Server-side request forgery in the SeleniumScrapingTool of crewai-tools through 1.15.28 lets an attacker who can influence the agent's website_url input - in practice through indirect prompt injection in content the agent processes - steer the local headless Chrome WebDriver to loopback, RFC1918, and link-local cloud-metadata addresses such as 169.254.169.254, disclosing internal service responses and potentially cloud instance credentials. The flaw is unauthenticated from the tool's perspective (CVSS v4.0 AV:N/PR:N, assessed as CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N), requires the victim deployment to actually have the tool enabled, and is limited to information disclosure - no integrity or availability impact is assessed. An upstream fix has been proposed in crewAI pull request #6870, but no public exploit code was identified at time of analysis and the issue is not in CISA KEV; it is a credible medium-to-high priority issue rather than an emergency.
LangBot through 4.11.0 accepts Lark/Feishu event-subscription callbacks without verifying the X-Lark-Signature header or verification token, so unauthenticated remote attackers who know a bot UUID can POST forged im.message.receive_v1 and card.action.trigger events into the bot. Successful injection drives the LLM pipeline, tools, and approval workflows as spoofed users, yielding high integrity impact with limited confidentiality exposure while the Lark adapter webhook is network-reachable. No public exploit code or active exploitation has been identified at time of analysis; the AC:H rating reflects the requirement to learn a valid bot UUID and reach the webhook directly.
Idle or half-open connections to aiohttp server deployments at version 3.14.3 and earlier are never timed out during the initial phase of a request, letting a client open a TCP connection and send nothing - or trickle partial header bytes - while holding the socket open indefinitely and consuming server connection capacity. Only deployments that expose the aiohttp listener directly to untrusted clients are affected; the vendor's recommended reverse-proxy pattern with sensible keepalive limits neutralizes the issue, and a meaningful outage requires accumulating many concurrent idle connections because a single stalled connection has negligible impact. There is no public exploit code identified at time of analysis and no confirmed active exploitation (CISA KEV), though the low attack complexity of simply opening sockets makes the flaw cheap to attempt at scale.
Unauthenticated remote attackers can exhaust file descriptors in aiohttp-based web services by sending crafted multipart/form-data requests to any handler that parses bodies with Request.post(), pushing the worker process toward EMFILE and denying service to legitimate clients. The flaw affects aiohttp releases from version 2 up to but not including 3.14.4, and only services that actually accept multipart uploads through that API are exposed; endpoints that never parse multipart bodies, or that use the streaming multipart reader instead, are not exploitable. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, but the attack requires no authentication or user interaction and is straightforward to script, so internet-facing upload endpoints should be prioritized for patching.
Pillow versions 10.0.0 through 12.x can free an invalid glyph pointer during FreeType text rendering when an active stroker is used, allowing malformed font bytes supplied by an attacker to corrupt memory or crash the process. Exploitation requires the application to render text with a nonzero stroke width and load an attacker-controlled font from untrusted bytes; no authentication or user interaction is required on the application side, but the attack requirements are present because the stroking path must be enabled. There is no CISA KEV confirmation and no public exploit identified at time of analysis; the issue is fixed in Pillow 13.0.0.
Denial of service in Pillow prior to 13.0.0 occurs when ImageFilter.RankFilter, MedianFilter, MinFilter, or MaxFilter is applied to a zero-width or zero-height image, triggering a native null pointer dereference during edge expansion and crashing the process. Remote, unauthenticated attackers who can supply or cause creation of such a zero-dimension image to an application that uses these rank filters can cause high availability impact only (C:N/I:N/A:H per the assessed CVSS 3.1 vector; official CVSS 4.0 score 8.2 with AT:P). No public exploit code or confirmed active exploitation is identified at time of analysis, and no EPSS data was provided.
Pillow versions 7.2.0 through 12.x can hang indefinitely at full CPU when an application reads n_frames or saves all frames from a crafted MIC image; MicImageFile inherits TIFF frame traversal but its tell() reports the OLE stream index and its seek() resets TIFF frame state, so an embedded TIFF with at least three IFDs never advances the traversal. The attacker only needs to supply the MIC file, but exploitation requires the optional olefile package to be installed and the application to invoke the frame-count or save-all code path - default Pillow installs that never touch MIC frames are unaffected. Impact is confined to availability (CWE-835 uncontrolled loop, no confidentiality or integrity effect); vendor-released patch: 13.0.0.
