Unauthenticated remote attackers can force the IoT Component of IBM Maximo Application Suite 9.0.0, 9.1.0, and 9.2.0 into an infinite parsing loop by submitting crafted input, hanging the parser and degrading or denying availability of the affected service. The flaw is rated CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), so per the vector no credentials or user interaction are required, but the impact is confined to availability with no data exposure or code execution; the practical exposure depends on whether the IoT parsing interface is reachable from the attacker's network position. There is no indication of confirmed active exploitation (CISA KEV) and no public exploit code identified at time of analysis, and our independent assessment rates this a moderate-priority availability issue rather than a top-tier emergency.
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 validate authentication tokens incorrectly, accepting a token the server should reject, so a remote attacker who can reach the instance can obtain unauthorized access under that token's identity. The vendor-published CVSS 3.1 base score is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N), while our independent assessment raises the confidentiality impact to High (C:H/I:H/A:N), reflecting that an improperly accepted token may expose data as well as permit modification; neither vector assesses any availability impact. No public exploit code or confirmed active exploitation was identified at time of analysis (the CVE is not in CISA KEV) and no EPSS score was available in the supplied data, so the realistic limiting factor is deployment exposure: the MarkLogic instance must be network-reachable by the attacker.
Improper validation of SAML assertions in Progress MarkLogic Server lets an unauthenticated remote attacker cause the server to accept an assertion that should have been rejected, potentially yielding unauthorized access to the MarkLogic deployment and its data. Affected are 12.x releases before 12.1.0 and 11.x releases before 11.3.7, but only instances explicitly configured to use SAML authentication and whose SAML endpoints are network-reachable are exposed to this flaw. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no credentials and no user interaction are required; no public exploit code was identified at time of analysis, and the vendor has published fixed versions 12.1.0 and 11.3.7.
Cleartext transmission of Amazon S3 credentials and data in Progress MarkLogic Server 12.x before 12.1.0 and 11.x before 11.3.7 allows a network-positioned attacker to intercept sensitive information when S3 integration is left on default transport settings. Exploitation is unauthenticated but requires the S3 feature to be in use, the default cleartext transport to be unchanged, and an on-path man-in-the-middle position; deployments using TLS, VPC endpoints, or VPNs are not at risk. No public exploit code has been identified at time of analysis, and our assessment rates this as AC:H rather than AC:L due to these prerequisites.
Progress MarkLogic Server deployments in the 12.x line before 12.1.0 and the 11.x line before 11.3.7 generate predictable anti-CSRF tokens for Query Console, allowing a remote attacker to forge requests that pass CSRF validation and execute server-side code with the permissions of a logged-in victim. Exploitation is conditional: the attacker must lure a user who currently holds a live authenticated Query Console session to an attacker-controlled page, so user interaction is mandatory and unattended servers or logged-out users are not reachable this way. A vendor advisory is available (community.progress.com MarkLogic Critical Security Alert Bulletin, October 2026) and confirmed fixed versions exist; there is no CISA KEV entry and no public exploit code identified at time of analysis, and no EPSS score was supplied, so this is best treated as a credible but conditional risk rather than a drop-everything emergency.
Improper verification of cryptographic signatures across the DigiDoc suite lets an attacker craft a document carrying a forged XAdES signature that affected software displays as valid, undermining the integrity of electronically signed documents (CVSS 7.5, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - pure integrity impact with no confidentiality or availability effect). The defect is reachable by unauthenticated remote attackers (PR:N) with no user privilege or special configuration, but exploitation still requires a relying party to validate the forged file with an unpatched build: libdigidocpp before 4.5.0, DigiDoc4 before 4.11.0, or DigiDoc for Android/iOS before 3.1.0. Vendor fixes are available per the ENISA-referenced disclosure and upstream PR; no public exploit code has been identified at time of analysis, and no active exploitation is confirmed.
