Unauthenticated remote code execution in Cognition before 0.13.0 lets any network-reachable attacker create a session through POST /sessions and post a message through POST /sessions/{id}/messages, driving the Deep Agents ReAct loop to execute attacker-supplied shell commands via the default local execution backend. Default deployments are exposed because the REST/SSE API ships without authentication and the agent sandbox backend defaults to local execution; publicly available exploit code exists, and the main limiting factor is whether operators placed the API behind an authenticating reverse proxy or configured a non-local sandbox backend. Vendor-released patch: 0.13.0.
Authenticated expression injection in Camunda 7 (7.24.0 through 7.24.13 and 7.23.0 through 7.23.16) lets a user who can reach the ad-hoc task-query API bypass the enableExpressionsInAdhocQueries restriction and execute arbitrary OS commands as the engine service account. The validator does not inspect sub-query expression maps in TaskQueryDto.orQueries, so a crafted JUEL expression can trigger Java reflection and Runtime.exec. Publicly available exploit code exists; the vendor has released fixed versions 7.24.14 and 7.23.17, and CISA KEV status is not indicated.
Relay-based impersonation in the CCC-Attestation attested-tls-poc reference implementation (all versions through commit 731ca82) lets an attacker who holds an extracted attested-TLS private key forward a relying party's attestation nonce to a genuine attester and replay the returned, valid Evidence on the attacker's own connection, thereby masquerading as the attested workload and intercepting data meant for it. The root problem is that early attestation Evidence is never cryptographically bound to the TLS connection, so possession of the key plus a position on the relay path is sufficient; CVSS 4.0 scores this 9.1 with AC:H, AT:P and PR:N, meaning no credentials are needed but attack requirements (key control, relay placement) are present. Publicly available exploit code exists in the form of the published ProVerif formal models and relay-attack artifacts, while no CISA KEV entry indicates confirmed active exploitation.
OS command injection in the H3C Magic NX15 consumer router (confirmed on firmware 100R017) lets a remote attacker who already holds a low-privilege authenticated session run arbitrary operating-system commands on the device via the sub_416874 function of /usr/bin/usrlist. The flaw scores 8.6 under CVSS v4.0 and 8.6-equivalent High under the assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N with full C/I/A impact), and publicly available exploit code exists - a working proof-of-concept and writeup for the usrlist command-injection path have been published on GitHub. The vulnerability is not listed in CISA KEV, so this is a public-PoC threat rather than a confirmed in-the-wild campaign; the practical risk hinges on whether the management interface is reachable from an untrusted network, since default deployments typically keep it LAN-side.
Path traversal in MLflow’s FileStore tracking backend allows unauthenticated remote attackers to write attacker-controlled trace metadata outside the intended experiment traces directory by submitting a crafted trace ID to the POST /api/3.0/mlflow/traces endpoint. MLflow 3.17.1 and earlier are affected; FileStore is the default backend before 3.7.0 and opt-in from 3.7.0 onward, so exposure depends on backend selection and network reachability. Publicly available exploit code exists, but no CISA KEV confirmation is present in the provided data; assessed impact is high integrity and low availability with no confidentiality impact.
Code injection in the H3C Magic NX15 home router (firmware NX15V100R017) allows a low-privilege authenticated attacker to manipulate the `path` argument of the `write` function exposed at /api/esps and achieve arbitrary file writes that escalate to root-level remote code execution. The flaw is remotely reachable over the RPC management interface (CVSS 4.0 score 8.6, AV:N/AC:L/PR:L/UI:N with high confidentiality, integrity, availability and subsequent-system impact; assessed as CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), with the PR:L prerequisite and the network exposure of the management interface acting as the main practical limits rather than attack complexity. Publicly available exploit code exists, including a published proof-of-concept for the file-write-to-root-RCE chain; no CISA KEV entry or confirmed in-the-wild exploitation was provided in the source data.
Missing authorization checks in Camunda 7's engine-rest task sub-resources allow any authenticated user to read, download, or permanently delete task comments and attachments without holding any permission grant on the target task. Versions 7.24.0 through 7.24.13 and 7.23.0 through 7.23.16 are affected; the attacker only needs a valid session and the target comment or attachment object ID. Publicly available exploit code exists and the issue is rated 8.6 under CVSS 4.0, making this a genuine priority for deployments that expose engine-rest.