Heap out-of-bounds read in Pillow's tiled-TIFF decoder (versions 8.2.0 through 12.x) lets a crafted TIFF file cause the stride-and-copy loop in _decodeTile to walk past the buffer libtiff allocated, potentially exposing adjacent heap contents in the returned pixel data or crashing the process. Any application that opens untrusted TIFF images with an affected Pillow build is exposed without authentication or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L, 6.5), though impact is bounded to partial confidentiality loss and partial availability loss with no write primitive. No public exploit code and no confirmed active exploitation were identified at time of analysis; the vendor fix in 13.0.0 makes the decoder reject the triggering images with 'decoder error -2'.
Stack exhaustion in the MongoDB PHP driver's BSON decoder allows unauthenticated attackers to terminate PHP processes that process crafted binary documents, causing availability loss. The issue affects driver deployments where application code passes attacker-controlled BSON into the decoder rather than only decoding trusted server responses; no public exploit code has been identified at time of analysis, and the CVSS 4.0 AT:P prerequisite reflects that deployment condition.
The SCIM provisioning endpoints in WSO2 Identity Server, Identity Server as Key Manager, and Open Banking IAM fail to disambiguate between a local user and a federated user that share the same username, so a federated identity can be acted upon as if it were the colliding local account. An attacker who can authenticate as a federated user - and who either already holds a federated identity matching a target's username or can self-register one where self-registration is enabled - can reach the SCIM 2.0 or SCIM 1.1 user endpoints and perform arbitrary operations against the local user store, up to and including account takeover; deployments without self-registration are rated medium severity by the vendor because the collision must be pre-arranged. Exploitation requires authentication as a federated user and a reachable SCIM endpoint, and no public exploit code or confirmed active exploitation was identified at time of analysis; the vendor's own CVSS of 8.2 uses a PR:N vector while our assessment treats the federated-user requirement as PR:L, giving 8.1-equivalent integrity impact with limited confidentiality exposure.
Credential header leakage in follow-redirects 1.16.0 allows remote attackers to receive sensitive headers that should have been stripped when a request follows a cross-origin or HTTPS-to-HTTP redirect to an attacker-controlled target. The flaw only manifests when an application explicitly declares a sensitive header whose name contains the regular-expression metacharacters ^ or |, so conventionally named headers and default configurations are not affected. The vendor fixed the issue in 1.16.1; no public exploit code or confirmed active exploitation was identified at time of analysis.
Cross-request abort in SGLang through 0.5.22 lets unauthenticated remote API clients terminate other users' in-flight generation requests, producing a denial of service against multi-tenant or internet-facing inference servers. An attacker submits a streaming /generate request using a deliberately short, client-controlled rid (for example a single hex character) and then disconnects, at which point the server's prefix-matching abort logic cancels every concurrent request whose identifier begins with that character. The 8.2 CVSS 4.0 score is driven entirely by high availability impact with no confidentiality or integrity effect, and practical impact requires other tenants' requests to be in flight at the same moment; no public exploit code has been identified at time of analysis.
Yank Note releases before 3.93.1 expose a path traversal flaw in the embedded HTTP server's publicly allowlisted /api/help endpoint, letting an unauthenticated remote attacker read arbitrary files - SSH keys, configuration, or stored notes - by supplying repeated '../' segments in the doc or path parameter that slip past the single-replacement sanitizer. Exposure is gated: the server is designed to bind locally, so exploitation requires the instance to be reachable on a non-localhost interface, which is why the assessed vector carries AC:H/AT:P despite PR:N and full confidentiality impact. Impact is disclosure only (no writes, no denial of service); no public exploit code or active exploitation (CISA KEV) was identified at time of analysis, and a vendor fix ships in 3.93.1.