Deny-pattern bypass in Network-AI's ClaudeHookBridge PreToolUse hook (versions 5.14.0 through 5.15.1) allows a prompt-injected agent to smuggle dangerous payloads past configured denyPatterns by placing a benign value in the first candidate field the hook inspects (such as file_path or command) while putting the actual malicious content in a secondary field the hook never evaluates, notably the Write tool's content parameter or an MCP script parameter - enabling web shell writes or script execution inside the local agent-execution context. The affected deployment must rely on the PreToolUse hook with denyPatterns as its guardrail, and exploitation additionally requires a successful prompt injection into the agent, which is why risk is bounded to local agent workflows rather than remote reachability; CVSS 4.0 scores 7.5 with attack requirements present (AT:P), and the assessed CVSS 3.1 vector is AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, meaning no prior authentication or user interaction is required per the vector but the attack is local and complex. There is confirmed actively exploited status not present - no CISA KEV listing and no public exploit code - so at time of analysis no public exploit identified at time of analysis; EPSS, SSVC, and KEV signals were absent from the supplied intelligence, so prioritization inputs remain incomplete.
SQL injection in Kong Gateway (Enterprise and Open Source) Hybrid Mode clustering logic allows an attacker who can reach the Control Plane's clustering port and present a valid mTLS client certificate and key to inject arbitrary SQL into the Control Plane's backing database, resulting in unauthorized read and write access to gateway configuration and related data. Successful exploitation yields high confidentiality, integrity, and availability impact on the Control Plane database (CVSS 4.0 base 7.5 / assessed CVSS 3.1 8.8), but the prerequisites are substantial: the deployment must be running the Control Plane/Data Plane split, the attacker must have adjacent network access to the normally internal clustering channel, and must hold legitimate clustering credentials, which effectively limits realistic abuse to compromised Data Plane nodes or insiders with stolen cluster keys. No public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis.
openstack-network-exporter can be made to silently skip basic authentication when an operator enables user authentication but forgets or misconfigures TLS, letting an adjacent-network attacker pull OVS/OVN dataplane metrics without credentials. Only deployments in that specific non-default, inconsistent configuration are exposed; correct TLS deployments and deployments without authentication enabled are unaffected. The published CVSS is 7.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N), but our assessment narrows this to AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - adjacency-limited, read-only information disclosure, with no integrity or availability impact and no public exploit identified at time of analysis.
Kerberos authentication service impersonation in Progress MarkLogic Server 12.x before 12.1.0 and 11.x before 11.3.7 lets an unauthenticated, suitably positioned network attacker impersonate trusted authentication infrastructure, potentially resulting in unauthorized access to or modification of protected data. Exploitation is conditional: it requires a deployment configured with Kerberos-backed password-based (external) authentication and an attacker holding a privileged on-path network position between the server and the Kerberos KDC, which is why CVSS rates attack complexity as high despite no required user interaction or prior authentication. No public exploit code or confirmed active exploitation has been identified at time of analysis.
FreeRDP 3.0.0 through 3.31.x allows an on-path attacker to capture OAuth authorization codes and substitute the OpenID discovery document during Azure AD authentication because freerdp_http_request() completes TLS handshakes without validating the server certificate chain. Exploitation requires the victim to use the Azure AD/AAD-brokered RDP path (plain RDP is unaffected) and to actively perform the login while the attacker holds a man-in-the-middle network position, making this a conditional risk rather than a broadly exploitable flaw. No public exploit code has been identified at time of analysis, and the issue is patched in FreeRDP 3.32.0.
Arbitrary file write in Progress ShareFile Storage Zones Controller 5.12.6 and earlier lets an unauthenticated remote attacker who can influence the remote file identifier consumed by FileCopyService place attacker-controlled content into any filesystem location writable by the Storage Zones service account. Escalating that write to remote code execution requires a second, non-default condition: an IIS-served directory that is both executable and writable by that same account, which is why the assessed attack complexity is high. No public exploit code has been identified at time of analysis, and the risk profile is configuration-dependent rather than a mass-exploitation emergency.
