An authenticated GitLab user can seize control of an existing LDAP-backed account on instances that have both OmniAuth SAML and LDAP auto-linking enabled, because the LDAP email lookup performed during OmniAuth identity linking does not properly sanitize input. GitLab CE/EE deployments from 10.1 up to (but excluding) 19.3.6, 19.4.3, and 19.5.1 are in scope; the attacker needs a valid account (PR:L) but no action from the victim (UI:N), and the compromise extends beyond the attacker's original security scope (S:C) with high confidentiality and integrity impact while availability is unaffected (CVSS 8.2). Publicly available exploit code exists and a HackerOne report documents the issue, though there is no CISA KEV confirmation of active exploitation; the dual-feature prerequisite (SAML plus LDAP auto-linking) sharply narrows the exposed population, so this is a high-priority fix for that specific configuration rather than a universal emergency.
D-Link DHP-W610AV firmware 1.02EUb03 leaves the administrative HNAP password empty in its default configuration, so remote attackers who can reach the management interface can log in without valid credentials and obtain full control of the device. The issue is unauthenticated and requires no user interaction (CVSS 8.9), and publicly available exploit code exists; active exploitation is not confirmed by CISA KEV.
Unauthenticated stored cross-site scripting in the Jane Menu WordPress plugin before 1.5.1 lets remote attackers bind any published page to an attacker-controlled remote document that the plugin fetches and renders without escaping, causing arbitrary JavaScript to execute for visitors, including administrators. Authentication is not required, but exploitation is not automatic: the payload fires only when a victim visits the tampered published page (UI:R). Publicly available exploit code exists; CISA KEV does not list this CVE, and the independent assessment rates this as a genuine high-priority issue rather than an inflated score.
Buffer overflow in the Tenda BE3L Pro router running firmware 16.03.60.62 lets an authenticated, low-privileged user of the web management interface corrupt memory and potentially achieve code execution or force a device crash by submitting a crafted security_5g value to /goform/WifiBasicSet. The bug is network-reachable with low attack complexity and no user interaction, and publicly available exploit code exists (no CISA KEV confirmation of active exploitation at time of analysis). Practical risk hinges on exposure: the management interface is normally confined to the LAN/Wi-Fi side, so exposure to untrusted networks materially raises the threat.
SQL injection in the Click n Chat (Chat Widget Integration) WordPress plugin before 1.1.3 allows unauthenticated remote attackers to read arbitrary WordPress database contents by controlling a sort parameter that is placed directly into an SQL ORDER BY clause. The assessed vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, so the practical impact is high confidentiality loss with no integrity or availability effect, and no authentication or user interaction is needed. Publicly available exploit code exists; exposure is limited to sites running an affected plugin version with the chat-widget request handler reachable.
Unauthenticated SQL injection in Click n Chat (Chat Widget Integration) before 1.1.3 allows remote attackers to influence SQL query structure by supplying a parameter that the plugin uses as a column identifier without validation, giving high confidentiality impact through database data exposure with no integrity or availability impact assessed. Publicly available exploit code exists, and only WordPress sites with this specific plugin below version 1.1.3 are exposed, making the affected population narrow. The independent assessment rates the issue as network-reachable, low-complexity, and unauthenticated with scope unchanged, while the supplied base score is 8.6.
Missing authorization in Backup and Staging by WP Time Capsule before 1.22.28 allows an authenticated Subscriber on a WP Time Capsule staging site to invoke the staging-to-live deployment handler and overwrite the linked live site's database and configuration, potentially taking it offline. Exploitation is conditional on the plugin's staging-to-live workflow being configured with a separate live site, and publicly available exploit code exists. The vendor-released fixed version is 1.22.28.
Unauthenticated privilege escalation in the WP User Manager WordPress plugin (versions 2.9.21 through 2.9.25) allows an attacker to submit a live paid registration form and receive its configured administrator-equivalent role once the associated payment gateway has been disconnected - the payment gate is silently dropped instead of failing closed. The flaw is rated CVSS 8.1 (AV:N/AC:H/PR:N/UI:N/C:H/I:H/A:H, CWE-269), but practical exploitation requires the non-default combination of a published paid registration form that assigns a privileged role plus an inactive gateway, so sites that never offered paid registration, never mapped the form to a high-privilege role, or have unpublished the form are not exposed. Publicly available exploit code exists and the issue is fixed in 2.9.26; no KEV listing appears in the supplied intelligence.
