Wukong AICRM (all versions through the 20260610 release) fails to verify ownership of the AI chat session identifier passed to POST /chat/send, so any user holding a valid account on the instance can read and append to another user's conversation. Because the endpoint streams back an assistant reply generated from the victim's most recent 20 messages, the attacker receives verbatim conversation content rather than just a write primitive. Exploitation requires authentication (PR:L) but no user interaction or non-default configuration, and publicly available exploit code exists (poc_chat_send.py), so the practical barrier is simply obtaining any low-privileged account. Rated CVSS 4.0 5.3 / CVSS 3.1 5.3, this is a moderate authorization-focused disclosure-and-tampering issue confined to chat session data, not account or system takeover.
Unauthenticated remote attackers can bypass authentication in AmoyLab Unla through 0.10.0 by exploiting an OAuth2 authorization server that never authenticates a resource owner, allowing them to register a client, request an authorization code, and exchange it for a valid access token. This grants access to OAuth2-protected MCP prefixes, proxied upstream APIs, and injected credentials, with high confidentiality impact and low integrity impact. No public exploit identified at time of analysis, and no vendor-released patch is available; the vulnerability is remotely exploitable without authentication or user interaction, making it a high-priority issue for exposed instances.
Unauthenticated appointment takeover in Easy!Appointments 1.6.0 and earlier allows any remote attacker to rewrite, rebind, reschedule, or cancel arbitrary existing bookings by calling the public Booking::register() endpoint with a sequential appointment id and a self-asserted manage_mode flag while omitting the appointment management hash. Successful abuse also yields the victim's management hash, its update endpoint is reachable at PR:N/UI:N, and the flaw carries an assessed impact of high integrity loss, making it a genuine priority rather than a high-CVSS paper tiger; no public exploit identified at time of analysis, although a public technical write-up of the flaw exists, and no EPSS score was supplied in the available data.
Unbounded request-body buffering in mark3labs mcp-go through 1.2.1 lets remote unauthenticated attackers exhaust server memory and OOM-kill the process by sending arbitrarily large or many concurrent POST requests to the StreamableHTTPServer HTTP transport. Because the handler calls io.ReadAll on the raw request body before any size validation occurs, a single oversized request or a modest burst of parallel requests can drive allocation without limit; no credentials or user interaction are required (CVSS:4.0 PR:N/UI:N, availability-only impact rated 8.7). There is no confirmed in-the-wild exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, but the low complexity and network reachability make this a credible, moderately-high-priority availability risk for any deployment exposing the StreamableHTTP endpoint directly to untrusted networks.
Unauthenticated information disclosure in Katanemo Plano through 0.4.37 allows any network attacker who can reach TCP port 9901 to read plaintext LLM provider API keys by issuing a single GET request to the Envoy admin interface's /config_dump endpoint. The Envoy admin listener is bound to all host interfaces (0.0.0.0) in the shipped config/envoy.template.yaml, so stock deployments are exposed by default; the only real barriers are network reachability to port 9901 and the presence of at least one configured provider key, and the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, C:H) reflects a low-effort, high-reward credential theft with no authentication or user interaction required. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, although the flaw has been publicly documented by VulnCheck.
Memory exhaustion in the Model Context Protocol (MCP) Kotlin SDK through version 0.15.0 allows unauthenticated remote clients to drive a server into denial of service by sending WebSocket frames whose headers declare payloads approaching 2 GiB, forcing the server to attempt huge heap allocations before any frame body is received. The flaw lives in the SDK's Application.mcpWebSocket extension, which installs Ktor WebSockets without a maxFrameSize limit, and because that unprotected configuration is the installed default, no special toggle or misconfiguration is required. Impact is availability-only (no confidentiality or integrity loss), the practical limiting factor is network reachability to an exposed WebSocket endpoint running an affected version, and no public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated information disclosure in OpenAgents Workspace (through launcher-v1.0.17) enables remote attackers to list all workspaces and retrieve sensitive data-including the unmasked browserfabric_api_key, workspace IDs, slugs, creator emails, and member lists-via a single GET /v1/workspaces request. The endpoint lacks authentication (CWE-306), so exploitation requires only network reachability to the backend API. No public exploit code or CISA KEV listing is reported; however, the exposure of API credentials creates a high confidentiality risk, consistent with the CVSS 4.0 base score of 8.7 and independent assessment.
pH7Builder (pH7 Social Dating CMS) versions before 18.6.0 leak sensitive member records - email addresses, IP addresses, phone numbers, and bank account fields - to unauthenticated remote attackers who bypass the API's access checks. The bypass works because Tool.class.php ships a hard-coded API key (private_api_key=dev772277) and the authorization logic trusts the client-supplied Host header, so an attacker sending 'Host: localhost' along with that static key and the shipped default allowed URL is treated as authorized. No public exploit code has been identified at time of analysis and there is no KEV entry, but the independent assessment scores the issue CVSS v3.1 7.5 (AV:N/AC:L/PR:N/UI:N, C:H/I:N/A:N), a high-priority confidentiality-only exposure, with the vendor shipping 18.6.0 as the fix.
