Severity signals and exploitation signals diverge here: Splunk SOAR deployments below 8.7.0 permit an authenticated low-privilege user to bypass authorization by supplying requests whose URL path is non-canonical, so the path used for the access-control decision differs from the path the application ultimately services (CWE-647), with CVSS 3.1 scoring the issue 8.8 and high confidentiality, integrity and availability impact. The exposure is limited to holders of valid SOAR credentials on the web interface (PR:L, AV:N, UI:N) and does not extend to anonymous remote attackers. No public exploit code or active exploitation has been identified at time of analysis (SSVC exploitation: none), and Cisco/Splunk has shipped a hardened 8.7.0 release that resolves the flaw.
Local access-control bypass in Cisco Unified Communications products allows an authenticated low-privileged user or local session holder to gain high confidentiality, integrity, and availability impact, with scope change beyond the vulnerable component. The CVSS 3.1 score is 8.8, but the vector is AV:L/PR:L, so exploitation requires existing local access and valid low-privilege credentials rather than a remote unauthenticated path; no public exploit or CISA KEV active exploitation is identified. Affected products include Cisco Emergency Responder, Prime Collaboration Deployment, Unified CM, Unified CM IM&P, Unified CM SME, and Unity Connection, and Cisco hardening releases are available via advisory cisco-sa-voice-hardening-twgbH9e3.
Insecure cancellation-token generation in the Booking Package WordPress plugin before 1.7.31 allows unauthenticated attackers to reconstruct any booking's cancellation token from publicly exposed values, disclosing that booking's personal data and, when visitor cancellation is enabled, canceling the booking. Publicly available exploit code exists, and the CVSS 3.1 score is 4.8 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N), indicating moderate risk: disclosure works on default installs, while cancellation depends on the visitor-cancellation setting. No CISA KEV active-exploitation signal is present in the supplied data.
Authenticated remote code execution in MindsDB allows a low-privileged user to run arbitrary Python in the context of the service account by supplying a crafted string to the OpenBBtable class. The flaw is a code-injection issue (CWE-94) in the OpenBB integration: the user-controlled value is used to execute Python without proper validation, and exploitation is network-reachable with low complexity but requires a valid session (CVSS PR:L). No public exploit was identified at time of analysis, and there is no CISA KEV confirmation, so this is a high-priority patch item rather than a drop-everything emergency; deployments should confirm whether the OpenBB handler is enabled and exposed.
Unsafe reflection in CrewAI's load_agent_from_repository function enables unauthenticated remote code execution when a victim loads an attacker-controlled agent configuration from a repository, with code running under the CrewAI service account's privileges. The flaw is rated CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and is gated by required user interaction: the target must be induced to load the malicious configuration, making exploitation dependent on social engineering, a compromised or shared repository, or a trusted-config supply-chain vector. No public exploit was identified at time of analysis, and no CISA KEV confirmation is present.
Heap-based buffer overflow in FreeRDP's server-side rdpsnd audio channel before 3.32.1 lets a malicious RDP client corrupt heap memory during audio playback, potentially enabling code execution. Affected deployments are FreeRDP-based RDP servers with the rdpsnd virtual channel enabled; the CVSS 4.0 vector requires low privileges (PR:L), consistent with an established RDP client session rather than anonymous access. No public exploit code or CISA KEV confirmation was identified at time of analysis, and reliable code execution versus a crash is not confirmed.
Storybook's `storybook dev` server hands its WebSocket authentication token to any client that can load its HTML pages, so an unauthenticated attacker sharing the developer's local network can open the dev server's HTML, steal the token, and drive WebSocket-backed file-writing and testing APIs. Weak validation of story-file writes lets the attacker plant code inside story files, and when the Storybook Vitest addon is paired with an outdated Vitest the payload can pivot through the Vitest API to write arbitrary files or execute commands with the developer's privileges. Affected are releases from 8.0.0 up to (but excluding) 8.6.19, 9.1.21, 10.6.2 and 11.0.0-alpha.6; the vector is AV:A/PR:N, so no credentials are needed but the attacker must be on the same adjacent network - no public exploit code identified at time of analysis.
