Unauthenticated server-side request forgery in MLflow 3.12.0rc0 through 3.16.x lets remote attackers make the tracking server issue outbound HTTP requests to an arbitrary attacker-chosen host, including internal services or cloud-metadata endpoints, with attacker-controlled headers and body. The flaw is reachable through the scorer invoke, register, and GenAI evaluate endpoints (notably POST /ajax-api/3.0/mlflow/scorer/invoke), and is only exploitable when the optional trulens and trulens-providers-litellm packages are installed in the server environment; a model URI outside MLflow's native provider registry forces the LiteLLM fallback that forwards raw api_base and api_key values. It is fixed in MLflow 3.17.0. No CISA KEV listing or confirmed active exploitation exists, and the vendor advisory ships a public proof-of-concept script that has not been independently verified here as working exploit code; the vuln.today decision label places it in the current month's remediation cycle rather than the emergency queue.
Improper shortcode handling in the Advanced Custom Fields: Extended and ACF Extended PRO WordPress plugins (versions 0.9.2.4 through 0.9.2.7) allows unauthenticated visitors to have arbitrary shortcodes executed server-side when they submit a front-end form whose stored configuration lacks the setting that disables shortcode processing in the confirmation message. Exploitation is conditional on the site publishing such a form, an attacker-uncontrolled precondition reflected by the high attack complexity; where that condition holds, no credentials or user interaction beyond a normal submission are needed. The impact is bounded to shortcodes registered on the target site rather than true arbitrary code execution, and the vendor has released a fix in 0.9.2.8; only a public PoC reference exists and it is not verified as working exploit code, with no confirmed active exploitation (CISA KEV) and this month's priority label.
reCAPTCHA verification bypass in the Profile Builder WordPress plugin 4.0.0 through 4.0.4 lets authenticated users post comments through submission paths that do not enforce the administrator-configured anti-spam check. The issue is low-severity and limited-impact, only affecting sites where reCAPTCHA is enabled for the WordPress comment form; a public PoC reference exists, but it is not verified as working exploit code. The vendor has released a fixed version, 4.0.5.
Server-side request forgery in AWS Multi Model Server 1.1.11 and earlier lets remote attackers steer the model download path at internal network destinations by supplying a crafted model URL, so the server itself issues the request into a separate internal trust boundary (CVSS 5.8, scope-changed, confidentiality-only impact). The vendor has declared the project end of life and states that no fixed version is available, so the only supported remediation is to discontinue use and migrate to a supported model-serving solution. No public exploit identified at time of analysis, and the real-world exposure hinges on whether the model-management/download interface is reachable by the attacker in a given deployment, which the available sources do not state.
The cgm-updater process shipped with CGM CLININET exposes a network listener that performs no authentication, so anything that can reach that port can interact with the updater service directly. The behaviour is confirmed in versions up to 2026.MS3, and the vendor material does not rule out later builds. Impact is bounded - confidentiality, integrity and availability are all rated Low in the assessed vector - and no public exploit code has been identified at time of analysis; the practical exposure depends on whether the updater port is reachable from untrusted network segments, which in hospital deployments is typically an internal-network question rather than an internet-facing one.
Lookyloo through 1.39.3 misassigns request parameters in the unauthenticated /json/<uuid>/report endpoint (CaptureReport), so a supplied email string lands in the as_admin slot and evaluates as true, forcing admin-mode processing. On instances that have a MISP backend configured, this makes each report request trigger a MISP search query and embed matching URLs in the notification sent to the analyst, which the vendor describes as a potential denial-of-service vector against that subsystem; there is no leak to the submitter and no confidentiality or integrity impact. A public PoC reference (a curl request) is included in the GHSA advisory but is not verified as working exploit code, no KEV entry exists, and the vuln.today decision label is this_month, so the issue is genuine but limited in severity.
Denial of service in Eclipse KeyPont's `gose` JOSE/JWT Go library: `JwtClaims.MarshalJSON` builds a runtime struct with `reflect.StructOf`, naming each field `"A" + claimName`, which panics whenever an untyped claim key is not a valid Go identifier (for example the URL-namespaced `https://example.com/roles` claims that OIDC and Auth0 mandate) or collides after prefixing (`utomaticJwtClaims`, `ettableJwtClaims`). All releases of `github.com/ThalesGroup/gose` from v0.7.3 through v0.13.0-rc1 are affected and that module path is deprecated and unpatched, while `github.com/eclipse-keypont/gose` is affected below v1.0.0-rc4 and fixed in v1.0.0-rc4. Impact is availability only (assessed CVSS:3.1 AV:N/AC:L/PR:N/UI:N/C:N/I:N/A:L, vendor CVSS 4.0 6.9 Medium with VA:L), the panic is reachable from legitimate standards-compliant IdP tokens without any attacker, and it only bites callers that call `json.Marshal` on the `*jose.JwtClaims` returned by `JwtVerifierImpl.Verify` without recovering; a reproducer is documented in the upstream advisory, and no public exploit code or active exploitation is confirmed (no CISA KEV listing).
