An out-of-bounds read in the Open Asset Import Library (Assimp) through version 6.0.5 is reachable through the PLY file handler, specifically in IOStreamBuffer::getNextBlock, when an application imports a crafted PLY model file. Affected deployments are any application, service, or pipeline that converts or previews PLY assets with Assimp; the practical impact is limited to disclosure of adjacent memory contents and/or a denial-of-service crash, with no evidence of code execution. Exploitation requires passive user interaction (someone must open or cause the file to be parsed) and no public exploit code has been identified at time of analysis; the vendor was contacted about the disclosure but did not respond, so no vendor-released patch is identified at time of analysis.
Predictable TCP initial sequence numbers in Zephyr RTOS allow off-path attackers to defeat RFC 6528 spoofing protection and perform blind TCP connection spoofing, data injection, or connection resets, but only on devices where the cryptographic random source fails exactly when the ISN secret key is first generated at boot. The flaw is a discarded return value from sys_csrand_get() that latches the 'key already generated' guard even on failure, leaving a 128-bit secret as all zeros for the entire boot; exploitation additionally requires the attacker to observe at least one ISN off-path and the spoofed peer to trust source addresses, and no public exploit was identified at time of analysis. The assessed vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N (4.8), reflecting an unauthenticated remote issue whose high attack complexity and conditional preconditions keep it moderate rather than critical, and the signals converge on a conditional, moderate-severity issue rather than a top priority.
Improper link resolution in the MoAI-ADK `moai init` template deployer (all versions through 3.1.2) lets a malicious repository redirect the tool's atomic file write so that it truncates and overwrites files outside the project directory. The deployer stages template content at a path formed by appending a `.moai-tmp` suffix to the destination and does not verify that this staging path is a regular file rather than a symlink, so an attacker who commits a path such as `.claude/settings.json.moai-tmp` pointing elsewhere on disk can cause the write to follow the link when a developer runs `moai init` against the repository. Exploitation is local and requires the victim to clone, trust, and execute the deployer on attacker-controlled content (CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P, assessed as CVSS:3.1/AV:L/AC:L/PR:N/UI:R); no authentication to the tool is required, impact is bounded to files the victim user can already write, and no public exploit code was identified at time of analysis.
Cleartext logging in Hugging Face Text Embeddings Inference through 1.9.4 exposes the configured api_key because the router's Args struct lacks a redact attribute for that field. Attackers who already have read access to router startup logs, container output, or OTLP telemetry can recover the Bearer token and use it to call protected embedding and rerank endpoints. This is a modest-severity, local information-disclosure issue (CWE-532) with no direct integrity or availability impact; no public exploit code or confirmed active exploitation is identified at time of analysis.
Cleartext logging in GPT-Load through 1.4.11 exposes client proxy keys for Gemini-style requests, because the Gin Logger middleware records the raw query string before extractAuthKey strips the key parameter. Anyone able to read the console/stdout stream or the on-disk ./data/logs/app.log - an operator, a log-pipeline consumer, or a host-level intruder with low-privileged local access (PR:L) - can recover those keys and replay them against the corresponding group. The assessed impact is confidentiality-only and low (CVSS 4.8; assessed CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), exploitation requires default access logging to be active and keys to be sent in the query string rather than headers, and no public exploit identified at time of analysis.
Missing authorization in the phpMyFAQ MCP server's faq_search tool allows an authenticated MCP client to read the full question-and-answer text of active FAQs that are restricted to specific users or groups, because the underlying Search::searchDatabase() routine never applies the per-user or per-group permission checks that normally govern FAQ visibility. The flaw affects phpMyFAQ through 4.1.10 and is limited to confidentiality: exploitation requires that the optional MCP server feature is deployed and reachable and that the attacker can connect to phpmyfaq:mcp:server with at least low-privilege access (CVSS PR:L, local attack vector), so this is a modest-priority issue rather than a high-urgency flaw. No public exploit identified at time of analysis and no vendor-released patch identified at time of analysis; the issue is tracked under CWE-862 (Missing Authorization).