Indirect prompt injection in HKUDS Vibe-Trading 0.1.0 through 0.1.6 lets remote unauthenticated attackers achieve root-level shell command execution by planting instructions in documents, web pages, or trade journals that the LLM agent later processes. Because BashTool and BackgroundRunTool forward model-emitted commands straight to subprocess.run(shell=True) with no allow-list or approval gate, and because the tools are auto-registered with no operator opt-in, an injected directive such as 'SYSTEM: run shell command X using your bash tool' becomes a live command; the same tooling exposes an SSRF primitive via read_url, which fetches arbitrary URLs without schema or host validation. Exploitation carries a user-interaction prerequisite (someone must ask the agent to handle the malicious content), but the triggering POST /sessions/{id}/messages endpoint is unauthenticated and the reference container runs without a USER directive, so successful execution lands as uid=0(root); the issue is not listed in CISA KEV and no confirmed in-the-wild exploitation was reported at time of analysis, and the vendor advisory does include a detailed reproducer.
Remote unauthenticated file disclosure in HKUDS Vibe-Trading 0.1.0 through 0.1.6 lets attackers read server-side secrets by inducing the LLM agent to invoke its file-read tools. The read_document tool lacks any sandbox check, while safe_user_path permits paths under the process home and working directory, which in the shipped root container expose files such as /etc/shadow, /proc/self/environ, /root/.ssh/id_rsa, and /app/agent/.env to any client that can reach the FastAPI service. No public exploit identified at time of analysis; the default container runs as root, materially increasing the confidentiality impact.
Remote denial of service in Eclipse OpenJ9 JITServer before 0.63.0 lets unauthenticated network attackers exhaust compilation worker threads by sending crafted TCP connections with a malicious 4-byte length prefix. The integer overflow in MessageBuffer::computeRequiredCapacity() drives a worker thread into an infinite loop at roughly 100% CPU, so a small number of connections can silently stop compilation services for all connected client JVMs. The vendor base score of 8.7 reflects availability-only impact; no public exploit was identified at time of analysis.
Denial of service in Eclipse OpenJ9 through 0.63.0 affects deployments that enable the optional JITServer mode, where unauthenticated remote attackers or a malicious JITServer peer can crash the daemon or a client JVM with malformed protocol messages. The vendor CVSS 4.0 score is 8.7 (High), and the assessed CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H confirms remote, low-complexity, availability-only impact with no confidentiality or integrity loss. JITServer is not enabled in default JVM operation, so standard OpenJ9 installations are not exposed; no public exploit or CISA KEV entry was identified at time of analysis.
A path traversal vulnerability in SvelteKit's Vite preview server on Windows (versions 2.10.0 before 3.0.0) allows remote attackers to read files outside the prerendered output directory, potentially exposing source code, configuration, or credentials readable by the server process. Exploitation requires the `vite preview` server to be running on a Windows host and reachable over the network or via a tunnel - a non-default posture, since the preview server is normally bound to localhost. Production deployments using adapter-node or static adapters, and hosts running POSIX/Linux/macOS, are not affected; no public exploit code has been identified at time of analysis, and impact is confined to confidentiality (no integrity or availability effect).
Unauthenticated memory exhaustion in vLLM versions after 0.24.0 and before 0.31.0 can crash the API process when the MOSS-Audio model is served, because request-controlled mm_processor_kwargs values are cached in an unbounded dictionary. Attackers can send distinct or oversized mel_config values to the /tokenize endpoint, which bypasses --api-key authentication, steadily consuming host memory until the service dies. No public exploit identified at time of analysis; the vendor-released fix is vLLM 0.31.0, and only deployments actively serving MOSS-Audio with a reachable /tokenize endpoint are exposed.
Arbitrary file write in Astral uv before 0.11.15 allows a malicious wheel to place generated console_scripts or gui_scripts entry points outside the environment's scripts directory, potentially shadowing or overwriting executables in a PATH directory for code execution. The flaw affects uv versions prior to 0.11.15 across the pip/uv and rust/uv packages and is a conditional risk: the attacker must first persuade the victim to install a crafted wheel, and the assessed vector is local with user interaction and changed scope. No public exploit code and no confirmed active exploitation were identified at time of analysis; vendor-released patch: uv 0.11.15.