Stored cross-site scripting in the Falang Multilanguage plugin for WordPress before 1.4.6 lets any authenticated user at Subscriber level or above plant script-bearing content that later renders in an administrator's browser session. The plugin's term-translation save handler performs no capability check and hands a valid nonce to any logged-in user, so a low-privilege account is enough to store the payload; execution still depends on a higher-privileged user opening the affected translation screen, which limits the real-world blast radius below the headline 8.0 score. Publicly available exploit code exists and the flaw is fixed in 1.4.6, but exploitation is only realistic on sites that allow self-registration or where the attacker already holds a low-tier account.
Authenticated SQL injection in the Modern Events Calendar Lite and Modern Event Calendar Pro WordPress plugins before version 7.37.0 allows any logged-in user with Subscriber-level access or higher to append additional SQL clauses to an existing query and read sensitive data from the site's database. Only confidentiality is affected - the vulnerable code path provides no route to modify or delete data, and no user interaction is needed (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N per independent assessment). Publicly available exploit code exists, and the practical blast radius is largest on event, membership and community sites that permit open or self-service registration, where an attacker can simply sign up for a low-privilege account.
Stored cross-site scripting in CF7 Redirection before 3.2.12 allows unauthenticated visitors to submit form data that is retained and later rendered without proper sanitization or escaping in the lead debug metabox. The payload executes only when a logged-in user, typically an administrator, opens the crafted entry's debug metabox while the plugin's non-default debug mode is enabled. Publicly available exploit code exists, but exploitation is constrained by that configuration dependency and the required privileged user interaction; no CISA KEV confirmation was provided.
Stored cross-site scripting in the Weglot WordPress plugin before 6.4.3 lets unauthenticated attackers plant a payload that executes in the browser of anyone who views an affected page in a translated language. The flaw appears when Weglot rewrites links for translated content: it re-inserts URLs without escaping and reverses earlier encoding. Exploitation requires the site to have link rewriting/translation rendering active with at least one additional language and a victim to load the translated view; publicly available exploit code exists, and the issue is moderate priority rather than a critical fire-drill.
Unauthenticated remote attackers can exhaust the daily rate-limit allowance for payment gateway verification in the Formidable Forms WordPress plugin on sites running versions 6.5 through 6.x with a payment gateway configured, causing legitimate verification attempts to be refused for up to 24 hours. The plugin records the rate-limit timestamp without verifying the caller's identity, so the issue is a bounded availability impact against the verification function rather than a full site outage or system compromise. Publicly available exploit code exists, a vendor patch is available in version 7.0, and the independently assessed impact is availability-only.
Privilege escalation in the Simple Banner WordPress plugin before 3.3.3 lets any role that an administrator has permitted to manage banners gain the full 'administrator' capability, allowing an authenticated low-privileged user to take complete control of the site. The flaw is only reachable when an admin has explicitly delegated banner management to a non-administrator role and the attacker holds an account in that role - a non-default configuration reflected in the AC:H/PR:L vector - so default installs and unauthenticated visitors are not exposed. Publicly available exploit code exists and the vendor has released version 3.3.3 as a fix; no CISA KEV listing is associated with this CVE at time of analysis.
miniOrange 2FA versions 6.2.9 to before 6.3.1 permit an attacker who already knows a victim's WordPress password to add an attacker-controlled passkey during a pending passkey login, bypassing the second factor on accounts that already have a passkey. The assessed vector is CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N, so exploitation is authenticated (PR:L) and depends on a timing/state window (AC:H), with high confidentiality and integrity impact but no availability impact; publicly available exploit code exists, while no CISA KEV entry was supplied.
