Unauthenticated attackers can obtain a non-expiring API token carrying a victim's full Rill permissions by abusing open dynamic client registration in the admin OAuth server of Rill Data's Rill 0.77.0 through 0.90.5 (CWE-862, missing authorization). The attacker self-registers an OAuth client with the long_lived_access_token scope and must then convince a logged-in Rill user - typically through a phishing authorization link - to approve it, because exploitation requires user interaction and cannot be executed silently against the server alone; the resulting access is bounded by the lured user's privilege level, so a high-privilege victim yields correspondingly broad, non-expiring access. Rill is not listed in CISA KEV and no public exploit has been identified at time of analysis, although a public technical writeup of the technique is linked from the advisory; the CVSS 4.0 base score is 8.6, and the independent assessment rates this a credible, above-average priority issue rather than an inflated high-CVSS score.
Signature verification bypass in hyper-mcp through 0.8.3 (src/wasm/oci.rs, load_wasm) lets an unauthenticated remote attacker who controls or tampers with OCI registry responses for a resolved tag load and execute unsigned WebAssembly plugins that were never covered by the Cosign signature check. The flaw is a time-of-check/time-of-use race (CWE-367): Cosign verifies a separately resolved tag while the loader consumes a different manifest, so a malicious registry can serve a signed manifest to the verifier and an unsigned malicious one to the plugin loader, with the payload then running under whatever host capabilities the operator granted. Exploitation is constrained - it requires signature-verified OCI plugin loading to be enabled, an active position on the registry channel, and winning the resolution race - and no public exploit code or confirmed active exploitation was identified at time of analysis.
Improper signature verification in hyper-mcp through 0.8.3 lets an attacker who controls or substitutes the OCI plugin image reference load a malicious WebAssembly plugin, because cosign_verify_args() accepts any signer identity and any OIDC issuer by default - so a plugin image signed with an ordinary, freely obtainable Sigstore keyless certificate passes verification. Successful exploitation allows the malicious plugin to execute with whatever host, filesystem, and environment capabilities the operator has granted to plugins, yielding high integrity impact with limited confidentiality exposure. No public exploit code has been identified at time of analysis; exploitation is gated by the attacker's ability to gain control of the image reference the target resolves (as reflected by the AT:P attack-requirement metric), and blast radius is bounded by the privileges a least-privilege deployment actually grants plugins.
Unauthenticated attackers can download private Corteza compose attachments by rewriting the 'kind' path segment of the original or preview serving route to 'page', 'icon', or 'namespace', which makes the platform's isAccessible() check treat the private file as a public-kind attachment and skip the token/signature verification that would normally gate it. Deployments at or below Corteza 2024.9.10 that expose the compose attachment endpoints are affected, and an attacker only needs to know or guess a valid private record or module attachment ID - that requirement is reflected as Attack Requirements: Present (AT:P) in the vendor's CVSS 4.0 score of 8.2 (High), while the assessed CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. Per available intelligence there is no CISA KEV entry and no public exploit identified at time of analysis, though a public technical write-up of the attachment kind-confusion technique is referenced; EPSS data was not supplied. The impact is confidentiality-only - high-volume unauthorized reads of files across namespace and record permission boundaries - with no integrity or availability effect reported.
OS command injection in GNU Emacs's TRAMP remote-file library (Emacs releases before 31.2, TRAMP through 2.8.2) lets an attacker who can get a crafted filename in front of a user execute arbitrary shell commands with that user's privileges, because tramp-user-regexp relies on an incomplete denylist of dangerous shell characters. This is a follow-on defect to CVE-2026-79992, whose fix did not cover all dangerous inputs. Exploitation is local, requires user interaction (the victim must open, complete, or otherwise have Emacs/TRAMP evaluate the malicious path), and only affects installations that use TRAMP remote-file functionality; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Local privilege escalation and sandbox escape in Zephyr RTOS affects builds with CONFIG_USERSPACE enabled that include a fuel-gauge driver: the syscall verifiers z_vrfy_fuel_gauge_get_props() and z_vrfy_fuel_gauge_set_props() size kernel-side variable-length arrays directly from an unvalidated caller-supplied len, letting any user-mode thread displace the supervisor stack and, where the caller holds fuel-gauge object permissions, write len * sizeof(union fuel_gauge_prop_val) bytes of attacker-controlled data into privileged memory. The outcome is an out-of-bounds write executing in supervisor mode with attacker-chosen length and content, leading to kernel code execution or a device crash; with the default CONFIG_PRIVILEGED_STACK_SIZE of 1024 bytes, a len of roughly 170 is sufficient to overrun the privileged stack, and a hardware stack guard does not contain it because the copy begins below the guard and walks upward. CVSS 3.1 rates this 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning the vector requires the attacker to already hold a low-privilege foothold - here, the ability to execute a user-mode thread on the device - and no public exploit code has been identified at time of analysis.