Denial of service in Eclipse OpenJ9's optional JITServer component (versions prior to 0.63.0) allows an unauthenticated remote attacker to crash the server process by sending a crafted DataDescriptor message. The flaw is an unsigned integer underflow caused by missing cross-field validation of _size, _paddingSize, and _dataOffset, leading to an out-of-bounds heap read and SIGSEGV. Exploitation requires JITServer to be enabled and network-reachable; no public exploit code or CISA KEV entry was identified at time of analysis, and the assessed impact is availability-only (CVSS 3.1 base 7.5), narrower than the headline CVSS 4.0 score of 8.7 suggests.
Velneo vServer can be knocked into a denial-of-service state by unauthenticated network traffic that exploits improper validation of an array index (CWE-129) in the server's request handling. Only installations running the 36.x branch before 36.6 or the 37.x branch before 37.2 are affected, and the assessed impact is availability-only (CVSS 4.0 8.7, VA:H with VC:N/VI:N) - there is no demonstrated path to data disclosure, tampering, or code execution from this flaw alone. Vendor fixes are published in Velneo's security advisories, and no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Remote unauthenticated memory exhaustion in vLLM 0.7.3 through versions before 0.31.0 allows clients to terminate shared multimodal inference servers by supplying oversized per-request mm_processor_kwargs, such as large image sizes, patch counts, crop counts, or frame counts, to processors including Isaac, InternVL, and H2OVL. Deployments are exposed when they serve a multimodal model and accept client-controlled mm_processor_kwargs without validation; text-only models and hardened configurations that disable or clamp these parameters are not affected. No public exploit was identified at time of analysis, and the impact is availability-only, with the highest practical risk for multi-tenant or internet-exposed inference APIs.
Privilege escalation in Shopper 2.0.0 through 2.5.x allows an authenticated admin-panel user who holds only the access_dashboard permission to create new administrator accounts or grant elevated permissions by invoking CreateTeamMember::store() or Permissions::togglePermission() directly through /livewire/update. The missing server-side authorization checks make this a genuine privilege-escalation path for low-privilege back-office accounts; upgrading to 2.6.0 adds the required authorize() guards. No public exploit identified at time of analysis, and exploitation requires a valid authenticated session rather than anonymous internet access.
Denial of service in toml-node before 5.0.1 allows unauthenticated remote attackers to stall or crash Node.js and browser-based processes that call toml.parse() on attacker-supplied TOML containing long dotted keys, table headers, array-of-tables headers, or inline-table keys. Repeated slicing and rejoining of every path prefix in assign(), deepRef(), and setNestedKey() creates quadratic work that can block the Node.js event loop for several seconds, and sufficiently long paths can terminate the process through memory exhaustion. No public exploit code was identified at time of analysis; impact is confined to availability, with no confidentiality or integrity loss, and the maxDepth option does not mitigate the issue because it limits nesting depth rather than key-segment count.
Denial of service in toml-node before 5.0.1 lets unauthenticated remote attackers stall the Node.js event loop by supplying TOML documents with many distinct [[array-of-tables]] headers, which force quadratic rescans of compiler bookkeeping sets in addTableArray(). The issue is CWE-407 inefficient algorithmic complexity and affects Node.js and browser deployments that call toml.parse() on untrusted input; no public exploit code has been identified at time of analysis.
Denial of service in adm-zip 0.6.0 and earlier lets remote attackers terminate the entire Node.js host process by submitting a single malformed ZIP file to any of the library's asynchronous decompression APIs. The flaw sits in inflateAsync (methods/inflater.js), which pipes attacker-controlled DEFLATE bytes into a zlib.createInflateRaw stream without registering an 'error' listener, so a corrupted stream or an over-large inflation surfaces as an uncatchable uncaught exception that kills the process and every in-flight request with it. Only applications that call readFileAsync, readAsTextAsync, extractAllToAsync, or ZipEntry.getDataAsync on untrusted input on versions <= 0.6.0 are exposed; the synchronous APIs are unaffected, and there is no data disclosure or code execution - impact is availability only. No public exploit code was identified at the time of analysis, and the issue is not listed in CISA KEV.
Installing a malicious source distribution with Astral uv versions before 0.8.22 can let a crafted chain of symlinks redirect file writes outside the intended extraction prefix, producing arbitrary file writes on the installer’s filesystem with high integrity impact but no confidentiality or availability impact. The reporter scored this CVSS 4.0 8.7 High, while independent analysis assesses CVSS 3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N and stresses that a user must actively install the attacker-controlled package; no public exploit was identified at time of analysis. Upgrading to uv 0.8.22 or later removes the vulnerable extraction behavior.
