Unauthenticated remote code execution with elevated privileges is possible in Juniper Junos OS and Junos OS Evolved through the J-Web management interface. An attacker who can reach J-Web can send a crafted HTTP request to bypass authentication and execute CGI content with high confidentiality, integrity, and availability impact; the CVSS v4 base score is 9.3 and the assessed CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. No public exploit was identified at time of analysis, and the primary risk factor is exposure of J-Web to untrusted or internet-facing networks, since devices with J-Web disabled or restricted to a management network are not reachable.
Remote root code execution in the routing protocol daemon (rpd) of Juniper Junos OS is reachable through protocol-valid EVPN route advertisements sent by an established BGP/EVPN peer for a configured EVPN-VPWS service, while the identical input causes only an rpd crash (denial of service) on Junos OS Evolved. The underlying defect is a stack-based buffer overflow (CWE-121) in a daemon that runs with root privileges on FreeBSD-based Junos OS, so a successful overflow yields full device compromise, and Juniper has published patched builds under advisory JSA112187. The vendor's CVSS 4.0 base is 9.3 with AV:N/AC:L/PR:N/UI:N/VC:H/VI:H/VA:H, but real exposure is gated by the requirement that the attacker already hold a configured BGP/EVPN adjacency to the target device; no public exploit code has been identified at time of analysis and there is no KEV confirmation of active exploitation.
Remote code execution (on Junos OS) and rpd denial of service (on Junos OS and Junos OS Evolved) result from a stack-based buffer overflow in Juniper Networks routing protocol daemon (rpd). A remote configured BGP peer can trigger it by sending a flow-spec update that is selected for re-advertisement; exploitation requires an existing BGP peering relationship and the relevant flow-spec re-advertisement configuration. Rated Critical (CVSS 4.0 base 9.3), Junos OS can be compromised for code execution while Junos OS Evolved is limited to an rpd crash, and no public exploit identified at time of analysis.
Remote code execution with root privileges on Juniper Networks Junos OS and Junos OS Evolved is possible when the routing protocol daemon (rpd) processes crafted BMP route monitoring messages from a configured external BGP neighbor. Exploitation requires the target device to have an established external BGP (eBGP) session with the attacker-controlled peer and BMP route monitoring enabled; routers without BMP configured or without eBGP peers are not exposed. No public exploit code or active exploitation has been identified at time of analysis.
Remote code execution and denial of service in Juniper Networks Junos OS and Junos OS Evolved arise from a stack-based buffer overflow (CWE-121) in the httpd process that serves the J-Web management interface, reachable by an unauthenticated network attacker who can reach the J-Web HTTP(S) listener. The vendor-assigned CVSS 4.0 score is 9.3 (and our independent assessment maps this to CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, i.e. 9.8), reflecting full confidentiality, integrity and availability impact with no authentication or user interaction required; attack complexity is low in the base vector, though the real-world exploitable population is constrained by two configuration prerequisites. Successful exploitation is contingent on J-Web being enabled and a J-Web virtual-domain being configured - a non-default state - so devices with J-Web disabled or no virtual-domain configured are not affected. No confirmed active exploitation (CISA KEV) or public exploit code has been identified at time of analysis.
Authenticated users with query access to an administrator-configured DuckDB data source on Redash 26.0.0 through versions before 26.9.0 can read and write files on the Redash server with the privileges of the Redash process, because the DuckDB query runner opened connections with enable_external_access left at its default value of true. The practical impact escalates beyond data exposure: reading application secrets such as REDASH_COOKIE_SECRET or REDASH_SECRET_KEY allows forged session cookies and a full authentication bypass, which is why the issue carries a 9.3 CVSS 4.0 base score under a CWE-284 improper access control root cause. There is no public exploit identified at time of analysis, and exploitation is not possible without both an existing administrator-created DuckDB data source and a query-capable account (authenticated, low privileges per the CVSS PR:L metric), so instances that do not use the DuckDB query runner are unaffected.