Cleartext transmission of certain cluster-management communications in Progress MarkLogic Server 12.x releases before 12.1.0 allows an on-path attacker to read and modify inter-node management data, compromising both confidentiality and integrity of cluster operations. The vendor CVSS is 7.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N): exploitation requires no authentication and no user interaction, but the attacker must already occupy a man-in-the-middle position on the network segment carrying MarkLogic cluster traffic, which in well-segmented environments is a trusted internal VLAN not reachable from general user networks - realistically limiting exposure to insiders or attackers who have already achieved lateral movement. Availability is unaffected, and no public exploit identified at time of analysis.
Outbound TLS connections initiated by Progress MarkLogic Server can be intercepted and modified by an on-path attacker because the product does not consistently validate the certificate hostname for certain outbound connections (CWE-297). Affected are 12.x releases before 12.1.0 and 11.x releases before 11.3.7; the vulnerability is unauthenticated from the attacker's perspective (CVSS:3.1/AV:N/AC:H/PR:N/UI:N) but requires the attacker to first occupy a man-in-the-middle position - for example via ARP or DNS spoofing, a rogue gateway, or control of intermediate network infrastructure - and requires MarkLogic to actually open one of the specific outbound connections that skip hostname verification. Impact is limited to confidentiality and integrity of those communications (C:H/I:H) with no availability impact and no code execution; no public exploit code or active exploitation has been identified at time of analysis.
Man-in-the-middle interception of IBM DataStage on Cloud Pak for Data 5.4.0.0 client sessions lets an attacker who presents a forged TLS certificate capture the IAM bearer Authorization header that the session adapter attaches automatically, granting full platform-scope tenant API access to read and manipulate the victim's DataStage projects, flows, assets, and pipeline definitions. The root cause is CWE-295 improper certificate validation in client-side SDK code running on the user's own machine, so exploitation requires an external network interceptor on the path between that machine and the Cloud Pak for Data platform - a co-tenant inside the shared cluster cannot exploit it - together with an active authenticated session that transmits a live token. CVSS 3.1 scores this 7.4 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N); no public exploit identified at time of analysis, and patch data indicates a fix is available from the vendor.
Arbitrary local program execution is possible in EdgeEver Desktop 1.92.0 through 1.112.0 because the desktop:acp-probe IPC handler performs no sender validation and spawns whatever executable path is supplied in the caller's input.path, running it with the victim user's privileges. This is not a standalone network RCE: an attacker must first land stored cross-site scripting in a renderer through the template-preview or drag-preview feature, and the victim must then preview that attacker-controlled content so the renderer script can invoke probeAcpAdapter (CVSS v4.0 7.3; independent assessment CVSS v3.1 AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H). No public exploit code and no CISA KEV listing were identified at time of analysis; an upstream fix commit has been referenced, but no patched release version has been independently confirmed.
Cross-site request forgery in the Patreon WordPress plugin (patreon-connect), affecting all versions up to and including 1.10.0, allows an attacker to ride a logged-in user's browser session and trigger state-changing plugin requests that lack a valid anti-CSRF token. The CVSS vector (PR:N, UI:R) means the attacker needs no credentials of their own but must convince an authenticated user - typically a site administrator or other privileged account - to load attacker-controlled content while logged in; the realistic impact is unauthorized state modification rather than data theft or denial of service. No public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV, so there is no evidence of active exploitation; the Patchstack advisory is the only public reference.
An out-of-bounds read in the Netcore NR268 router firmware (version 1.7.121109) can be triggered by manipulating the put_file argument of the ARP filter import handler at /router/filter_arp_put_file.cgi, allowing an attacker with an authenticated management session to disclose process memory or crash the device; no code execution or lateral impact was assessed. Exploitation requires high/administrative privileges (CVSS PR:H) on the router, so this is not reachable by an anonymous external attacker despite the network-facing attack vector. Publicly available exploit code exists - the researcher's write-up is published on GitHub and the vendor was contacted but never responded - and the CVSS 4.0 vector carries an E:P (proof-of-exploit) modifier; no CISA KEV listing and no EPSS score were supplied in the available data, and no vendor-released patch has been identified, so unpatched, internet- or management-exposed NR268 units should be treated as at risk of authenticated memory disclosure and denial of service.