An out-of-bounds write of up to 127 bytes in the Zephyr RTOS NXP MCUX TRNG entropy driver (drivers/entropy/entropy_mcux_trng.c) allows a locally-present attacker to corrupt memory immediately following a caller-supplied buffer on affected NXP i.MX RT5xx/RT6xx SoCs. Because entropy_get_entropy() is a syscall whose verifier (K_SYSCALL_MEMORY_WRITE) checks only the requested length, an unprivileged user-mode thread that has merely been granted the entropy device can supply a length such as 1 and an arbitrary destination, causing the kernel to write 128 bytes where 1 was proven to be owned; on these Cortex-M33 parts there is no MMU, so the overflow can land in adjacent kernel state. The same defect is reachable from kernel mode via getentropy() or sys_rand8_get()/sys_rand16_get() where those resolve to the hardware generator. No public exploit code was identified at time of analysis and the flaw is not confirmed as actively exploited (no CISA KEV listing), but exploitation is local, deterministic in offset, and low complexity, which the assessed vector captures as AV:L/AC:L/PR:L with changed scope and high integrity impact.
Improper link following in mistral.rs 0.9.0 through 0.9.4 allows code running in the mistralrs-code-exec sandbox to read and overwrite files outside the intended sandbox by using symlinks with the server process's filesystem permissions. The flaw requires the code-execution feature to be enabled and reachable, low-level session or agent access (PR:L), and the ability to name a symlink as an output or reuse a session whose input path is a symlink (AT:P), making it a moderate-priority, context-dependent issue rather than a mass-exploitation threat; no public exploit identified at time of analysis.
Password reset tokens in Traccar through 6.16.0 are not bound to their intended purpose, allowing an attacker who possesses a leaked reset link to obtain a full session via /api/session or change passwords via /api/password/update. Exploitation is unauthenticated but requires the attacker to first acquire a valid, unexpired reset token, for example through referer leakage, shared URLs, or intercepted email. No public exploit code has been identified at time of analysis.
Use-after-free in the Zephyr RTOS Bluetooth LE host lets an adjacent, unauthenticated peer with an established L2CAP connection-oriented channel (CoC) on a dynamic PSM (0x0080-0x00FF) leave a pending work item pointing into channel memory that the application has already been told it may free. The attacker only needs to send a data K-frame immediately followed by an L2CAP Disconnect Request; because the Bluetooth RX workqueue outranks the system workqueue under cooperative scheduling, the deferred rx_work item cannot run before teardown, so the stack's released() callback fires while the system workqueue still holds a reference, producing memory corruption, information disclosure, or a corrupted workqueue pending list. The vector (CVSS:3.1/AV:A/AC:H/PR:N/UI:N) reflects adjacent-only access, no privileges, and a scheduling race that must be won, and realistic exploitability is further reduced by the requirement that the application free or re-accept the channel in released(). No public exploit code has been identified at time of analysis and the flaw is not in CISA KEV; an upstream fix commit is available.
OS command injection in pbi-cli 3.10.1 through 3.12.0 allows a local attacker to execute arbitrary commands with victim privileges when the victim opens a crafted Power BI .pbip project from a space-free filesystem path containing an '&' character. The flaw resides in desktop_sync.py, which passes unquoted paths to 'cmd /c start' during report write or reload, and exploitation requires user interaction (UI:P) with the crafted path. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; CVSS 4.0 score is 7.3 (High), and an independent CVSS 3.1 assessment yields 7.8 (High).