Unauthenticated remote attackers can gain root-level configuration access and fully compromise Juniper Junos OS and Junos OS Evolved devices through the J-Web management interface when web management is enabled, due to improper authentication in NETCONF session handling. This is a critical vulnerability (CVSS 9.3/9.8) that requires only network reachability to the J-Web HTTP/HTTPS service; no credentials or user interaction are needed. No public exploit code or active exploitation has been identified at time of analysis, but the risk is genuine and high-priority as noted in independent assessment, not merely a high-CVSS artifact.
Integer underflow in the Junos OS kernel can crash a device when the Extended Echo feature (RFC 8335 ICMP probing) is configured, allowing a remote, unauthenticated attacker to cause a denial of service; the independent assessment rates the impact as availability-only (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). The exposure is bounded by the Extended Echo precondition, and no public exploit identified at time of analysis. Juniper advisory JSA112188 should be used to identify affected and fixed releases.
Heap-based buffer overflow in Juniper Networks Junos OS on SRX Series devices that have Secure Vector Routing (SVR) enabled allows unauthenticated remote attackers to cause a denial of service and potentially compromise confidentiality and integrity via malformed IPv4 packets. Exploitation requires the target device to have at least one interface explicitly configured for SVR, a non-default feature; devices without SVR are not exposed. At time of analysis, no public exploit code has been identified, but the flaw carries a critical severity rating (CVSS 9.3) and should be prioritized for patching on affected deployments.
Stack-based buffer overflow in Juniper Networks Junos OS and Junos OS Evolved BGP flowspec handling allows a configured BGP flowspec peer to compromise the routing engine or cause a routing-daemon denial of service when BGP update-threading is enabled. The vendor CVSS 4.0 score is 9.3, and the independent assessment is CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, reflecting a genuinely high-priority issue whose exploitability is more constrained than the critical score alone suggests: the attacker must already be a configured flowspec BGP neighbor, and update-threading must be enabled, so devices without those conditions are not exposed. Vendor patches are available in fixed builds such as Junos OS 23.2R2-S7.7, 23.4R2-S8.13, 24.4R2-S5, 25.4R1-S3, and 26.2R1-S2 (with corresponding Junos OS Evolved -EVO releases); no public exploit code has been identified at time of analysis.
Unauthenticated remote code execution as root affects Juniper Junos OS on MX Series routers that are configured for IKE/IPsec with certificate-based authentication, due to a stack-based buffer overflow in the key management daemon (kmd). An attacker with network access to the IKE service can send specially crafted IKE certificate-based packets to trigger the overflow and execute arbitrary code with root privileges. No public exploit code or confirmed active exploitation has been identified at time of analysis, but the vendor has released patches and the vulnerability carries a critical severity rating (CVSS 9.3 from Juniper, 9.8 assessed).
An authentication bypass in Better Auth versions 1.4.0-beta.18 through 1.7.6 allows unauthenticated attackers to sign in as other users by reusing OAuth state values as Magic Link tokens. The attack requires the target application to have both an OAuth/social sign-in provider and the Magic Link plugin enabled; the attacker must also know the victim's email address. No public exploit identified at time of analysis, but the vulnerability is rated critical (CVSS 9.3 per CVSS 4.0, 9.8 per assessed CVSS 3.1).
Missing authentication in NullHub through 2026.5.29 exposes the /api/* management API, so any remote attacker who can reach the listener can control agent instances, rewrite configuration including provider credentials, and manage cron jobs and MCP servers. The root cause is the auth_token field defaulting to null and never being assigned, meaning requests sent without Authorization and Origin headers are accepted without credentials (CWE-306). Exploitation requires the API to be bound to a non-loopback interface - the deployment pattern reflected in the project's Dockerfile - and once that exposure exists there are no further attacker prerequisites; severity is rated 9.2 and the independent assessment (CVSS:3.1 AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) treats this as a genuine high-priority issue rather than a CVSS-inflated one. No public exploit code was identified at the time of analysis, and the issue is not confirmed as actively exploited.