An out-of-bounds memory read in the Zephyr RTOS zbus proxy agent IPC backend allows a peer domain that already controls its own firmware - typically a second core on the same SoC - to leak a small amount of adjacent memory into the receiving domain's log output. The flaw is a non-NUL-terminated channel_name[] array being printed with a plain %s conversion on the frame-rejection error path; it is only reachable when CONFIG_ZBUS_PROXY_AGENT_IPC is built and logging is at warning level or higher (the default). Impact is bounded to limited information disclosure (CVSS 3.4, AV:L/PR:H, C:L/A:L) and a possible fatal fault if the scan leaves a mapped region; there is no public exploit identified at time of analysis and no confirmed active exploitation.
Symlink-following file writes in thClaws through 0.141.0 let an attacker who can pre-plant a symbolic link under the permitted inputs/ prefix redirect a later authenticated upload to the v1 API POST /v1/inputs endpoint, causing the post_inputs handler to write or truncate files outside the workspace with daemon privileges. Exploitation requires two preconditions in sequence - the staged symlink plus a real authenticated upload targeting that path - so a single remote request cannot trigger it, and the resulting impact is confined to file integrity and availability with no confidentiality disclosure. All available signals rate this as a low-priority issue and are mutually consistent: the vendor records CVSS 2.3, our independent assessment is CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:L, and no public exploit code was identified at time of analysis.
JupyterHub deployments through 6.0.1 that run in multi-user mode with the named-server feature enabled allow an authenticated low-privilege user to hijack the OAuth client identity of another user's named server by registering a hyphenated username that collides with the victim's client identifier (for example, an attacker named 'alice-prod' overwrites the client used by user 'alice' for server 'prod'). The overwrite breaks the victim's OAuth login flow and revokes their tokens when the attacker stops their own server, producing a targeted, account-level denial of service rather than a broad compromise; it requires the attacker to hold an authenticated account whose name they can control and to know the victim/target server combination in advance. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor-assigned CVSS 4.0 base score is 2.3, consistent with an independent assessment of LOW severity.
Stored cross-site scripting in open-computer-use through commit 610bac8 lets an attacker who controls content the agent observes (such as a web page or run_command output) inject script into the generated log.html, which then executes when a human operator opens the log and can exfiltrate transcript contents. Exploitation requires both attacker-controlled sandbox content and operator interaction, so this is a low-priority issue (CVSS 2.3, CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N) rather than a directly exploitable server-side compromise; no public exploit identified at time of analysis.
Authorization bypass in UnicomAI Wanwu through 0.6.5 allows any authenticated user to mint an AppKey bound to another user's MCP server by POSTing that victim's MCP server UUID with appType=mcpserver to /v1/appspace/app/key, after which the attacker can open MCP sessions and invoke the victim server's tools under the victim's upstream credentials. The attack is remote with no user interaction, but is gated by valid account credentials (PR:L) and prior knowledge of the target MCP server UUID, which is why the assessed vector carries AC:H and only low confidentiality and integrity impact (C:L/I:L, no availability impact). No public exploit code or confirmed active exploitation was identified at time of analysis, and the overall risk is low-priority per both the CVSS 4.0 base score of 2.3 and the independent CVSS 3.1 assessment of AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N.
Authorization bypass in Lightdash through 2.556.0 allows any authenticated organization member to delete another user's personal access token by supplying that token's UUID to the personal-access-tokens DELETE route, which performs no ownership or organization check - the deletion also succeeds across organization boundaries in multi-tenant or hosted deployments. Impact is limited to revoking the victim's token and breaking the API integrations that depend on it (a denial-of-service against integrations); there is no data disclosure, privilege escalation, or code execution. Exploitation requires an authenticated account with at least organization-member privileges and knowledge of the victim's PAT UUID, which is not practically enumerable and is the primary limiting factor; no public exploit code identified at time of analysis, though a third-party technical writeup of the flaw is referenced, and both the supplied CVSS 4.0 score (2.3) and the independently assessed CVSS 3.1 vector rate this as a low-severity issue.
Information disclosure in CloudBeaver through 25.3.5 allows an authenticated remote web session holder to read other users' exported LOB files from the shared LOB-export folder served by WebSQLResultServlet. Exploitation is practically constrained: the attacker must already have a valid session, know or guess the victim's table and column names, and enumerate second-resolution timestamps to reconstruct valid export filenames, and the impact is limited to confidentiality. No public exploit has been identified at time of analysis, and the assessed vector plus these prerequisites indicate genuinely low real-world risk, with the greatest concern in multi-tenant instances shared by untrusted users.