Authenticated local access to the IBM Power Systems service processor enables writing crafted host firmware configuration data that crashes the boot stack during system initialization, potentially corrupting memory in firmware versions FW1060.00 through FW1060.81. This stack-based buffer overflow (CWE-121) has a CVSS 3.1 score of 7.3, with limited integrity impact and high availability impact. Exploitation requires service-level credentials (PR:L) and local access to the management plane (AV:L); no public exploit code or active exploitation is identified at time of analysis.
Adjacent attackers can manipulate the mobile device connected to a Windows host running Samsung Continuity Service versions before 4.6.1217.0, with no authentication or user interaction needed once a paired session is active. Exploitation requires wireless proximity or local L2 adjacency and high attack complexity, and it can affect confidentiality, integrity, and availability across both the PC and the linked phone. No public exploit was identified at time of analysis, and the assessed risk is moderate rather than top-tier because the attacker must be near the target and the phone must be actively connected.
Remote code execution in Thelia v2.6.0 is achievable by an authenticated administrator who abuses the document update endpoint to upload a server-executable file such as a PHP script. The document upload endpoint correctly blocks executable file types, but the update path omits the same validation (CWE-434), so the flaw is a validation gap between two sibling features rather than a broken upload filter overall. Exploitation is access-gated: the CVSS vector (AV:N/AC:L/PR:H/UI:N) confirms network reachability but requires high-privilege Thelia admin credentials, and the server must actually execute PHP from the writable document location; impact is rated high for confidentiality, integrity, and availability, but no public exploit code or confirmed active exploitation was identified at time of analysis.
Authenticated attackers holding a Thelia administrator account can achieve remote code execution on the underlying server by uploading a PHP file through the store banner upload feature, which validates file type solely on the client-supplied MIME type rather than inspecting file content or extension. The flaw affects Thelia v2.6.0 and carries a CVSS 3.1 score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), reflecting complete loss of confidentiality, integrity, and availability on a successful upload-to-execution chain, though the PR:H vector means the attacker must already hold high privileges and no pre-authentication path is involved. No public exploit code has been identified at time of analysis, and exploitation additionally assumes the web server executes PHP from the directory where uploaded banners are stored.
Authenticated low-privilege users of Open WebUI versions 0.8.6 up to but not including 0.11.4 can escalate privileges through the terminal proxy endpoint /api/v1/terminals/{server_id}/{path}, which forwards requests to the backend Terminals administrator API with the shared key attached; by targeting admin paths directly, an attacker can enumerate and stop other users' terminals, modify terminal policies, and inject environment variables into other users' sessions. The flaw is a missing-authorization (CWE-862) path-confusion issue reachable by any account with PR:L and no user interaction, and it only matters where the terminals feature is enabled against configured terminal servers in a multi-user deployment. No public exploit code has been identified at time of analysis and the issue is not tied to any confirmed active exploitation, but the vendor has shipped a fix and the independent assessment rates this as a genuine, moderate-priority risk rather than an emergency.
Improper access control in the Location Service for Esri component of IBM Maximo Application Suite 9.0, 9.1, and 9.2 allows an attacker who already holds high privileges on the underlying Kubernetes/OpenShift platform to abuse a schema-less Custom Resource Definition (CRD) and escalate to full read and write control over affected resources, since the CRD enforces no input validation and the component applies insufficient authorization checks. Exploitation requires authenticated high-privilege access (CVSS vector PR:H), no user interaction, and the optional Esri Location Service add-on to be deployed, so the barrier to entry is significant; the assessed vector is AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H for a base score of 7.2. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), making this a moderate-priority, high-barrier issue rather than an urgent widespread threat - though successful abuse yields high confidentiality and integrity impact on the Maximo environment.