Unauthenticated remote denial of service in Vaadin Framework 8 (com.vaadin:vaadin-server 8.16.0 through 8.32.1, and vaadin-server-mpr-jakarta 8.18.0 through 8.32.1): a request carrying a non-numeric v-uiId parameter makes Integer.parseInt throw inside VaadinService.requestEnd() while the session lock is held, so the lock is never released and the serving thread returns to the pool still owning it. Every subsequent request for that session then blocks indefinitely in VaadinService.lockSession(), and repeating the request exhausts the container thread pool and takes the application down. Exploitation requires no credentials - a session cookie from a single initial request is sufficient - and no public exploit code or confirmed active exploitation was identified at time of analysis, though the flaw is trivially reachable over HTTP by any client.
Arbitrary file deletion in Astral uv 0.11.5 and earlier allows a maliciously hand-crafted wheel to cause uv to remove files outside the package's installation prefix when that wheel is uninstalled. The attacker must embed relative traversal sequences ('../') in the wheel's RECORD entries - something no standards-compliant Python packaging tool produces - and the victim must both install and later uninstall the package for the deletion to occur; the attacker must also correctly guess the installation prefix depth to reach specific system files. The published CVSS 4.0 score of 8.7 (AV:N/AC:L/PR:N/UI:N) overstates practical exploitability, and our reassessment (CVSS 3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:H) reflects the required user interaction and prefix-guessing precondition; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis. Fixed in uv 0.11.6.
Apache Traffic Server 9.2.15, 10.1.4, and 10.2.0 can be driven into a denial-of-service condition through log amplification: each internal '@' header stripped from a request causes an unthrottled diagnostic log line, so requests carrying many such headers generate disproportionate log writes. The issue is network-reachable and unauthenticated, with high availability impact when log storage, rotation, or retention is constrained; no public exploit identified at time of analysis.
Missing authorization in Apache Pulsar's shadow topic feature allows an authenticated tenant administrator to bind a topic in their own tenant to a persistent topic in another tenant through the PULSAR.SHADOW_SOURCE property, exposing retained messages and enabling destructive retention or deletion of the source topic's ledgers. This affects shadow-topic-capable releases before the fixed 4.0.14 and 4.2.5 versions under the default authorization provider, and no public exploit was identified at time of analysis.
Local privilege escalation in OnePlus OxygenOS lets any installed Android app, with no declared permissions and no user action beyond launching it, execute arbitrary shell commands as root (uid 0) in the u:r:dumpstate:s0 SELinux domain. The chain abuses the unauthenticated atlasservice setEvent binder call and the root audiodumpinfo init service, which passes the attacker-controlled oplus.audio.dumpinfo.type property into system(). Affected builds are OxygenOS 16.1.0 before 16.1.10.500, 16.0.0 before 16.0.5.1200, and 15.0.0 before 15.0.0.2000; the assessed CVSS 3.1 score is 8.5, and no public exploit identified at time of analysis beyond the referenced technical writeup.
Cross-site request forgery in Trigger.dev before 4.5.2 lets an attacker mint a Personal Access Token for a logged-in victim and then collect it from the unauthenticated /api/v1/token endpoint, resulting in full account takeover. The flaw affects Trigger.dev deployments running versions prior to 4.5.2 and requires only that the victim have an active authenticated session and be lured into opening a crafted /account/authorization-code/<code> URL. No public exploit identified at time of analysis; the vendor advisory GHSA-58mc-m3qq-6qrh and the VulnCheck advisory provide further detail, and upgrading to 4.5.2 addresses the vulnerable flow.
Authenticated TastyIgniter administrators can achieve arbitrary operating-system command execution by storing a crafted serialized PHP object in a settings value, which the application later unserializes when the setting is read. TastyIgniter versions through 4.4.5 are affected; the vulnerable path includes settings such as maintenance_message consumed by CheckMaintenance.php, and exploitation requires a usable PHP gadget chain in loaded application code or dependencies. No public exploit was identified at time of analysis, and no CISA KEV status was provided.
