OS command injection in the Agno agent framework's CodingTools.run_shell helper (versions up to and including 3.0.9) lets an authenticated caller who can influence the tool's `command` argument execute arbitrary shell commands on the host running the agent. The weakness is a bypass of the `restrict_to_base_dir` allowlist and metacharacter block rather than an absence of one: allowlisted interpreters such as python, pip and git can be invoked with inline-code options (for example `python -c`) to run arbitrary code, so the restriction only reduces accidental damage and is explicitly documented as 'not a security sandbox'. Publicly available exploit code exists, but the practical risk is LOW: exploitation requires run_shell to be enabled (it was on by default through 3.0.9 and is off by default from 3.0.10), an agent wired to accept untrusted input, and the affected CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L, with the vendor-supplied CVSS 4.0 score of 2.0 consistent with that low assessment. There is no indication of confirmed active exploitation (not in CISA KEV), and a vendor patch is available - upgrade to 3.0.10.
Cross-site request attacks can reach the terminal-spawn handler in BlackBeltTechnology pi-agent-dashboard 0.8.0 and earlier, letting a malicious web page open a WebSocket or blind-POST to the loopback service and invoke terminalManager.spawn with an attacker-chosen working directory, because pre-patch builds enforce no Origin-based authorization gate on the WebSocket upgrade or on /api/* mutation routes. Exploitation is unauthenticated from the network's perspective but requires the victim to have the dashboard running and to visit an attacker-controlled page in the same browser, making user interaction mandatory; publicly available exploit code exists (disclosed via VulDB and a linked public drive folder), but there is no CISA KEV listing and no confirmed active exploitation, and our assessment rates this a genuinely low-priority issue despite remote reachability given the loopback binding, mandatory interaction, and only low confidentiality/integrity/availability impact.
Agno's Team Delegation Feature runs member agents without a confirmation gate, allowing an actor who can influence delegated task content to cause team agents to execute actions with unnecessary, unscoped privileges. The flaw resides in the delegate_task_to_member / delegate_task_to_members tooling in libs/agno/agno/team/_default_tools.py and affects agno versions up to 3.0.6 and 3.1.1. Publicly available exploit code exists (no CISA KEV listing), and the upstream fix - PR #10124, which sets delegate_func.requires_confirmation = True - still awaits acceptance, so no released patched version is independently confirmed.
SQL injection in Tencent WeKnora through version 0.8.1 allows an authenticated, low-privileged remote attacker to bypass the platform's own SQL Validator by crafting a malicious subquery that is mishandled by the validateSubquery function in internal/utils/inject.go, manipulating backend database queries. Publicly available exploit code exists, including a proof-of-concept write-up and a public gist, so exploitation is practical for anyone with valid credentials, though the assessed impact is limited to Low confidentiality, integrity, and availability per the vendor vector; no confirmed active exploitation (CISA KEV) has been recorded. The issue carries a very low CVSS 4.0 base score of 2.1 and is a low-priority issue despite being a remotely reachable SQL injection (CWE-89).
SQL injection in DataEase up to and including 3.0.0 allows an authenticated low-privilege user - or the holder of a valid share-link identity - to inject SQL through a crafted calculated-field expression that is concatenated into a query by Utils.buildCalcField (io/dataease/engine/utils/Utils.java). Because a valid identity is required (CVSS PR:L), the assessed impact is limited to low confidentiality, integrity, and availability loss rather than full database takeover, and publicly available exploit code exists for this flaw. There is no indication that it is confirmed actively exploited (no CISA KEV listing), so it should be treated as a moderate-priority issue rather than an emergency.
Improper privilege management in RuoYi up to 4.8.3 allows an authenticated low-privileged attacker to modify role authorization data via the roleKey parameter at the /system/role/authDataScope endpoint, enabling privilege escalation within the management console. Publicly available exploit code exists, and the vendor did not respond to disclosure; no vendor-released patch has been identified at time of analysis. The vulnerability has a CVSS 4.0 base score of 5.3 (medium) with low integrity and availability impact and no confidentiality impact.
