Memory exhaustion in the Quarkus LangChain4j chat-scopes WebSocket runtime (versions 1.9.0 through 1.14.1) lets unauthenticated remote clients repeatedly send WebSocket CONNECT frames to the /_chat/routes endpoint while reusing a single chatId, leaving orphaned scopes in the activeScopes map so heap usage grows steadily until the JVM is restarted. Per the assessed CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) the effect is availability-only - no confidentiality or integrity impact - and exploitation requires the chat-scopes WebSocket feature to be deployed and the endpoint reachable from the attacker; deployments that do not use this feature or that place /_chat/routes behind authentication or network controls are not exposed. No public exploit code and no confirmed active exploitation were identified at the time of analysis, and the EPSS signal is not notable.
CAPTCHA and anti-automation checks protecting public forms in pH7Builder (pH7 Social Dating CMS) before 19.3.0 can be bypassed by unauthenticated remote attackers who supply a client-chosen form ID to the PFBC Form::isValid() routine. An attacker loads any CAPTCHA-free form such as login or search to obtain a valid form identifier, then submits that identifier together with contact, comment, forum, invite, or signup data, causing the application to accept the input without the intended human-verification step. Per the independent assessment this is a moderate-severity anti-automation control bypass (CVSS 3.1 AV:N/AC:L/PR:N/UI:N with only low integrity impact) - there is no authentication bypass, data disclosure, or code execution, so realistic harm is spam, fake-account creation, and automated abuse; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the issue is fixed in 19.3.0.
Server-side request forgery in Company Research Agent through 2.2.0 allows unauthenticated remote attackers to make the server issue outbound HTTP requests by injecting unescaped ReportLab paragraph markup - specifically inline img elements - into the report_content parameter handled by the /generate-pdf endpoint, with the fetched image responses embedded in the returned PDF to give an attacker a content-leakage and internal-reachability oracle. Impact is confined to confidentiality (only responses renderable as images leak content), with no integrity or availability effect, and no public exploit code has been identified at time of analysis, although a public technical writeup describes the injection technique. The issue is tracked as CWE-918 and rated CVSS 4.0 base 6.9 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L), consistent with an independent assessment of a genuine-but-moderate SSRF.
An out-of-bounds stack write in the Zephyr RTOS Goodix GT9xx touch driver (drivers/input/input_gt911.c) lets a malicious or misbehaving I2C touch controller overwrite up to 112 bytes of the gt911_process() stack frame with attacker-chosen data running at kernel privilege, potentially hijacking control flow on the host microcontroller. Only systems built with the GT9xx driver are affected, and reaching the defect requires physical/local access to the I2C bus (AV:P) - there is no network, USB, or syscall path - most plausibly on boards where the panel is a pluggable display module or shield rather than a soldered part. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, though the fix is a small one-line clamp and the same overflow can occur non-adversarially with a GT9271-class panel or a single corrupted status byte.
Predibase LoRAX through 0.12.1 can expose private-adapter API tokens because the router writes the caller-supplied api_token from POST /generate request bodies into router logs and instrumented GenerateParameters spans, making the tokens recoverable by anyone who can read those logs or the OTLP trace backend. Exploitation is not a raw network attack against the inference API: the supplied CVSS 4.0 vector and our independent CVSS 3.1 assessment both require local/low-privileged access (AV:L, PR:L) and show confidentiality-only impact, while integrity and availability are unaffected. No public exploit identified at time of analysis, and the practical risk is limited to deployments that log requests or export traces with the GenerateParameters instrumentation active and whose users send api_token for private/gated adapters.
The Bluetooth LE Controller in Zephyr RTOS can be faulted or have its receive PDU pool exhausted by a radio-range peer that drives the Link Layer PHY Update procedure into the retained-RX-node state and then sends an unexpected LL Control PDU before the update instant arrives; the invalid-PDU branches of llcp_lp_pu_rx() and llcp_rp_pu_rx() complete the procedure without releasing the retained node, so the procedure context is freed while the node stays out of the receive pool. In the default configuration (CONFIG_BT_ASSERT and CONFIG_BT_CTLR_ASSERT_DEBUG both y) the violated invariant trips llcp_lr_check_done()/llcp_rr_check_done() and terminates in k_oops()/k_panic() from a single crafted PDU sequence, while on releases v3.4.0 through v3.7.x the assertion is never reached and each attempt silently leaks one PDU node from a pool that defaults to a single buffer (CONFIG_BT_CTLR_RX_BUFFERS=1), allowing a few reconnects to render Bluetooth inoperable until reboot. No pairing or encryption is required of the attacking peer (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 6.5), and no public exploit identified at time of analysis.