Shepherd (shepherd-ai) through 0.3.1 contains a DNS-rebinding bypass of the citation-checker's public_url SSRF guard, letting an attacker who controls authoritative DNS for a reference URL planted in a checked document redirect the outbound fetch to internal HTTP(S) services and capture the responses inside evidence files. Exploitation requires the shepherd_citation_checker extra to be in use and a victim to actually run a citation check on the attacker-influenced document, then win a time-of-check/time-of-use race in which the guard validates a public IP but the connection re-resolves the hostname to an internal address; no public exploit identified at time of analysis. Impact is read-only information disclosure (low confidentiality, no integrity or availability effect), consistent with the low CVSS 4.0 base score of 2.3 and the assessed CVSS 3.1 vector AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N, and the attacker does not need credentials but does need user interaction and DNS control.
Cross-tenant workflow hijacking in iFlytek Astron Agent through 1.1.2 lets an authenticated application on a shared deployment inject content into another tenant's paused workflow and read its continuation output stream by supplying the victim's event_id to POST /workflow/v1/resume. Exploitation requires a valid authenticated application identity (PR:L in the assessed vector) plus a victim workflow that is currently paused awaiting resume; the enabling weakness is that event_id values are time-ordered Snowflake identifiers that are predictable rather than cryptographically random. Severity is genuinely low (assessed CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N), there is no CISA KEV entry, no public exploit identified at time of analysis, and the cross-tenant impact disappears entirely on single-tenant or otherwise isolated deployments.
Traccar 5.7 through 6.16.0 can log a victim into an attacker-controlled account via a cross-site request forgery flaw in its OpenID Connect callback, causing data the victim enters, such as registered devices, to be stored in the attacker's account. Exploitation requires the non-default OIDC/OAuth SSO configuration plus user interaction, with the supplied CVSS 4.0 score of 2.3 and the independent assessment CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N both indicating low impact. No public exploit identified at time of analysis; this is not an account takeover of the victim and does not permit code execution or availability impact.
An authenticated user with low privileges on an InstantCMS 2 (icms2) installation running version 2.18.2 or earlier can manipulate the 'size' argument passed to the image handler's file-deletion routine, using path-traversal sequences to delete files outside the intended upload directory. Impact is limited to availability and, to a lesser degree, integrity of files on the server - there is no confidentiality gain per the assessed vector - but deletions can break the site or remove stored content. Publicly available exploit code exists for this issue, and while it is not confirmed as actively exploited (no CISA KEV listing), the vendor has published a fix commit, so unpatched instances should be prioritized for update. EPSS data was not provided for this CVE.
SQL injection in erzhongxmu JEEWMS (warehouse management system) through 2026.09.27-W39 lets an authenticated remote user inject arbitrary SQL via the 'searchstr' argument of the notice search endpoint handled by WvNoticeController.list. Publicly available exploit code exists, and the maintainer was contacted early but did not respond, so no vendor-supplied fix has been published; there is no indication of confirmed active exploitation (no CISA KEV entry). Impact is bounded by the privileges of the application's database account (Low confidentiality, integrity, and availability), and exploitation requires a valid low-privileged session (CVSS PR:L).
SQL injection in erzhongxmu JEEWMS (versions up to 2026.09.27-W39) allows an authenticated remote attacker to inject arbitrary SQL through the binstore, binid, des, or cengshu parameters handled by the getbinall and getbinallagv functions of MdBinController.java, potentially reading or altering database content. The CVSS v4.0 base score is 5.3 (assessed as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L), reflecting low-level confidentiality, integrity, and availability impact rather than full database takeover. A public exploit has been published and may be used, but there is no KEV confirmation of active exploitation; the vendor was contacted and did not respond, so no official fix is documented. Because exploitation requires a valid low-privileged JEEWMS session (PR:L in the assessed vector), risk is concentrated in deployments where the warehouse management interface is network-reachable and credentials are shared or weakly managed.
SQL injection in Furion .NET Framework up to 4.9.9.92 allows an authenticated low-privilege attacker to manipulate the 'Name' argument processed by String.Replace in framework/Furion/Templates/Extensions/StringRenderExtensions.cs, potentially altering database queries. Publicly available exploit code exists, and the vendor was contacted but did not respond, so no official patch has been released. Network exploitation requires a valid low-privilege session (CVSS 4.0 score 5.3, E:P); no CISA KEV active exploitation is indicated.