Incorrect authorization in Vearch 3.5.2 through 3.5.9 lets any authenticated non-root user who holds a role with ReadOnly or None resource privileges perform write operations that role should forbid. Because Role.HasPermissionForResources ignores the stored privilege level, such a user can upsert and delete documents and can call PUT /roles to grant their own role WriteRead privileges, escalating toward cluster-administrator access. Exploitation requires valid low-privilege credentials (PR:L) and is limited to the 3.5.2-3.5.9 range, so exposure is greatest in multi-tenant or shared deployments where untrusted users hold accounts; no public exploit code or confirmed active exploitation was identified at time of analysis.
Simple Membership, a WordPress membership plugin, transmits a newly registered member's plaintext password in a URL query string when the optional auto-login-after-registration feature is enabled, leaving the credential exposed in browser history and in web server, reverse-proxy, and CDN access logs (fixed in 4.8.3). Publicly available exploit code exists, but the exposure is strictly conditional: the vulnerable feature is not on by default, and an attacker must already have local access to the registrant's browser profile or privileged read access to the log stores named in the advisory. The CVSS vector (AV:L/AC:H/PR:L/UI:N) confirms some level of local or privileged access is required and that only confidentiality is impacted, making this a genuine-but-low-priority information-disclosure issue rather than an urgent remote flaw.
Unauthenticated attackers can obtain a non-expiring API token carrying a victim's full Rill permissions by abusing open dynamic client registration in the admin OAuth server of Rill Data's Rill 0.77.0 through 0.90.5 (CWE-862, missing authorization). The attacker self-registers an OAuth client with the long_lived_access_token scope and must then convince a logged-in Rill user - typically through a phishing authorization link - to approve it, because exploitation requires user interaction and cannot be executed silently against the server alone; the resulting access is bounded by the lured user's privilege level, so a high-privilege victim yields correspondingly broad, non-expiring access. Rill is not listed in CISA KEV and no public exploit has been identified at time of analysis, although a public technical writeup of the technique is linked from the advisory; the CVSS 4.0 base score is 8.6, and the independent assessment rates this a credible, above-average priority issue rather than an inflated high-CVSS score.
Signature verification bypass in hyper-mcp through 0.8.3 (src/wasm/oci.rs, load_wasm) lets an unauthenticated remote attacker who controls or tampers with OCI registry responses for a resolved tag load and execute unsigned WebAssembly plugins that were never covered by the Cosign signature check. The flaw is a time-of-check/time-of-use race (CWE-367): Cosign verifies a separately resolved tag while the loader consumes a different manifest, so a malicious registry can serve a signed manifest to the verifier and an unsigned malicious one to the plugin loader, with the payload then running under whatever host capabilities the operator granted. Exploitation is constrained - it requires signature-verified OCI plugin loading to be enabled, an active position on the registry channel, and winning the resolution race - and no public exploit code or confirmed active exploitation was identified at time of analysis.
Information disclosure in the WP-Invoice WordPress plugin through version 4.3.1 allows any authenticated user - including a low-privileged Subscriber - to retrieve the email addresses, display names and profile details of every registered user on the site by invoking AJAX handlers that perform no capability checks. The issue is network-exploitable with low attack complexity (CVSS 3.1: 4.3, AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) and requires only a valid logged-in account, which an attacker can often self-provision when public user registration is enabled. Publicly available exploit code exists, but CISA's SSVC assessment records no known exploitation at time of analysis, and no KEV listing applies. Because the leaked roster of names and emails is directly reusable for phishing and credential-targeting, the practical risk is moderate for sites with open registration and low for closed-membership deployments.