Authenticated path traversal in the Template Management component of westboy CicadasCMS (versions up to commit 2431154dac8d0735e04f1fd2a3c3556668fc8dab) allows a low-privileged user to manipulate the filePath argument sent to /system/cms/template/input so that the underlying TemplateController.input handler resolves paths outside the intended template directory, exposing files that should not be readable. Exploitation requires a valid low-privileged session (CVSS PR:L) and is limited to confidentiality impact - there is no write or code-execution primitive - so this is a moderate, not high-priority issue despite being remotely reachable. Publicly available exploit code exists (a proof-of-concept is published on GitHub and linked from the VulDB advisory), and the vendor was contacted early but did not respond, so no vendor-released patch has been identified at time of analysis.
Improper access control in 1024-lab SmartAdmin 3.30.0 and earlier lets any authenticated low-privilege user read configuration values they should not see by manipulating the configKey argument of the /support/config/queryByKey endpoint. The endpoint is remotely reachable and publicly available exploit code exists (a GitHub issue containing the proof of concept), but the flaw is not listed in CISA KEV and the project has not responded to the report. With a CVSS 4.0 base score of 5.3 and only low confidentiality/integrity/availability impact, this is a genuine but modest-priority issue rather than a top-tier emergency.
Code injection in the PythonTools component of Agno (agno-agi/agno) through version 3.0.6 lets an attacker who can influence the 'code' argument of run_python_code execute arbitrary Python in the host process. The CVSS v4.0 vector supplied with the record is low (2.1, PR:L), and our independent assessment confirms that a low-privilege foothold is required - realistic paths are an authorized-but-malicious user of an agent that has PythonTools enabled, or indirect prompt injection steering the model into calling the tool with attacker-chosen code; PythonTools is an optional agent tool rather than a default network-exposed endpoint. Publicly available exploit code exists (a third-party advisory and PoC repository are linked), and the vendor was notified via a GitHub issue but has not responded, so no vendor patch is confirmed; despite the RCE framing, the signals point to a low real-world priority.
Insufficient session expiration in MacroZheng Mall through 1.0.3 allows an attacker who already holds a valid low-privilege JWT for a disabled or deactivated account to keep that session alive by repeatedly calling the /admin/refreshToken endpoint, because JwtTokenUtil.validateToken verified only the username match and token non-expiry and omitted the userDetails.isEnabled() check. The issue is rated 5.3 (CVSS 4.0 vector with PR:L, E:P) with low confidentiality, integrity and availability impact and no scope change, and publicly available exploit code exists, although there is no confirmation of active exploitation. Effectively, the defect prevents account deactivation from taking effect on the token-refresh path, letting a terminated user retain access until the token is otherwise invalidated.
Authenticated file upload in KusalkaSilva LMS (rolling release commit ffeb873f) allows an attacker with a valid account to bypass the getimagesize() content check and upload arbitrary files via the uploaded_file/image argument to upload_save.php. Publicly available exploit code exists, and while the flaw is rated CVSS 2.1 by the vendor, successful exploitation could lead to remote code execution only if the upload directory is web-accessible and configured to execute PHP; otherwise impact is limited to storing malicious files. The project has not responded to the issue report, and no fixed version is available, but real-world risk is low given the niche deployment and required authentication.
Stored cross-site scripting in the Netcore NR268 router running firmware 1.7.121109 allows an attacker with a presence on the device's local/broadcast network to plant a malicious DHCP hostname that later executes as script in the browser of an administrator who views the DHCP host-dump page rendered by filter_hosts_dump.cgi. The DHCP hostname is persisted by the router and only fires on subsequent admin page views, so successful exploitation pairs local-network access to inject the value with the passive step of the administrator opening the affected page; no authentication on the router itself is needed. Publicly available exploit code exists in the form of a detailed GitHub proof-of-concept report, and the vendor was contacted about the disclosure but did not respond; impact is confined to script execution in the administrator's session (integrity-low, with no demonstrated confidentiality or availability loss).