Crafted ABC Music Format files cause uncontrolled resource consumption in libmodplug up to and including 0.8.9.1, where the abc_add_gchord() routine in src/load_abc.cpp can be driven into excessive CPU/memory use, resulting in a denial-of-service condition (crash or hang) of the hosting application. The issue is remotely triggerable but not self-triggering: per the assessed vector (UI:P/UI:R), an attacker must get a victim or an ingesting application to open the malicious .abc file, and impact is limited to availability (VA:L) with no code execution or data disclosure. Publicly available exploit code exists (CVSS 4.0 E:P proof-of-concept maturity), but there is no confirmed active exploitation (CISA KEV) and no EPSS signal was supplied; the vendor was contacted early but did not respond, so no fixed version is confirmed.
An authenticated authorization bypass (IDOR) in BerriAI LiteLLM up to and including 1.95.0 allows a low-privileged user holding any valid proxy API key to read spend and usage logs belonging to other users, keys, or teams by supplying a foreign session_id to the Spend Tracking UI endpoint ui_view_session_spend_logs. Exploitation requires a valid credential (CVSS PR:L) but no user interaction, and the impact is limited to confidentiality - an attacker can view another tenant's token counts and cost data but cannot modify records or disrupt service. Publicly available exploit code exists (the CVSS 4.0 vector carries E:P and VulDB reports a published exploit), but there is no confirmed active exploitation (CISA KEV); the realistic risk is materially higher in multi-tenant or shared-proxy deployments where tenant isolation matters, and low in single-tenant or trusted-internal installations. Vendor-released patch: v1.96.0.
SQL injection in highwarden Super Store Finder 3.8 and earlier allows an attacker who can reach the /products/superstorefinder/index.php endpoint and holds low-level application privileges to inject arbitrary SQL through the lat and lng request parameters, giving limited read and write access to the backend database. Publicly available exploit code exists, but the flaw is not listed in CISA KEV, so it is not confirmed as actively exploited; the vendor has already shipped version 3.9 to fix it. With a CVSS 4.0 base score of 5.3 and only low confidentiality, integrity and availability impact, this is a moderate, not high-priority, issue whose real-world reach is constrained by the authentication prerequisite and the product's limited deployment footprint.
Server-side template injection in Furion .NET Framework up to and including 4.9.9.95 allows an authenticated, low-privileged user to have attacker-supplied template expressions evaluated by the ViewEngine.RunCompile routine, potentially disclosing or tampering with data rendered through the view engine. The flaw is rated moderate (CVSS 4.0 base 5.3; independent assessment CVSS 3.1 5.3, AV:N/AC:L/PR:L/UI:N, C:L/I:L/A:L) and is only reachable where a deployed application routes user-influenced content into RunCompile. Publicly available exploit code exists, and no CISA KEV entry confirms active exploitation.
Server-side request forgery in Casdoor's CAS proxy-validation handler (CasP3ProxyValidate in controllers/cas.go) lets a low-privilege authenticated user who already holds a valid CAS service ticket supply a crafted pgtUrl callback value and make the Casdoor server issue outbound HTTP requests to an arbitrary destination of the attacker's choosing. Only deployments that expose the CAS protocol endpoints and use CAS proxy authentication in versions up to 3.164.0 and 4.10.0 are affected, and because the pre-patch code fetches the attacker-supplied URL with http.DefaultClient.Do without destination validation, redirect restrictions, or a timeout, the practical impact is a blind or limited SSRF (some confidentiality exposure, no integrity or availability impact) rather than full compromise of internal services. Publicly available exploit code exists, but there is no confirmed active exploitation (no CISA KEV listing), and the assessed severity is genuinely low, so this is a low-priority hardening item for CAS-enabled Casdoor instances rather than an emergency patch; upgrading to 4.11.0 resolves it.
Improper authorization in BerriAI LiteLLM through version 1.94.0 allows an authenticated low-privilege user to manipulate the api_key argument handled by get_secret() in secret_managers/main.py (Secret Resolution component), causing secrets to be resolved for credentials the caller should not be able to reference. Exploitation requires an authenticated account on a deployment that exposes LiteLLM's secret-resolution path to non-trusted users (multi-tenant proxy setups); confidentiality, integrity, and availability impact is assessed as low, and single-user or trusted-operator installations face negligible exposure. Publicly available exploit code exists, but no CISA KEV entry confirms active exploitation, and the vendor did not respond to the disclosure, so no fixed version has been confirmed.