Authenticated users holding only Subscriber-level access can abuse the Veeqo for WooCommerce WordPress plugin (all versions through 2.2.8) to make the site download and extract an attacker-controlled archive, dropping arbitrary PHP files into the WordPress root and converting a low-privilege account into remote code execution; publicly available exploit code exists. The plugin's remote bridge-installation routine performs neither a capability check nor any validation of the URL it is given, and the attack needs no user interaction - the practical gate is simply having an account on the target site (e.g. open self-service registration) and the plugin being installed and active. Note that the widely published CVSS 4.3 score reflects confidentiality-only impact and understates the flaw; our independent assessment is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, while CISA's SSVC decision data records no observed exploitation and marks the issue non-automatable.
Missing authorization in the MemberHero WordPress plugin through version 6.9 allows any authenticated user - including a subscriber-level account - to invoke an AJAX action that has no capability or nonce check and make the site send arbitrary HTML email from its own mail system to arbitrary recipients. The practical impact is outbound mail relay used for phishing that carries the victim site's domain and sending reputation, with no direct data disclosure or code execution; the assessed CVSS vector (PR:L, I:L, no C/A impact) keeps this at medium severity (CVSS 4.3). Publicly available exploit code exists, and there is no KEV entry confirming active exploitation; the primary gating factor is authentication, which is trivially obtained on membership sites that permit open self-service registration.
Improper signature verification in hyper-mcp through 0.8.3 lets an attacker who controls or substitutes the OCI plugin image reference load a malicious WebAssembly plugin, because cosign_verify_args() accepts any signer identity and any OIDC issuer by default - so a plugin image signed with an ordinary, freely obtainable Sigstore keyless certificate passes verification. Successful exploitation allows the malicious plugin to execute with whatever host, filesystem, and environment capabilities the operator has granted to plugins, yielding high integrity impact with limited confidentiality exposure. No public exploit code has been identified at time of analysis; exploitation is gated by the attacker's ability to gain control of the image reference the target resolves (as reflected by the AT:P attack-requirement metric), and blast radius is bounded by the privileges a least-privilege deployment actually grants plugins.
Unauthenticated attackers can download private Corteza compose attachments by rewriting the 'kind' path segment of the original or preview serving route to 'page', 'icon', or 'namespace', which makes the platform's isAccessible() check treat the private file as a public-kind attachment and skip the token/signature verification that would normally gate it. Deployments at or below Corteza 2024.9.10 that expose the compose attachment endpoints are affected, and an attacker only needs to know or guess a valid private record or module attachment ID - that requirement is reflected as Attack Requirements: Present (AT:P) in the vendor's CVSS 4.0 score of 8.2 (High), while the assessed CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. Per available intelligence there is no CISA KEV entry and no public exploit identified at time of analysis, though a public technical write-up of the attachment kind-confusion technique is referenced; EPSS data was not supplied. The impact is confidentiality-only - high-volume unauthorized reads of files across namespace and record permission boundaries - with no integrity or availability effect reported.
OS command injection in GNU Emacs's TRAMP remote-file library (Emacs releases before 31.2, TRAMP through 2.8.2) lets an attacker who can get a crafted filename in front of a user execute arbitrary shell commands with that user's privileges, because tramp-user-regexp relies on an incomplete denylist of dangerous shell characters. This is a follow-on defect to CVE-2026-79992, whose fix did not cover all dangerous inputs. Exploitation is local, requires user interaction (the victim must open, complete, or otherwise have Emacs/TRAMP evaluate the malicious path), and only affects installations that use TRAMP remote-file functionality; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Local privilege escalation and sandbox escape in Zephyr RTOS affects builds with CONFIG_USERSPACE enabled that include a fuel-gauge driver: the syscall verifiers z_vrfy_fuel_gauge_get_props() and z_vrfy_fuel_gauge_set_props() size kernel-side variable-length arrays directly from an unvalidated caller-supplied len, letting any user-mode thread displace the supervisor stack and, where the caller holds fuel-gauge object permissions, write len * sizeof(union fuel_gauge_prop_val) bytes of attacker-controlled data into privileged memory. The outcome is an out-of-bounds write executing in supervisor mode with attacker-chosen length and content, leading to kernel code execution or a device crash; with the default CONFIG_PRIVILEGED_STACK_SIZE of 1024 bytes, a len of roughly 170 is sufficient to overrun the privileged stack, and a hardware stack guard does not contain it because the copy begins below the guard and walks upward. CVSS 3.1 rates this 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning the vector requires the attacker to already hold a low-privilege foothold - here, the ability to execute a user-mode thread on the device - and no public exploit code has been identified at time of analysis.