Authenticated members of pH7Builder (pH7 Social Dating CMS) instances running versions before 18.5.0 can delete arbitrary files on the host by submitting ../ traversal sequences in the POST picture_link parameter handled by the picture module's deletePhoto() action. Because the parameter is concatenated unsanitized into the public picture storage directory, an attacker can escape that directory to remove other members' photos as well as application configuration and cache files, producing content loss and a denial-of-service condition (CVSS 3.1 base 7.1, AV:N/AC:L/PR:L/UI:N, C:N/I:H/A:H; vendor/SI scoring 7.2 under CVSS 4.0). Impact is limited to destructive deletion - there is no file read/exfiltration and no code execution path - and no public exploit code was identified at time of analysis, with no CISA KEV listing.
Privilege escalation in GoatCounter through 2.7.0 lets an authenticated user - even one holding only read-only access - promote their own account to superuser by sending a form-encoded POST to /user/pref containing protected fields such as user.access[all]=* and user.email_verified=true, which the userPrefSave handler mass-assigns despite its readonly tags. Because the attacker must already hold a valid low-privilege account (PR:L in both the CVSS 4.0 vector and our assessed CVSS 3.1 vector), the realistic exposure is shared, hosted, or multi-tenant instances where registration or account provisioning is available to untrusted parties; fully anonymous exploitation is not possible. No public exploit code was identified at time of analysis and there is no confirmed vendor-released fix version, so operators should treat this as a credible, actionable escalation flaw rather than a mass-exploitation emergency.
Authenticated low-privileged users on UnicomAI Wanwu deployments running versions before 0.6.3 can permanently delete other tenants' agent and RAG applications by sending a DELETE request to /v1/appspace/app with a guessed appId, because the pre-patch handler performs no ownership check on the supplied identifier. The vulnerability is an IDOR (CWE-639) and is exacerbated by sequential, predictable assistant IDs, which makes enumeration of victims' appIds practical; deletion also cascades to associated workflows, conversations, and linked data, giving high integrity and availability impact (assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H, vendor score 7.2). Exploitation requires a valid low-privileged account on a multi-tenant instance with other tenants' applications present, and no public exploit code has been identified at time of analysis, though a detailed technical writeup and patch commit are publicly available.
Unauthenticated network access to the LlamaFarm management API on port 14345 allows adjacent attackers to read stored provider API keys, modify projects, trigger data ingestion, and irreversibly delete projects in versions through 0.0.34. The insecure default binds the FastAPI server to 0.0.0.0, and the lf CLI silently ignores HOST overrides, preventing easy remediation. Exploitation requires the attacker to be on the same network segment (CVSS AV:A), and no public exploit code has been identified at time of analysis.
Omarchy 4 before 4.0.1 stages files from third-party themes without filtering executable content, so installing a theme from an untrusted Git repository and applying it with omarchy-theme-set lets the theme author run code as the victim user: Hyprland loads a theme's hyprland.lua and gum_env.lua at login, Neovim loads neovim.lua at startup, terminal configs (alacritty.toml, foot.ini, ghostty.conf, kitty.conf) name the program the terminal launches, and vscode.json installs an arbitrary VS Code extension. The CVSS 7.1 rating is tempered by the deliberate user action required - a user must choose to install and apply an attacker-supplied theme (UI:R, no credentials needed, PR:N) - and by the confinement of the resulting code to the victim's own privileges rather than root, which places real-world urgency at moderate-to-low rather than drop-everything. No public exploit code was identified at time of analysis and the flaw is not in CISA KEV; the vendor shipped a fix in the v4.0.1 release, and users who only apply bundled or self-authored themes are not exposed.
NornicDB through 1.4.1 fails to enforce per-database read restrictions on its vector-search endpoints, so an authenticated viewer-role user who is allowlisted for a database but explicitly denied read permission can still submit search queries or node IDs to /nornicdb/search and /nornicdb/similar and retrieve node IDs, labels and full property maps. The flaw is rated CVSS 4.0 7.1 (HIGH) and is confidentiality-only (CWE-862 missing authorization), requiring valid credentials (PR:L) plus a deployment that actually uses per-database allowlisting with read denial - instances without granular policies have nothing to bypass. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV).
Authenticated API clients of pH7Builder (pH7 Social Dating CMS) before 18.5.0 can retrieve sensitive member records - including bcrypt password hashes, non-expiring hashValidation password-reset tokens, and TOTP two-factor secrets - because the member API endpoints UserController::users() and user() return unfiltered database rows directly to the caller. Exploitation requires a valid private API key (PR:L) and network reachability to the exposed member API, so anonymous attackers cannot trigger it, but the leaked reset tokens never expire, removing any time window on their reuse. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (CISA KEV); the vendor addressed it in 18.5.0 and via upstream commit 52a59da. This is a credible but bounded risk best characterized as medium-severity requiring authentication.