Arbitrary code execution in Mandiant FLARE floss before 3.2.0 occurs when an analyst opens a crafted vivisect workspace (.viv or .exe.viv), because the utility deserializes the file without adequate trust checks. Exploitation is local and requires user interaction-the attacker must deliver a malicious workspace and persuade the victim to run floss on it-so it is a conditional risk concentrated in malware-analysis workflows rather than a remotely exploitable or mass-exploitation emergency. No public exploit code or confirmed active exploitation was identified in the available intelligence, and the vendor has fixed the issue in floss 3.2.0.
Mandiant FLARE capa versions before 10.0.0 deserialize untrusted data from .viv and .exe.viv workspace files, enabling arbitrary code execution when an analyst opens a crafted workspace. Exploitation is local and requires user interaction plus an additional attack prerequisite (CVSS:4.0 AV:L/AC:H/AT:P/UI:A), so it is not remotely triggerable and no public exploit code or active exploitation has been identified at time of analysis. The 8.7 vendor score reflects high confidentiality, integrity, and availability impact, but the practical risk is confined to workflows that load untrusted or third-party workspace files.
OS command injection in Qingteng Security Toolbox, as shipped in Qingteng Host Adaptive Security Platform (Host Monitoring) V3.0 before build 20260929, allows an authenticated console administrator to execute arbitrary commands on attached client endpoints. The vendor CVSS 4.0 score is 8.5 (High), with adjacent-network reachability and administrative console privileges limiting exposure; the input vector lists PR:N, which conflicts with the description's authenticated-admin prerequisite. No public exploit identified at time of analysis.
Cross-origin message injection in the Storybook preview iframe lets a malicious website drive a developer's locally running `storybook dev` server, sending attacker-controlled events into the preview that can rewrite story files in the project and, if a modified file is later executed by a local runtime, achieve arbitrary code execution with the developer's privileges. The flaw affects Storybook 8.0.0 through 8.6.18, 9.0.0 through 9.1.20, 10.0.0 through 10.6.1, and 11.0.0-alpha.0 through alpha.5; per the CVSS vector it is unauthenticated (PR:N) but requires user interaction (UI:A), since the developer must visit the attacker's site and engage with the injected interface in the same browser. Storybook states it is not aware of exploitation in the wild, and no public exploit code has been identified at time of analysis.
Path traversal in Trigger.dev's api/v1/packets and api/v2/packets presigned-URL endpoints lets any holder of a single valid API key escape its tenant object-key prefix and read or overwrite other tenants' run payloads and outputs. Tracked as CVE-2026-114083 and rated 8.6 under CVSS 4.0 (assessed 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), the flaw affects releases before 4.5.0-rc.3 and requires authenticated, low-privilege tenant access with no user interaction and no named non-default configuration. No KEV listing or public exploit code was reported in the available intelligence, and real-world impact is concentrated on shared or multi-tenant deployments, since single-tenant self-hosted instances have no other tenants' objects to reach.
Trigger.dev before 4.6.0 exposes each environment's root TRIGGER_SECRET_KEY and other plaintext secrets through the GET /api/v1/projects/:projectRef/envvars endpoint, so an attacker holding a restricted read:envvars API key can escalate beyond that key's intended read-only scope. The affected environments are staging, production, and preview, and successful exploitation lets the attacker trigger tasks and mint admin public JWTs; exploitation requires a valid scoped key rather than anonymous access. This is a genuine priority rather than a high-score/low-real-risk issue, and no public exploit identified at time of analysis.
MongoDB Compass before 14.9.15 can execute arbitrary code with the privileges of the user running Compass when that user connects to a MongoDB deployment containing a specially crafted stored view and opens that view for editing. The underlying issue is improper escaping of BSON values while Compass converts a view's aggregation pipeline into editable source, so attacker-controlled view definitions can break out into executable code. The assessed CVSS 3.1 score is 8.6 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), and no public exploit code or confirmed active exploitation was identified at time of analysis; exposure is concentrated in shared, hosted, or multi-tenant deployments where an attacker can create or modify views that a victim later opens.
Out-of-bounds write in Cisco Expressway Series (VCS Expressway) allows remote, unauthenticated attackers to trigger memory corruption that can cause high availability impact, such as process crashes or appliance instability, while confidentiality and integrity remain unaffected per the assessed CVSS vector. The issue is one of multiple internally discovered out-of-bounds write flaws addressed in Cisco hardening releases, and unpatched Expressway deployments are affected. No public exploit was identified at time of analysis, and no CISA KEV entry was provided.