SQL injection in itsourcecode Online Admission System 1.0 lets an authenticated low-privilege user inject arbitrary SQL through the ID parameter of the admin-area script /admin/sum.php, allowing data disclosure or manipulation. Publicly available exploit code exists (referenced via the VulDB submission and a public GitHub issue), although the CVE is not listed in CISA KEV, so there is no confirmed active exploitation. With a CVSS 4.0 base score of 5.3 (E:P, PR:L) and only low confidentiality/integrity/availability impact, this is a low-to-moderate risk that should not be treated as an urgent priority despite the public exploit.
Authenticated SQL injection in itsourcecode Baptism Information Management System 1.0 allows a low-privilege, logged-in user to inject arbitrary SQL through the b_id parameter of the pbaptism.php endpoint, potentially reading, modifying, or corrupting records in the underlying database. Publicly available exploit code exists - the vulnerability was reported via VulDB and a proof-of-concept submission is linked from a public GitHub issue - and the vendor's freely distributed PHP source means the flawed query pattern is easy to locate and reproduce. Because exploitation requires a valid session (CVSS vector PR:L) and the application has an extremely small deployment base, the practical risk is low-to-moderate, consistent with the assigned CVSS 4.0 base score of 5.3.
Cross-site request forgery in the CGI endpoint of the Netcore NR268 router (firmware 1.7.121109) allows an attacker to ride an authenticated administrator's active browser session and silently submit unauthorized state-changing requests to the device. Publicly available exploit code exists, but exploitation requires the logged-in admin to visit an attacker-controlled page while a valid session is open, which materially limits realistic risk; the independent assessment rates this low-priority (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) with impact confined to low-integrity configuration changes and no data disclosure or denial of service. No vendor-released patch has been identified at time of analysis, and the vendor did not respond to the disclosure.
Authenticated path traversal in WMCMS 4.446.1257 lets any user holding a low-privileged account read files outside the intended web directory by manipulating the path/file argument of /index.php, exposing source code, configuration, and credential material on the host. The flaw is network-reachable with no user interaction, and publicly available exploit code exists - a GitHub proof-of-concept repository dedicated to this exact build - so unpatched instances with weak, default, or shared credentials are the realistic targets. Impact is bounded to confidentiality (no write, no code execution, no availability effect), and our independent assessment rates this a moderate-risk, low-priority issue in practice because a valid session is a prerequisite.
SQL injection in itsourcecode Baptism Information Management System 1.0 allows an attacker who already holds a low-privileged session to manipulate the ID argument of ebaptism.php and inject arbitrary SQL into the backend query, potentially exposing or altering records such as baptism registrations. Publicly available exploit code exists - a proof-of-concept was published in a public GitHub issue tied to the VulDB report - but there is no confirmed active exploitation (CISA KEV). The vendor-scored CVSS 4.0 base value is 2.1 with E:P, and an independent assessment rates the real-world risk as low because exploitation requires network reach plus a low-privileged authenticated context and the product has a very small, largely non-production deployment base.
Authenticated SQL injection in SEMCMS through version 5.0 lets a low-privileged logged-in user inject arbitrary SQL through the SEMCMS_Banner.php banner handler, potentially reading or altering data stored in the underlying database. Publicly available exploit code exists (a GitHub proof-of-concept repository was referenced in the disclosure), but there is no indication of confirmed active exploitation (no CISA KEV entry), and the requirement for a valid authenticated session keeps the real-world priority LOW. The vendor was contacted about the flaw but never responded, so no official fix has been issued and all deployments up to 5.0 remain affected.
SQL injection in SEMCMS 5.0 and earlier lets an attacker manipulate a user-controlled parameter handled by SEMCMS_Download.php so that unsanitized input is passed into a backend SQL query, exposing and potentially modifying database contents. Per the CVSS vector (PR:L) a low-privileged authenticated session is required, which narrows exposure to actors who can reach and log into the application, although that authentication requirement is derived from the vector alone and has not been confirmed by a vendor advisory. Publicly available exploit code exists (referenced from a GitHub PoC repository), the CVSS 4.0 vector carries an Exploit Maturity of E:P, and the vendor was contacted early but did not respond; no vendor-released patch was identified at time of analysis.