Account takeover is possible in Uncanny Toolkit for LearnDash (WordPress plugin) before 3.8.2: the plugin's password-reset handler accepts forged cross-site requests without validating their origin, so an unauthenticated attacker who induces a victim - one who is already partway through a reset - into loading a crafted page can set that account's password to an attacker-chosen value. Publicly available exploit code exists and the vendor shipped a fix in 3.8.2, though exploitation is gated by the timing of an in-progress reset plus victim interaction (CVSS 7.5, AC:H/UI:R).
Improper input validation in Node.js DNS resolution functions lets hostname or address strings containing null bytes reach dns.resolve/dns.lookup, which the 26.12.1 security release fixes by adding explicit null-byte validation of resolve inputs. Node.js 22.x through 22.23.3, 24.x through 24.22.0, and 26.x through 26.12.0 are affected, with the vendor patch shipped in Node.js 26.12.1. The assessed vector (AV:N/AC:H/PR:N/UI:N, C:H/I:H) means unauthenticated remote reach is possible but exploitation is conditional on the target application passing attacker-influenced strings into DNS resolution, and the exact trigger mechanism is not described in the available sources; a public PoC reference exists but is not verified as working exploit code, and there is no CISA KEV listing.
Node.js TLS certificate validation in versions 26.12.0 and 24.22.0 can mishandle non-canonical IP address representations, potentially causing IP-based certificate identity checks to be evaluated incorrectly. A network-positioned attacker who can influence the certificate presented during TLS peer validation of an IP address may exploit this to affect confidentiality and integrity, though exploitation requires a man-in-the-middle or malicious-endpoint position and a suitably crafted certificate. No CISA KEV active-exploitation confirmation is provided, but a public PoC reference exists and is not verified as working exploit code.
Node.js TLS certificate validation can accept a peer certificate that presents an IP address in a non-canonical representation instead of rejecting it, undermining identity checks for IP-addressed TLS peers; affected versions are 26.12.0, 24.22.0, and 22.23.3 and earlier on those branches. An attacker positioned to intercept the TLS path and able to supply a crafted certificate could exploit this to impersonate an IP-identified peer, with high confidentiality and integrity impact but no authentication or user interaction required. The vendor fixed the issue in the 2026-10-21 security release v26.12.1; a public PoC reference exists but is not verified as working exploit code, and no confirmed active exploitation is reported in the supplied intelligence.
Reflected cross-site scripting (CVSS 7.1) in WP Booking System before 2.1.0.3 allows unauthenticated remote attackers to inject script into an administrative page by luring a logged-in administrator to a crafted URL. The plugin reflects one of its parameters without validation or escaping, so the payload executes in the victim administrator's browser session and can perform actions with that user's privileges; exploitation requires user interaction (UI:R). Publicly available exploit code exists, and the vendor has released version 2.1.0.3 as a fix.
Stored cross-site scripting in the Advanced File Manager WordPress plugin (versions 5.4.13 through before 6.0.0) lets an attacker with file-manager access plant a file whose embedded script survives sanitisation, which then executes in the browser of any user who opens or previews it - typically an administrator. Exploitation requires a low-privileged account that an administrator has explicitly delegated file-manager access to (PR:L) plus a victim opening the crafted file (UI:R), which is why public exploit code exists but no active exploitation has been confirmed. Fixed in 6.0.0; the vendor advisory and WPScan entry document the detection flaw.
Reflected cross-site scripting in the User Profile Builder WordPress plugin before 4.0.1 allows an attacker to craft a URL that executes script in the browser of a logged-in high-privilege user, such as an administrator, when that user loads the vulnerable plugin admin page. The attacker needs no WordPress credentials (PR:N), but exploitation requires the victim to click the crafted link (UI:R) and succeeds only against users who can already access that admin page. Publicly available exploit code exists, and the vendor has released version 4.0.1 to address the flaw.
Code execution can be triggered in applications that use sharp before 0.35.4 on glibc-based Linux to decode untrusted AVIF or HEIF images, because the bundled libheif dependency contains heap buffer overflow flaws (CWE-122). The CVE record rates this 8.9 under CVSS 4.0 with a local vector and PR:N, but the independent assessment emphasizes that exploitation requires sharp's VipsForeignLoadHeif path to process attacker-controlled image data and is substantially easier when the Node.js executable is not compiled as PIE; non-glibc deployments and PIE builds reduce exposure. No public exploit identified at time of analysis, and no CISA KEV confirmation was provided.
