Zephyr's Bluetooth LE controller leaks a retained RX node when the Connected Isochronous Stream (CIS) Create control procedure is aborted through its "invalid PDU received" path, giving a radio-range attacker a denial-of-service primitive against affected devices. Any build with CONFIG_BT_CTLR_PERIPHERAL_ISO or CONFIG_BT_CTLR_CENTRAL_ISO is affected if it is mid-CIS-Create: against a peripheral the attacker sends a valid LL_CIS_REQ and then any unrelated LL Control PDU (for example LL_VERSION_IND) before the Host replies, while against a central a malicious peripheral simply answers LL_CIS_REQ with LL_UNKNOWN_RSP. In default builds the retained-node assertion fires immediately and produces a controller fatal error and usually a system reset from a single injected PDU; with CONFIG_BT_CTLR_ASSERT_DEBUG disabled, repeated connect-attack-reconnect cycles permanently drain the small LL notification pool until allocation always fails, RX flow control stalls, and the non-disableable LL_ASSERT_ERR() in llcp_lp_cc_flush() faults, with recovery requiring a reboot. Only availability is impacted - the leaked node is orphaned and never reused or double-freed - and no public exploit identified at time of analysis. Exploitation requires the attacker to be within Bluetooth LE radio range of an unauthenticated, unencrypted ACL link; no pairing, encryption, or user interaction is needed.
Denial of service affects Zephyr RTOS builds that include the Bluetooth Link Layer controller, where an over-the-air peer within Bluetooth radio range can trigger a retained RX node leak without pairing, bonding, or encryption. The peer sends a well-formed LL_CONNECTION_UPDATE_IND with a future instant (or reaches the same state as a central via LL_CONNECTION_PARAM_REQ, or through the local procedure via LL_REJECT_IND) and then, before that instant is reached, any other LL Control PDU such as LL_LENGTH_REQ; the invalid-PDU termination path completes the procedure without releasing the retained node, so llcp_rr_check_done() drops the last reference to it. With the default CONFIG_BT_CTLR_ASSERT_DEBUG enabled this produces an immediate fatal assertion in the controller, and with asserts disabled each occurrence permanently consumes a node from the small fixed RX pool until the receive path operates on NULL, with the impact being availability-only, limited to Bluetooth proximity, and persisting until reboot; no public exploit code was identified at time of analysis and there is no CISA KEV listing.
IP allowlist bypass in Speedtest Tracker through 1.15.0 lets unauthenticated remote attackers defeat both the ALLOWED_IPS restriction and the Prometheus endpoint allowlist by spoofing the X-Forwarded-For header, giving them read access to /prometheus metrics and other allowlist-gated web and API endpoints. The root cause is that bootstrap/app.php trusts every peer as a reverse proxy, so any client-supplied forwarding header is accepted as the real client IP. Impact is limited to information disclosure and reaching allowlist-protected routes; endpoints that separately require an application login are not necessarily compromised. No confirmed active exploitation (CISA KEV) is reported, though a public technical writeup of the bypass technique is referenced and no fixed version is identified in the available data.
Denial of service in zhayujie CowAgent through version 2.2.0 allows an authenticated, low-privileged user to disrupt the availability of the Markdown Rendering component by submitting crafted Markdown content to the Markdown.tsx code path. The CVSS 4.0 score is only 2.1 (our independent CVSS 3.1 assessment is AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L), reflecting a low-impact, availability-only issue with no confidentiality or integrity loss. Publicly available exploit code exists (a proof-of-concept report is published in a GitHub repository), and the vendor was contacted early but did not respond, so no official patch or advisory is available; the flaw is not listed in CISA KEV and no active exploitation is confirmed.
Denial of service in zhayujie CowAgent through 2.2.0 lets a low-privilege authenticated remote attacker exhaust process resources by supplying attacker-influenced streaming tool-call arguments that are passed unbounded to json.loads inside the agent's Streaming Tool-Call Argument Handler. The issue is rated CVSS 2.1 / CVSS:4.0 (AV:N/AC:L/PR:L/UI:N/VA:L, E:P), so impact is confined to limited availability with no confidentiality or integrity effect, and the affected project is a niche open-source LLM agent framework with limited deployment. Publicly available exploit code exists (a proof-of-concept report is published on GitHub), but there is no confirmed active exploitation (CISA KEV); the vendor was contacted and did not respond, so no patched release has been confirmed.