Zephyr's Bluetooth LE controller leaks a retained RX node when the Connected Isochronous Stream (CIS) Create control procedure is aborted through its "invalid PDU received" path, giving a radio-range attacker a denial-of-service primitive against affected devices. Any build with CONFIG_BT_CTLR_PERIPHERAL_ISO or CONFIG_BT_CTLR_CENTRAL_ISO is affected if it is mid-CIS-Create: against a peripheral the attacker sends a valid LL_CIS_REQ and then any unrelated LL Control PDU (for example LL_VERSION_IND) before the Host replies, while against a central a malicious peripheral simply answers LL_CIS_REQ with LL_UNKNOWN_RSP. In default builds the retained-node assertion fires immediately and produces a controller fatal error and usually a system reset from a single injected PDU; with CONFIG_BT_CTLR_ASSERT_DEBUG disabled, repeated connect-attack-reconnect cycles permanently drain the small LL notification pool until allocation always fails, RX flow control stalls, and the non-disableable LL_ASSERT_ERR() in llcp_lp_cc_flush() faults, with recovery requiring a reboot. Only availability is impacted - the leaked node is orphaned and never reused or double-freed - and no public exploit identified at time of analysis. Exploitation requires the attacker to be within Bluetooth LE radio range of an unauthenticated, unencrypted ACL link; no pairing, encryption, or user interaction is needed.
Denial of service affects Zephyr RTOS builds that include the Bluetooth Link Layer controller, where an over-the-air peer within Bluetooth radio range can trigger a retained RX node leak without pairing, bonding, or encryption. The peer sends a well-formed LL_CONNECTION_UPDATE_IND with a future instant (or reaches the same state as a central via LL_CONNECTION_PARAM_REQ, or through the local procedure via LL_REJECT_IND) and then, before that instant is reached, any other LL Control PDU such as LL_LENGTH_REQ; the invalid-PDU termination path completes the procedure without releasing the retained node, so llcp_rr_check_done() drops the last reference to it. With the default CONFIG_BT_CTLR_ASSERT_DEBUG enabled this produces an immediate fatal assertion in the controller, and with asserts disabled each occurrence permanently consumes a node from the small fixed RX pool until the receive path operates on NULL, with the impact being availability-only, limited to Bluetooth proximity, and persisting until reboot; no public exploit code was identified at time of analysis and there is no CISA KEV listing.
IP allowlist bypass in Speedtest Tracker through 1.15.0 lets unauthenticated remote attackers defeat both the ALLOWED_IPS restriction and the Prometheus endpoint allowlist by spoofing the X-Forwarded-For header, giving them read access to /prometheus metrics and other allowlist-gated web and API endpoints. The root cause is that bootstrap/app.php trusts every peer as a reverse proxy, so any client-supplied forwarding header is accepted as the real client IP. Impact is limited to information disclosure and reaching allowlist-protected routes; endpoints that separately require an application login are not necessarily compromised. No confirmed active exploitation (CISA KEV) is reported, though a public technical writeup of the bypass technique is referenced and no fixed version is identified in the available data.
Reflected cross-site scripting (CWE-80) in the Cohesity NetBackup Administration Console web interface before version 11.2 allows remote attackers to inject malicious script into a victim's browser session via a crafted URL, potentially leading to session hijacking or theft of sensitive information in the context of the console. The vulnerability requires user interaction (the victim must be logged into the console and open the malicious link), and no public exploit code or active exploitation has been identified at time of analysis. Cohesity has released a fix in NetBackup 11.2.
Authenticated APIPark users who hold authorization-view permission on even one application can read another application's plaintext API keys by supplying a foreign authorization UUID to /api/v1/app/authorization or its details route, and the exposure occurs regardless of the HideCredential setting. The flaw affects APIPark through 1.9.7-beta and is a genuine but moderate-severity authorization issue (CVSS 6.0, CWE-639) rather than an emergency: the attacker must already be authenticated with the required permission and must possess or guess another tenant's non-sequential UUID, which meaningfully limits opportunistic mass exploitation. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Cleartext transmission in mcp-remote 0.8.0 through 0.14.3 allows unauthenticated on-path attackers to capture OAuth client secrets and issued access/refresh tokens when the device-code authorization flow uses non-loopback HTTP endpoints. Exploitation requires a man-in-the-middle network position and a victim actively initiating the device-code grant; no public exploit code exists, and the issue is rated medium severity (CVSS 4.0 base 6.0).