An out-of-bounds write of up to 127 bytes in the Zephyr RTOS NXP MCUX TRNG entropy driver (drivers/entropy/entropy_mcux_trng.c) allows a locally-present attacker to corrupt memory immediately following a caller-supplied buffer on affected NXP i.MX RT5xx/RT6xx SoCs. Because entropy_get_entropy() is a syscall whose verifier (K_SYSCALL_MEMORY_WRITE) checks only the requested length, an unprivileged user-mode thread that has merely been granted the entropy device can supply a length such as 1 and an arbitrary destination, causing the kernel to write 128 bytes where 1 was proven to be owned; on these Cortex-M33 parts there is no MMU, so the overflow can land in adjacent kernel state. The same defect is reachable from kernel mode via getentropy() or sys_rand8_get()/sys_rand16_get() where those resolve to the hardware generator. No public exploit code was identified at time of analysis and the flaw is not confirmed as actively exploited (no CISA KEV listing), but exploitation is local, deterministic in offset, and low complexity, which the assessed vector captures as AV:L/AC:L/PR:L with changed scope and high integrity impact.
Improper link following in mistral.rs 0.9.0 through 0.9.4 allows code running in the mistralrs-code-exec sandbox to read and overwrite files outside the intended sandbox by using symlinks with the server process's filesystem permissions. The flaw requires the code-execution feature to be enabled and reachable, low-level session or agent access (PR:L), and the ability to name a symlink as an output or reuse a session whose input path is a symlink (AT:P), making it a moderate-priority, context-dependent issue rather than a mass-exploitation threat; no public exploit identified at time of analysis.
Password reset tokens in Traccar through 6.16.0 are not bound to their intended purpose, allowing an attacker who possesses a leaked reset link to obtain a full session via /api/session or change passwords via /api/password/update. Exploitation is unauthenticated but requires the attacker to first acquire a valid, unexpired reset token, for example through referer leakage, shared URLs, or intercepted email. No public exploit code has been identified at time of analysis.
Use-after-free in the Zephyr RTOS Bluetooth LE host lets an adjacent, unauthenticated peer with an established L2CAP connection-oriented channel (CoC) on a dynamic PSM (0x0080-0x00FF) leave a pending work item pointing into channel memory that the application has already been told it may free. The attacker only needs to send a data K-frame immediately followed by an L2CAP Disconnect Request; because the Bluetooth RX workqueue outranks the system workqueue under cooperative scheduling, the deferred rx_work item cannot run before teardown, so the stack's released() callback fires while the system workqueue still holds a reference, producing memory corruption, information disclosure, or a corrupted workqueue pending list. The vector (CVSS:3.1/AV:A/AC:H/PR:N/UI:N) reflects adjacent-only access, no privileges, and a scheduling race that must be won, and realistic exploitability is further reduced by the requirement that the application free or re-accept the channel in released(). No public exploit code has been identified at time of analysis and the flaw is not in CISA KEV; an upstream fix commit is available.
OS command injection in pbi-cli 3.10.1 through 3.12.0 allows a local attacker to execute arbitrary commands with victim privileges when the victim opens a crafted Power BI .pbip project from a space-free filesystem path containing an '&' character. The flaw resides in desktop_sync.py, which passes unquoted paths to 'cmd /c start' during report write or reload, and exploitation requires user interaction (UI:P) with the crafted path. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; CVSS 4.0 score is 7.3 (High), and an independent CVSS 3.1 assessment yields 7.8 (High).
Authenticated members of pH7Builder (pH7 Social Dating CMS) instances running versions before 18.5.0 can delete arbitrary files on the host by submitting ../ traversal sequences in the POST picture_link parameter handled by the picture module's deletePhoto() action. Because the parameter is concatenated unsanitized into the public picture storage directory, an attacker can escape that directory to remove other members' photos as well as application configuration and cache files, producing content loss and a denial-of-service condition (CVSS 3.1 base 7.1, AV:N/AC:L/PR:L/UI:N, C:N/I:H/A:H; vendor/SI scoring 7.2 under CVSS 4.0). Impact is limited to destructive deletion - there is no file read/exfiltration and no code execution path - and no public exploit code was identified at time of analysis, with no CISA KEV listing.