XML external entity injection in the camel-smooks component of Apache Camel (versions 4.7.0 through 4.18.4 and 4.19.0 through 4.22.0) lets remote attackers who can supply or influence an XML message body that is unmarshalled by Smooks read files accessible to the Camel process and force it to issue requests to internal network hosts. No privileges or user interaction are required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N), and no non-default configuration is needed because external entity resolution was the default behaviour of the Woodstox SAX reader Smooks used; the confidentiality impact is high with a low availability impact, giving a base score of 8.2. The flaw is only reachable on routes that unmarshal XML through .unmarshal().smooks(...) or the smooks: component with its default reader, and full return of exfiltrated content depends on an InOut route binding the resolved entity into the reply, so no public exploit code or active exploitation has been identified at time of analysis, though the vendor has released fixed versions.
Unauthenticated remote AS2 partners can turn an Apache Camel camel-as2 receiver into a server-side request forgery pivot: the component reads the asynchronous Message Disposition Notification (MDN) return address out of the inbound message and dials it verbatim, so the sender chooses the host the Camel instance connects to, including addresses only routable from inside the deployment's network. Deployments running Apache Camel 4.0.0 through 4.18.4 or 4.19.0 through 4.22.0 with an exposed camel-as2 receiver are affected; where mdnUserName, mdnPassword or mdnAccessToken are configured, the outbound receipt presents those MDN-delivery credentials to the attacker-chosen destination, which drives the high confidentiality component of the CVSS 3.1 score of 8.2 (CWE-918). No public exploit code has been identified at time of analysis, and vendor fixes are released in 4.23.0, 4.18.5 and 4.22.1; real-world urgency is moderated by whether the receiver is reachable by untrusted partners and whether credentials are attached to MDN delivery.
Authorization bypass in Apache Camel's camel-netty-http component allows remote unauthenticated attackers to reach protected routes by changing the case of characters in the request path so the security constraint no longer recognizes it while routing still dispatches to the endpoint. It affects Apache Camel 4.0.0 before 4.18.5 and 4.19.0 before 4.22.1, with a CVSS score of 8.2; no public exploit identified at time of analysis.
Apache Camel's camel-oauth route guards fail open: when authentication cannot be completed, the OAuthBearerTokenProcessor and OAuthCodeFlow processors set an error status and body but never stop the exchange, so the request falls through and continues into the protected part of the route as if the caller had authenticated. Camel 4.11.0 through 4.18.4 and 4.19.0 through 4.22.0 are affected wherever camel-oauth is used to protect an HTTP-reachable endpoint, and exploitation needs no credentials, user interaction, or special configuration - simply omitting the Authorization header, sending a non-Bearer header, presenting an invalid token, or arriving without an authorization code is enough (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N, 8.2). The gap is a confidentiality problem first and foremost, exposing whatever the protected route returns, with limited integrity impact; no public exploit identified at time of analysis, and the vendor-released patch is 4.23.0, with backports in 4.18.5 and 4.22.1.
Header-driven URI resolution in Apache Camel's HTTP producer components causes message-supplied CamelHttpUri and CamelRestHttpUri values to be expanded through CamelContext.resolvePropertyPlaceholders() before use, so an attacker who can influence those headers turns a URI string into a configuration-evaluation context and can read OS environment variables, JVM system properties, every registered secret-backend PropertiesFunction (AWS, Azure, GCP, HashiCorp, IBM, CyberArk, Kubernetes) and even invoke no-argument methods on beans in the registry. The flaw affects Apache Camel 4.0.0 before 4.18.5 and 4.19.0 before 4.22.1 across camel-http, camel-http-common, camel-vertx-http, camel-undertow and camel-netty-http, and a plain static to(http://backend/api) route is enough to be exposed; no authentication is required where a route is reachable by untrusted senders (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N, 8.2). Exploitation yields a high-confidentiality but limited-integrity impact, and while no public exploit code or CISA KEV entry exists at time of analysis, the preconditions are ordinary and the vendor has shipped fixes, so this warrants prioritised patching.