Denial of service in zhayujie CowAgent (up to and including 2.1.7) allows an authenticated remote user with low privileges to tie up server resources through the Web Console by manipulating the session_id argument processed in channel/web/web_channel.py. The flaw is an improper resource shutdown/release condition (CWE-404) that degrades availability only - there is no data exposure or integrity impact, and reachability requires network access to the Web Console plus a valid low-privileged session. Publicly available exploit code exists (an exploit report is linked from the CVE references) and the vendor was notified early, but there is no confirmed active exploitation (not in CISA KEV); version 2.1.7 commit dec28324 only partly mitigates the issue via a 512MB request-body cap.
Denial of service in zhayujie CowAgent 2.1.6 and earlier allows an authenticated remote attacker with a low-privilege session to trigger resource exhaustion via the read function of the /upload endpoint in the Web Console component. Publicly available exploit code exists, but there is no confirmation of active exploitation. The vendor did not respond to disclosure and no patch is confirmed; risk is low-to-moderate and should not be prioritized ahead of more impactful issues.
Path traversal in ag2ai AG2 through version 0.13.4 allows an attacker who can influence the filename argument consumed by UserProxyAgent's os.path.join call to escape the intended working directory and read or write files with the privileges of the host process. Impact is bounded rather than catastrophic: the CVSS vector specifies PR:L, so some authorized or authenticated interaction with the agent is required, and the host application must route attacker-influenced input into that filename argument, meaning the in-process library code is not directly reachable by an unauthenticated remote attacker. Publicly available exploit code exists (a public report demonstrating legacy filename handling in a Docker environment), but there is no confirmed active exploitation and no CISA KEV listing; the vendor was contacted and did not respond, and no vendor-released patch has been identified at time of analysis.
Unbounded memory allocation in the media download handler of zhayujie CowAgent through version 2.1.9 allows an authenticated participant in a connected messaging channel (the patched code covers DingTalk and Feishu media paths) to exhaust the agent's process memory by supplying oversized or unvalidated remote media, producing a denial-of-service condition with availability-only impact. Publicly available exploit code exists (a proof-of-concept report is published on GitHub), but there is no confirmation of active exploitation (not listed in CISA KEV), and the exposure is limited because the attacker must already be able to deliver a media message through the bot's channel rather than reaching it anonymously over the internet. The vendor resolved the issue by routing all channel downloads through a size-bounded helper in version 2.2.0.
Use-after-free in GPAC's filter queue (gf_fq_pop in filter_core/filter_queue.c) allows an attacker who supplies a crafted MP4/media file to crash or corrupt memory in MP4Box builds through 26.07.0. Exploitation is not confirmed in the wild (no CISA KEV entry), but publicly available exploit code exists (the PoC archive linked from the VulDB report), and per the independent assessment the realistic attack path is local/UI-driven: the victim or an automated transcoding pipeline must feed the malicious file to MP4Box, with the impact limited to Low confidentiality, integrity and availability (crash or constrained memory corruption, not confirmed code execution). Because there is no listening network service and user interaction is required, this is a low-priority issue despite the 'remote' framing used in the vendor-style CVSS 4.0 vector.
Server-side request forgery in Studio-Saelix Sencho up to 0.94.1 allows an authenticated user who can configure git sources to make the backend issue outbound HTTP/HTTPS connections to attacker-chosen internal addresses by manipulating the repo_url argument handled by outboundTarget.ts in the git-sources Browse API endpoint. Exploitation requires a valid session with git-source administration rights (CVSS 3.1 PR:L), and impact is limited to low confidentiality - internal request issuance and response exposure - with no integrity or availability effect; publicly available exploit code exists, though no confirmed in-the-wild activity has been reported. The vendor disputes the CVE characterization, arguing repository access to private LAN, VPC, VPN, CGNAT and IPv6 ULA ranges is an intentional administrative feature rather than a privilege-boundary bypass, while nonetheless shipping defense-in-depth hardening.