Path traversal in CicadasCMS up to commit 2431154 allows authenticated users with high-privilege backend access to manipulate the TemplateController.save function via the /system/cms/template/save endpoint, potentially leading to limited file read or write. The vulnerability requires an authenticated session with privileged backend access (PR:H) and has a medium CVSS 4.0 score of 5.1; publicly available exploit code exists. The vendor did not respond to the disclosure, and no patched version has been released.
SQL injection in Zen Cart 2.2.2 and earlier within the admin/modules.php Module Configuration interface allows an authenticated administrator to manipulate the configuration parameter and execute crafted SQL against the backend database, yielding limited confidentiality, integrity, and availability impact. Exploitation requires a valid backend administrative session (CVSS PR:H), so it is not reachable by unauthenticated or low-privileged users; publicly available exploit code exists, and an upstream fix is available as commit 08f572654edee1db8f9db091c9949825c6c69339. This is a genuine but lower-priority SQL injection given the admin-level prerequisite.
Stored DDNS account credentials on Netcore NR268 routers running firmware 1.7.121109 are disclosed through the DDNS Handler endpoint ddns_wan_list_show.cgi (function ddns_wan_list_show), which returns the user_idN and passwordN values for configured dynamic DNS providers. Exploitation requires an already-authenticated session with high (administrative) privileges on the web management interface (CVSS vector PR:H), so the flaw is primarily a credential-exposure issue for attackers who have already obtained admin access rather than a direct path to compromise; there is no integrity or availability impact and confidentiality loss is limited. Publicly available exploit code exists - a proof-of-concept write-up is hosted on GitHub - but there is no indication of active exploitation (not listed in CISA KEV), and the assessed CVSS 3.1 score is 4.9-equivalent impact-wise with a base of AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N, making this a low-priority issue despite the remote reachability and public disclosure.
Display-layer injection in Shenzhen HCC Technology MPOS M6 PLUS 1.31-N lets an attacker on the same local or adjacent network distort how the terminal's QR code rendering component stacks its UI layers by supplying a manipulated 'alignment' argument, causing the device to draw QR codes or controls in a misleading way. The bug is unauthenticated from the network position, but it requires the victim to interact with the manipulated display (UI:P) and yields only low integrity impact with no confidentiality or availability loss, per both the vendor-reported CVSS 4.0 score of 5.1 and independent assessment. Publicly available exploit code exists on GitHub (Davim09/m6plusexploit) and the vendor did not respond to the disclosure, so no vendor patch has been identified; this is a low-to-moderate real-world priority, not an actively exploited (CISA KEV) issue.
Cross-site scripting in idcCMS 1.70 is a low-priority vulnerability: publicly available exploit code exists, but it affects the admin/member_deal.php member management function and requires a low-privilege authenticated session plus victim interaction to execute injected script, so it is not remotely exploitable without credentials. No CISA KEV confirmation is present, and the provided data does not include EPSS. Affected deployments should restrict admin access and sanitize/encode member-related inputs until a vendor fix is available.
Stored cross-site scripting in y_project RuoYi up to and including 4.8.3 lets an authenticated low-privilege admin user inject arbitrary script through the cssClass argument handled by renderDrawer in the Dictionary Data Drawer Preview at /system/dict/data/add; the payload is persisted and executes in the browser of any second user who opens the preview. Publicly available exploit code exists (a proof-of-concept is published on GitHub by Bob-wentao), but there is no indication of confirmed active exploitation (no CISA KEV entry). Successful abuse requires a valid backend account plus a victim passively viewing the affected preview, so impact is limited to client-side actions in that victim's session rather than server compromise, consistent with the medium severity (CVSS 5.1) rating.