Stored cross-site scripting in Open WebUI versions before 0.11.4 allows an authenticated user to plant a markdown link using a javascript: scheme inside a shared chat; when a second user opens that chat and clicks the link, the script executes in the victim's browser session and can exfiltrate the JWT held in local storage - including an administrator's token. Exploitation requires a valid low-privilege account plus the chat-sharing feature and, critically, a click by the targeted victim, so this is best characterized as a targeted social-engineering risk rather than an unauthenticated mass-exploitation issue. No public exploit code or confirmed active exploitation was identified at time of analysis, and the independent assessment rates this a credible, moderately serious risk rather than a top-tier emergency.
Authenticated users can modify records in Frappe ERPNext before 16.22.0 by invoking endpoints that omit proper authorization checks, allowing operations beyond their permitted role and resulting in unauthorized data modification. This missing authorization flaw (CWE-862) requires a valid low-privilege account and network access to the ERPNext web application, but no victim interaction; the assessed CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) confirms integrity impact only. No public exploit code or confirmed active exploitation was identified at time of analysis.
VeraCrypt 1.26.29 (FUSE-T build) on macOS can leave a dismounted volume's decrypted contents readable, because VeraCrypt fails to terminate the FUSE-T auxiliary service (go-nfsv4) and its associated core-service helper processes, which keep serving the decrypted volume image (volume.dmg) over a loopback SMB session while retaining an open handle to the underlying raw device. An authenticated local user or process on the same host can then re-attach volume.dmg from the stale auxiliary mount, or simply reopen a previously accessed path (for example from the macOS Open Recent menu), and read the decrypted volume without supplying the passphrase again. The issue is specific to the FUSE-T build - the macFUSE build is explicitly unaffected - and requires that a volume was previously mounted and dismounted on that machine; no public exploit code and no confirmed active exploitation have been identified at time of analysis.
Time-of-check/time-of-use weakness in Privasys ra-tls-clients before 0.9.1 allows a local, low-privileged attacker on the attested TLS endpoint (the Attester) to modify workload code, data, or configuration after remote attestation has already succeeded, while the verifying peer continues to trust the original Evidence for the remainder of the connection. Exploitation requires prior local access to the Attester plus an attested connection (deterministic or challenge mode) that is still open - the window spans connection establishment to termination, and unattested ('none') connections are out of scope. The flaw is fixed in 0.9.1; no public exploit identified at time of analysis.
Heap corruption and process crash in vLLM audio transcription allow an authenticated remote attacker to repeatedly deny service to the inference API in versions before 0.29.0. Uploads to /v1/audio/transcriptions that fail primary decoding fall through to a PyAV/FFmpeg av.open() fallback guarded only by a file-size check, so a malformed IAMF container reaches FFmpeg's vulnerable IAMF parser and corrupts the heap, terminating the API process. The CVSS vector (PR:L) confirms authentication is required, impact is availability-only (no confidentiality or integrity effect), and no public exploit code or CISA KEV listing was identified at time of analysis; no EPSS score was supplied.
Authenticated users of Open WebUI 0.11.0 through 0.11.3 can crash or stall the backend by submitting short nested-repetition regex patterns to the built-in knowledge and chat file search tools (grep_knowledge_files, grep_chat_files), which compile the attacker-controlled pattern with a backtracking regex engine whose nested counted repetition expands without bound at compile time and is then cached. The result is a blocked event loop and exhausted worker memory - a pure availability impact (CVSS 4.0 7.1, AV:N/AC:L/AT:N/PR:L/UI:N/VA:H, CWE-400) with no confidentiality or integrity loss; the flaw sits in the default regex compilation path, so default installs of the affected versions are exposed rather than only a non-default feature. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor has shipped a fix in Open WebUI 0.11.4 that replaces the engine with RE2.
Denial of service in Open WebUI 0.9.0 through 0.11.3 lets an authenticated user who holds the operator-granted 'automations' permission stall the whole instance by submitting recurrence rules that are syntactically valid but unsatisfiable - the canonical example being a rule that resolves to a nonexistent date such as February 30th - to the automations create or update endpoints. Each submitted rule blocks the single shared async event loop for several seconds, so repeated requests degrade or halt service for all users; impact is availability-only, with no data exposure or code execution, and the instance recovers once the requests stop. The vulnerability is scored 7.1 (CVSS 4.0 AV:N/AC:L/PR:L, and 7.1 under CVSS 3.1 with A:H) and there is no public exploit identified at time of analysis, though a vendor-released fix (0.11.4) is available.