Unauthenticated remote attackers can crash the SGLang inference server (versions up to and including 0.5.19) by calling its expert-distribution recording control endpoints - /start_expert_distribution_record, /stop_expert_distribution_record and /dump_expert_distribution_record - on a server that was launched without --expert-distribution-recorder-mode, which is the default configuration. Because the recorder is never initialized in that state, the request path into Scheduler.expert_distribution_handle fails without a handled error, producing a denial of service against the serving process; confidentiality and integrity are unaffected. Publicly available exploit code exists (a proof-of-concept is linked from the vendor issue tracker), but there is no evidence of confirmed active exploitation (no CISA KEV listing); the practical gate on real-world abuse is whether the SGLang control API is reachable from an untrusted network, since these endpoints are typically bound to internal or trusted segments. Vendor-released patch: not confirmed - the fix is an upstream pull request (sgl-project/sglang#42098) that is still awaiting acceptance.
Stored cross-site scripting in the Document Gallery WordPress plugin through 5.1.1 lets any authenticated user with the Contributor role or higher embed malicious event-handler attributes inside gallery shortcode attributes, which are then rendered unescaped into the page markup. Because the injected payload is stored in post content, it executes in the browser of a higher-privileged editor or administrator who later views or previews that content, potentially leading to session/token theft or full site takeover via an admin session. Publicly available exploit code exists (WPScan advisory), but the flaw is not in CISA KEV and carries no EPSS score in the supplied data, so there is no evidence of active or widespread exploitation - only demonstrated feasibility. Risk is tempered by the required authenticated foothold and the mandatory privileged-victim interaction (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N per independent assessment).
Stored cross-site scripting in the Blaze Demo Importer WordPress plugin before 1.0.17 allows authenticated users holding the Author role or higher to upload crafted SVG files that execute arbitrary JavaScript in the browser of any user who later opens or previews them. The plugin both skips sanitization of uploaded SVGs and unconditionally registers the SVG MIME type with the WordPress media library, bypassing WordPress's default block on SVG uploads. Publicly available exploit code exists and the issue carries a moderate CVSS 6.8; because the payload is passive-stored and only fires when a second user (typically an administrator) opens the file, risk is concentrated on multi-author sites that grant Author accounts to untrusted or self-registered users, while sites with only trusted staff face materially lower exposure.
Unauthenticated remote command execution is possible in MLJAR Mercury 3.0.0 through 3.2.3 because a missing comma in the BLOCKED_PATTERNS list merges the /lab and /api/terminals regular expressions into a single pattern, so requests to /api/terminals no longer match the anonymous-endpoint blocklist and are proxied straight to Jupyter Server's terminal API. An attacker with network access to a Mercury instance that serves dashboards to anonymous users can therefore open an interactive operating-system shell and run commands with the privileges of the Mercury process (CVSS 10.0, AV:N/AC:L/PR:N/UI:N/S:C). All severity signals agree - network reachability with no credentials or user interaction, scope change into the underlying Jupyter Server, and high confidentiality/integrity/availability impact - and the only limiting factor is that the instance must be reachable and running an affected version; no public exploit code or confirmed active exploitation was identified at time of analysis.
Authorization bypass in Camunda 7 Cockpit allows authenticated users with minimal Cockpit access to read all process instances, process definitions, and incidents engine-wide without logging when the engine has a non-empty disabledPermissions configuration. Affected versions are Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17. Publicly available exploit code exists, and a vendor patch is available; exploitation requires both valid Cockpit credentials and the non-default non-empty disabledPermissions setting, so exposure is configuration-dependent.
Unauthenticated remote code execution affects the camel-hazelcast component of Apache Camel 4.0.0 through 4.18.4 and 4.19.0 through 4.22.0, where two self-built Hazelcast bootstrap paths create instances without the default JavaSerializationFilterConfig added for CVE-2026-43865. A route using ReplicatedHazelcastAggregationRepository without an injected hazelcastInstance, or a client-mode endpoint built by HazelcastDefaultComponent#getOrCreateHzClientInstance() when neither a ClientConfig nor hazelcastConfigUri is supplied, will accept and deserialize arbitrary Java objects published into the backing cluster, letting an attacker who can write into that cluster execute code before Camel ever processes the exchange. Hazelcast clusters ship without authentication or TLS by default, so the write prerequisite is often met in practice; no public exploit code or CISA KEV entry was identified at time of analysis, but the vendor has published fixed releases and the missing-filter condition requires no unsafe opt-in by the deployer.