Use-after-free in GPAC's MP4Box media packaging tool (all builds through 26.07.0) can be triggered when the utility parses a malformed or attacker-supplied media file, corrupting memory in the affected process. The fault lives in the gf_mx_v() helper in utils/os_thread.c and is reached through the file-parsing path, not through any listening network service, so exploitation requires someone or an automated pipeline to run MP4Box on the hostile input. Publicly available exploit code exists (a PoC archive is linked from the advisory), the vendor was contacted early but did not respond, and there is no indication of active exploitation (no CISA KEV listing); impact is limited to availability of the processing process rather than confidentiality or integrity of the host.
Reflected cross-site scripting (CWE-80) in the Cohesity NetBackup Administration Console web interface before version 11.2 allows remote attackers to inject malicious script into a victim's browser session via a crafted URL, potentially leading to session hijacking or theft of sensitive information in the context of the console. The vulnerability requires user interaction (the victim must be logged into the console and open the malicious link), and no public exploit code or active exploitation has been identified at time of analysis. Cohesity has released a fix in NetBackup 11.2.
Server-side request forgery (SSRF) in elvix-sdk versions up to 0.10.1 allows remote attackers with low-privileged authenticated access to the MCP Request Handler to manipulate the 'path' argument in src/mcp/index.ts, causing the server to make arbitrary outbound requests. Publicly available exploit code exists, though no confirmed active exploitation has been observed. The vendor was contacted but did not respond, and no patch is available, leaving mitigation to compensating controls.
Authenticated APIPark users who hold authorization-view permission on even one application can read another application's plaintext API keys by supplying a foreign authorization UUID to /api/v1/app/authorization or its details route, and the exposure occurs regardless of the HideCredential setting. The flaw affects APIPark through 1.9.7-beta and is a genuine but moderate-severity authorization issue (CVSS 6.0, CWE-639) rather than an emergency: the attacker must already be authenticated with the required permission and must possess or guess another tenant's non-sequential UUID, which meaningfully limits opportunistic mass exploitation. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Server-side request forgery in Studio-Saelix Sencho up to 0.97.1 allows an authenticated user with node-management permission to supply a crafted URL to the Add Remote Node API endpoint, where the isValidRemoteUrl function in backend/src/utils/validation.ts fails to block server-side requests. Publicly available exploit code exists, and the CVSS 4.0 base score is 2.0; the independent assessment also rates this as a low-priority issue. Per the vendor, the issue demonstrates server-side request capability but not arbitrary internal response exfiltration, so confidentiality, integrity, and availability impact are limited.
Cleartext transmission in mcp-remote 0.8.0 through 0.14.3 allows unauthenticated on-path attackers to capture OAuth client secrets and issued access/refresh tokens when the device-code authorization flow uses non-loopback HTTP endpoints. Exploitation requires a man-in-the-middle network position and a victim actively initiating the device-code grant; no public exploit code exists, and the issue is rated medium severity (CVSS 4.0 base 6.0).
SQL injection (CWE-89) in Interuse i-Bos 3.0 lets unauthenticated remote attackers pass crafted input that is concatenated into SQL statements, potentially exposing database contents. The assessed vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N, base 5.9) shows confidentiality as the primary impact, with attack complexity rated High because reliable exploitation depends on a condition not fully under the attacker's control - characteristic of blind/inferential SQL injection, back-end-specific behavior, or a particular application state rather than a single deterministic request. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the report originates from Israel's INCD advisory stream.
Local MCP callers and prompt-injected model turns can bypass the password-manager denylist in Open Computer Use through 1.0.0 on macOS by supplying case-variant bundle identifiers such as 'com.1Password.1Password', letting them invoke get_app_state and action tools against a running password manager. Successful abuse reads accessibility trees, captures screenshots, and drives the unlocked interface of applications that the denylist was explicitly designed to shield, resulting in high confidentiality impact with limited integrity impact to the host. The attack is local-only, requires the agent to already hold macOS accessibility and screen-recording permissions, and requires the target password manager to be unlocked; no public exploit code or confirmed active exploitation was identified at time of analysis, and no vendor-released patch was identified at time of analysis.