Heap out-of-bounds write in openGauss Server's HLL (HyperLogLog) unpacking routine lets an authenticated database user corrupt server memory through ordinary SQL. HllObjectUnpack() in src/gausskernel/cbb/utils/hll/hll.cpp trusts an attacker-supplied packed HLL whose encoded lenTotal is smaller than lenUsed, allocates a buffer sized to lenTotal but then copies lenUsed bytes using memcpy_s() with the wrong destination size, so the safe-copy guard never fires. Any non-privileged user with a valid connection can reach the path via hll_in(), hll_print(), or hll_cardinality() - for example by casting bytes with ::hll - affecting versions from 2.1.0 through 7.0.0-RC3 (fixed in 7.0.0-LTS); the CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H reflects high integrity and availability impact, and no public exploit was identified at time of analysis.
An uncontrolled search path element in Dell Application Store (CWE-427) lets a local, low-privileged user plant a malicious library or executable in a location the installer or updater searches, so the higher-privileged Application Store process loads attacker code and yields elevation of privilege plus arbitrary code execution. All builds prior to 26.05.0.7 are affected; the CVSS 3.1 vector is AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (7.8), meaning the attacker must already hold a local account or code-execution primitive on the host, no victim interaction is required, and impact is confined to that machine. There is no remote attack surface here - it is a post-compromise or insider escalation step rather than an entry vector - and no public exploit code has been identified at time of analysis, with no CISA KEV listing.
Use-after-free in GIMP's XCF loader can crash the application and potentially allow arbitrary code execution when a user opens a crafted .xcf file that selects a path and then fails to load it. The flaw affects GIMP as packaged in Red Hat Enterprise Linux 6 through 10 according to the provided CPE mappings, and exploitation is local and requires user interaction (CVSS 7.8, AV:L/UI:R/PR:N); no public exploit was identified at time of analysis. Because scope is unchanged, any code execution would run with the privileges of the user opening the file rather than automatically gaining root.
Opening a crafted XCF file in GIMP can trigger a use-after-free in the XCF loader's linked-channels handling, crashing the main GIMP process and potentially enabling code execution in the opening user's context. The defect affects GIMP installations that parse XCF files, with Red Hat tracking impact across RHEL 6 through RHEL 10 packages; exploitation requires local delivery and a victim to open the malicious image, and no public exploit code or CISA KEV entry is identified in the provided data.
Heap out-of-bounds read and write in GIMP's PSD thumbnail resource loader allows memory corruption when a victim opens or thumbnail-previews a crafted PSD file containing a grayscale JPEG thumbnail, potentially leading to code execution in the plug-in process. The loader assumes a 3-byte BGR stride and never validates that the embedded thumbnail is RGB, so a single-channel grayscale image drives out-of-bounds indexing. Rated CVSS 7.8 (AV:L/UI:R/PR:N) - a client-side file-parsing bug with no network reachability; no public exploit code identified at time of analysis, and Red Hat tracks it across RHEL 6 through 10.
Local privilege escalation in Progressive Robot hMailServer 6.0.0 through 6.3.6 allows any authenticated, non-administrator user on the host to run code as LocalSystem or as the mail server's virtual service account, but only when the installer was pointed at a folder that inherits writable permissions from its parent, such as the root of an NTFS drive. The installer accepts any path without warning and creates neither the program folder nor its Bin subfolder with explicit permissions, so a drive-root install leaves Bin writable to Authenticated Users (Modify on Windows clients) or Users (create files and folders on Windows Server); the default Program Files installation grants ordinary users only read and execute and is explicitly not affected. No public exploit code or active exploitation is confirmed at time of analysis, and the reference to the v6.3.7 release indicates the vendor has shipped a fixed version.
Path traversal in Koozali SME Server 11.0rc1-215 allows remote unauthenticated attackers to read files outside the intended logs directory through the server-manager View Logs feature, exposing system and application files with high confidentiality impact but no integrity or availability effect. The CVSS 4.0 vector rates exploitation maturity as E:P, so publicly available exploit code exists at the proof-of-concept level, but there is no CISA KEV confirmation of active exploitation. Real-world exposure is bounded to instances whose administrative web interface is reachable from untrusted networks.
Arbitrary Python code execution in docTR through 1.1.0 is possible when load_pretrained_params() deserializes an attacker-controlled or tamperable checkpoint on PyTorch releases before 2.6. Unauthenticated attackers can supply the poisoned model artifact, but exploitation is conditionally gated: the victim application must load that checkpoint from a path or URL the attacker controls, and PyTorch must predate 2.6, where torch.load began defaulting to weights_only=True. No public exploit code or CISA KEV entry was identified at time of analysis, and this is a genuine but conditionally-gated code-execution flaw rather than a drop-everything emergency.