DeepSeek Harness versions up to and including 0.1.1-rc.2 do not properly enforce the intended behavioral workflow within the dsh-workflow-worker-thread component's agent function (CWE-841), allowing an authenticated remote attacker who can also induce passive user interaction to partially bypass intended workflow sequencing, with limited confidentiality, integrity, and availability impact confined to the harness itself. Publicly available exploit code exists, but the requirement for low-privileged authentication (CVSS 4.0 PR:L) and user interaction (UI:P) keeps the issue medium severity (CVSS 4.0 base 5.1), and there is no confirmed CISA KEV listing for this CVE.
Stored cross-site scripting (CWE-79) in the Netcore NR268 router Web UI (firmware 1.7.121109) lets an attacker who already holds a privileged, authenticated session write malicious markup through the title, note, URL, or content arguments processed by /router/l7_call_board_user_set.cgi, which is later rendered in another Web UI user's browser. Publicly available exploit code exists (documented in a GitHub report linked from the VulDB entry), but the practical blast radius is small: the payload only executes when a victim subsequently loads the affected call-board page, and the assessed impact is limited to low integrity with no confidentiality or availability effect (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N; CVSS 4.0 base 1.9). The vendor was contacted about the disclosure and did not respond, so no vendor-released patch has been identified at time of analysis.
Cross-site scripting in Edimax BR-6208AC firmware 1.32 lets an authenticated administrator inject script through the /goform/formPortFw Port Forwarding handler; publicly available exploit code exists. Exploitation requires high privileges (PR:H) and user interaction (UI:P) when an administrator later views the affected Port Forwarding page, and the assessed impact is limited to low integrity with no direct confidentiality or availability effect. The vendor was contacted but did not respond, so no vendor-released patch is identified in the available data.
Edimax BR-6208AC firmware 1.32 contains a cross-site scripting vulnerability in the QoS configuration page (/goform/formQoS). An authenticated administrator must be tricked into interacting with a crafted request, after which malicious script can alter page content, but impact is limited to low integrity with no confidentiality or availability loss. Publicly available exploit code exists, though active exploitation has not been confirmed (not in CISA KEV); this is a low-priority, high-noise finding rather than an urgent threat.
Cross-site scripting in the web management interface of Edimax BR-6208AC firmware 1.32 allows an authenticated administrator to inject script into the /goform/formFilter packet-filter configuration handler; a victim with administrative access must then interact with the affected page for the payload to execute in their browser. Publicly available exploit code exists, but no CISA KEV active-exploitation confirmation is available, and the risk is low-to-moderate because exploitation requires high administrative privileges and user interaction while targeting a LAN-facing management endpoint rather than an unauthenticated internet service. The vendor was contacted but did not respond, and no vendor-released patch has been identified.
Cross-site scripting in Edimax BR-6208AC 1.32 firmware allows an authenticated administrator to inject script into the HTTP Blocking Page via /goform/formUrlb, with execution occurring when a victim views the affected page. Public exploit code exists, but there is no CISA KEV confirmation of active exploitation, and the independent assessment rates this as a low-priority issue because it requires high administrative privileges and victim interaction. The vendor did not respond to disclosure, and no fixed firmware version is identified.
Authenticated participants of the Meetecho Janus Gateway VideoRoom plugin can bypass a room's max_publishers cap by winning a narrow timing race between a session's 'starting' and 'started' states, allowing more concurrent publishers in a room than the operator configured (CWE-362). The issue is a low-severity one: it requires an authenticated, low-privileged VideoRoom participant able to send 'publish' requests, only matters for rooms that actually enforce a publisher limit, and yields only Low integrity and Low availability impact with no confidentiality loss (assessed CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L; CVSS 4.0 base 2.3 with AC:H and E:P). Publicly available exploit code exists, but there is no confirmed active exploitation (not in CISA KEV), and the vendor responded quickly with an upstream fix in PR #3678 (commit 27c0d1af888153e818675b56a4e6267f62d57097).