Out-of-bounds write in the Eclipse NetX Duo TLS 1.3 client lets a malicious or compromised server corrupt memory past the caller-supplied TLS packet buffer by returning a HelloRetryRequest containing an oversized cookie; the copy happens before certificate authentication completes, so no valid certificate is required. It is remotely triggerable without authentication (CVSS:4.0 base 9.3; independently assessed as CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and affects only devices acting as TLS 1.3 clients that initiate an outbound handshake to an attacker-controlled or MITM-positioned server. No public exploit code or CISA KEV entry was identified at time of analysis.
A stack-based buffer overflow in the kernel of Juniper Networks Junos OS Evolved can be triggered by a crafted TCP packet when key-chain authentication is configured for BGP or LDP sessions, leading to a kernel panic and denial of service. This remotely exploitable, unauthenticated vulnerability requires network reachability to BGP (TCP/179) or LDP (TCP/646) and the operator-side configuration of key-chain authentication for those protocols. No public exploit code or active exploitation has been identified at time of analysis; the assessed impact is limited to denial of service with no confidentiality or integrity impact, and it is not a code-execution threat.
Stack-based buffer overflow in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated BGP peer to cause a denial of service and potentially execute commands with root privileges via crafted BGP route updates when the BGP Monitoring Protocol (BMP) is enabled. Exploitation requires that BMP be explicitly enabled (not default) and that the attacker have an established BGP session, meaning a configured neighbor or compromised peer. No public exploit code has been identified at the time of analysis, and the vulnerability is not known to be actively exploited; patched releases are available from Juniper.
A stack-based buffer overflow (CWE-121) in the UTM Anti-Spam SBL inspection component of Juniper Networks Junos OS on SRX series firewalls lets an unauthenticated, remote attacker achieve arbitrary code execution or a denial of service by injecting a malformed DNS packet into the device's SBL lookup flow. Exploitation is gated by two real-world preconditions: the non-default UTM Anti-Spam SBL feature must be explicitly enabled, and the attacker must be positioned to inject or spoof the DNS response the device consumes (reflected by the CVSS 4.0 AT:P attack-requirements metric) - which is why the vendor's 9.2 score is tempered by our assessed CVSS 3.1 vector of AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. No public exploit code and no confirmed active exploitation were identified at time of analysis.
Heap buffer overflow in NGINX Plus and NGINX Open Source can be triggered by crafted HTTP requests when a non-default map directive with regex matching is configured so that the root directive or access log format references the map's regex capture variables before the map output variable, or when a non-cacheable variable is used in a string expression under specific conditions. The flaw is remotely reachable without authentication (CVSS PR:N) but has high attack complexity (AC:H) because exploitation depends on conditions beyond the attacker's control and on a non-default configuration; the realistic outcome on systems with ASLR enabled is worker-process restart/DoS, while code execution is limited to systems with ASLR disabled or bypassed. F5 rates this CVSS 4.0 9.2 (Critical), and no public exploit identified at time of analysis.
Heap buffer overflow in NGINX Plus and NGINX Open Source can be triggered by unauthenticated remote attackers through crafted HTTP requests, but only when a non-default configuration uses the alias directive together with rewrite and a set or return directive referencing the $request_filename variable, or when $request_filename is used in an access log format directive. Successful exploitation causes a heap buffer overflow in the NGINX worker process, leading to a restart (denial of service) and potentially allowing code execution on systems with ASLR disabled or bypassable. No public exploit code or active exploitation has been identified at time of analysis.
Remote code execution in Juniper Networks Junos OS on SRX Series devices configured for AutoDiscovery VPN (ADVPN) can let an attacker who already is a trusted ADVPN peer take complete control of the device via malformed ADVPN attributes that trigger a buffer overflow. Exploitation requires the attacker either to possess the ADVPN pre-shared secret to impersonate a peer or to have compromised a legitimate peer, and the independent assessment rates this as high severity but not an emergency despite the 9.2 CVSS 4.0 score. No public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthenticated attackers can take over Databasus accounts, including administrator accounts, by exploiting an authentication bypass in versions 3.7.0 through 3.61.0. The flaw allows brute-forcing six-digit password reset codes via POST /api/v1/users/reset-password because the application lacks rate limiting, account lockout, and code invalidation after failed attempts. No public exploit code has been identified at time of analysis, and while the flaw is high severity, real-world priority is tempered by the product's limited deployment footprint and absence of active exploitation signals.