Path traversal in the MapSVG Lite WordPress plugin through version 8.16.1 allows an authenticated low-privilege user to supply directory traversal sequences to a file-handling parameter and delete files outside the plugin's intended directory, causing high availability impact. Because the CVSS vector is PR:L with UI:N, any account at the low privilege tier is sufficient, and sites that allow untrusted user registration are most exposed. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Heap use-after-free in Pillow 11.3.0 through 12.x can crash any Python process that encodes TIFF data into an in-memory buffer while an attacker influences the TIFF tags being written. When an application saves to BytesIO with a tiffinfo dictionary containing a tag libtiff rejects during encoding - the documented trigger is a floating-point predictor (PREDICTOR=3) applied to integer sample data - TIFFWriteScanline fails inside ImagingLibTiffEncode, the error path frees the output buffer without closing the TIFF handle, and a later cleanup flushes buffered bytes through the write callback into freed memory. The vector (CVSS 5.9, AV:N/AC:H/PR:N/UI:N, C:N/I:N/A:H) reflects unauthenticated but configuration-dependent reachability: exploitation needs the memory-buffer code path plus attacker-controlled tag values, and the reliable outcome is process termination, with code execution unproven; no public exploit identified at time of analysis, and the upstream fix commit ships a regression test rather than weaponized tooling.
Denial of service in FFmpeg build N-119856-gbe46370941 occurs when the H.264 decoding path processes a crafted media file and dereferences a NULL pointer in avpriv_h264_has_num_reorder_frames, crashing the affected process. The CVSS 3.1 score is 7.5 with availability-only impact (C:N/I:N/A:H) and an AV:N/AC:L/PR:N/UI:N vector, making it remotely reachable without privileges or user interaction in automated decoding pipelines; services that automatically ingest untrusted media are the highest-risk exposure, while manual-open scenarios add user interaction not reflected in the vector. No public exploit identified at time of analysis, and CISA SSVC records exploitation as none with automatable set to yes.
Denial of service in hMailServer 6.0.0 through 6.3.6 lets a remote unauthenticated sender exhaust the mail queue and disk and stop the server from carrying mail at all. The server trusts a client-supplied X-hMailServer-LoopCount header, reading it with a signed conversion and no validation, so a negative value - or, on Linux builds, a value above the 32-bit signed maximum that wraps negative - passes every check against the default loop limit of 5 and lets a message caught in a forward, redirect, or auto-reply cycle iterate roughly two billion times, each hop queuing and delivering another message. Exploitation is conditional: the targeted account or domain must have a mail-generating feature that can form a cycle (rule forward/reply/copy, account forward, Sieve redirect/vacation/notify, bounce, or out-of-office reply); no public exploit code was identified at time of analysis and there is no CISA KEV listing, and the CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects pure availability impact with no confidentiality or integrity loss.
GeoVision GV-ASmanager's GeoWebServer.exe web service is vulnerable to a stack-based buffer overflow that allows remote, unauthenticated attackers to crash the service, causing a denial-of-service condition. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms only an availability impact; confidentiality and integrity are unaffected. No public exploit code or active exploitation has been identified at time of analysis, but any exposed GV-ASmanager web port could be disrupted.
DKIM signing in Progressive Robot hMailServer 6.0.0 through 6.3.6 can be induced to sign attacker-authored mail with the DKIM key of any hosted domain named in the message's From header, because signing happens on the first delivery pass before local delivery and without checking the sender's authenticated identity. A remote unauthenticated sender can therefore obtain a valid, DMARC-aligned signature for a hosted domain, but only where an administrator has enabled DKIM signing for that domain and an external relay path such as a forward, alias, list, Sieve redirect, mirror or quarantine release carries the message off-server; a separate authenticated-SMTP variant lets a logged-in account get mail signed for a different hosted domain when SmtpAuthenticatedSenderCheck is disabled. Rated CVSS 7.5 with integrity impact only; no public exploit identified at time of analysis.
