseboard management controller and, because the CVSS vector carries a scope change (S:C), potentially on the systems that controller manages. The flaw is rated CVSS 3.1 9.0 (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H); the high attack complexity means a successful bypass hinges on specific preconditions, state, or timing rather than one deterministic request, and reachability is limited to networks that can route to the iLO management interface. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, so real-world risk concentrates in environments where iLO is exposed beyond a segmented out-of-band management network.