Improper authentication in Studio-Saelix Sencho (through 0.94.1) lets remote unauthenticated attackers manipulate the X-Forwarded-For header on the /api/auth/login endpoint to rotate their apparent client address and defeat the per-IP failed-login rate limiter. Exploitation requires network reach to the login endpoint on an instance deployed without a correctly configured trusted-proxy boundary, which matches default/typical deployments; publicly available exploit code exists, though CISA KEV does not list this CVE and no confirmed in-the-wild exploitation has been reported. The weakness is a control bypass rather than a direct login bypass - the attacker must still brute-force or guess valid credentials - so its practical impact is medium severity (CVSS 4.0 base 5.5; assessed CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N), primarily enabling credential-stuffing and password-guessing at scale.
Unauthenticated SQL injection in Xinhu Rainrock RockOA through version 2.7.6 allows remote attackers to run attacker-controlled SQL against the application's backend database by manipulating the ID argument that reaches kqjcmdModel::returnchuli through the Openkqj Action endpoint at webmain/task/openapi/openkqjAction.php. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms a low-barrier network attack that needs no credentials, no user interaction, and no special preconditions, with impact bounded to partial confidentiality, integrity, and availability (base score 6.9); publicly available exploit code exists, and the vendor was contacted but did not respond, so no vendor-released patch has been identified at time of analysis. There is no CISA KEV confirmation of active exploitation, and risk is further shaped by the product's niche deployment and whether the openapi interface is actually exposed beyond a firewall.
Heap-based buffer overflow in Samsung rlottie (all versions at or before commit e57b094f03c39a751a1fded6f7d6c13f1ed95ec9) can crash an application that parses a crafted Lottie animation containing an embedded image asset with oversized dimensions, causing an undersized bitmap allocation followed by an out-of-bounds heap write. Exploitation requires local delivery and user interaction (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) - an unauthenticated local context, but the victim must actively open or render the malicious animation - and the impact is limited to availability (denial of service/crash), with no confidentiality or integrity effect assessed. No public exploit code identified at time of analysis, and no CISA KEV listing; EPSS score was not supplied in the available intelligence. Overall this is a genuine but modest-severity defect rather than an urgent priority.
System-wide denial of service can be triggered on Zephyr RTOS v4.4.0 or later builds for RISC-V Espressif SoCs (in-tree, the ESP32-C6 HPCORE) when CONFIG_USERSPACE is enabled: a local user-mode thread that has been granted the I2S device (PR:L) can issue a single i2s_trigger() call naming a direction the devicetree does not describe, causing a NULL pointer dereference in kernel mode (CWE-476). The impact is availability only-a NULL read with no attacker-controlled offset, no write primitive, and no information disclosure-but the default fatal-error handler halts the system, so an enabled user-mode thread can effect a system-wide denial of service. No public exploit code identified at time of analysis, and this is not confirmed actively exploited; real-world exposure is narrow because Xtensa Espressif targets do not support Zephyr userspace, ESP32-C5 does not select CONFIG_RISCV_PMP by default, and non-userspace builds can only pass the bad direction from trusted in-kernel code.
Path traversal in the Lippu Docx Reader / Office Viewer app up to version 1.4.5 on Android lets a remote, unauthenticated attacker influence file paths handled by the word.office.docxviewer.document.docx.reader.ViewTxt function by supplying a crafted '_display_name' value containing '../' sequences, potentially reading or altering files within the app sandbox. Exploitation is not autonomous: it requires the victim to open attacker-controlled document content (CVSS 4.0 UI:P, passive user interaction), and impact stays inside the application sandbox with no scope change, which is why our assessment rates this a medium-severity issue (CVSS 3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L, CVSS 4.0 base 5.3) and a low real-world priority. There is no public exploit identified at time of analysis and no confirmed active exploitation; no vendor-released patch for version 1.4.5 was identified at time of analysis.
Information disclosure in Postiz (gitroomhq/postiz-app) prior to v2.25.1 causes two API endpoints to return full database rows rather than the limited field sets clients require, exposing secrets to callers who should not receive them. The public API's channel-delete operation returns the deleted integration row including the channel's platform access and refresh tokens, so a third-party OAuth app holding delete permission can obtain social-platform credentials and act against the connected account outside Postiz, while GET /user/organizations returns each organization row - including the admin-only organization API key - to every member regardless of role, letting a low-privileged member call the public API on the organization's behalf. Exploitation requires a valid Postiz session, API key, or OAuth token already belonging to the target organization (authentication requirements: authenticated per the assessed vector CVSS:4.0/.../PR:L); there is no anonymous access and no cross-tenant exposure, no public exploit code was identified at time of analysis, and the flaw is fixed in v2.25.1, making this a genuine but moderate-severity disclosure rather than a top-priority emergency.