Supply-chain malware in Rank Math SEO PRO 3.0.123 packages downloaded or updated between October 15, 2026 at 20:02 UTC and October 16, 2026 at 07:12 UTC can compromise WordPress sites that activated the affected plugin, exposing credentials and enabling persistent backdoor access. The vendor-confirmed incident is limited to that roughly 11-hour distribution window and requires plugin activation; running version 3.0.123 obtained outside the window is not sufficient to establish compromise. Rank Math released version 3.0.124 as the clean replacement, and no public exploit was identified at time of analysis in the provided data.
OS command injection in orbitale/imagemagick-php through 3.3.5 lets unauthenticated remote attackers inject shell metacharacters through the fontFile argument of Command::font when a host application passes untrusted input to that parameter. Publicly available exploit code exists, but there is no CISA KEV confirmation and exploitation depends entirely on whether the calling application exposes fontFile and on the OS/shell context in which ImageMagick commands run. The vendor did not respond to disclosure, and no vendor-released patch was identified at time of analysis.
Remote code inclusion in the HivePress WordPress plugin (versions through 1.7.32) lets an authenticated low-privileged user execute arbitrary code on the server, since the injection flaw is reachable over the network with low complexity and no user interaction in a changed-scope context. Because HivePress powers marketplace and listing sites that frequently allow open vendor or user self-registration, the PR:L barrier is often trivial to clear in real deployments. No public exploit code or CISA KEV entry was identified at time of analysis, but the severity (CVSS 9.9) and low prerequisite make it a high-priority patch target; sites that disable public registration materially reduce exposure.
Authenticated attackers with low privileges can upload dangerous files, including PHP web shells, to WordPress sites running the MapSVG plugin through version 8.16.1, potentially achieving remote code execution. The vulnerability is an unrestricted file upload (CWE-434) that requires a valid low-privileged account but no user interaction, and the CVSS vector indicates high confidentiality, integrity, and availability impact with scope change. No public exploit identified at time of analysis, yet the high CVSS score and web-shell outcome make this a high-priority issue.
Unsafe reflection in Apache Johnzon's ClassConverter can cause the library to load and statically initialize an attacker-named class from untrusted JSON, potentially producing code execution or other harmful side effects when a suitable classpath gadget and an exposed deserialization path exist. Signals conflict sharply and should be weighed together rather than reading the 9.8 at face value: the public CVSS is 9.8 and SSVC technical impact is total, but the assessed vector uses AC:H, EPSS is 0.36% (28th percentile), no CISA KEV entry was present, and no public exploit identified at time of analysis. The issue affects Johnzon 1.0.0 to before 1.3.1 in the javax namespace and 2.0.0 to before 2.2.0 in the jakarta namespace, with fixed releases 1.3.1 and 2.2.0.
SQL injection in SLiMS (Senayan Library Management System) Bulian 9.8.0 lets any authenticated staff user extract arbitrary database contents by supplying malicious SQL identifiers in the tableName and tableFields POST parameters of the admin AJAX endpoints admin/AJAX_lookup_handler.php, admin/AJAX_check_id.php and admin/AJAX_vocabolary_control.php. The submitted CVSS of 9.8 with PR:N conflicts with the documented requirement for a valid staff login, so the realistic exposure is a post-authentication confidentiality breach (independently assessed as C:H/I:N/A:N) rather than a pre-auth compromise. EPSS is low at 0.33% (25th percentile), there is no CISA KEV entry, and no confirmed public exploit code was identified at time of analysis, although a GitHub repository named for this CVE appears in the references and warrants triage. No vendor-released patch version is confirmed in the available data.
Command injection in GeoVision GV-ASManager's GeoWebServer.exe allows unauthenticated remote attackers who can reach the default web ports to execute arbitrary OS commands with high confidentiality, integrity, and availability impact. The CVSS 3.1 score is 9.8 and the weakness class is CWE-78, but no public exploit identified at time of analysis and no CISA KEV entry is present in the supplied data. Because the management web service is typically central to access-control operations, exposed instances should be treated as high priority while the exact affected version range and vulnerable endpoint are confirmed against GeoVision's advisory.