GitLab CE/EE versions from 18.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 can redirect certain OAuth/OIDC flows to an externally controlled server when an unauthenticated attacker poisons a shared cache of discovery documents; exploitation is high-complexity and requires a legitimate user to subsequently start an affected flow (UI:R). The issue is rated CVSS 7.5 with scope change and high confidentiality impact, but no public exploit identified at time of analysis and CISA KEV status was not indicated, making this a moderate-priority fix rather than an emergency. Patched releases 19.3.6, 19.4.3, and 19.5.1 are available.
Charts rendered by Vaadin Charts across Vaadin 22 through 25.3.0 bundle a pinned Highcharts release (9.2.2 in Vaadin 22-24, 12.2.0 in Vaadin 25) whose disclosed flaws - prototype pollution through dotted series.keys paths and several DOM-XSS sinks (credits.href, breadcrumbs.style, HTML parsed while printing, and xlink:href in exported charts) - become reachable whenever attacker-controlled data reaches the chart configuration. Applications that pass untrusted input into additionalOptions, updateConfiguration() or markup-bearing text options can be induced to execute script in a victim's browser or, in the Node.js SVG export path, to pollute Object.prototype. Scoring 8.4 (CVSS 4.0) and 9.3-equivalent under the assessed CVSS 3.1 vector, exploitation requires a low-privileged authenticated input path and a victim actively rendering, printing or exporting the chart; no public exploit code has been identified at time of analysis, and because Vaadin pins the Highcharts version, upgrading Highcharts independently does not remove the exposure.
Arbitrary command execution in OnePlus OxygenOS on Android lets a uid-0 process in any SELinux domain granted binder access to the olc2 logging HAL execute caller-supplied shell commands through a privileged vendor shell. The HAL's sole authorization check is getCallingUid() == 0 and it does not validate the command string, so the practical attack path requires reaching a qualifying uid-0 domain; the described dumpstate route depends on a separate flaw that makes dumpstate reachable from an unprivileged app. The issue is local-only and affects OxygenOS 16.1.0 before 16.1.10.500, 16.0.0 before 16.0.5.1200, and 15.0.0 before 15.0.0.2000; no public exploit identified at time of analysis.
Image decoding through the sharp npm library before 0.35.0 - or through a system libvips older than 8.18.3 - exposes the GIF, TIFF and VIPS loaders to five inherited libvips decoder flaws (CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591 and CVE-2026-69242), two of which are rated High under CVSSv4. An attacker who can get crafted images into an affected application can trigger those decoder bugs with no victim interaction; the independent assessment (CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H) treats the path as remotely reachable and unauthenticated, so real exposure depends on whether the application accepts untrusted uploads. No public exploit code or CISA KEV entry was identified at time of analysis, and upgrading to sharp 0.35.0/0.35.3 or blocking the three loaders removes the vulnerable path.
Trigger.dev's dashboard run replay endpoint lets an attacker who knows or enumerates a run friendlyId replay another organization's task run into an environment of the attacker's choosing, potentially exposing task payloads and executing the task with the victim's secrets. The vendor CVSS 4.0 score is 8.3 (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N), with an independent CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N; the CVSS PR:N designation suggests unauthenticated access, although the GHSA's 'any authenticated user' wording means authentication requirements are not definitively confirmed. Publicly available exploit code exists (a PoC POST request is included in the GHSA), but no CISA KEV entry or confirmed active exploitation appears in the supplied data.
Unauthenticated remote attackers can wipe every group, tag and ticket in Trudesk 1.2.11 and earlier by calling the /debug/populatedb route, which remains registered whenever the NODE_ENV environment variable is unset - an unauthenticated, no-interaction, network-reachable action that destroys data integrity and availability (rated 8.3, CWE-1188) but is gated entirely by that deployment-configuration prerequisite rather than by any credential. The same call reseeds the database with default accounts whose password is 'password', so a successful wipe can additionally hand the attacker a working login to the emptied instance. No CISA KEV activity and no public exploit code were identified at time of analysis, and the overall signal is a credible but conditionally-gated destructive flaw rather than a top-tier emergency.