Code injection in Zen Cart through 2.2.2 lets an attacker who already has privileged admin/database write access to the `configuration` table supply a malicious `use_function` value that `zen_call_function()` in `admin/includes/functions/general.php` then invokes as PHP, achieving limited code execution (low confidentiality, integrity and availability impact). The attack is network-reachable but rated highly complex and requires high privileges (CVSS:4.0 PR:H / assessed CVSS:3.1 PR:H, AC:H, base score 2.1), because the vendor states the only ways to control `use_function`/`configuration_value` are the admin SQL Patch tool (raw SQL execution) or a separate pre-existing SQL injection - normal unprivileged input does not reach it. Publicly available exploit code exists per the disclosed proof-of-concept, but there is no evidence of confirmed active exploitation and the vendor explicitly rejects the issue as independently exploitable.
SQL injection in Zen Cart 2.2.2's Admin Panel (admin/configuration.php) lets an attacker influence the SQL executed through the eval-based handling of set_function/use_function values reached via the gID argument. Exploitation is deliberately hard to reach: per the vendor, set_function/use_function are not editable through any normal admin UI and can only be introduced at plugin-install time via SQL or through direct database access, so the practical precondition is pre-existing database write access or equivalent high administrative privilege (CVSS 3.1 AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L; CVSS 4.0 base 2.1). Publicly available exploit code exists, but there is no evidence of active exploitation, and this is assessed as a low-priority issue rather than a remotely reachable flaw in default, properly configured installations.
Username enumeration in Thelia 2.6.0 lets unauthenticated remote attackers determine which administrator accounts exist by observing that the administrative login and forgotten-password endpoints respond differently to invalid usernames versus incorrect passwords. Because those endpoints apply no rate limiting or anti-automation controls, enumeration can be carried out efficiently at scale, with the resulting account list serving as reconnaissance for later credential attacks. The issue only discloses account existence (low confidentiality impact) and does not grant access; no public exploit code or confirmed active exploitation was identified at time of analysis, and the reported CVSS base score of 3.7 reflects the low severity.
Race condition in the Pixelite Events Manager WordPress plugin (versions through 7.4.7) lets a remote, unauthenticated attacker target a narrow synchronization window in the plugin's handling of a shared resource, resulting in a limited integrity impact with no confidentiality or availability effect. Exploitation hinges on winning a concurrency race - tightly-timed overlapping requests must land inside the vulnerable window (CVSS AC:H), a probabilistic timing requirement that substantially reduces reliability and keeps overall severity low. No public exploit has been identified at time of analysis, and there is no confirmed active exploitation (no CISA KEV listing).
Symlink following in the nginx third-party module ngx_cache_purge before 3.0.4 allows a local attacker to cause deletion of files outside the configured proxy_cache_path: the module's purge walks (purge_all, wildcard purge, or a plain proxy_cache_purge PURGE request) trust nginx's ngx_walk_tree(), which classifies directory entries with stat() and therefore descends into planted symlinks. Exploitation is narrow - it requires that nginx and a served application such as WordPress run under the same OS user account and that the attacker already has that user's file-write or code-execution capability to plant the link - and no public exploit code or confirmed in-the-wild activity was identified at time of analysis, with the assessed CVSS of 3.6 (AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L) reflecting a genuinely low-priority, local-only, high-complexity issue. Version 3.0.4 blocks symlinks found inside the cache tree but does not close an applicable TOCTOU race condition, so the shared-user deployment remains the decisive risk factor.
Stored cross-site scripting in the HireZoot WordPress plugin before version 4.0.0 lets an authenticated user who holds the plugin's management capability (Administrator by default) store a script payload in a job specification setting that is later rendered without escaping in an admin-area settings page and executes in the browser of any administrator who opens that page. Because the payload runs inside the viewing administrator's session, any impact is bounded by that administrator's own privileges, and the flaw is only a meaningful privilege escalation where administrators lack the unfiltered_html capability - WordPress multisite installs or sites with DISALLOW_UNFILTERED_HTML defined - since on default single-site installations administrators can already inject unfiltered HTML. This is a low-priority, network-reachable issue (CVSS 3.5, PR:H, UI:R) and no public exploit was identified at time of analysis; the vendor has shipped a fix in version 4.0.0.