SQL injection (CWE-89) in Interuse i-Bos 3.0 lets unauthenticated remote attackers pass crafted input that is concatenated into SQL statements, potentially exposing database contents. The assessed vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N, base 5.9) shows confidentiality as the primary impact, with attack complexity rated High because reliable exploitation depends on a condition not fully under the attacker's control - characteristic of blind/inferential SQL injection, back-end-specific behavior, or a particular application state rather than a single deterministic request. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the report originates from Israel's INCD advisory stream.
Local MCP callers and prompt-injected model turns can bypass the password-manager denylist in Open Computer Use through 1.0.0 on macOS by supplying case-variant bundle identifiers such as 'com.1Password.1Password', letting them invoke get_app_state and action tools against a running password manager. Successful abuse reads accessibility trees, captures screenshots, and drives the unlocked interface of applications that the denylist was explicitly designed to shield, resulting in high confidentiality impact with limited integrity impact to the host. The attack is local-only, requires the agent to already hold macOS accessibility and screen-recording permissions, and requires the target password manager to be unlocked; no public exploit code or confirmed active exploitation was identified at time of analysis, and no vendor-released patch was identified at time of analysis.
Improper authentication in Studio-Saelix Sencho (through 0.94.1) lets remote unauthenticated attackers manipulate the X-Forwarded-For header on the /api/auth/login endpoint to rotate their apparent client address and defeat the per-IP failed-login rate limiter. Exploitation requires network reach to the login endpoint on an instance deployed without a correctly configured trusted-proxy boundary, which matches default/typical deployments; publicly available exploit code exists, though CISA KEV does not list this CVE and no confirmed in-the-wild exploitation has been reported. The weakness is a control bypass rather than a direct login bypass - the attacker must still brute-force or guess valid credentials - so its practical impact is medium severity (CVSS 4.0 base 5.5; assessed CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N), primarily enabling credential-stuffing and password-guessing at scale.
Unauthenticated SQL injection in Xinhu Rainrock RockOA through version 2.7.6 allows remote attackers to run attacker-controlled SQL against the application's backend database by manipulating the ID argument that reaches kqjcmdModel::returnchuli through the Openkqj Action endpoint at webmain/task/openapi/openkqjAction.php. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms a low-barrier network attack that needs no credentials, no user interaction, and no special preconditions, with impact bounded to partial confidentiality, integrity, and availability (base score 6.9); publicly available exploit code exists, and the vendor was contacted but did not respond, so no vendor-released patch has been identified at time of analysis. There is no CISA KEV confirmation of active exploitation, and risk is further shaped by the product's niche deployment and whether the openapi interface is actually exposed beyond a firewall.
Heap-based buffer overflow in Samsung rlottie (all versions at or before commit e57b094f03c39a751a1fded6f7d6c13f1ed95ec9) can crash an application that parses a crafted Lottie animation containing an embedded image asset with oversized dimensions, causing an undersized bitmap allocation followed by an out-of-bounds heap write. Exploitation requires local delivery and user interaction (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) - an unauthenticated local context, but the victim must actively open or render the malicious animation - and the impact is limited to availability (denial of service/crash), with no confidentiality or integrity effect assessed. No public exploit code identified at time of analysis, and no CISA KEV listing; EPSS score was not supplied in the available intelligence. Overall this is a genuine but modest-severity defect rather than an urgent priority.
System-wide denial of service can be triggered on Zephyr RTOS v4.4.0 or later builds for RISC-V Espressif SoCs (in-tree, the ESP32-C6 HPCORE) when CONFIG_USERSPACE is enabled: a local user-mode thread that has been granted the I2S device (PR:L) can issue a single i2s_trigger() call naming a direction the devicetree does not describe, causing a NULL pointer dereference in kernel mode (CWE-476). The impact is availability only-a NULL read with no attacker-controlled offset, no write primitive, and no information disclosure-but the default fatal-error handler halts the system, so an enabled user-mode thread can effect a system-wide denial of service. No public exploit code identified at time of analysis, and this is not confirmed actively exploited; real-world exposure is narrow because Xtensa Espressif targets do not support Zephyr userspace, ESP32-C5 does not select CONFIG_RISCV_PMP by default, and non-userspace builds can only pass the bad direction from trusted in-kernel code.