Unauthenticated remote attackers can bypass Socket.IO authentication on self-hosted Trigger.dev webapps before 4.5.4 because the /coordinator namespace authenticates against a source-published default COORDINATOR_SECRET ('coordinator-secret') that is absent from the self-hosting docs, .env.example, and Helm values, so operators who never overrode it ship the published value. With that value an attacker can emit READY_FOR_EXECUTION to pull a run's decrypted environment variables (V1/marqs deployments, provided an internal runId is known) or send TASK_RUN_FAILED_TO_RUN, TASK_RUN_COMPLETED, CHECKPOINT_CREATED and similar events to tamper with arbitrary runs. No public exploit code or confirmed active exploitation was identified at time of analysis; exposure is confined to self-hosted deployments left on the default secret, and Trigger.dev Cloud is not implicated by this self-host default-configuration issue.
SQL injection in Trigger.dev before 4.5.6 lets an authenticated caller holding a project API key with read:runs scope read TaskRun records, including payloads and metadata, across organizations on a multi-tenant self-hosted instance by supplying malicious SQL in the tags query parameter of /realtime/v1/runs. The flaw is high severity but operationally meaningful primarily where multiple organizations share the same self-hosted deployment; single-tenant or SaaS-isolated deployments do not expose foreign tenant data in the same way. No public exploit identified at time of analysis.
Cross-tenant SQL injection in Trigger.dev's TSQL/TRQL query compiler (versions up to and including 4.5.5) allows any authenticated customer holding a valid API key to read other organizations' analytics data from the shared ClickHouse backend through the customer-facing POST /api/v1/query endpoint. The compiler applies its allowlists, identifier escaping, and per-tenant WHERE guard everywhere except the window-function name, which is concatenated raw into the generated SQL, so a backtick-quoted identifier can smuggle a raw subquery that sits outside the tenant guard. Exploitation requires authentication (PR:L) and a multi-tenant deployment for maximum impact; no public exploit code identified at time of analysis, and the issue is fixed in 4.5.6.
Authenticated subscribers on WordPress sites running the Productive Commerce plugin before 1.1.49 can activate any plugin already installed on the site, because one of its AJAX actions omits a capability check and the nonce meant to guard it is exposed on every admin-area page. The flaw is a moderate, integrity-only authorization issue (CVSS 4.3, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) that requires a logged-in account and cannot be used to upload new plugins. Publicly available exploit code exists, and the vendor has released version 1.1.49 to address it.
Missing authorization checks in the SmartyParcel WordPress plugin before version 1.23.4 let any authenticated user - including a default subscriber - delete shipping label and tracking records belonging to arbitrary orders across the entire store. Because the vulnerable code path performs no capability or ownership validation, an attacker only needs a valid low-privilege account, which is trivially self-provisioned on stores that leave WordPress user registration open. Publicly available exploit code exists, and the impact is confined to integrity loss (records deleted, no data disclosure or site takeover), consistent with the CVSS 4.3 score (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N); no confirmed active exploitation (CISA KEV) has been reported.
Cross-site request forgery in the Download Manager WordPress plugin lets remote attackers trick a logged-in administrator into changing the plugin's privacy and storage settings, including the credential that protects its unauthenticated maintenance endpoint. The flaw affects versions before 3.3.71 and 4.0.0 through 7.5.9, requires administrator interaction with a crafted link (UI:R), and publicly available exploit code exists. With CVSS 4.3, impact is limited to integrity of plugin settings, but an attacker who sets the maintenance-endpoint credential can expose that otherwise-unauthenticated interface.
Unauthenticated attackers can download private ticket attachments from Trudesk through 1.2.11 because express.static serves the public/ directory ahead of the hasAuth-guarded /uploads mount, so a direct request bypasses the authentication middleware entirely. Successful retrieval requires knowing or guessing a valid ticket MongoDB ObjectId plus the matching attachment filename, which is the main bound on the risk: no credentials or user interaction are needed and default configurations are affected, but the 12-byte ObjectId is not trivially guessable, so blind mass exploitation is impractical and realistic compromise depends on IDs and filenames leaking via URLs, email notifications, or referrers, or on an instance where IDs can be enumerated. No public exploit code and no confirmed active exploitation were identified at time of analysis.