Improper input validation in IBM Db2 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 lets a local attacker who already holds authenticated low-privilege access to the database host or instance disrupt the affected component, resulting in a limited availability impact. The issue is not remotely reachable and cannot be triggered by an unauthenticated user; our assessment rates it CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L, a low-severity availability-only condition, and there is no public exploit identified at time of analysis. Overall this is a low-priority, low-real-risk issue despite being a named CVE, and vendor patching is available.
Authenticated users of Red Hat Quay 3 can retrieve auto-prune policy configurations belonging to repositories in other namespaces, exposing configuration details that should remain tenant-scoped. Exploitation requires a valid Quay account, control of a repository whose name collides with the target's repository name, and prior knowledge of the target policy's unique identifier - conditions reflected in the CVSS 3.1 base score of 3.1 (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N). Impact is confined to information disclosure, with no modification of data or denial of service, and no public exploit has been identified at time of analysis.
Terminal-output injection in the Elixir Hex package manager (all versions from 0.0.1 up to, but not including, 2.5.2) allows a malicious package publisher or a hostile repository server to smuggle ANSI escape sequences and Unicode bidirectional overrides into what Mix prints, forging displayed URLs, package descriptions and suggested commands, hiding real output, or writing attacker-chosen text to the victim's clipboard via OSC 52. Exploitation is unauthenticated (CVSS:4.0 PR:N) but requires the victim to run one of the affected interactive Mix tasks - such as mix hex.info, mix hex.package search, mix hex.search, mix hex.user or mix hex.policy - against data the attacker controls, and it depends on the victim's terminal emulator interpreting the injected sequences; impact is confined to output forgery and clipboard manipulation, with no code execution, file access or privilege gain, and the assessed severity is low (CVSS 4.0 base 2.3). No public exploit code was identified at time of analysis and there is no indication of active exploitation; the vendor has released a fix in Hex 2.5.2.
FreeRDP clients before version 3.32.0 can be crashed by a malicious RDP server that sends a crafted sequence of video redirection messages, resulting in a NULL pointer dereference. The attack requires the victim to initiate an RDP connection to an attacker-controlled server with the client video redirection channel active, and it only causes a client denial of service without code execution or data exposure. No public exploit code has been identified at the time of analysis.
FreeRDP clients version 3.11.0 through 3.32.0 can be crashed by a malicious or compromised RDP server that sends a crafted USB redirection request. The vulnerability is a reachable assertion in the urb_isoch_transfer function, triggered by an OutputBufferSize value exceeding INT32_MAX, which leads to client termination. Exploitation requires the victim to connect to the malicious server with USB redirection enabled, and no public exploit code is identified; the issue is low severity (CVSS 2.3) with only denial-of-service impact.
Former collaborators on Open WebUI knowledge bases can keep downloading or deleting files they were previously granted access to, because the has_access_to_file authorization check evaluates a stale cached knowledge base reference after the collaborator has been removed. The flaw affects Open WebUI 0.6.0 through the release immediately preceding 0.11.4, and is only reachable by an authenticated user who previously held a read or write grant on a specific knowledge base and then lost it - a share-then-revoke lifecycle - so single-owner or never-shared knowledge bases are unaffected; impact is confined to file download and deletion inside Open WebUI, including files in the owner's private knowledge bases. Rated low severity (CVSS 4.0 base 2.3; independent assessment CVSS 3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L), with no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV) - a genuinely low-priority issue despite the 'Authentication Bypass' tag.
An authorization logic flaw in the goose AI agent framework affects versions 1.28.0 through 1.43.x and lets tools annotated readOnlyHint: true run without user approval even after the session has been switched to Manual Approval mode. The bypass is stateful rather than a default-configuration remote attack: a session must previously have run in Smart Approval mode, which persists read-only tool annotations, and update_goose_mode subsequently fails to clear them, so PermissionInspector::inspect skips its approval prompt when a prompt-injected call invokes one of those annotated tools. Successful exploitation yields low confidentiality and integrity impact with no availability impact, requires user interaction (the victim must process injected content in an agent session that earlier used Smart Approval), and no public exploit code was identified at time of analysis; per the supplied CVSS vector this is a network-reachable, unauthenticated-vector issue but with high attack complexity and a required user-interaction component, so real-world risk is low.