Path traversal in the Lippu Docx Reader / Office Viewer app up to version 1.4.5 on Android lets a remote, unauthenticated attacker influence file paths handled by the word.office.docxviewer.document.docx.reader.ViewTxt function by supplying a crafted '_display_name' value containing '../' sequences, potentially reading or altering files within the app sandbox. Exploitation is not autonomous: it requires the victim to open attacker-controlled document content (CVSS 4.0 UI:P, passive user interaction), and impact stays inside the application sandbox with no scope change, which is why our assessment rates this a medium-severity issue (CVSS 3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L, CVSS 4.0 base 5.3) and a low real-world priority. There is no public exploit identified at time of analysis and no confirmed active exploitation; no vendor-released patch for version 1.4.5 was identified at time of analysis.
Information disclosure in Postiz (gitroomhq/postiz-app) prior to v2.25.1 causes two API endpoints to return full database rows rather than the limited field sets clients require, exposing secrets to callers who should not receive them. The public API's channel-delete operation returns the deleted integration row including the channel's platform access and refresh tokens, so a third-party OAuth app holding delete permission can obtain social-platform credentials and act against the connected account outside Postiz, while GET /user/organizations returns each organization row - including the admin-only organization API key - to every member regardless of role, letting a low-privileged member call the public API on the organization's behalf. Exploitation requires a valid Postiz session, API key, or OAuth token already belonging to the target organization (authentication requirements: authenticated per the assessed vector CVSS:4.0/.../PR:L); there is no anonymous access and no cross-tenant exposure, no public exploit code was identified at time of analysis, and the flaw is fixed in v2.25.1, making this a genuine but moderate-severity disclosure rather than a top-priority emergency.
Blind server-side request forgery (SSRF) in LLMGateway through 1.20.0 allows authenticated API key holders to force webhook POST requests to arbitrary internal targets via the video-generation callback_url parameter, which bypasses the assertSafeWebhookTarget check. Attackers can reach loopback, private RFC1918, or cloud metadata endpoints (169.254.169.254) from the worker's network, potentially exposing internal services or cloud credentials, though the blind nature limits data exfiltration to side effects of the POST request. No public exploit code has been identified at time of analysis, and exploitation requires a valid API key and use of the video feature.
Authenticated users of Frappe HR (hrms) - including accounts holding no HR role whatsoever - can read other employees' net pay along with loan, advance, and expense-claim balances by calling the whitelisted get_account_and_amount method over /api/method. Affected releases are all 14.x and 15.x builds through 15.64.3, plus any pre-16.11.0 build; the endpoint ships whitelisted by default and requires no non-default configuration or user interaction, only a valid low-privileged session (CVSS 4.0 score 5.3, PR:L, confidentiality-only impact). Exploitation is a straightforward IDOR-style enumeration exercise because Salary Slip and claim document names are sequential and guessable, so an attacker can harvest amounts systematically; CISA KEV does not list this issue and no public exploit code has been confirmed, although a public technical writeup describing the payroll "amount oracle" is referenced in the advisory data, making the technique widely discoverable.
Authenticated low-privilege users of phpIPAM through 1.8.3 can read restricted subnet and address data via the customer, location, and NAT tool pages, which omit the Subnets::check_permission authorization check (CWE-862). This moderate-severity issue requires a valid low-privilege account (CVSS 4.0 5.3, PR:L) and enables read-only disclosure of IP addresses, CIDRs, hostnames, and MAC addresses from sections the user is not authorized to view; there is no unauthenticated path, no write or code execution impact, and no public exploit identified at time of analysis. A public technical writeup describing the cross-section address disclosure is referenced, but this is not a top-tier priority.
Authenticated non-admin users of SuiteCRM through 7.15.2 and 8.x through 8.10.2 can read other users' assigned roles and per-module ACL action matrix by supplying a different user's id in the record parameter of the DetailUserRole entry point. The flaw is a missing authorization check (CWE-862) with a CVSS v4.0 score of 5.3, rated medium severity because it only discloses confidentiality-impacting ACL configuration data and requires a valid low-privileged session. No public exploit code was identified at the time of analysis, and the issue affects standard installations without needing special configuration.