Unauthenticated remote attackers who can reach Dgraph Zero's administrative HTTP port (default 6080) can read cluster topology via /state, allocate identifiers via /assign, invoke the exposed /moveTablet route, or remove cluster members via /removeNode in any Dgraph deployment prior to 25.4.0, destabilizing the Zero control plane and the Alpha nodes that depend on it. The /removeNode path accepts attacker-controlled id and group values and, when group 0 is supplied, reaches Server.RemoveNode and ProposePeerRemoval, giving a caller with only network access the ability to alter cluster membership. No public exploit identified at time of analysis, but the vendor CVSS 4.0 score of 9.2 reflects a fully remote, unauthenticated, low-complexity vector (PR:N confirmed) with high integrity and availability impact, cascading to dependent Alpha nodes; the practical limiting factor is network exposure of port 6080, which is intended to sit on a trusted network.
XML injection in the Unified Threat Management daemon (utmd) of Junos OS on SRX Series devices allows an unauthenticated network attacker to push arbitrary Junos device configuration that the daemon then commits with root privileges, by serving a crafted XML response from a configured custom URL-feed server. Exploitation is not opportunistic: the SRX must be running UTM with a custom URL-category feed pointed at an attacker-influenced server, and the attacker must either control that feed server or be positioned to intercept and modify its response (a MITM), which is why the vendor's CVSS 4.0 score of 9.2 sits alongside an independent assessed vector of CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. Impact is total on exposed devices - full confidentiality, integrity and availability loss on the affected SRX - but no public exploit has been identified at time of analysis and there is no confirmed active exploitation. Treat it as a genuine high-priority issue rather than an inflated high-CVSS artifact, and prioritize any SRX running a custom URL-feed.
Remote code execution in GitPython 3.1.30 through 3.1.x allows unauthenticated attackers controlling the positional refspec argument to Remote.pull() to execute arbitrary OS commands via a crafted --upload-pack option, bypassing the library's keyword-only unsafe-option guard. The flaw affects local-path and SSH transports and is fixed in 3.2.0; no public exploit code has been identified at time of analysis, but the vulnerability carries a CVSS 4.0 base score of 9.2 and requires the calling application to pass attacker-controlled data as the positional refspec.
Denial of service against the Two-Way Active Measurement Protocol (TWAMP) client in Juniper Networks Junos OS allows an unauthenticated, network-positioned attacker to crash the rmopd service by sending a single specially crafted TCP packet. Only devices on which the TWAMP client feature is configured are exposed, since the faulty code path lives in that client; the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, vendor-scored 9.2 under CVSS 4.0) confirms no authentication, privileges, or user interaction are required once the feature is enabled, and impact is confined to availability with no confidentiality or integrity effect. No public exploit identified at time of analysis, and no CISA KEV entry accompanies this advisory; the realistic risk is driven by the non-default nature of the TWAMP configuration rather than by broad internet-scale exposure.
Unauthenticated remote attackers can trigger a use-after-free in NGINX's ngx_http_core_module when asynchronous file I/O (AIO) is enabled and a Server Side Includes (SSI) page containing 'include virtual' commands is processed, causing memory corruption or a worker process crash. This affects both NGINX Plus and NGINX Open Source, with code execution possible only on systems where Address Space Layout Randomization (ASLR) is disabled or can be bypassed. Exploitation requires a non-default configuration (AIO and SSI enabled), and no public exploit code was identified at time of analysis.
Unauthenticated server-side request forgery in Kan 0.5.5 through 0.6.0 allows remote attackers to make the server issue arbitrary outbound HTTP requests through the /api/download/attatchment route by supplying a crafted url query parameter. The flaw is an incomplete fix for CVE-2026-32255 and only manifests when the S3_ENDPOINT environment variable is unset or blank - the configuration the project's own .env.example documents as the intended setup for AWS S3 - in which case hostname validation is skipped entirely and the attacker-controlled URL is handed directly to fetch(). No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (no CISA KEV listing), but EPSS/scoring data and the unauthenticated network vector (CVSS 4.0 base 9.2, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) make this a high-priority fix for exposed deployments.