Code execution can occur in sharp versions before 0.35.5 when an application decodes attacker-supplied SVG images through the bundled librsvg, which contains the use-after-free tracked as CVE-2026-96889. The RCE outcome is constrained to glibc-based Linux and Node.js executables that are not built as PIE, so many distribution-packaged Node.js deployments are protected from code execution even though the underlying memory corruption remains. No public exploit was identified at time of analysis; SVG decoding can be disabled with sharp.block as a workaround.
Heap-based buffer overflow in NoMachine's mDNS resource-record parsing enables unauthenticated, network-adjacent attackers to execute arbitrary code on affected installations, running in the context of the NoMachine service account. Exploitation requires the attacker to be on the same local link/multicast domain as the target (AV:A), with NoMachine's mDNS service discovery active and reachable; no authentication (PR:N) or user interaction (UI:N) is required, and complexity is low (AC:L), giving a CVSS 8.8 impact of high confidentiality, integrity, and availability. Originally reported through Trend Micro ZDI as ZDI-CAN-30982 (advisory ZDI-26-710), the flaw is a classic CWE-122 length-validation failure; no public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and the practical risk is gated by the adjacency precondition rather than internet-wide reachability.
PHP object injection in Duplicator and Duplicator Pro allows unauthenticated attackers to plant a serialized object in public site content that is later deserialized when an administrator builds a package and then runs a migration or import with database search-and-replace. In Duplicator through 1.5.17 the bundled Requests 1.7 POP chain can escalate this to operating-system command execution; in Duplicator Pro through 4.6.10 the IndexList destructor gadget is limited to deleting an attacker-selected file when the containing directory is writable by the installer PHP process, with site takeover possible only through the additional wp-config.php deletion, race, and attacker-controlled database steps. This is a high-priority but heavily gated issue, and no public exploit identified at time of analysis.
PHP object injection in the GS Plugins WordPress Team Members plugin through version 2.8.2 lets an authenticated low-privilege user submit crafted serialized data to a plugin feature that invokes PHP unserialize(), enabling object injection that can lead to high confidentiality, integrity, and availability impact if a usable POP gadget chain exists. The issue is network-reachable, requires no user interaction, and is scored CVSS 3.1 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H); no public exploit identified at time of analysis and no CISA KEV active exploitation was reported.
PHP object injection in GS Pins for Pinterest 1.9.2 and earlier allows an authenticated low-privilege WordPress user to pass crafted serialized data into PHP unserialize(), potentially enabling object injection and, if a usable POP gadget chain exists, code execution or other high-impact actions. The flaw is rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), and no public exploit was identified at time of analysis. Sites running the plugin should treat low-privilege accounts as an attack prerequisite and remove or mitigate the plugin until a fix is confirmed.
Privilege escalation in pfSense-pkg-RESTAPI before 2.9.0 lets an authenticated account holding the scoped settings-sync permission modify REST API configuration secrets through the HA sync endpoint, elevating that non-administrative user to full administrator. The issue is confined to installations of the unofficial pfSense REST API package and is not exploitable against a default configuration with no scoped-permission accounts; no public exploit code was identified at time of analysis. CVSS scores it 8.8, but practical risk is bounded by the deliberately assigned sync privilege and any REST API ACL or firewall restrictions on API endpoints.
Authorization bypass in Jupyter Server gateway mode (2.0.0 through 2.6.0) allows a restricted authenticated user to open an upstream kernel channel and execute code even when the configured Authorizer explicitly denies the kernel execute action, exposing kernel data and credentials and permitting environment modification or disruption. Exploitation requires a non-default GatewayClient.url configuration (or, in 2.6.0 and later, manual registration of the deprecated jupyter_server.gateway.handlers module) plus a valid low-privileged account whose policy denies execute; the default gateway configuration in 2.6.0 and later is fixed. No public exploit code or confirmed active exploitation was identified at time of analysis, and the CVSS 8.8 score reflects high confidentiality, integrity, and availability impact under that gated configuration.