Blind server-side request forgery (SSRF) in LLMGateway through 1.20.0 allows authenticated API key holders to force webhook POST requests to arbitrary internal targets via the video-generation callback_url parameter, which bypasses the assertSafeWebhookTarget check. Attackers can reach loopback, private RFC1918, or cloud metadata endpoints (169.254.169.254) from the worker's network, potentially exposing internal services or cloud credentials, though the blind nature limits data exfiltration to side effects of the POST request. No public exploit code has been identified at time of analysis, and exploitation requires a valid API key and use of the video feature.
Authenticated users of Frappe HR (hrms) - including accounts holding no HR role whatsoever - can read other employees' net pay along with loan, advance, and expense-claim balances by calling the whitelisted get_account_and_amount method over /api/method. Affected releases are all 14.x and 15.x builds through 15.64.3, plus any pre-16.11.0 build; the endpoint ships whitelisted by default and requires no non-default configuration or user interaction, only a valid low-privileged session (CVSS 4.0 score 5.3, PR:L, confidentiality-only impact). Exploitation is a straightforward IDOR-style enumeration exercise because Salary Slip and claim document names are sequential and guessable, so an attacker can harvest amounts systematically; CISA KEV does not list this issue and no public exploit code has been confirmed, although a public technical writeup describing the payroll "amount oracle" is referenced in the advisory data, making the technique widely discoverable.
Authenticated low-privilege users of phpIPAM through 1.8.3 can read restricted subnet and address data via the customer, location, and NAT tool pages, which omit the Subnets::check_permission authorization check (CWE-862). This moderate-severity issue requires a valid low-privilege account (CVSS 4.0 5.3, PR:L) and enables read-only disclosure of IP addresses, CIDRs, hostnames, and MAC addresses from sections the user is not authorized to view; there is no unauthenticated path, no write or code execution impact, and no public exploit identified at time of analysis. A public technical writeup describing the cross-section address disclosure is referenced, but this is not a top-tier priority.
Authenticated non-admin users of SuiteCRM through 7.15.2 and 8.x through 8.10.2 can read other users' assigned roles and per-module ACL action matrix by supplying a different user's id in the record parameter of the DetailUserRole entry point. The flaw is a missing authorization check (CWE-862) with a CVSS v4.0 score of 5.3, rated medium severity because it only discloses confidentiality-impacting ACL configuration data and requires a valid low-privileged session. No public exploit code was identified at the time of analysis, and the issue affects standard installations without needing special configuration.
Workspace metadata and custom_instructions disclosure in Plastic Labs Honcho through 3.3.0 allows a holder of a peer- or session-scoped API key to read workspace-level configuration they should not be able to access. The flaw (CWE-863, incorrect authorization) is that get_or_create_workspace inspects only the workspace claim on the supplied token and never verifies the key's scope, so an attacker who knows the parent workspace name can submit it to POST /v3/workspaces and retrieve fields such as custom_instructions that are reserved for workspace or admin keys. Exploitation requires an already-valid low-privilege scoped credential and knowledge of the workspace name (CVSS 4.0 base 5.3, PR:L, read-only confidentiality impact); no public exploit code or confirmed active exploitation was identified at time of analysis, and no vendor-released patch is present in the available intelligence.
Authenticated server-side request forgery (CWE-918) in Miniflux 2.3.0 through 2.3.3 lets any logged-in user who can create or edit a feed set that feed's proxy_url to a loopback or internal host, defeating the FETCHER_ALLOW_PRIVATE_NETWORKS safeguard so the server itself probes internal ports and sends proxy-style requests to internal services. Impact is confined to low confidentiality disclosure - internal port probing and response/metadata leakage - with no integrity, availability, code-execution or denial-of-service component, and the prerequisite of a valid account means unauthenticated outsiders cannot trigger it; both the supplied CVSS v4.0 score (5.3) and the independent CVSS v3.1 assessment (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, also 5.3) agree on a moderate rating. Exploitation status is modest: no CISA KEV entry and no public exploit identified at time of analysis, although a public technical writeup of the bypass and the exact upstream source locations of the flawed logic are linked in the references; reported by VulnCheck, which published a matching advisory, and no EPSS data was supplied with this record.