SQL injection in Frappe ERPNext (15.x before 15.113.0 and 16.x before 16.22.0) allows attackers with a valid ERPNext account to inject crafted parameters into database queries and read sensitive records from the underlying database. Exploitation requires an authenticated session over the network and no user interaction; the flaw yields high confidentiality impact with no integrity or availability impact. No public exploit code or confirmed in-the-wild activity has been identified at time of analysis, and the primary risk driver is the availability of low-privilege accounts - risk rises sharply where self-service or open registration is enabled or where the instance is internet-exposed.
Hex, the package manager used by Elixir and Erlang projects, fails to properly scope its 'release-age cooldown' protection in versions 2.5.0 through 2.5.1, allowing an authenticated package owner to slip a freshly published, malicious release past the cooldown. The attacker must already hold package-owner permission on the target package, retire (or rely on a security advisory for) the release locked in the victim's mix.lock, and then wait for the victim to run mix deps.update - at which point Hex.RemoteConverger.build_cooldown_bypass/3 and unsafe_lock_bypass/1 lift the cooldown for every version of that package and its dependencies, so the new release is selected regardless of age. A secondary scoping defect causes the bypass to be keyed on package name alone, extending it to identically named packages in other repositories; cooldown configured through an organization dependency policy is not affected. This is a conditional supply-chain weakness rather than a broadly dangerous remote flaw, and no public exploit or in-the-wild activity has been identified at time of analysis. Patches are available from the vendor in Hex 2.5.2.
Denial of service in the Gitoxide gix-pack crate before 0.75.0 allows a remote attacker operating a malicious Git remote to crash a victim's clone or fetch operation by advertising an absurd pack-header object count, forcing the client to reserve hundreds of gigabytes of memory. Exploitation requires the victim to initiate the clone or fetch against the untrusted remote (user interaction), and no authentication is required of the attacker; the flaw sits in the default pack-header parsing path, so unmodified configurations are affected. The impact is limited to killing the client process with no code execution or data exposure, and no public exploit code was identified at time of analysis.
Memory exhaustion denial of service affects Grav CMS versions before 2.1.7, where an authenticated user with media-author upload privileges can submit a highly compressed oversized raster image that, when referenced through a Twig or Markdown image transform, is fully decoded by GD or Imagick without source-dimension validation. Once the transformed image is embedded in published content, unauthenticated page requests repeatedly trigger the decode-and-allocate behavior, causing sustained page unavailability; the assessed CVSS 4.0 base score is 7.1 (AV:N/AC:L/AT:N/PR:L/UI:N/VA:H), and no public exploit code was identified at time of analysis.
Denial of service in SiYuan versions 3.1.12 up to (but not including) 3.8.6 allows an attacker who can reach the /api/icon/getDynamicIcon endpoint to exhaust server memory and trigger an OOM kill of the SiYuan process with a single crafted request. The content parameter is rendered through an unrestricted Sprig template function map, so uncapped functions such as 'until' can be used to allocate unbounded resources (CWE-770, uncontrolled resource consumption). Per the CVSS 4.0 vector (PR:L) at least a publish-reader-level account is required in the default configuration, but if the administrator has disabled publish authentication the endpoint becomes reachable by any remote user with network access; the flaw is strictly a resource-exhaustion issue with no code execution or data exposure. No public exploit code was identified at time of analysis, and no confirmed active exploitation (CISA KEV) is associated with this CVE.