Privilege escalation in GoatCounter through 2.7.0 lets an authenticated user - even one holding only read-only access - promote their own account to superuser by sending a form-encoded POST to /user/pref containing protected fields such as user.access[all]=* and user.email_verified=true, which the userPrefSave handler mass-assigns despite its readonly tags. Because the attacker must already hold a valid low-privilege account (PR:L in both the CVSS 4.0 vector and our assessed CVSS 3.1 vector), the realistic exposure is shared, hosted, or multi-tenant instances where registration or account provisioning is available to untrusted parties; fully anonymous exploitation is not possible. No public exploit code was identified at time of analysis and there is no confirmed vendor-released fix version, so operators should treat this as a credible, actionable escalation flaw rather than a mass-exploitation emergency.
Authenticated low-privileged users on UnicomAI Wanwu deployments running versions before 0.6.3 can permanently delete other tenants' agent and RAG applications by sending a DELETE request to /v1/appspace/app with a guessed appId, because the pre-patch handler performs no ownership check on the supplied identifier. The vulnerability is an IDOR (CWE-639) and is exacerbated by sequential, predictable assistant IDs, which makes enumeration of victims' appIds practical; deletion also cascades to associated workflows, conversations, and linked data, giving high integrity and availability impact (assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H, vendor score 7.2). Exploitation requires a valid low-privileged account on a multi-tenant instance with other tenants' applications present, and no public exploit code has been identified at time of analysis, though a detailed technical writeup and patch commit are publicly available.
Unauthenticated network access to the LlamaFarm management API on port 14345 allows adjacent attackers to read stored provider API keys, modify projects, trigger data ingestion, and irreversibly delete projects in versions through 0.0.34. The insecure default binds the FastAPI server to 0.0.0.0, and the lf CLI silently ignores HOST overrides, preventing easy remediation. Exploitation requires the attacker to be on the same network segment (CVSS AV:A), and no public exploit code has been identified at time of analysis.
Omarchy 4 before 4.0.1 stages files from third-party themes without filtering executable content, so installing a theme from an untrusted Git repository and applying it with omarchy-theme-set lets the theme author run code as the victim user: Hyprland loads a theme's hyprland.lua and gum_env.lua at login, Neovim loads neovim.lua at startup, terminal configs (alacritty.toml, foot.ini, ghostty.conf, kitty.conf) name the program the terminal launches, and vscode.json installs an arbitrary VS Code extension. The CVSS 7.1 rating is tempered by the deliberate user action required - a user must choose to install and apply an attacker-supplied theme (UI:R, no credentials needed, PR:N) - and by the confinement of the resulting code to the victim's own privileges rather than root, which places real-world urgency at moderate-to-low rather than drop-everything. No public exploit code was identified at time of analysis and the flaw is not in CISA KEV; the vendor shipped a fix in the v4.0.1 release, and users who only apply bundled or self-authored themes are not exposed.
NornicDB through 1.4.1 fails to enforce per-database read restrictions on its vector-search endpoints, so an authenticated viewer-role user who is allowlisted for a database but explicitly denied read permission can still submit search queries or node IDs to /nornicdb/search and /nornicdb/similar and retrieve node IDs, labels and full property maps. The flaw is rated CVSS 4.0 7.1 (HIGH) and is confidentiality-only (CWE-862 missing authorization), requiring valid credentials (PR:L) plus a deployment that actually uses per-database allowlisting with read denial - instances without granular policies have nothing to bypass. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV).
Authenticated API clients of pH7Builder (pH7 Social Dating CMS) before 18.5.0 can retrieve sensitive member records - including bcrypt password hashes, non-expiring hashValidation password-reset tokens, and TOTP two-factor secrets - because the member API endpoints UserController::users() and user() return unfiltered database rows directly to the caller. Exploitation requires a valid private API key (PR:L) and network reachability to the exposed member API, so anonymous attackers cannot trigger it, but the leaked reset tokens never expire, removing any time window on their reuse. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (CISA KEV); the vendor addressed it in 18.5.0 and via upstream commit 52a59da. This is a credible but bounded risk best characterized as medium-severity requiring authentication.
Authenticated vendor (store_owner) accounts in the MultiVendorX WooCommerce plugin through 5.0.19 can silently overwrite marketplace-wide commission, payout, and onboarding settings by sending POST requests to /wp-json/multivendorx/v1/settings, because that REST route is authorized only against the low-privilege edit_stores capability instead of an administrator-level capability (CWE-863). The practical outcome is high integrity impact on marketplace configuration - a vendor can rewrite commission rates and payout rules in its own favor - with no user interaction and no administrator action required, while availability impact remains limited. Exploitation requires the attacker to already hold a vendor account with edit_stores on the target store, so exposure is greatest where vendor registration is open or self-service; no public exploit code has been identified at time of analysis and there is no CISA KEV entry, making this a moderate-priority broken-access-control (privilege boundary) issue rather than a pre-authentication compromise.