An authorization bypass in LibreNMS through 26.9.1.1 lets a restricted user who has been granted access on at least one smokeping probe device view smokeping latency graphs for devices they are not authorized to see, including enumeration of device names. The flaw is in the smokeping graph authorization include, which validates the src probe device rather than the rendered target device, so requesting smokeping_in or smokeping_out with arbitrary device IDs succeeds. Exploitation requires an authenticated restricted account with probe access and a deployment using smokeping graphing; the impact is limited to read-only information disclosure with no integrity or availability effect, no public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV.
Decompression bomb uploads in OpenDocMan 2.4.0 through 2.10.0 let an authenticated user with document-upload permission crash PHP workers by submitting a small ODT, DOCX, or XLSX file whose compressed XML entries expand to hundreds of megabytes once the application runs its text-extraction routine. The CVSS 4.0 vector (AV:N/AC:L/PR:L/UI:N, VC:N/VI:N/VA:L) and the independent assessment agree the impact is limited to availability degradation rather than code execution or data disclosure, and exploitation requires a valid account - unauthenticated attackers cannot trigger it. No CISA KEV listing or public exploit code was identified at time of analysis, so this is a genuine low-to-moderate priority availability issue rather than an emergency.
Holders of scoped EdgeEver API tokens can exceed their granted permissions in versions through 1.108.0, because the Hono-based memo-template routes never call the requireScopes authorization check - allowing a token that explicitly lacks the write:memos scope to create memos via POST /api/v1/templates/:id/use and to list, modify, or delete templates in the token owner's workspace. The flaw is authenticated (CVSS vector PR:L) and limited in blast radius: exploitation is confined to the token owner's own workspace and produces only integrity impact, with no confidentiality disclosure or service-availability loss (assessed CVSS 3.1 base 5.3). No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; this is a genuine but moderate-severity authorization bypass rather than an emergency, since an attacker must first be issued a valid workspace-scoped token.
Authenticated console users in Combodo iTop 3.1.0 through 3.3.0 can bypass their profile grants to delete objects, clear external keys, and read object attributes they are not authorized to access by supplying arbitrary class and key parameters to the linkset delete, detach, and get-remote-object routes handled by LinkSetController.php. The flaw is a CWE-862 missing authorization issue rated moderate (CVSS 3.1: 5.3, AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L), and the independent assessment confirms it is gated behind a valid console account rather than being an anonymous or portal-only attack. No public exploit code has been identified at time of analysis, and there is no CISA KEV confirmation of active exploitation.
Missing authorization in Frappe HR (hrms) lets any authenticated user - including ordinary employees with no HR role - zero out another employee's leave allocation by POSTing the target Leave Allocation record name to the whitelisted expire_allocation method, silently wiping that employee's remaining leave balance. The flaw affects all 14.x and 15.x releases through 15.64.3 and every build before 16.11.0, is exploitable in the default configuration with only a low-privileged session and no victim interaction, and is confined to data integrity (no confidentiality or availability impact). No public exploit identified at time of analysis, and a vendor-released patch (16.11.0) is available, so this is best treated as a medium-severity, insider-oriented data-integrity issue rather than a mass-exploitation emergency.
Missing authorization in SuiteCRM through 7.15.2 and 8.x through 8.10.2 allows authenticated low-privileged users to create and modify EmailMarketing records via the setCampaignMarketingAndTemplate entry point, despite lacking Campaigns module access. Attackers can POST marketingId, campaignId, and templateId to reattach marketing messages or swap the email template sent by EmailMan in campaign emails, resulting in low integrity impact. No public exploit has been identified at time of analysis, and exploitation requires a valid session and active campaign email functionality.