A divide-by-zero in FreeRDP's freerdp-shadow-cli shadow server (versions before 3.32.0) allows an authenticated client to crash the process by sending a Frame Acknowledge PDU with a frame id one greater than the last frame sent, disconnecting all viewers. Exploitation requires a valid authenticated session and only affects the non-default shadow server deployment; no user interaction is needed and complexity is low. No public exploit code has been identified at time of analysis, and the impact is availability-only (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
Denial of service in SurrealDB versions before 3.3.0 lets a query-capable authenticated user with embedded JavaScript scripting enabled abort the database server process by reading a non-ASCII header value through the JavaScript Headers get(), entries(), values(), or getSetCookie() APIs, or by returning such a value from a fetch() endpoint. The flaw is rated 7.1 (CVSS 4.0 AV:N/AC:L/AT:N/PR:L/UI:N, availability-only), reflecting that exploitation requires an authenticated query-capable principal plus the non-default scripting capability, and that the impact is limited to a server abort with no data exposure or modification; there is no public exploit identified at time of analysis and no CISA KEV listing. Vendor patch is 3.3.0.
Denial of service in Open WebUI 0.11.0 through 0.11.3 lets authenticated users who are permitted to create automations submit crafted recurrence rules that expand on a per-second basis, synchronously blocking the shared event loop for minutes per request and again on every scheduler poll. The root cause is a mismatch in strictness: the sub-daily frequency guard in the recurrence-rule validator parses rule text more strictly than the calendar library that actually executes it, so whitespace-folded rules (or, on 0.11.0 specifically, lowercase frequency keywords or omitted RRULE prefixes) slip past the guard yet still execute. The flaw is availability-only (CVE-2026-109297, CWE-400, CVSS 7.1) and authentication-gated; no public exploit code was identified at time of analysis and it is not confirmed actively exploited (not in CISA KEV), with patched builds available in 0.11.4.
Memory exhaustion in Open WebUI 0.6.42 through 0.11.3 allows an authenticated user to take the entire instance offline for all users by submitting a chat message whose image field points to an attacker-controlled host that returns a gzip-encoded HTTP response. Because get_image_base64_from_url decompresses remote image responses without any size limit, a small compressed payload expands into an arbitrary amount of heap memory and drives the server into an out-of-memory denial of service. Exploitation requires a valid account and the ability to post chat messages (PR:L per the CVSS vector), and the independent assessment rates the impact as availability-only (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), moderate severity rather than critical; no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV.
Authorization bypass in LavaLite CMS through 10.1.2 lets an authenticated low-privileged user modify other users' accounts - including administrator accounts - by sending a PATCH request to the user update route carrying a target user identifier, altering the victim's name, email, password, status, or mobile number. The CVSS:4.0 vector (AV:N/AC:L/PR:L/UI:N/VI:H) and the independent CVSS:3.1 assessment (PR:L, I:H, S:U) both confirm that a valid low-privilege login is required, that no victim interaction or non-default configuration is needed, and that the impact is high-integrity write access with no direct confidentiality or availability loss; the practical effect is a route to full administrative account takeover. No public exploit code was identified at time of analysis and there is no confirmed active exploitation (not in CISA KEV), so the principal exposure limiter remains the need for an existing low-trust account, which narrows realistic risk to deployments that allow self-registration or where an attacker already holds low-level credentials.
Authenticated SurrealDB record users can read field values that field-level SELECT permissions are meant to conceal on SurrealDB 3.0.0 through versions before 3.3.0, either by selecting records whose COMPUTED fields are derived from protected fields or by issuing write statements with RETURN clauses that reference $before/$after. It is a moderate, authentication-gated information disclosure (CVSS 4.0 7.1; independent CVSS 3.1 assessment AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) that only bites deployments whose schemas pair field-level SELECT permissions with COMPUTED fields or allow record users to use write RETURN clauses - no public exploit identified at time of analysis, and the vendor fix is SurrealDB 3.3.0.
Page editors on Grav CMS versions 2.0.22 through 2.1.6 can render the Clockwork debugger's system.debugger.token via editor-authored Twig and replay it as the X-Clockwork-Auth header, disclosing profiler records that contain configuration values, request metadata, and database queries. The flaw is an authenticated, page-editor-level information disclosure (CVSS 4.0 base 7.1; independent assessment CVSS 3.1 AV:N/AC:L/PR:L/UI:N/C:H/I:N/A:N) that requires the Clockwork debugger to be enabled so that a token and profiler records exist; it is not anonymously reachable. Exploitation status: no public exploit identified at time of analysis, and the issue is remediated by upgrading to 2.1.7, which adds system.debugger.token to the Twig sandbox redaction list. This is a moderate-priority information disclosure flaw, not a critical emergency, because it needs valid editor credentials and Twig authoring rights and yields read-only exposure.