SQL injection in Cisco Unified CM and related Cisco collaboration products (Emergency Responder, Unified CM IM&P, Unified CM SME, and Unity Connection) allows authenticated remote attackers with low privileges to execute arbitrary SQL against the underlying database, with high impact to confidentiality, integrity, and availability (CVSS 8.8). The flaw is network-reachable, low-complexity, and requires no user interaction, but exploitation requires a valid low-privilege account on an affected web or administrative interface. No public exploit was identified at time of analysis.
Cisco Unified CM and related Cisco UC products contain improper input validation that can let authenticated low-privilege attackers with network access affect confidentiality, integrity, and availability. Exploitation requires valid low-privilege credentials and reachability to the affected management/application interface, with no user interaction needed; the assessed CVSS 3.1 vector is 8.8 HIGH with high confidentiality, integrity, and availability impact. No public exploit was identified at time of analysis, and no CISA KEV status is indicated in the supplied data.
Unauthenticated remote attackers can retrieve a signed Biscuit identity token belonging to any approved, bootstrap-enrolled peer from the Google OSS Agent Mesh (SAM) control plane in versions 0.1.0-alpha.1 through 0.1.0-alpha.8, then replay it as a bearer credential to read mesh authorization policies via /policies and to overwrite advertised router multiaddrs via /routers/lease. The chain requires only the peer_id that the unauthenticated GET /info endpoint discloses, so no credentials or user interaction are needed; a related POST /enroll flaw let any bootstrap-token holder re-fetch another peer's credential. Vendor-released patch: 0.1.0-alpha.9, which enforces cryptographic proof of possession of the enrollment private key on credential-releasing endpoints, adds rate limiting, and validates router lease addresses; no public exploit code or confirmed active exploitation was identified at time of analysis.
Authenticated Splunk Enterprise users whose roles include the schedule_search capability can use the scheduled search workflow to run risky SPL commands that the platform would normally block, resulting in disclosure or alteration of Splunk data or disruption of Splunk availability. The issue affects Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, and is fixed in those releases. The assessed vector requires low privileges (PR:L) and no user interaction, with high confidentiality, integrity, and availability impact; no public exploit identified at time of analysis.
Prototype pollution in toml-node before 5.0.1 lets an attacker who controls TOML input passed to toml.parse() inject properties into Object.prototype by combining colliding quoted dotted-key bookkeeping with a table-array declaration. The flaw can corrupt objects created elsewhere in the same Node.js or browser process, producing high integrity and availability impact with no confidentiality impact; no public exploit identified at time of analysis.
Path traversal in Jupyter nbconvert 5.4.0 through 7.17.1 allows a remote unauthenticated attacker to write attacker-controlled output data to arbitrary filesystem locations writable by the victim's user account. Exploitation requires the victim to convert an attacker-supplied notebook using the markdown, LaTeX, reStructuredText, or AsciiDoc exporter, not the default HTML exporter; the assessed impact is high integrity and low availability with no confidentiality impact. No public exploit was identified at time of analysis, and version 7.17.2 contains the vendor fix.
Authenticated low-privileged Splunk Enterprise users can escalate to arbitrary OS command execution on search head cluster members by reconstructing the PostgreSQL sidecar superuser password. The password is deterministically derived from the search head cluster identifier, which surfaces in search job logs readable by users who do not hold the 'admin' or 'power' roles. Deployments below 10.4.4 and below 10.2.8 are affected where a search head cluster runs the PostgreSQL sidecar service; no public exploit code has been identified at time of analysis, but the flaw carries a CVSS score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and warrants prompt patching in SHC environments.
Unauthenticated remote attackers can drive HTTP transactions to completion against Apache Traffic Server instances that have loaded the experimental WebAssembly plugin and trigger a use-after-free in the plugin's transaction-close handler, producing memory corruption that primarily threatens availability (high) with a limited integrity impact. The same plugin also passes unvalidated guest-supplied metric IDs straight into ATS's internal stats API, a path that requires the attacker to control or supply the wasm guest module. Exposure is limited to deployments that explicitly enable this non-default experimental plugin on versions 10.0.0 through 10.1.4 or 10.2.0; no public exploit identified at time of analysis.