Root-level code execution is possible on Juniper SRX Series devices running Junos OS, because the ipfd daemon passes externally supplied data retrieved from a configured HTTPS feed server into a formatted-output function, allowing the feed server to inject format specifiers that corrupt memory and hand the attacker code execution as root (CWE-134, CVSS 4.0 base 9.2). The flaw is unauthenticated with no user interaction (PR:N/UI:N), but the CVSS 4.0 vector carries AT:P because two prerequisites must hold: the SRX device must actually be configured to consume an HTTPS feed source, and the attacker must either compromise or impersonate that feed server, which is why the independent assessment maps the issue to CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H rather than treating it as a default-configuration remote takeover. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, so a default, feed-less SRX configuration is not directly reachable by arbitrary internet attackers; the risk concentrates on deployments that actively pull external feeds.
Remote code execution as root in Juniper Networks Junos OS on SRX Series allows unauthenticated network-based attackers to execute arbitrary code via a SQL injection flaw in the ipfd process, but exploitation requires that the SRX device be configured with a Security Intelligence (SecIntel) feed connection. This high-severity vulnerability (CVSS 4.0 base score 9.2) has no public exploit identified at time of analysis. Devices without SecIntel configured are not exposed.
Remote unauthenticated attackers can retrieve confidential PDF invoices from Copart's Online Billing Service because the endpoint that serves those documents performs no authorization check, exposing customer names, addresses, invoice numbers, payment details and tax information. Exploitation is made easier by invoice document URLs that are publicly indexed by search engines and by predictable invoice identifiers, which allow an attacker to enumerate and pull additional files beyond any single leaked link. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, but the CVSS 4.0 base score of 9.2 (Critical) reflects a fully remote, low-complexity, unauthenticated vector with high confidentiality impact on both the vulnerable service and a subsequent system.
Arbitrary shortcode execution in Click to Chat for WhatsApp plugin versions up to and including 4.44 allows unauthenticated remote attackers to run registered WordPress shortcodes by injecting delimiters into the URL of an archive page, which is substituted into the {url} greeting placeholder and then passed to do_shortcode() without sanitization. Exploitation depends on a non-default configuration: the greetings feature must be active and rendering greetings-1 or greetings-2 templates on archive pages with the {url} placeholder present, and meaningful impact requires a dangerous shortcode from WordPress core, the active theme, or another plugin. The CVE assigns a 9.1 base score (AC:L), but our independent assessment sets attack complexity to High (AC:H); no public exploit code or active exploitation has been identified at time of analysis.
Authentication bypass in Zulip Server through 12.1 can log an attacker into an existing user account when OIDC single sign-on is configured with a misconfigured identity provider. The GenericOpenIdConnectBackend matches the IdP's email claim against an active account's delivery_email without rejecting an explicit email_verified=false, so a user who does not control that address can be authenticated as the account that owns it. Exploitation requires OIDC SSO to be enabled, a trusted IdP that emits email addresses the authenticating user does not control, and a pre-existing account whose delivery_email matches that address; deployments whose IdP only emits user-controlled addresses are explicitly not affected. The vendor fixed the flaw in Zulip Server 12.2, unauthenticated remote exploitation is rated Critical (CVSS 4.0 9.1, AT:P), and no public exploit has been identified at time of analysis.
Authentication bypass in Better Auth's OAuth Proxy plugin (versions 1.5.0-beta.12 through 1.7.6) lets unauthenticated remote attackers sign in as arbitrary users by forging encrypted profile state when the plugin is deployed with a shared global secret and cookie-stored OAuth state, abusing implicit account linking against a victim's verified email to seize the account. The vendor rates the flaw 9.1 (CVSS 4.0) with high attack complexity and a present attack requirement because exploitation depends on that specific shared-secret/cookie-state configuration rather than a default install; no public exploit code has been identified at time of analysis and there is no CISA KEV entry. Priority risk is therefore concentrated on deployments that have enabled the OAuth Proxy plugin in that exact configuration; upgrading to 1.7.7 or later closes the bypass.