Authenticated file read in ConvertX through 0.19.0 allows any logged-in user to retrieve arbitrary files from the server by uploading a crafted reStructuredText document that uses an include directive pointing at an absolute path, converting it, and downloading the generated output. The flaw exists because the Pandoc converter wrapper in src/converters/pandoc.ts invokes Pandoc without the --sandbox flag, so Pandoc's own file-inclusion behavior is left unrestricted; the CVSS 4.0 vector (AV:N/AC:L/PR:L/UI:N, high confidentiality only) confirms remote exploitation requires valid credentials and does not affect integrity or availability. There is no public exploit identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), so this is a credible but moderate-priority information-disclosure risk whose real severity depends on what the ConvertX/Pandoc process user can reach on the host.
Secret values used by Flyte task pods can be recovered by anyone who can read Pods: in Flyte 2.0.1 through 2.0.51 the embedded secret manager webhook base64-encodes FILE-mounted secret contents into the SECRETS environment variable of the task's init container, so a principal with Kubernetes Pod get/list rights in the namespace can decode them without holding any Secret-store permission - the exact privilege separation the feature was meant to preserve. Assessed as a credible but conditional information-disclosure issue rather than a critical remote-takeover bug: exploitation requires an authenticated cluster principal with Pod-read RBAC and a deployment that mounts secrets in FILE mode, and it is most damaging in multi-tenant clusters that intentionally segregate Pod-read from Secret-read. Base64 encoding is not encryption, so confidentiality is fully lost for affected secrets (CVSS 4.0 score 7.1, VC:H, PR:L, no integrity or availability impact); no public exploit code or active exploitation was identified at time of analysis.
Blind prompt injection into a user's OpenClaw agent session is possible through the Pinclaw channel plugin version 0.3.0 and earlier, because the HTTP router skips the authToken check on POST /pinclaw/send. The service binds all interfaces on port 18790 by default, but per the assessed CVSS vector exploitation requires adjacent-network access (same LAN or Wi-Fi) rather than arbitrary internet reachability, so real-world risk is moderate rather than urgent. Successful abuse lets an unauthenticated attacker plant instructions into the victim's agent session, affecting integrity only; no public exploit code has been identified at time of analysis.
An unauthenticated attacker on the same link can crash or partially leak memory from Zephyr IPv6 devices by sending a unicast packet to a neighbor entry that is still in the unresolved state: net_route_ipv6_packet() reads the link-layer address at index NET_NBR_LLADDR_UNKNOWN (0xff) and returns a pointer roughly 2.5 KB past the end of the neighbor link-layer address array. Because builds with CONFIG_ASSERT enabled fire the misplaced assertion and panic, the primary outcome is a repeatable remote denial of service (CVSS 7.1, AV:A/AC:L/PR:N/UI:N, A:H), while builds with assertions disabled instead copy up to 8 bytes of unrelated static RAM into the destination link-layer address of the outgoing frame, disclosing them to any listener (C:L). Exploitation requires no router or forwarding configuration: CONFIG_NET_IPV6_ROUTE is enabled by default whenever the IPv6 neighbor cache is, and the attacker only needs to first force a neighbor into the unresolved state (e.g. by eliciting traffic to a spoofed non-existent address, or by sending a Router Advertisement without a source link-layer address option) before sending the trigger packet. No public exploit code was identified at time of analysis.
Server-side request forgery in Appwrite 2.3.0 and earlier allows remote attackers to make the Browser Screenshot Service (exposed through the Avatars screenshot endpoint and its 'url' parameter) fetch arbitrary attacker-chosen URLs, reaching internal services or cloud metadata endpoints; because the headless browser resolves the hostname itself, the pre-patch hostname validation can be bypassed via DNS rebinding. Per the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N), exploitation is unauthenticated over the network with confidentiality-only impact (score 6.9), and the independent assessment rates this a genuine but moderate-priority issue bounded to information disclosure through the rendered screenshot. No public exploit was identified at time of analysis, and exploitation requires the screenshot endpoint to be deployed and reachable; the vendor-released fix is Appwrite 2.4.0 (patch commit 393255e7302ae5503331d45802e2eee01c6a47fe, PR 13995).