Cisco/Splunk has shipped a software hardening release for Splunk SOAR that fixes multiple internally discovered flaws, one of which is tracked as CVE-2026-76526, an improper-neutralization (CWE-707) weakness rated 8.8. Splunk SOAR deployments below version 8.7.0 are affected, and exploitation requires a valid low-privilege authenticated account (CVSS PR:L, AV:N) - there is no anonymous path, but no user interaction is needed, and successful abuse can fully compromise confidentiality, integrity and availability of the SOAR instance. No public exploit code has been identified at time of analysis and EPSS is low (0.17%, 6th percentile), so this is a this-week patch item rather than an emergency, though the appliance's role as an automation and credential hub raises the value of compromising it.
Splunk Enterprise releases 10.2 before 10.2.8, 10.0 before 10.0.11, 9.4 before 9.4.16 and 10.4 before 10.4.4 carry multiple internally discovered resource-lifetime flaws (CWE-664) that a remote attacker holding low-privileged credentials can use to gain high confidentiality, integrity and availability impact, with low attack complexity and no user interaction (CVSS 3.1 base 8.8, PR:L). Cisco/Splunk shipped the fixes in a consolidated hardening release rather than a single-feature advisory, so the specific triggering component is not described in the available sources; the only confirmed limiting factor is the need for valid low-privileged access. There is no CISA KEV entry and no confirmed working exploit code, and EPSS is low at 0.17% (6th percentile), though the vendor's this-week prioritisation and the breadth of the hardening release justify prompt upgrading.
Arbitrary file write in Dulwich before 1.2.9 on Windows can be escalated to remote code execution when an unauthenticated remote attacker convinces a victim or an automated Windows CI runner to clone or check out a malicious repository. A crafted Git tree entry whose name is a DOS drive-letter prefix such as 'C:' passes NTFS validation and causes os.path.join to discard the intended worktree root, allowing writes to locations like the user's .gitconfig or Startup folder. A proof-of-concept generator is described in the vendor advisory, so publicly available exploit code exists.
Trigger.dev self-hosted and cloud deployments through version 4.7.6 expose a supervisor workload API endpoint (attempts/start) that performs no ownership check, letting a caller act on runs and snapshots belonging to other deployments. Exploitation is not anonymous: an attacker must already hold a legitimate low-privilege run/snapshot pair and must reach the supervisor over an adjacent network segment, after which they can read resolved environment variables and run JWTs or start, complete, and suspend other tenants' runs. There is no public exploit code or confirmed active exploitation (no CISA KEV), and the vendor advisory GHSA-jc26-22qp-cgqj is the authoritative reference; risk concentrates in multi-tenant or hosted installations where untrusted workloads share a supervisor, while single-tenant self-hosted setups with no third-party workloads are materially less exposed.
Severity signals and exploitation signals diverge here: Splunk SOAR deployments below 8.7.0 permit an authenticated low-privilege user to bypass authorization by supplying requests whose URL path is non-canonical, so the path used for the access-control decision differs from the path the application ultimately services (CWE-647), with CVSS 3.1 scoring the issue 8.8 and high confidentiality, integrity and availability impact. The exposure is limited to holders of valid SOAR credentials on the web interface (PR:L, AV:N, UI:N) and does not extend to anonymous remote attackers. No public exploit code or active exploitation has been identified at time of analysis (SSVC exploitation: none), and Cisco/Splunk has shipped a hardened 8.7.0 release that resolves the flaw.
Local access-control bypass in Cisco Unified Communications products allows an authenticated low-privileged user or local session holder to gain high confidentiality, integrity, and availability impact, with scope change beyond the vulnerable component. The CVSS 3.1 score is 8.8, but the vector is AV:L/PR:L, so exploitation requires existing local access and valid low-privilege credentials rather than a remote unauthenticated path; no public exploit or CISA KEV active exploitation is identified. Affected products include Cisco Emergency Responder, Prime Collaboration Deployment, Unified CM, Unified CM IM&P, Unified CM SME, and Unity Connection, and Cisco hardening releases are available via advisory cisco-sa-voice-hardening-twgbH9e3.