Authenticated vendor (store_owner) accounts in the MultiVendorX WooCommerce plugin through 5.0.19 can silently overwrite marketplace-wide commission, payout, and onboarding settings by sending POST requests to /wp-json/multivendorx/v1/settings, because that REST route is authorized only against the low-privilege edit_stores capability instead of an administrator-level capability (CWE-863). The practical outcome is high integrity impact on marketplace configuration - a vendor can rewrite commission rates and payout rules in its own favor - with no user interaction and no administrator action required, while availability impact remains limited. Exploitation requires the attacker to already hold a vendor account with edit_stores on the target store, so exposure is greatest where vendor registration is open or self-service; no public exploit code has been identified at time of analysis and there is no CISA KEV entry, making this a moderate-priority broken-access-control (privilege boundary) issue rather than a pre-authentication compromise.
Authenticated file read in ConvertX through 0.19.0 allows any logged-in user to retrieve arbitrary files from the server by uploading a crafted reStructuredText document that uses an include directive pointing at an absolute path, converting it, and downloading the generated output. The flaw exists because the Pandoc converter wrapper in src/converters/pandoc.ts invokes Pandoc without the --sandbox flag, so Pandoc's own file-inclusion behavior is left unrestricted; the CVSS 4.0 vector (AV:N/AC:L/PR:L/UI:N, high confidentiality only) confirms remote exploitation requires valid credentials and does not affect integrity or availability. There is no public exploit identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), so this is a credible but moderate-priority information-disclosure risk whose real severity depends on what the ConvertX/Pandoc process user can reach on the host.
Secret values used by Flyte task pods can be recovered by anyone who can read Pods: in Flyte 2.0.1 through 2.0.51 the embedded secret manager webhook base64-encodes FILE-mounted secret contents into the SECRETS environment variable of the task's init container, so a principal with Kubernetes Pod get/list rights in the namespace can decode them without holding any Secret-store permission - the exact privilege separation the feature was meant to preserve. Assessed as a credible but conditional information-disclosure issue rather than a critical remote-takeover bug: exploitation requires an authenticated cluster principal with Pod-read RBAC and a deployment that mounts secrets in FILE mode, and it is most damaging in multi-tenant clusters that intentionally segregate Pod-read from Secret-read. Base64 encoding is not encryption, so confidentiality is fully lost for affected secrets (CVSS 4.0 score 7.1, VC:H, PR:L, no integrity or availability impact); no public exploit code or active exploitation was identified at time of analysis.
Blind prompt injection into a user's OpenClaw agent session is possible through the Pinclaw channel plugin version 0.3.0 and earlier, because the HTTP router skips the authToken check on POST /pinclaw/send. The service binds all interfaces on port 18790 by default, but per the assessed CVSS vector exploitation requires adjacent-network access (same LAN or Wi-Fi) rather than arbitrary internet reachability, so real-world risk is moderate rather than urgent. Successful abuse lets an unauthenticated attacker plant instructions into the victim's agent session, affecting integrity only; no public exploit code has been identified at time of analysis.
An unauthenticated attacker on the same link can crash or partially leak memory from Zephyr IPv6 devices by sending a unicast packet to a neighbor entry that is still in the unresolved state: net_route_ipv6_packet() reads the link-layer address at index NET_NBR_LLADDR_UNKNOWN (0xff) and returns a pointer roughly 2.5 KB past the end of the neighbor link-layer address array. Because builds with CONFIG_ASSERT enabled fire the misplaced assertion and panic, the primary outcome is a repeatable remote denial of service (CVSS 7.1, AV:A/AC:L/PR:N/UI:N, A:H), while builds with assertions disabled instead copy up to 8 bytes of unrelated static RAM into the destination link-layer address of the outgoing frame, disclosing them to any listener (C:L). Exploitation requires no router or forwarding configuration: CONFIG_NET_IPV6_ROUTE is enabled by default whenever the IPv6 neighbor cache is, and the attacker only needs to first force a neighbor into the unresolved state (e.g. by eliciting traffic to a spoofed non-existent address, or by sending a Router Advertisement without a source link-layer address option) before sending the trigger packet. No public exploit code was identified at time of analysis.