Remote code execution in IBM MQ Operator and IBM MQ Advanced container images is possible when a TLS-enabled channel processes a malformed TLS certificate whose distinguished name overflows a stack buffer during connection establishment. The flaw is rated 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) because the certificate parsing happens before any authentication completes, so a remote attacker reaching a TLS listener on an affected queue manager needs no credentials and no user interaction; successful exploitation yields full compromise of confidentiality, integrity and availability. Exposure is bounded by configuration: only queue managers whose channels accept or require TLS (for example with SSLCIPH set) reach the vulnerable parsing path. A vendor patch is available, EPSS is low at 0.25% (15th percentile) and SSVC records exploitation as none with automatable no, so no public exploit code has been identified at time of analysis, but the priority label is act_now given total technical impact across a very broad set of shipped container image and operator versions.
Unauthenticated remote code execution in MLJAR Mercury deployments running the default tokenless configuration allows any network-reachable client to create a Jupyter kernel and send execute_request messages containing arbitrary Python, resulting in code execution as the Mercury server process user. Mercury versions through 3.2.5 are affected and 3.2.6 is the fixed release; deployments that require a token or password via MERCURY_TOKEN or --token are not exploitable through this path. The issue is assessed at CVSS 9.8, publicly available exploit code exists, but no active exploitation is confirmed (not in CISA KEV).
SQL injection in SENAYAN Library Management System (SLiMS) Bulian 9.8.0 allows attackers who can reach the administrative reporting endpoint to manipulate SQL queries through the fileID parameter in admin/modules/reporting/customs/dl_detail.php, potentially exposing, modifying, or deleting library data. The supplied CVSS 3.1 vector rates this 9.8 with PR:N, but our assessed vector requires low privileges (PR:L) because the vulnerable script is under the /admin/ tree; authentication requirements should therefore be confirmed against the source. No CISA KEV entry or confirmed public exploit was identified at time of analysis.
Stack-based buffer overflow in H3C Magic NX15 firmware NX15V100R017 can be triggered remotely through the /usr/bin/usrlist function sub_416874, causing a denial-of-service condition by crashing the affected service. Exploitation requires network reachability plus low-level privileges (CVSS PR:L), so an attacker needs an existing authenticated session or equivalent low-privilege access to the router. Publicly available exploit code exists, but the independent CVSS:3.1 assessment is availability-only with PR:L and points to moderate, not critical, priority.
Unrestricted file upload in Eptura Archibus lets a user with a low-privileged account submit an export report containing arbitrary JSP code with a JSPX extension and then browse to the stored file, causing the Java application server to execute attacker-controlled code. Because the upload normally requires an account, the separately disclosed authentication bypass is the key force multiplier: chaining the two removes the authentication prerequisite and yields unauthenticated remote code execution on Java/JSP-capable deployments where uploads are stored in a web-executable location. Rapid7 reports the vendor has fixed the issue; no public exploit code or CISA KEV entry was identified at time of analysis.
Unauthenticated remote attackers can influence which classes or code paths are loaded by the speaches speech server (all builds up to and including 0.9.0-rc.3) by supplying a crafted 'model' argument to PyannoteDiarizationModelManager._load_fn in src/speaches/executors/pyannote_diarization.py. The CVSS 4.0 base score is 5.5 with impact limited to low confidentiality, integrity and availability (VC:L/VI:L/VA:L), and publicly available exploit code exists (a PoC archive is linked from the advisory) - there is no CISA KEV confirmation of active exploitation. Practical exposure is bounded by the need for the server to be network-reachable, the diarization feature to be enabled, and the deployment to run an affected pre-release build of this niche self-hosted tool.
Denial of service in SGLang 0.5.19 and earlier allows an attacker who can reach the remote weight-export path to supply an unregistered group_name to WeightExporter.send_weights_to_remote_instance, triggering an unhandled KeyError that aborts the export operation. The CVSS vector rates it network-reachable and unauthenticated (PR:N), but practical exposure depends on whether the remote weight-export feature is actually reachable in the deployment, and impact is limited to availability loss of that operation rather than full service compromise. Publicly available exploit code exists, while the upstream fix is a pull request that awaits acceptance.