Authenticated remote code execution in MindsDB allows a low-privileged user to run arbitrary Python in the context of the service account by supplying a crafted string to the OpenBBtable class. The flaw is a code-injection issue (CWE-94) in the OpenBB integration: the user-controlled value is used to execute Python without proper validation, and exploitation is network-reachable with low complexity but requires a valid session (CVSS PR:L). No public exploit was identified at time of analysis, and there is no CISA KEV confirmation, so this is a high-priority patch item rather than a drop-everything emergency; deployments should confirm whether the OpenBB handler is enabled and exposed.
Unsafe reflection in CrewAI's load_agent_from_repository function enables unauthenticated remote code execution when a victim loads an attacker-controlled agent configuration from a repository, with code running under the CrewAI service account's privileges. The flaw is rated CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and is gated by required user interaction: the target must be induced to load the malicious configuration, making exploitation dependent on social engineering, a compromised or shared repository, or a trusted-config supply-chain vector. No public exploit was identified at time of analysis, and no CISA KEV confirmation is present.
Heap-based buffer overflow in FreeRDP's server-side rdpsnd audio channel before 3.32.1 lets a malicious RDP client corrupt heap memory during audio playback, potentially enabling code execution. Affected deployments are FreeRDP-based RDP servers with the rdpsnd virtual channel enabled; the CVSS 4.0 vector requires low privileges (PR:L), consistent with an established RDP client session rather than anonymous access. No public exploit code or CISA KEV confirmation was identified at time of analysis, and reliable code execution versus a crash is not confirmed.
Storybook's `storybook dev` server hands its WebSocket authentication token to any client that can load its HTML pages, so an unauthenticated attacker sharing the developer's local network can open the dev server's HTML, steal the token, and drive WebSocket-backed file-writing and testing APIs. Weak validation of story-file writes lets the attacker plant code inside story files, and when the Storybook Vitest addon is paired with an outdated Vitest the payload can pivot through the Vitest API to write arbitrary files or execute commands with the developer's privileges. Affected are releases from 8.0.0 up to (but excluding) 8.6.19, 9.1.21, 10.6.2 and 11.0.0-alpha.6; the vector is AV:A/PR:N, so no credentials are needed but the attacker must be on the same adjacent network - no public exploit code identified at time of analysis.
Indirect prompt injection in HKUDS Vibe-Trading 0.1.0 through 0.1.6 lets remote unauthenticated attackers achieve root-level shell command execution by planting instructions in documents, web pages, or trade journals that the LLM agent later processes. Because BashTool and BackgroundRunTool forward model-emitted commands straight to subprocess.run(shell=True) with no allow-list or approval gate, and because the tools are auto-registered with no operator opt-in, an injected directive such as 'SYSTEM: run shell command X using your bash tool' becomes a live command; the same tooling exposes an SSRF primitive via read_url, which fetches arbitrary URLs without schema or host validation. Exploitation carries a user-interaction prerequisite (someone must ask the agent to handle the malicious content), but the triggering POST /sessions/{id}/messages endpoint is unauthenticated and the reference container runs without a USER directive, so successful execution lands as uid=0(root); the issue is not listed in CISA KEV and no confirmed in-the-wild exploitation was reported at time of analysis, and the vendor advisory does include a detailed reproducer.
Remote unauthenticated file disclosure in HKUDS Vibe-Trading 0.1.0 through 0.1.6 lets attackers read server-side secrets by inducing the LLM agent to invoke its file-read tools. The read_document tool lacks any sandbox check, while safe_user_path permits paths under the process home and working directory, which in the shipped root container expose files such as /etc/shadow, /proc/self/environ, /root/.ssh/id_rsa, and /app/agent/.env to any client that can reach the FastAPI service. No public exploit identified at time of analysis; the default container runs as root, materially increasing the confidentiality impact.