Administrative account takeover in the Hitachi Vantara application is possible when password reset and email delivery are enabled, because reset-code attempts are not rate limited, allowing unauthenticated attackers to brute-force reset codes. The CVSS 4.0 score is 9.1 (Critical), but an independent assessment uses CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N because exploitation depends on the reset flow being active and email configured; impact is bounded to application administration functions and does not expose device credentials or customer data. No public exploit code or CISA KEV entry was identified in the provided data.
Eclipse Vert.x's HTTP client (io.vertx:vertx-core) caches SSL contexts using a cache key that does not fully capture the SSL semantics of the requested properties, so a caller asking for a context with hostname/endpoint-identification validation can be handed a cached context that silently ignores it - a TLS trust-decision failure affecting versions 5.0.0 through 5.0.12, 5.1.0 through 5.1.9, and 5.2.0. The issue is unauthenticated (CVSS vector PR:N/UI:N) but rated high attack complexity because exploitation additionally requires the application to create multiple SSL contexts with differing security properties and an attacker to hold a man-in-the-middle network position to abuse the resulting loss of certificate verification. There is no public exploit identified at time of analysis and no CISA KEV listing; the advisory-driven CVSS 4.0 score is 9.1, while the independent v3.1 assessment rates it lower (High, ~7.4) with AC:H, reflecting the configuration-dependent and MITM-gated prerequisites.
Unauthenticated remote attackers can mint valid JWT access tokens - and thereby log in as an administrator - on affected Hitachi Vantara deployments by abusing the private key shipped inside the product's default self-signed SSL certificate (CWE-321, hard-coded cryptographic key). Exploitation is gated by a single configuration precondition: the web interface must still be running the out-of-the-box default certificate whose key material is reused to sign session JWTs, which is why the vendor's CVSS 4.0 vector carries AT:P (attack requirements present) even though no authentication or user interaction is needed (PR:N/UI:N). Impact is bounded to administrative/configuration control such as changing service settings or requesting log collection - the vendor states device credentials and customer data are not reachable - and no public exploit was identified at time of analysis (the issue is not in CISA KEV).
Command injection in Dokku before 0.38.25 allows a user with authenticated app-level Dokku access and remote SSH access to store shell-substitution payloads through the docker-options plugin, and also via dokku run -e/--env values and --ttl-seconds; on the next build, deploy, or run, Bash eval interprets the stored value and executes arbitrary commands as the dokku OS user. Exploitation is privilege-gated, requiring valid app-level credentials and SSH access rather than being remote-unauthenticated, and no public exploit was identified at time of analysis despite the CVSS 9.0 severity.
Dell Terraform Provider for Redfish versions before 1.6.2 exposes Redfish BMC traffic, including credentials, to man-in-the-middle interception because TLS certificate verification is unconditionally disabled in its base HTTP transport. This critical-severity flaw (CVSS 9.0) allows an unauthenticated remote attacker who occupies a MITM position to capture or alter sensitive Redfish API communications, though exploitation is condition-gated to active provider-to-BMC traffic windows and is materially lower risk on trusted, isolated management segments. No public exploit identified at time of analysis; Dell recommends upgrading to 1.6.2.
Renovate before 44.60.1 on self-hosted instances lets an attacker with a legitimate foothold (PR:L in the assessed vector, i.e., control of a repository or externally sourced preset the instance already extends) bypass the restricted environment-variable allowlist by embedding an env block inside a shared preset, overriding variables such as PATH, LD_PRELOAD, NODE_OPTIONS, or GIT_SSL_CAINFO in child processes. Because those variables govern dynamic library loading, runtime module resolution, command lookup, and TLS trust stores, a successful bypass can escalate from a poisoned preset into arbitrary code execution or credential and traffic interception inside the Renovate execution context. The exposure is narrow but severe for the population it touches - self-hosted deployments that extend third-party or community presets while treating allowedEnv as a security boundary - and no public exploit identified at time of analysis; the record carries no KEV status or EPSS score.