SQL injection in satya-vinay Events-Management-System allows unauthenticated remote attackers to manipulate the id, name, title, year, gender, fromdate, todate, and people parameters in doedit.php, affecting registration data with limited confidentiality, integrity, and availability impact. The application is a rolling-release GitHub project with no versioned fix, and publicly available exploit code exists; no CISA KEV entry was provided, so active exploitation is not confirmed. Real-world priority is modest because the product is niche and unmaintained, but the doedit.php endpoint must be internet-reachable for exposure.
Unauthenticated information disclosure in Dav-ee dairy-management-system lets remote attackers manipulate the fname argument of the delivery/checkfarmer.json.php AJAX endpoint to expose sensitive data; affected deployments are rolling-release snapshots such as commits 31ace9692d1e1e6d64339a42c463b361319c615c and f31a584c3330c013b61f8b0306d9e0849c6d693d, and no version-specific fixed release is provided. Publicly available exploit code exists via the project's GitHub issue, but there is no CISA KEV confirmation of active exploitation. Impact is limited to confidentiality (CVSS 4.0 base 6.9; assessed CVSS 3.1 5.3), with no integrity or availability effect, and practical exposure depends on internet-reachable instances of this small-deployment PHP application.
SQL injection in vraj404 Criminal-Management-System's search.php lets unauthenticated remote attackers manipulate the Search parameter to access or alter limited data and affect availability, with low impact assessed across confidentiality, integrity, and availability. The project uses a rolling release, so all deployed snapshots up to commit 2808d057e7ddc5295519a487365b0cacfd0ba8c4 should be treated as potentially affected, and publicly available exploit code exists via the project's GitHub issue tracker. No CISA KEV listing or confirmed active exploitation is available, and real-world priority is low-to-moderate because exposure depends on an organization self-hosting and network-exposing this niche PHP application.
SQL injection in the /ws.asmx SOAP endpoint of Wubang Five-in-One Safety Production Management Information System through version 3.5 allows unauthenticated remote attackers to manipulate the 'sql' argument passed to the xp_cmdshell function, with limited confidentiality, integrity, and availability impact and possible escalation to database or OS command execution if MSSQL xp_cmdshell is enabled. Publicly available exploit code exists, but there is no CISA KEV confirmation; the vendor reportedly did not respond to disclosure. The issue is moderate severity (CVSS 5.5) and is most relevant to exposed deployments of this niche industrial safety-management product.
Denial of service in GPAC MP4Box 2.5-DEV (rev1672-gc9a31d0e1-master) occurs when SAP-dump processing of a crafted MP4 file reaches dump_isom_saps and uses a missing sample result, crashing the MP4Box process. The issue is local and requires user interaction because the victim must run MP4Box with SAP dumping enabled against the attacker-supplied file, and impact is limited to availability with no code execution or data disclosure. Publicly available exploit code exists, and the upstream project has a fix commit adding a null check, but no CISA KEV active-exploitation listing was provided.
Sensitive information exposure in Webkul Aureus ERP through 1.6.0 allows unauthenticated remote attackers to retrieve debugging-related data reachable via composer.json, and publicly available exploit code exists. The CVSS 4.0 vector shows network reachability with no privileges or user interaction and only low confidentiality impact; integrity and availability are unaffected, and there is no CISA KEV confirmation. Real-world risk is limited to deployments that expose composer.json or associated debug/metadata output, with the product's narrow footprint further reducing exposure.
SQL injection in vraj404 Criminal-Management-System, through commit 2808d057e7ddc5295519a487365b0cacfd0ba8c4, lets remote attackers submit crafted values in the Officer Registration Form at Officers/addOfficer.php to alter backend MySQL queries. Publicly available exploit code exists, and the vendor's CVSS 4.0 vector rates the issue PR:N, while the independent assessment notes that a valid session may be required if the endpoint is not reachable without authentication. The project has not responded to the issue report, and no patched release is identified.
Unauthenticated SQL injection in the Search Page of vraj404 Criminal-Management-System (`Officers/searchOff.php`) allows remote attackers to manipulate the `Search` parameter passed to `mysqli_query`, exposing sensitive records and permitting limited data modification. The application is a niche open-source PHP project on a rolling release with no published affected or fixed version, and the vendor has not responded to the issue report; publicly available exploit code exists, but there is no CISA KEV confirmation of active exploitation. With a CVSS 4.0 score of 6.9 and exposure-dependent preconditions, the practical risk is moderate and concentrated on Internet-reachable deployments.