Workspace metadata and custom_instructions disclosure in Plastic Labs Honcho through 3.3.0 allows a holder of a peer- or session-scoped API key to read workspace-level configuration they should not be able to access. The flaw (CWE-863, incorrect authorization) is that get_or_create_workspace inspects only the workspace claim on the supplied token and never verifies the key's scope, so an attacker who knows the parent workspace name can submit it to POST /v3/workspaces and retrieve fields such as custom_instructions that are reserved for workspace or admin keys. Exploitation requires an already-valid low-privilege scoped credential and knowledge of the workspace name (CVSS 4.0 base 5.3, PR:L, read-only confidentiality impact); no public exploit code or confirmed active exploitation was identified at time of analysis, and no vendor-released patch is present in the available intelligence.
Authenticated server-side request forgery (CWE-918) in Miniflux 2.3.0 through 2.3.3 lets any logged-in user who can create or edit a feed set that feed's proxy_url to a loopback or internal host, defeating the FETCHER_ALLOW_PRIVATE_NETWORKS safeguard so the server itself probes internal ports and sends proxy-style requests to internal services. Impact is confined to low confidentiality disclosure - internal port probing and response/metadata leakage - with no integrity, availability, code-execution or denial-of-service component, and the prerequisite of a valid account means unauthenticated outsiders cannot trigger it; both the supplied CVSS v4.0 score (5.3) and the independent CVSS v3.1 assessment (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, also 5.3) agree on a moderate rating. Exploitation status is modest: no CISA KEV entry and no public exploit identified at time of analysis, although a public technical writeup of the bypass and the exact upstream source locations of the flawed logic are linked in the references; reported by VulnCheck, which published a matching advisory, and no EPSS data was supplied with this record.
An authorization bypass in LibreNMS through 26.9.1.1 lets a restricted user who has been granted access on at least one smokeping probe device view smokeping latency graphs for devices they are not authorized to see, including enumeration of device names. The flaw is in the smokeping graph authorization include, which validates the src probe device rather than the rendered target device, so requesting smokeping_in or smokeping_out with arbitrary device IDs succeeds. Exploitation requires an authenticated restricted account with probe access and a deployment using smokeping graphing; the impact is limited to read-only information disclosure with no integrity or availability effect, no public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV.
Decompression bomb uploads in OpenDocMan 2.4.0 through 2.10.0 let an authenticated user with document-upload permission crash PHP workers by submitting a small ODT, DOCX, or XLSX file whose compressed XML entries expand to hundreds of megabytes once the application runs its text-extraction routine. The CVSS 4.0 vector (AV:N/AC:L/PR:L/UI:N, VC:N/VI:N/VA:L) and the independent assessment agree the impact is limited to availability degradation rather than code execution or data disclosure, and exploitation requires a valid account - unauthenticated attackers cannot trigger it. No CISA KEV listing or public exploit code was identified at time of analysis, so this is a genuine low-to-moderate priority availability issue rather than an emergency.
Holders of scoped EdgeEver API tokens can exceed their granted permissions in versions through 1.108.0, because the Hono-based memo-template routes never call the requireScopes authorization check - allowing a token that explicitly lacks the write:memos scope to create memos via POST /api/v1/templates/:id/use and to list, modify, or delete templates in the token owner's workspace. The flaw is authenticated (CVSS vector PR:L) and limited in blast radius: exploitation is confined to the token owner's own workspace and produces only integrity impact, with no confidentiality disclosure or service-availability loss (assessed CVSS 3.1 base 5.3). No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; this is a genuine but moderate-severity authorization bypass rather than an emergency, since an attacker must first be issued a valid workspace-scoped token.
Authenticated console users in Combodo iTop 3.1.0 through 3.3.0 can bypass their profile grants to delete objects, clear external keys, and read object attributes they are not authorized to access by supplying arbitrary class and key parameters to the linkset delete, detach, and get-remote-object routes handled by LinkSetController.php. The flaw is a CWE-862 missing authorization issue rated moderate (CVSS 3.1: 5.3, AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L), and the independent assessment confirms it is gated behind a valid console account rather than being an anonymous or portal-only attack. No public exploit code has been identified at time of analysis, and there is no CISA KEV confirmation of active exploitation.