Algorithmic complexity (quadratic-time) denial of service in markdown-it's smartquotes typographic rule affects releases prior to 14.3.2 and 15.0.2 when the parser is configured with typographer: true. Unauthenticated remote attackers who can submit Markdown for rendering - for example in comment fields, chat messages, or wiki pages - can supply a document containing many opening double quotes followed by unmatched closing single quotes (or the same pattern with quote types reversed), forcing the smartquotes matching loop to rescan the entire opener stack on every quote and driving CPU consumption up quadratically with input size. The default typographer: false configuration is unaffected, and the impact is limited to availability (CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5); no public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), though the advisory notes the vulnerable option is enabled with high probability in real deployments.
IBM Concert versions 1.0 through 3.0.0 rely on weaker-than-expected cryptographic algorithms when protecting sensitive data, allowing an attacker who obtains that ciphertext - captured network traffic or exfiltrated at-rest data - to decrypt highly sensitive information. The weakness is confidentiality-only (C:H/I:N/A:N) with no authentication or user interaction required per the CVSS vector, though practical exploitation demands prior possession of the encrypted material and non-trivial cryptanalytic effort, which is why the independently assessed vector rates complexity as High rather than Low. No public exploit code or confirmed active exploitation was identified at time of analysis, and IBM has released a vendor patch.
Path traversal through dangling symlinks in anshupriyan CLI Bridge prior to 0.0.2 lets attackers who can drive the write_file MCP tool write arbitrary files outside the configured WORKSPACE_ROOT, an integrity-only impact bounded by the privileges of the user running the server. The flaw sits in resolveSafePath: when fs.realpathSync throws ENOENT because a symlink's target does not yet exist, the fallback validates only the parent directory and returns the symlink path as safe, so the subsequent write follows the link out of the sandbox. The project released a fix in 0.0.2 via PR #3 and commit 284a84c, and the independent assessment rates this local-vector (AV:L), unauthenticated, no-interaction integrity impact; no public exploit code or KEV-listed active exploitation was identified at time of analysis.
Credential disclosure in the Apache Camel camel-http component lets a malicious or compromised remote endpoint harvest OAuth2 bearer tokens and basic/digest credentials by answering a request with an HTTP redirect to a host it controls. The leak occurs because OAuth2ClientConfigurer's request interceptor sits in ProtocolExec, below RedirectExec, so 'Authorization: Bearer' headers are re-attached on every redirect hop, and because basic/digest credentials were registered against an AuthScope that matched any host. Affected are Apache Camel 4.0.0 through 4.18.4 and 4.19.0 through 4.22.0; exploitation requires an endpoint with credentials configured and followRedirects=true (not the default) plus an attacker positioned to influence the target server's responses, and no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
XML external entity injection in the Apache Camel XPath component lets unauthenticated remote attackers read files accessible to the Camel process and induce it to make outbound requests to attacker-named hosts when an expression is configured with documentType=InputSource and evaluates XML from an untrusted sender. The flaw is configuration-gated rather than default: Camel's default document type already refuses a DOCTYPE, so stock deployments are not exposed, but a deployment that selected InputSource for streaming reasons unknowingly also selected a weaker parser. Fixed in 4.23.0, 4.18.5 and 4.22.1; no public exploit identified at time of analysis, and the CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) reflects confidentiality impact only.
Netis EAP930 access point firmware (build 1.250905.115454) ships a hidden backdoor in the /cgi-bin/debug CGI endpoint, where the return200 function activates concealed functionality when the SIGNATURE argument is manipulated with a specific value. The defect is remotely reachable over the network but is a constrained threat rather than a broadly exploitable one: the assessed vector (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) requires a high-privilege context and a non-trivial barrier - knowing or forging the correct SIGNATURE - and the vendor itself rates exploitability as difficult. The CVSS v4 vector carries an E:P (proof-of-concept) exploit maturity rating, but no confirmed active exploitation or CISA KEV listing was identified at time of analysis, and Netis did not respond to the disclosure, so no vendor-released patch has been identified.