LearnHouse versions before 1.4.0 contain a missing authorization flaw (CWE-862) in the playground duplication endpoint POST /api/v1/playgrounds/{uuid}/duplicate, which fails to re-apply the read-access and draft checks that the normal get_playground path enforces. An authenticated user who holds playground creation rights - for example an Instructor - and who already knows the exact UUID of someone else's RESTRICTED or unpublished playground can duplicate it, copy its html_content, and republish that content publicly. Exploitation is constrained: the attacker must be authenticated (not anonymous) and must possess a specific, non-trivial UUID, so this is a genuinely low-priority, low-impact disclosure issue rather than a broadly exploitable one; no public exploit code or confirmed active exploitation has been identified, and the fix is available in the 1.4.0 release.
CSV formula injection in Thelia (before 3.1.2 and 3.2.0 through 3.2.0, fixed in 3.2.1) lets unauthenticated visitors plant spreadsheet formulas in registration, checkout, and newsletter fields that are later exported verbatim by CSVSerializer and executed when an administrator opens the file in Excel, LibreOffice Calc, or Google Sheets. The attacker never touches the Thelia server: impact is limited to the exporting administrator's workstation, and exploitation depends on an admin both performing the export and opening the resulting file (CVSS 3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N; CVSS 4.0 base 2.3). No public exploit code and no confirmed active exploitation have been identified at time of analysis, and the low EPSS-style risk profile is consistent with the assessed vector - this is a genuinely low-priority issue that vendor patches already resolve.
Live heart-rate readings can be intercepted over Bluetooth Low Energy from Fire-Boltt BSW013 smartwatches running firmware through V0.0.8, because the Heart Rate Measurement characteristic (0x2A37) accepts subscriptions from unpaired devices with no bonding, authentication, or on-watch confirmation. An attacker within BLE radio range of a powered-on, advertising watch can collect the wearer's heart rate in real time without authenticating or interacting with the victim, and the vector (PR:N/UI:N) confirms no credentials or user action are required, though the exposure is confidentiality-only and ends when the watch leaves range or is powered off. Risk is genuinely low (CVSS 4.0 base 2.3; independent assessment 3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), and no public exploit code or confirmed active exploitation was identified at time of analysis; no vendor-released patch was identified in the provided data.
Cross-origin information disclosure in Network-AI (npm package network-ai) before 5.15.2 stems from an origin validation error in McpSseServer._handleRequest (lib/mcp-transport-sse.ts) that reflects a localhost Origin into the Access-Control-Allow-Origin response header regardless of which interface the server binds. An attacker-controlled page carrying a localhost Origin can therefore read unauthenticated endpoints such as /health cross-origin, but only when the operator has bound the MCP SSE server to a non-loopback address (a non-default configuration) and a victim visits that malicious page - no public exploit code identified at time of analysis. Impact is limited to low-sensitivity information disclosure (assessed CVSS:3.1 base 3.0, C:L/I:N/A:N), and the reported CVSS 4.0 base of 2.3 is consistent with this low-priority characterization.
Memory exhaustion in hex_core (a library vendored into Hex/mix and rebar3) lets an untrusted repository mirror or a malicious server answering hex_core API requests abort the client-side Erlang VM by returning a tiny, highly compressed response that expands into a very large term or signed envelope. The vulnerable code paths decompress and decode attacker-controlled bytes before the registry signature is verified, and the Erlang safe-binary decoder used for application/vnd.hex+erlang responses accepts compressed terms without bounding the decoded size. Exploitation requires the attacker to control the served data (malicious/compromised mirror, hostile API server, or TLS MITM) and the victim to actively run a fetch operation; this is an unauthenticated remote issue per the assessed vector (CVSS:4.0 PR:N, UI:A, AT:P), but it is a low-severity availability-only problem with no code execution or data exposure, and no public exploit identified at time of analysis.