SQL injection in JeeWMS up to and including 3.7 lets an authenticated remote user inject arbitrary HQL through the 'searchVal' parameter of the getTreeData function in JeecgFormDemoController.java, allowing manipulation of the underlying database query. Exploitation requires a valid application session with access to the Autocomplete Data Handler endpoint, which resides in a demo/sample controller (com.jeecg.demo) that may not be exposed in every deployment, so this is a moderate, authentication-gated issue rather than an emergency; no public exploit code has been identified at time of analysis and no EPSS score was provided. The upstream project has published a fix in commit 6e29bd57972a499e9c8a81a2dbe94d0d5cf23af0 (PR #4), which switches the vulnerable string concatenation to a parameterized query.
Authenticated Frappe CRM users can read linked-document details for records they are not permitted to view, because the API method crm.api.doc.get_linked_docs_of_document in versions 1.49.0 through 1.87.0 resolves leads, deals, comments, and users by name without applying Frappe's permission checks. By supplying the name of a document they cannot legitimately access, any logged-in account - even a low-trust or self-service one - can extract linked call-log phone numbers, deal organization names, and mention notification text. The flaw is a genuine but modest information-disclosure issue (CVSS 5.3), limited to read-only metadata with no write, modification, or denial-of-service impact; no public exploit was identified at time of analysis and there is no confirmed active exploitation (CISA KEV).
Missing authorization checks in Raven (Frappe-based team chat) 2.0.0 through 3.0.0 allow any authenticated user to read Public channel message history and Open/Public channel file metadata from workspaces they do not belong to, by calling the legacy get_messages_with_dates and get_all_files_shared_in_channel methods with predictable or guessed channel IDs. The CVSS 4.0 vector (PR:L, VC:L) confirms this is an authenticated, read-only confidentiality exposure with no integrity or availability impact, and our independent assessment rates it a genuinely medium/low-priority issue rather than a high-severity one. No public exploit code was identified at time of analysis and no KEV listing applies.
Authenticated low-privileged users can bypass authorization checks in GLPI through 12.0.0 via the ajax/map.php endpoint, disclosing match counts, titles, and coordinates of itemtypes such as Contact, Supplier, Contract, and Budget within their entities. This missing authorization (CWE-862) is a low-severity information-disclosure issue, as per our independent assessment; no public exploit has been identified at time of analysis, and the CVSS 3.1 vector indicates limited confidentiality impact (C:L) with no integrity or availability impact. Affected users must be authenticated with at least low privileges (PR:L) and network access to the endpoint.
Field-level access control bypass in Odoo MCP (erpipe-org/mcp-odoo) versions 1.0.0 through 1.3.2 allows an attacker holding a valid, low-privileged MCP client session to read restricted Odoo field values by invoking the execute_method tool and calling the read or search_read ORM methods directly against named denied fields. Exploitation is confidentiality-only, with no integrity or availability impact, and requires authenticated access - the execute_method tool must be exposed and the caller must know or guess the restricted field names; a prompt-injected LLM agent with tool-calling access is an additional attack path. No public exploit code was identified at time of analysis, and the CVSS 4.0 base score of 5.3 reflects a moderate-priority disclosure rather than an emergency, consistent with EPSS-style low-to-moderate risk and no confirmed active exploitation.
Authenticated, enabled users of UnicomAI Wanwu (also tracked as unicomai/wanwu) before version 0.6.3 can revoke other organizations' legacy AppKeys through a broken object-level authorization flaw in the DELETE /v1/appspace/app/key endpoint. Because the handler authorizes deletion solely on the client-supplied numeric apiId and never validates that the caller's userId or orgId owns the key, a low-privileged account can iterate sequential key IDs and invalidate AppKeys tenant-wide, silently breaking MCP and OpenAPI integrations until each owner manually issues replacements. This is a genuine but moderate-priority authorization issue (CWE-639) rather than a critical one: it requires a valid account (PR:L per the CVSS vector), discloses no data, and is limited to integrity/availability impact, and no public exploit code or confirmed active exploitation was identified at time of analysis. Patches are available.