Unrestricted file upload in vraj404's Criminal-Management-System lets a remote attacker push an arbitrary file through the 'my_img' parameter handled by move_uploaded_file in home.php, which can result in attacker-controlled content being written into a web-reachable location and potentially executed. All deployments built from the repository up to commit 2808d057e7ddc5295519a487365b0cacfd0ba8c4 are affected, and because the project follows a rolling release model with no tagged versions, there is no defined fixed release to upgrade to. Publicly available exploit code exists and the maintainer has not responded to the issue report, though real-world exposure is limited by the project's niche, single-developer nature and near-absent production footprint; no public exploit identified at time of analysis beyond the published proof-of-concept, and no CISA KEV listing applies.
Information disclosure in OctoAlly (ai-genius-automations/octoally) through version 1.0.87 lets remote attackers manipulate the path argument handled in server/src/index.ts to expose data the server should not return. Per the CVSS vector (PR:N, AV:N) no authentication is required, and because pre-1.0.88 builds default to binding all interfaces with no Host or Origin validation, exposure is reachable either directly over the network or through a victim's browser via DNS rebinding or cross-origin requests against an otherwise loopback-only deployment. Publicly available exploit code exists (upstream issue #24) and the vendor shipped a fix in 1.0.88; no confirmed active exploitation (CISA KEV) has been reported, and the CVSS 4.0 base score is 6.9 with E:P reflecting proof-of-concept maturity rather than in-the-wild use.
Unauthenticated remote attackers can retrieve sensitive files such as project.sql from satya-vinay Events-Management-System deployments running up to commit 437c77ceb69bf9fe2e3f4f46f7871b83f425383a, exposing database schema or seed content. Publicly available exploit code exists and the project has not responded to the issue report, although no CISA KEV entry confirms active exploitation. The assessed impact is read-only confidentiality loss; integrity and availability are not affected.
Missing authentication enforcement across multiple endpoints in satya-vinay Events-Management-System (rolling-release code through commit 437c77ceb69bf9fe2e3f4f46f7871b83f425383a) lets unauthenticated remote attackers reach functionality that should require login, yielding Low confidentiality, integrity, and availability impact without scope change. Publicly available exploit code exists via VulDB and GitHub issue #4, but no CISA KEV confirmation is present in the supplied data; the assessed CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. Because the project uses a rolling release and has not responded to the issue report, no fixed version is identified and defenders must identify exposed deployments by commit or deployment state.
SQL injection in the dodelete.php Registration-Delete Handler of satya-vinay Events-Management-System allows unauthenticated remote attackers to manipulate the ID parameter and influence backend SQL queries, with low impact to confidentiality, integrity, and availability per the assessed vector. Publicly available exploit code exists via the linked GitHub issue, but the flaw is not confirmed actively exploited (not in CISA KEV); no vendor-released patch or fixed version is identified, and the project has not responded to the report.
SQL injection in the administrative document viewer of subhajitkhan's Online Clinic Management System allows remote attackers to supply a crafted docid value to admindocview.php and influence backend SQL queries, with the supplied vector indicating no privileges or user interaction are required. Publicly available exploit code exists, and the rolling-release project has not issued a fixed version or responded to the upstream issue, so deployments remain exposed until the endpoint is manually hardened or restricted. The practical risk is moderate: the CVSS v3.1 assessment rates confidentiality, integrity, and availability impact as low, and any login enforced on the admin area would be a key prerequisite to verify.
FlyCms through commit edfdf724 permits unauthenticated remote takeover because it retains a default super-administrator account, flycms/admin123, reachable through POST /api/auth/login with only an image captcha as a barrier. An attacker who can reach that endpoint and solve the captcha can obtain full control of site content, users, and configuration. This is a genuine high-priority default-credentials issue (CWE-1392); no CISA KEV listing or public exploit code was identified at time of analysis, and the assessed CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Google OSS Agent Mesh (SAM) 0.1.0-alpha.1 through 0.1.0-alpha.8 allows remote attackers to self-enroll into the mesh and invoke arbitrary tools across every connected MCP backend node. The control plane exposes GET /info publicly, auto-enrolls any valid OIDC token holder via POST /register without claim filtering or ban checks, and ships a default policy binding sam:system:authenticated to wildcard services and targets, so a token holder can obtain a mesh credential with full read, write, and execution access. No public exploit code or active exploitation is confirmed at time of analysis, though the CVSS vector is PR:N and practical risk depends on whether the configured OIDC provider lets an attacker self-obtain a valid token; upgrading to 0.1.0-alpha.9 enforces fail-closed defaults, explicit policy-binding requirements on enrollment, and ban checks.