Unauthenticated remote attackers can read unmoderated and rejected product reviews on Sylius storefronts through 2.3.0 because the AcceptedExtension Doctrine filter is applied to review collection queries but not to the single-item operation, allowing sequential IDs to be enumerated against GET /api/v2/shop/product-reviews/{id}. The exposure is read-only and limited to low-sensitivity fields - review title, rating, comment, timestamp and author first name - so the practical impact is a moderation/authorization bypass plus minor privacy disclosure rather than credential, order or payment compromise; no public exploit identified at time of analysis. Sylius ships this endpoint as part of the standard shop REST API (/api/v2/shop), which is exposed by default on typical storefront deployments; CVSS 6.9 (v4.0) reflects the confidentiality-only scope, while our own assessment scores it 5.3 under CVSS 3.1 - a genuine but moderate-priority issue, not a top-tier emergency.
Unauthenticated remote attackers can exhaust server memory in Hatchet 0.110.5 and earlier by sending arbitrarily large or highly concurrent request bodies to the SNS ingestion endpoint POST /api/v1/sns/{tenant}/{event}, degrading availability only (CVSS 4.0 base 6.9, vector AV:N/AC:L/AT:N/PR:N/UI:N with impact restricted to low availability; assessed CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). No credentials, valid tenant ID, or genuine SNS signature are required because the SnsUpdate handler buffers the full request body before signature verification and accepts any UUID, so the SNS signature check provides no protective limit; the practical exposure constraint is network reachability of the endpoint. The issue is tracked by VulnCheck and is not listed in CISA KEV, no public exploit code has been identified at time of analysis, and no vendor-released patched version is confirmed in the available data, leaving request-size limits and network restriction of the endpoint as the primary defenses.
Memory exhaustion in the Quarkus LangChain4j chat-scopes WebSocket runtime (versions 1.9.0 through 1.14.1) lets unauthenticated remote clients repeatedly send WebSocket CONNECT frames to the /_chat/routes endpoint while reusing a single chatId, leaving orphaned scopes in the activeScopes map so heap usage grows steadily until the JVM is restarted. Per the assessed CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) the effect is availability-only - no confidentiality or integrity impact - and exploitation requires the chat-scopes WebSocket feature to be deployed and the endpoint reachable from the attacker; deployments that do not use this feature or that place /_chat/routes behind authentication or network controls are not exposed. No public exploit code and no confirmed active exploitation were identified at the time of analysis, and the EPSS signal is not notable.
CAPTCHA and anti-automation checks protecting public forms in pH7Builder (pH7 Social Dating CMS) before 19.3.0 can be bypassed by unauthenticated remote attackers who supply a client-chosen form ID to the PFBC Form::isValid() routine. An attacker loads any CAPTCHA-free form such as login or search to obtain a valid form identifier, then submits that identifier together with contact, comment, forum, invite, or signup data, causing the application to accept the input without the intended human-verification step. Per the independent assessment this is a moderate-severity anti-automation control bypass (CVSS 3.1 AV:N/AC:L/PR:N/UI:N with only low integrity impact) - there is no authentication bypass, data disclosure, or code execution, so realistic harm is spam, fake-account creation, and automated abuse; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the issue is fixed in 19.3.0.
Server-side request forgery in Company Research Agent through 2.2.0 allows unauthenticated remote attackers to make the server issue outbound HTTP requests by injecting unescaped ReportLab paragraph markup - specifically inline img elements - into the report_content parameter handled by the /generate-pdf endpoint, with the fetched image responses embedded in the returned PDF to give an attacker a content-leakage and internal-reachability oracle. Impact is confined to confidentiality (only responses renderable as images leak content), with no integrity or availability effect, and no public exploit code has been identified at time of analysis, although a public technical writeup describes the injection technique. The issue is tracked as CWE-918 and rated CVSS 4.0 base 6.9 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L), consistent with an independent assessment of a genuine-but-moderate SSRF.
An out-of-bounds stack write in the Zephyr RTOS Goodix GT9xx touch driver (drivers/input/input_gt911.c) lets a malicious or misbehaving I2C touch controller overwrite up to 112 bytes of the gt911_process() stack frame with attacker-chosen data running at kernel privilege, potentially hijacking control flow on the host microcontroller. Only systems built with the GT9xx driver are affected, and reaching the defect requires physical/local access to the I2C bus (AV:P) - there is no network, USB, or syscall path - most plausibly on boards where the panel is a pluggable display module or shield rather than a soldered part. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, though the fix is a small one-line clamp and the same overflow can occur non-adversarially with a GT9271-class panel or a single corrupted status byte.