Signature-verification bypass in bootc and ostree image-mode deployments: a deployment staged while the container signature policy still accepted unsigned content remains bootable after the policy is hardened, because already-staged deployments are finalized on reboot without being revalidated against the current policy. An attacker who can stage a deployment under a permissive policy can therefore get unsigned OS content finalized and booted later, yielding full host compromise (C:H/I:H/A:H); the assessed vector is AV:L/AC:H with operator/local privilege (PR:L) despite the vendor's PR:N rating, and the flaw affects RHEL 8/9/10 image mode, OpenShift Container Platform 4, and Red Hat Hardened Images. No public exploit code was identified at time of analysis and there is no confirmed active exploitation (not in CISA KEV).
Stored cross-site scripting in IBM Cloud Pak System 2.3.6.0 and 2.3.6.1 allows an authenticated low-privileged user to save JavaScript payloads that execute in another user's browser when the affected page is viewed. The flaw is rated CVSS 7.4 (network-reachable, low privileges, scope change) and requires access to a web-console input field whose value is stored and rendered without proper sanitization or HTML encoding. No public exploit code was identified at time of analysis, and IBM has released a vendor patch.
Red Hat Advanced Cluster Security for Kubernetes (RHACS) Central's SAML assertion consumer service (ACS) endpoint does not cache used assertion or response identifiers, so a single valid signed SAML response can be replayed to mint multiple distinct Central authentication tokens for the same mapped identity. Deployments are only exposed when Central is configured to authenticate via SAML; an attacker must first obtain a legitimately signed, unexpired SAML response - they cannot forge one - which is why the issue is rated CVSS 7.4 with high attack complexity despite requiring no privileges or user interaction. Successful replay yields full compromise of confidentiality and integrity for the impersonated identity; no public exploit code or confirmed active exploitation was identified at time of analysis, and non-SAML authentication configurations are unaffected.
Path traversal in Apache Camel's remote-file consumers - the azure-files scheme named in this CVE plus the FTP/SFTP consumers sharing the RemoteFileConsumer base class - lets a malicious, compromised, or multi-tenant remote file server (or an on-path attacker on the integrity-free FTP control channel) cause Camel to read, delete, or rename files outside the directory it was configured to poll, using the endpoint's own credentials. Retrieval is reachable in the default consumer configuration because remote consumers download every listed file; deletion and renaming additionally require delete=true, move, preMove, moveFailed, or readLock=rename. The jailStartingDirectory option, enabled by default and documented as a boundary, did not constrain this remote operand before the fix, so it offered no protection; triggering the traversal requires control over a listing name returned by the server, and for azure-files specifically the Azure Files REST service does not normally return multi-segment names, making exploitation there impractical. No public exploit code or confirmed active exploitation was identified at time of analysis; vendor patches are available.
Path traversal in Apache Camel's remote-file consumers (including the SMB component's share-walking consumer) lets a directory listing entry that is not a single path segment resolve outside the polled remote directory, so Camel will retrieve, delete, or rename files outside that directory using the endpoint's own credentials. Affected are Camel 4.2.0 through 4.18.5-exclusive and 4.19.0 through 4.22.1-exclusive; file retrieval is reachable in a default consumer configuration, while deletion requires delete=true and renaming requires move, preMove, moveFailed, or readLock=rename. The CVSS 3.1 vector (7.4, AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) reflects unauthenticated reachability over the network with a high attack-complexity prerequisite: the remote server - or an on-path attacker rewriting an unprotected FTP LIST response, or a malicious, compromised, multi-tenant, or virtual-filesystem-backed server - must emit a qualifying listing name; for the SMB scheme a conforming SMB2 server will not do so, and no public exploit identified at time of analysis.
Path traversal in Apache Camel's remote-file consumers (the FTP, SFTP and mina-sftp schemes) lets a name reported in a remote server's directory listing resolve outside the directory Camel was configured to poll, so Camel will read, delete or rename files elsewhere using that endpoint's own credentials. Affected are Camel 4.18.0 through 4.18.4 and 4.19.0 through 4.22.0, with retrieval reachable in a default consumer configuration because remote consumers download every listed file (CVSS 3.1 base score 7.4, AV:N/AC:H/PR:N/UI:N, C:H/I:H/A:N). The attacker must influence the LIST/SFTP listing output - via a malicious, compromised or multi-tenant server, a virtual-filesystem-backed server, or an on-path attacker against plaintext FTP whose control channel has no integrity protection - and no public exploit has been identified at time of analysis.