Missing authorization in Frappe HR (hrms) lets any authenticated user - including ordinary employees with no HR role - zero out another employee's leave allocation by POSTing the target Leave Allocation record name to the whitelisted expire_allocation method, silently wiping that employee's remaining leave balance. The flaw affects all 14.x and 15.x releases through 15.64.3 and every build before 16.11.0, is exploitable in the default configuration with only a low-privileged session and no victim interaction, and is confined to data integrity (no confidentiality or availability impact). No public exploit identified at time of analysis, and a vendor-released patch (16.11.0) is available, so this is best treated as a medium-severity, insider-oriented data-integrity issue rather than a mass-exploitation emergency.
Missing authorization in SuiteCRM through 7.15.2 and 8.x through 8.10.2 allows authenticated low-privileged users to create and modify EmailMarketing records via the setCampaignMarketingAndTemplate entry point, despite lacking Campaigns module access. Attackers can POST marketingId, campaignId, and templateId to reattach marketing messages or swap the email template sent by EmailMan in campaign emails, resulting in low integrity impact. No public exploit has been identified at time of analysis, and exploitation requires a valid session and active campaign email functionality.
SQL injection in JeeWMS up to and including 3.7 lets an authenticated remote user inject arbitrary HQL through the 'searchVal' parameter of the getTreeData function in JeecgFormDemoController.java, allowing manipulation of the underlying database query. Exploitation requires a valid application session with access to the Autocomplete Data Handler endpoint, which resides in a demo/sample controller (com.jeecg.demo) that may not be exposed in every deployment, so this is a moderate, authentication-gated issue rather than an emergency; no public exploit code has been identified at time of analysis and no EPSS score was provided. The upstream project has published a fix in commit 6e29bd57972a499e9c8a81a2dbe94d0d5cf23af0 (PR #4), which switches the vulnerable string concatenation to a parameterized query.
Authenticated Frappe CRM users can read linked-document details for records they are not permitted to view, because the API method crm.api.doc.get_linked_docs_of_document in versions 1.49.0 through 1.87.0 resolves leads, deals, comments, and users by name without applying Frappe's permission checks. By supplying the name of a document they cannot legitimately access, any logged-in account - even a low-trust or self-service one - can extract linked call-log phone numbers, deal organization names, and mention notification text. The flaw is a genuine but modest information-disclosure issue (CVSS 5.3), limited to read-only metadata with no write, modification, or denial-of-service impact; no public exploit was identified at time of analysis and there is no confirmed active exploitation (CISA KEV).
Missing authorization checks in Raven (Frappe-based team chat) 2.0.0 through 3.0.0 allow any authenticated user to read Public channel message history and Open/Public channel file metadata from workspaces they do not belong to, by calling the legacy get_messages_with_dates and get_all_files_shared_in_channel methods with predictable or guessed channel IDs. The CVSS 4.0 vector (PR:L, VC:L) confirms this is an authenticated, read-only confidentiality exposure with no integrity or availability impact, and our independent assessment rates it a genuinely medium/low-priority issue rather than a high-severity one. No public exploit code was identified at time of analysis and no KEV listing applies.
Authenticated low-privileged users can bypass authorization checks in GLPI through 12.0.0 via the ajax/map.php endpoint, disclosing match counts, titles, and coordinates of itemtypes such as Contact, Supplier, Contract, and Budget within their entities. This missing authorization (CWE-862) is a low-severity information-disclosure issue, as per our independent assessment; no public exploit has been identified at time of analysis, and the CVSS 3.1 vector indicates limited confidentiality impact (C:L) with no integrity or availability impact. Affected users must be authenticated with at least low privileges (PR:L) and network access to the endpoint.
Field-level access control bypass in Odoo MCP (erpipe-org/mcp-odoo) versions 1.0.0 through 1.3.2 allows an attacker holding a valid, low-privileged MCP client session to read restricted Odoo field values by invoking the execute_method tool and calling the read or search_read ORM methods directly against named denied fields. Exploitation is confidentiality-only, with no integrity or availability impact, and requires authenticated access - the execute_method tool must be exposed and the caller must know or guess the restricted field names; a prompt-injected LLM agent with tool-calling access is an additional attack path. No public exploit code was identified at time of analysis, and the CVSS 4.0 base score of 5.3 reflects a moderate-priority disclosure rather than an emergency, consistent with EPSS-style low-to-moderate risk and no confirmed active exploitation.