Unauthenticated remote libp2p peers can bypass Biscuit capability policy enforcement in Google OSS Agent Mesh (SAM) 0.1.0-alpha.1 and 0.1.0-alpha.2 through the /libp2p-http ingress server, invoking arbitrary registered backend services including command/stdio-backed MCP servers, A2A, and inference endpoints. The defect is a missing-authentication and missing-authorization flaw in StartIngressServer (cmd/sam-node/node.go): unlike the MCP stream handler, the ingress path routes requests to backend handlers without verifying a Biscuit token or mesh enrollment. CVSS 4.0 scores this 9.3 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H); no public exploit code or CISA KEV entry was identified at time of analysis, and the vendor has released a fixed version.
Unauthenticated resource exhaustion in the Grav API plugin (grav-plugin-api) before 1.0.42 allows any remote attacker who can reach GET /api/v1/translations/{lang} to make the plugin cache a full ~560 KB translation dictionary for each well-formed language code, potentially filling disk or APCu; separately, authenticated accounts with api.pages.write can bypass target/destination page rules in the sync and batch copy endpoints to overwrite translations or create pages that page-level rules deny. The plugin is an optional add-on rather than part of a default Grav install, which limits exposure, and no public exploit has been identified at time of analysis.
Grav CMS 2.0.15 through 2.1.x (before 2.2.2) allows authenticated users with page-edit permission to bypass the Flex form callable allowlist and invoke arbitrary public static methods such as Folder::delete, Folder::move, and Utils::download. By renaming a Flex form field using the replace-name@ syntax, an editor can smuggle data-*@ directives past validation, enabling directory deletion, file overwrite, and arbitrary file reads. No public exploit code has been identified at time of analysis, and exploitation requires an authenticated editor account rather than anonymous access.
Authorization bypass in Craft CMS 5.0.0 through 5.10.x allows an authenticated holder of a narrowly site-scoped GraphQL token to create entries in other sites and to delete entries, categories, tags and assets shared across sites. The bypass exists because the requireAllowedSite() check applied to GraphQL queries is not enforced on mutation resolvers, so an attacker can simply supply a siteId outside the token's scope and have the write succeed. Only multi-site installations with the GraphQL API and mutation-enabled, site-scoped tokens are exposed; single-site installs and read-only GraphQL schemas are not affected, and no public exploit code or confirmed active exploitation was identified at time of analysis. Impact is integrity and availability only (no confidentiality loss), but deletion of shared elements can corrupt content consumed by multiple sites.
Cross-site scripting in the Five-in-One Safety Production Management Information System through version 3.5 allows remote attackers to inject script through the NewFile argument in the legacy FCKeditor ASPX upload connector, with exploitation requiring a victim to follow a crafted request to /FCKeditor/editor/filemanager/connectors/aspx/upload.aspx. Publicly available exploit code exists, but no CISA KEV confirmation of active exploitation was provided.
The App Builder WordPress plugin before 5.7.1 writes attacker-supplied data into one of its options without any authentication or authorization check, and a second unauthenticated request then redirects the visitor's browser to a URI built from that stored value. The result is an unauthenticated, persistent open redirect (CVSS 5.3, integrity-only) that remote attackers can use to bounce victims to attacker-chosen destinations, typically as a phishing delivery step. Publicly available exploit code exists, but the real-world impact is bounded because a victim must actually follow the crafted link; sites running 5.7.1 or later are not affected.
TrueBooker, a WordPress booking/appointment plugin, renders a booking confirmation summary without verifying that the requester actually owns the referenced booking, so anyone on the internet can walk booking identifiers and read the confirmation pages of other customers. That exposes customer personal information contained in the summary and also lets an attacker invalidate a victim's own confirmation link (a limited integrity impact on top of the disclosure). All versions before 1.3.0 are affected, no authentication or user interaction is required against a default installation, publicly available exploit code exists, and the issue is rated CVSS 5.3 (Medium) with confidentiality and limited integrity impact only.