Apache Camel's ftp, ftps and sftp remote-file consumers build each file's remote path by concatenating the polled directory with the name returned in the server's directory listing, without any lexical normalization or containment check, so a listing entry containing parent-directory segments resolves outside the configured directory and is then read, deleted or renamed with the endpoint's own credentials. Affected are Camel 4.0.0 through 4.18.4, 4.19.0 through 4.22.0, and earlier; the 4.14.x stream is end-of-life and unfixed, while patches ship in 4.18.5, 4.22.1 and 4.23.0 (CPE: apache_software_foundation:apache_camel). Retrieval is reachable in a default consumer route, whereas deletion needs delete=true and renaming needs move, preMove, moveFailed or readLock=rename; the crucial caveat is that the jailStartingDirectory option, on by default and documented as confining Camel to the starting directory, does not constrain this remote path, so it cannot be used as a mitigation. There is confirmed no active exploitation tracked (not in CISA KEV) and no public exploit code identified at time of analysis, although the reporter privately demonstrated the issue end to end against an FTP endpoint; CVSS 7.4 with AC:H reflects that the attacker must first control or influence the remote server's LIST response rather than attack Camel directly.
OS command injection on the Remote Management Controller (RMC) of HPE Compute Scale-up Server 3200/3250 and Superdome Flex / Flex 280 platforms allows an attacker who already holds high-privilege credentials on the RMC to run arbitrary operating system commands on the controller. The flaw is rated CVSS 7.2 (High) with a vector of AV:N/AC:L/PR:H/UI:N, so exploitation is remote and low-complexity once the privileged foothold exists - the high-privilege requirement is the principal limiting factor and rules out unauthenticated attacks. No public exploit code or confirmed active exploitation is identified in the available data, though the sensitive nature of the RMC as a system-management plane makes exposure to untrusted networks a significant risk multiplier.
Authenticated MISP users can read sensitive server configuration secrets-including the security salt, Redis connection passwords, and plugin API keys-by supplying a configuration branch name such as Security, MISP, or Plugin to the server settings lookup or settings-edit endpoints in versions before 2.5.48. The flaw bypasses the intended redaction check because branch nodes lack the leaf-level redaction flag, exposing the entire configuration sub-tree to any account that can reach those endpoints. No public exploit code or CISA KEV entry was identified at time of analysis, and the impact is limited to confidentiality; a vendor fix is available via commit 30b849102.
Heap out-of-bounds read in rdesktop through 1.9.0's process_raw_bmpcache() lets a malicious RDP server crash the client by sending a raw bitmap cache order that declares large width, height, and bpp values with an undersized payload, causing memcpy() to read past the receive buffer. The attack is unauthenticated but requires the victim to connect to the hostile server (UI:R/UI:P per assessments), and impact is limited to client-side denial of service with no confidentiality or integrity loss. No public exploit identified at time of analysis; the 7.1 CVSS 4.0 score reflects high availability impact only, making real-world priority moderate-to-low.
Authenticated Control Panel users of Craft CMS 4.0.0 through 4.18.7 and 5.0.0 through 5.10.x can bypass the Twig sandbox allowlist through crafted keys in the column, contains, filterByValue, index, where, or multisort array filters, exposing values such as the securityKey, database credentials, and auth tokens. The flaw is limited to accounts that can author or influence Twig template content or field expressions; no unauthenticated path is identified. No public exploit code or confirmed active exploitation was identified at the time of analysis.
MISP before 2.5.48 discloses proposal (shadow attribute) records to authenticated users whose sharing group is attached to the target attribute or object, because the visibility logic accepted any matching sharing group without confirming that the attribute was actually distributed at sharing-group level. The exposure is read-only - an attacker learns proposed attribute changes they should not see - and requires a valid MISP account plus an existing sharing-group overlap with the targeted data; a separate defect also blocked the owning organisation from viewing proposals on its own org-only attributes. No public exploit identified at time of analysis, and the vendor has released a patch in 2.5.48 (commit 9c5af321f).