Missing authorization in Frappe Raven 2.0.0 through 3.0.0 lets an authenticated user with the Raven User role join Public workspaces that are configured as invite-only, because the can_only_join_via_invite setting is not enforced by the join_workspace API. The practical consequence is unauthorized persistent membership in those workspaces, allowing the attacker to read and post messages in the associated Public and Open channels, but not to reach private data or administrative functions. Exploitation requires a valid authenticated account and a target that is specifically a Public workspace with invite-only enabled; no public exploit code has been identified at time of analysis, and EPSS/KEV signals are absent, so this rates as a medium-severity, low-to-moderate real-world risk.
Any authenticated CoreShop customer can tamper with other customers' orders in versions through 1.5.5, because the OrderController's OrderConfirm and SendReship actions trust client-supplied order and reship identifiers instead of verifying that the caller owns the order. Omitting the data field in OrderConfirm allows the attacker to mark a victim's order as received, while supplying another customer's reshipId to SendReship overwrites that customer's return-tracking details - an integrity-only impact with no confidentiality or availability loss (assessed CVSS 3.1 5.3, PR:L). Exploitation requires an ordinary registered storefront account rather than elevated privileges, and no public exploit code has been identified at time of analysis; the CVE is not listed in CISA KEV.
Missing authorization in UnicomAI Wanwu through 0.6.5 lets any authenticated, enabled user revoke other users' AppKeys by submitting a target appId and appType - values obtainable from the exploration marketplace - to the unpublish endpoint, which then deletes api_key rows belonging to other users across organizations and cuts off their MCP and OpenAPI client access. Exploitation requires a valid enabled account on the platform (CVSS PR:L, so authenticated, not unauthenticated) and a multi-tenant deployment where other users' or organizations' apps exist to target; the impact is confined to credential revocation (integrity/availability of API access), not data disclosure. Scored 5.3 under CVSS 4.0 with the independent assessment landing at CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L, this is a genuine but moderate-severity access-control flaw; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Missing authorization in the Telegram router of Abilityai Trinity (through version 0.9.5) lets an agent-scoped MCP API key invoke binding operations that are intended to be human-only, including sending messages through the owner's bot token, replacing the Telegram binding with an attacker-controlled token, or deleting the binding outright. An attacker must first gain control of an agent holding a valid agent-scoped MCP key - typically achieved through prompt injection - so this is an authenticated (PR:L) issue rather than a pre-auth one, and impact is bounded to manipulation of the Telegram messaging binding rather than host compromise. No public exploit code or confirmed active exploitation was identified at time of analysis, and the independent assessment rates this as a genuine but moderate-priority authorization flaw rather than a high-severity item.
Missing authorization in CoreShop through 2026.2.2 lets authenticated Pimcore backend users who lack the relevant resource grants enumerate restricted commerce configuration - payment providers, carriers, price rules, stores, and tax rules - including their IDs, names, and identifiers. The flaw lives in ResourceController::listAction, which omits the isGrantedOr403() check that sibling actions enforce, so any valid low-privileged backend account can reach the auto-generated list routes. Impact is confined to read-only information disclosure (no create/update/delete and no secret exposure indicated), and no public exploit code or confirmed active exploitation was identified at time of analysis.
Missing authorization in the CloudBeaver web database manager (versions through 25.3.5) lets any authenticated member of a shared project - including users granted view-only access - persist attacker-supplied credentials onto a shared connection without holding datasource-edit permission. The initConnection GraphQL mutation accepts the saveCredentials and sharedCredentials flags together with attacker-chosen authProperties, so other users who later open that shared connection authenticate to the underlying database under the attacker's identity rather than their own. Exploitation requires a valid low-privilege account (authenticated, CVSS PR:L), a multi-user deployment that actually uses the shared-projects/team collaboration feature, and at least one subsequent victim connecting to the tampered connection; no public exploit code has been identified at time of analysis.
Cheshire Cat AI core through 2.0.23 is affected by a stored cross-site scripting vulnerability in its uploads plugin, which allows any authenticated user to upload HTML files via POST /uploads without type restrictions. A signed-in victim who opens a crafted GET /uploads/{path} link executes attacker-controlled script in the application's origin, potentially exposing the access_token cookie and enabling session hijacking, with administrators at highest risk. The issue requires victim interaction and a valid account; no public exploit code or active exploitation (CISA KEV) has been identified, and the overall risk is assessed as moderate (CVSS 5.1).