Authorization bypass in SurrealDB 3.0.0 through 3.3.0 allows authenticated record users to read records from other namespaces or databases by resolving record IDs via FETCH queries. Attackers can switch to a foreign namespace/database and use a RETURN … FETCH query to read another tenant's data if table PERMISSIONS allow reads. No public exploit identified at time of analysis; exploitation requires a valid authenticated session, multi-tenant deployment, and knowledge of a specific record ID.
Information disclosure in Open WebUI 0.11.0 through 0.11.3 allows an authenticated non-admin user who holds the tool export permission to retrieve the complete Python source code of tools shared with them in read-only mode by calling GET /api/v1/tools/export, exposing any API keys or credentials embedded in that source. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the impact is bounded by three prerequisites: a valid account, the specific tool export permission, and the presence of read-only shared tools that actually contain secrets. The issue is rated CVSS 4.0 7.1 (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N) and is fixed in 0.11.4.
Arbitrary file read in Frappe Framework versions before 15.117.0 and 16.x before 16.30.0 allows a user who can supply outgoing email HTML content to set an HTML attribute value pointing at a local server file path, which the framework then dereferences and exposes, disclosing server files readable by the Frappe service account. The flaw is remote and low-complexity but requires an authenticated account with enough privilege to author or configure outgoing email/notification content (CVSS vector PR:L, no victim user interaction), so its impact is confined to information disclosure of the service account's readable files rather than code execution or data modification; the vendor advisory GHSA-8v98-cfpm-9p67 and VulnCheck advisory describe the fix, and no public exploit code has been identified at time of analysis.
SQL injection in Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 allows an authenticated attacker holding at least low-level application credentials to inject SQL into database queries through specific endpoints that fail to validate input, resulting in extraction of sensitive data from the underlying database. The vulnerability is confidentiality-only (CVSS:4.0 7.1 / assessed CVSS:3.1 7.1, C:H with I:N and A:N) - there is no integrity or availability impact, and exploitation is not possible anonymously, so broad internet scanning is ruled out. No public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); risk is highest for internet-exposed instances that provision self-service or broadly distributed low-privilege accounts.
Authenticated SQL injection in Frappe ERPNext (before 15.106.0 and 16.x before 16.16.0) allows a low-privilege logged-in user to inject crafted input into several endpoints that build database queries without adequate validation, exposing sensitive data stored in the ERPNext database. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, vendor score 7.1) confirms high confidentiality impact with no inherent integrity or availability effect, and authentication is mandatory, so risk is concentrated where low-privilege accounts are widely issued, self-registration is enabled, or instances are internet-facing. No public exploit code and no confirmed active exploitation were identified at time of analysis, though the breadth of affected endpoints and the presence of a public GitHub security advisory make the issue operationally relevant for exposed, multi-tenant deployments.
SQL injection in Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 lets an authenticated low-privileged attacker read sensitive database information through specific endpoints that fail to validate input. Exploitation requires a valid low-privileged ERPNext session and network reachability to the affected instance; no user interaction or elevated privileges are needed, and patched 15.106.0/16.16.0 versions are not affected. There is no public exploit identified at time of analysis, and no CISA KEV entry is present in the provided data.
SQL injection in Frappe ERPNext allows authenticated attackers to read sensitive data from the underlying database by sending specially crafted requests to endpoints that fail to validate user-supplied input. The flaw affects ERPNext releases before 15.110.0 and 16.x versions before 16.21.0, and exploitation requires a valid low-privilege session (CVSS PR:L), so it cannot be triggered by an unauthenticated remote attacker. No public exploit code has been identified at time of analysis and no CISA KEV entry confirms active exploitation; the assessed risk is moderate-priority given the authentication barrier and the read-only confidentiality impact (C:H/I:N/A:N).