Authenticated, enabled users of UnicomAI Wanwu (also tracked as unicomai/wanwu) before version 0.6.3 can revoke other organizations' legacy AppKeys through a broken object-level authorization flaw in the DELETE /v1/appspace/app/key endpoint. Because the handler authorizes deletion solely on the client-supplied numeric apiId and never validates that the caller's userId or orgId owns the key, a low-privileged account can iterate sequential key IDs and invalidate AppKeys tenant-wide, silently breaking MCP and OpenAPI integrations until each owner manually issues replacements. This is a genuine but moderate-priority authorization issue (CWE-639) rather than a critical one: it requires a valid account (PR:L per the CVSS vector), discloses no data, and is limited to integrity/availability impact, and no public exploit code or confirmed active exploitation was identified at time of analysis. Patches are available.
Missing authorization in Frappe Raven 2.0.0 through 3.0.0 lets an authenticated user with the Raven User role join Public workspaces that are configured as invite-only, because the can_only_join_via_invite setting is not enforced by the join_workspace API. The practical consequence is unauthorized persistent membership in those workspaces, allowing the attacker to read and post messages in the associated Public and Open channels, but not to reach private data or administrative functions. Exploitation requires a valid authenticated account and a target that is specifically a Public workspace with invite-only enabled; no public exploit code has been identified at time of analysis, and EPSS/KEV signals are absent, so this rates as a medium-severity, low-to-moderate real-world risk.
Any authenticated CoreShop customer can tamper with other customers' orders in versions through 1.5.5, because the OrderController's OrderConfirm and SendReship actions trust client-supplied order and reship identifiers instead of verifying that the caller owns the order. Omitting the data field in OrderConfirm allows the attacker to mark a victim's order as received, while supplying another customer's reshipId to SendReship overwrites that customer's return-tracking details - an integrity-only impact with no confidentiality or availability loss (assessed CVSS 3.1 5.3, PR:L). Exploitation requires an ordinary registered storefront account rather than elevated privileges, and no public exploit code has been identified at time of analysis; the CVE is not listed in CISA KEV.
Missing authorization in UnicomAI Wanwu through 0.6.5 lets any authenticated, enabled user revoke other users' AppKeys by submitting a target appId and appType - values obtainable from the exploration marketplace - to the unpublish endpoint, which then deletes api_key rows belonging to other users across organizations and cuts off their MCP and OpenAPI client access. Exploitation requires a valid enabled account on the platform (CVSS PR:L, so authenticated, not unauthenticated) and a multi-tenant deployment where other users' or organizations' apps exist to target; the impact is confined to credential revocation (integrity/availability of API access), not data disclosure. Scored 5.3 under CVSS 4.0 with the independent assessment landing at CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L, this is a genuine but moderate-severity access-control flaw; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Missing authorization in the Telegram router of Abilityai Trinity (through version 0.9.5) lets an agent-scoped MCP API key invoke binding operations that are intended to be human-only, including sending messages through the owner's bot token, replacing the Telegram binding with an attacker-controlled token, or deleting the binding outright. An attacker must first gain control of an agent holding a valid agent-scoped MCP key - typically achieved through prompt injection - so this is an authenticated (PR:L) issue rather than a pre-auth one, and impact is bounded to manipulation of the Telegram messaging binding rather than host compromise. No public exploit code or confirmed active exploitation was identified at time of analysis, and the independent assessment rates this as a genuine but moderate-priority authorization flaw rather than a high-severity item.
Missing authorization in CoreShop through 2026.2.2 lets authenticated Pimcore backend users who lack the relevant resource grants enumerate restricted commerce configuration - payment providers, carriers, price rules, stores, and tax rules - including their IDs, names, and identifiers. The flaw lives in ResourceController::listAction, which omits the isGrantedOr403() check that sibling actions enforce, so any valid low-privileged backend account can reach the auto-generated list routes. Impact is confined to read-only information disclosure (no create/update/delete and no secret exposure indicated), and no public exploit code or confirmed active exploitation was identified at time of analysis.