Insufficient authenticity verification in the PayPal billing handler of InstantSoft icms2 (version 2.18.2 and earlier) lets an authenticated remote user forge a PayPal order by manipulating the 'bid' and 'sig' arguments, causing the application to accept payment notifications it should have rejected. Exploitation requires the Billing Module to be enabled with PayPal configured as a payment method and a low-privileged account able to start a billing/PayPal order; the impact is limited to integrity (fraudulent order acceptance) with no confidentiality or availability effect. Publicly available exploit code exists (the disclosed CVSS 4.0 vector carries E:P), and the vendor was contacted but did not respond, so no vendor-released patch is identified at time of analysis; the flaw is not confirmed actively exploited (CISA KEV).
SQL injection in the erzhongxmu JEEWMS warehouse management system (versions up to 2026.09.27-W39) allows an authenticated user to inject arbitrary SQL through the 'searchstr' argument processed by the WvGiController.list endpoint, enabling unauthorized reads of database contents and potentially modification or deletion of records. Both the supplied CVSS 4.0 vector (PR:L, E:P) and our independent assessment require a valid low-privilege session before the payload can be delivered, which keeps the rating moderate (CVSS 4.0 base 5.3) and bounds realistic exploitation to insiders or attackers who have already acquired credentials rather than anonymous internet-wide attacks. Publicly available exploit code exists, and the vendor was contacted about the disclosure but did not respond, so no official fix has been published at time of analysis.
SQL injection in erzhongxmu JEEWMS (versions up to 2026.09.27-W39) lets an authenticated attacker who supplies a crafted 'goodscode' argument to the docheck handler in WmOmNoticeHController.java manipulate the underlying SQL query. The CVSS v4.0 score is only 2.1 (Low) and our independent re-scoring lands at CVSS 3.1 5.4 (Medium) because exploitation requires a valid low-privileged session (PR:L), yields limited confidentiality and integrity impact, and is confined to one parameter of one controller. Exploit code is publicly available, but there is no CISA KEV entry and no evidence of active exploitation; the vendor was contacted and did not respond, so no official patch is identified. Overall this should be treated as a low-priority hardening item rather than an urgent exposure.
Cross-site scripting in Deep Chat through 2.5.1 enables remote attackers to inject javascript: links into AI responses, addMessage content, or loaded history because the embedded Remarkable markdown renderer disables link scheme validation; victims must click the crafted link for script execution in the embedding page. The flaw requires the attacker to first place malicious Markdown into the chat stream-typically via control over the AI backend, supplied history, or a reflection path-and no authentication is needed, though user interaction is decisive. This is a genuinely low-priority issue despite being a real XSS flaw, and no public exploit code was identified at time of analysis.
Stored cross-site scripting in InstantCMS 2 (icms2) up to 2.18.2 lets an authenticated low-privilege user inject script through the user 'nickname' field, which is rendered unescaped into the title attribute of contact links in the Private Message Handler templates (templates/default and templates/modern, controllers/messages/index.tpl.php). When a victim views the private-message contact list, the injected markup executes in their browser session, which can lead to session or content manipulation within the CMS, and because the payload is stored on the profile it can trigger whenever a contact list is rendered. An exploit has been disclosed publicly and may be used, but the issue is not confirmed as actively exploited (no CISA KEV listing); the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) reflects a moderate, interaction-dependent risk rather than an urgent remote-code-execution-class flaw.
Symlink-following path handling in the answer-me-with-html `am` CLI (through version 0.5.0) causes `am render` to embed files from outside the repository checkout - potentially SSH keys, config files or other data readable by the victim's process - into the generated HTML, which then leaks them if that output is shared or published. The attack is narrow: an attacker must deliver a crafted repository (local vector, AT:P), the victim must deliberately render it (passive user interaction), and the targeted file must be readable by the victim's process, which is why the CVSS 4.0 base score is only 2.0 (AV:L/AC:L/AT:P/PR:N/UI:P, confidentiality low, no integrity or availability impact). No public exploit code and no confirmed active exploitation were identified at time of analysis; the CVSS vector carries PR:N, so no authentication is required, and our independent assessment rates this as a low-priority, low-real-risk issue despite being a genuine vulnerability.