Predibase LoRAX through 0.12.1 can expose private-adapter API tokens because the router writes the caller-supplied api_token from POST /generate request bodies into router logs and instrumented GenerateParameters spans, making the tokens recoverable by anyone who can read those logs or the OTLP trace backend. Exploitation is not a raw network attack against the inference API: the supplied CVSS 4.0 vector and our independent CVSS 3.1 assessment both require local/low-privileged access (AV:L, PR:L) and show confidentiality-only impact, while integrity and availability are unaffected. No public exploit identified at time of analysis, and the practical risk is limited to deployments that log requests or export traces with the GenerateParameters instrumentation active and whose users send api_token for private/gated adapters.
Information disclosure in the Dokan multivendor marketplace plugin for WordPress (versions before 5.2.0) lets any authenticated vendor read the commission rate and fixed fee that the marketplace administrator configured for other vendors, simply by requesting a commission calculation for someone else's vendor identifier. The root cause is a missing ownership check (CWE-200 information exposure) on the commission-calculation feature, which is reachable by a logged-in vendor account - a low barrier on marketplaces that allow self-service vendor registration. Publicly available exploit code exists per the WPScan advisory, no CISA KEV listing has been recorded, and impact is confined to disclosure of pricing configuration: there is no data modification, privilege escalation, or service disruption. The vendor has released a fix in version 5.2.0, and the independent assessment confirms this as a genuinely low-severity issue with a consistent risk picture.
Authenticated information disclosure in the Envira Gallery WordPress plugin affects all versions before 1.16.2, allowing any user who can create or edit a gallery - Author role and above by default - to retrieve the title and excerpt of other users' private, draft, pending, and trashed posts that WordPress would normally withhold. The flaw is a missing authorization check (CWE-200) on the image identifier supplied when adding media to a gallery, and it is rated low severity (vendor CVSS 2.7, CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N; our independent assessment lowers the privilege requirement to PR:L since Author is the default capability for gallery editing). Publicly available exploit code exists, but there is no indication of confirmed active exploitation, and a vendor fix is available in version 1.16.2.
Authenticated users with the lowest-tier Trainer role in the Squadeno WordPress plugin before 1.12.0 can modify metadata of sports they are assigned to-section, age group, author, password, comment settings, and date-by exploiting a save path that does not re-apply the plugin's authorization restrictions. This is an incorrect authorization flaw (CWE-863) with a low CVSS base score of 2.7, and publicly available exploit code exists, though no active exploitation has been confirmed. Upgrading to version 1.12.0 resolves the issue.
Envira Gallery, a WordPress gallery plugin, fails to verify that a user is authorized to read a gallery before rendering it in versions before 1.16.2, letting an authenticated attacker with author-level publishing privileges embed another user's gallery and expose its non-public metadata to unauthenticated visitors. Publicly available exploit code exists, and the vendor has released a fix in 1.16.2. The measured risk is low (CVSS 2.7), because exploitation requires an author-level account on a multi-author site and disclosure is limited to gallery metadata rather than full account or site compromise.
Envira Gallery before 1.16.2 contains a missing authorization flaw in its gallery-conversion feature, allowing an authenticated WordPress user with contributor-level access to create and publish gallery posts that the plugin's settings would otherwise withhold from them. Publicly available exploit code exists, but impact is limited to gallery content integrity; there is no code execution, data disclosure, or site takeover, and upgrading to 1.16.2 remediates the issue.
The Bluetooth LE Controller in Zephyr RTOS can be faulted or have its receive PDU pool exhausted by a radio-range peer that drives the Link Layer PHY Update procedure into the retained-RX-node state and then sends an unexpected LL Control PDU before the update instant arrives; the invalid-PDU branches of llcp_lp_pu_rx() and llcp_rp_pu_rx() complete the procedure without releasing the retained node, so the procedure context is freed while the node stays out of the receive pool. In the default configuration (CONFIG_BT_ASSERT and CONFIG_BT_CTLR_ASSERT_DEBUG both y) the violated invariant trips llcp_lr_check_done()/llcp_rr_check_done() and terminates in k_oops()/k_panic() from a single crafted PDU sequence, while on releases v3.4.0 through v3.7.x the assertion is never reached and each attempt silently leaks one PDU node from a pool that defaults to a single buffer (CONFIG_BT_CTLR_RX_BUFFERS=1), allowing a few reconnects to render Bluetooth inoperable until reboot. No pairing or encryption is required of the attacking peer (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 6.5), and no public exploit identified at time of analysis.