Missing authorization in the CloudBeaver web database manager (versions through 25.3.5) lets any authenticated member of a shared project - including users granted view-only access - persist attacker-supplied credentials onto a shared connection without holding datasource-edit permission. The initConnection GraphQL mutation accepts the saveCredentials and sharedCredentials flags together with attacker-chosen authProperties, so other users who later open that shared connection authenticate to the underlying database under the attacker's identity rather than their own. Exploitation requires a valid low-privilege account (authenticated, CVSS PR:L), a multi-user deployment that actually uses the shared-projects/team collaboration feature, and at least one subsequent victim connecting to the tampered connection; no public exploit code has been identified at time of analysis.
Cheshire Cat AI core through 2.0.23 is affected by a stored cross-site scripting vulnerability in its uploads plugin, which allows any authenticated user to upload HTML files via POST /uploads without type restrictions. A signed-in victim who opens a crafted GET /uploads/{path} link executes attacker-controlled script in the application's origin, potentially exposing the access_token cookie and enabling session hijacking, with administrators at highest risk. The issue requires victim interaction and a valid account; no public exploit code or active exploitation (CISA KEV) has been identified, and the overall risk is assessed as moderate (CVSS 5.1).
An out-of-bounds read in the Open Asset Import Library (Assimp) through version 6.0.5 is reachable through the PLY file handler, specifically in IOStreamBuffer::getNextBlock, when an application imports a crafted PLY model file. Affected deployments are any application, service, or pipeline that converts or previews PLY assets with Assimp; the practical impact is limited to disclosure of adjacent memory contents and/or a denial-of-service crash, with no evidence of code execution. Exploitation requires passive user interaction (someone must open or cause the file to be parsed) and no public exploit code has been identified at time of analysis; the vendor was contacted about the disclosure but did not respond, so no vendor-released patch is identified at time of analysis.
Predictable TCP initial sequence numbers in Zephyr RTOS allow off-path attackers to defeat RFC 6528 spoofing protection and perform blind TCP connection spoofing, data injection, or connection resets, but only on devices where the cryptographic random source fails exactly when the ISN secret key is first generated at boot. The flaw is a discarded return value from sys_csrand_get() that latches the 'key already generated' guard even on failure, leaving a 128-bit secret as all zeros for the entire boot; exploitation additionally requires the attacker to observe at least one ISN off-path and the spoofed peer to trust source addresses, and no public exploit was identified at time of analysis. The assessed vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N (4.8), reflecting an unauthenticated remote issue whose high attack complexity and conditional preconditions keep it moderate rather than critical, and the signals converge on a conditional, moderate-severity issue rather than a top priority.
Improper link resolution in the MoAI-ADK `moai init` template deployer (all versions through 3.1.2) lets a malicious repository redirect the tool's atomic file write so that it truncates and overwrites files outside the project directory. The deployer stages template content at a path formed by appending a `.moai-tmp` suffix to the destination and does not verify that this staging path is a regular file rather than a symlink, so an attacker who commits a path such as `.claude/settings.json.moai-tmp` pointing elsewhere on disk can cause the write to follow the link when a developer runs `moai init` against the repository. Exploitation is local and requires the victim to clone, trust, and execute the deployer on attacker-controlled content (CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P, assessed as CVSS:3.1/AV:L/AC:L/PR:N/UI:R); no authentication to the tool is required, impact is bounded to files the victim user can already write, and no public exploit code was identified at time of analysis.
Cleartext logging in Hugging Face Text Embeddings Inference through 1.9.4 exposes the configured api_key because the router's Args struct lacks a redact attribute for that field. Attackers who already have read access to router startup logs, container output, or OTLP telemetry can recover the Bearer token and use it to call protected embedding and rerank endpoints. This is a modest-severity, local information-disclosure issue (CWE-532) with no direct integrity or availability impact; no public exploit code or confirmed active exploitation is identified at time of analysis.
Cleartext logging in GPT-Load through 1.4.11 exposes client proxy keys for Gemini-style requests, because the Gin Logger middleware records the raw query string before extractAuthKey strips the key parameter. Anyone able to read the console/stdout stream or the on-disk ./data/logs/app.log - an operator, a log-pipeline consumer, or a host-level intruder with low-privileged local access (PR:L) - can recover those keys and replay them against the corresponding group. The assessed impact is confidentiality-only and low (CVSS 4.8; assessed CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), exploitation requires default access logging to be active and keys to be sent in the query string rather than headers, and no public exploit identified at time of analysis.