CPU exhaustion in the Go JOSE library Eclipse KeyPont gose (formerly github.com/ThalesGroup/gose) allows a hostile JWK/JWKS document to pin one CPU core for roughly 15 seconds, because the duplicate key_ops validation in jwkFields.CheckConsistency runs an all-pairs nested loop whose cost grows with the square of the entry count (CWE-407). Because that check executes on every JWK and JWKS unmarshal, any consumer that parses a JWKS body from an attacker-controlled or attacker-influenced source - a compromised or malicious identity provider, a misconfigured discovery URL, or an application that accepts a JWKS URL as user input - is exposed; the authoritative assessment rates the impact as availability-only (CVSS:3.1 AV:N/AC:H, no confidentiality or integrity effect), with the higher AC reflecting the precondition that the victim must actually fetch from the hostile endpoint rather than any attacker-uncontrolled timing condition, and notes a trusted, pinned IdP deployment is not triggerable. All releases since the earliest tag are affected on the ThalesGroup module path (>= 0.7.3, <= 0.13.0-rc1, which is deprecated and unpatched) and on the Eclipse path (< 1.0.0-rc4), with the fix first shipped in v1.0.0-rc4; there is no CISA KEV listing and no public exploit identified at time of analysis.
Denial of service in the Eclipse Keypont gose Go JWE library (published historically as github.com/ThalesGroup/gose) where AesGcmCryptor.Open forwards a caller-supplied, wire-derived nonce to crypto/cipher AEAD Open without a length check, causing the Go standard library to panic instead of returning an error. Any party able to submit a compact JWE to a gose-backed decryptor can trigger it without key material or credentials (CVSS 4.0 base 6.9; assessed CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) - they only need a kid matching a key in the decryptor's keystore, alg=dir with a matching enc, and an IV whose decoded length is anything other than 12 bytes. Impact is bounded by the caller's panic posture: under net/http the panic is recovered per request and only that request fails, while a worker, daemon or CLI without recovery has its process terminated; confidentiality and integrity are unaffected because the panic occurs before plaintext is produced. No public exploit code was identified at time of analysis, although the advisory ships a unit-test reproducer that demonstrates the panic; this_month priority, not KEV-listed.
Eclipse KeyPont GoSE's JWE decryptor panics instead of returning an error when a compact JWE carries an incorrectly sized initialization vector, giving a denial of service to anyone holding the recipient's public key. The flaw affects github.com/eclipse-keypont/gose releases from v0.8.0 up to but excluding v1.0.0-rc4, and the deprecated github.com/ThalesGroup/gose module through v0.13.0-rc1. A public PoC reference and a working reproducer are documented in the upstream advisory; it is not confirmed as actively exploited (no KEV entry), and the practical impact ranges from a single failed HTTP request to full process termination depending on the caller's panic recovery posture.
Parsing an attacker-supplied PLY file with RPly 1.1.4 or earlier can crash a host application on the ASCII parsing path and corrupt memory on the binary parsing path, because the library accepts the token 'list' as the length type or value type of a list property and then indexes handler tables out of bounds. The weakness sits in ply_read_header_property() and is reached through ply_read_list_property(); an application is only exposed if it ingests a crafted PLY, so delivery is local and requires victim-side file processing (CVSS 3.1 AV:L/UI:R, no attacker authentication), not a remote network trigger. No confirmed in-the-wild exploitation or public exploit code was identified at time of analysis, though a public technical writeup of the property list type confusion exists; independent assessment rates this a genuine but moderate-priority issue to be handled within the current monthly patch cycle rather than an emergency.
CGM CLININET before 2026.MS3 exposes production database and RabbitMQ broker credentials to any local account because the SysIO.pl configuration file has insecure permissions that make it readable. An attacker with an existing local account on the CLININET application server can read those credentials and use them to attempt access to the production database or message broker, though no remote vector is involved. The issue is rated 6.8 (Medium) by CERT-PL, and no public exploit was identified at the time of analysis.
Predictable replacement-password generation in Goobi Viewer Core (Maven io.goobi.viewer:viewer-core) before 26.05 lets an attacker who can approximate the server-side generation time brute-force the password that is emailed after a reset and log in as the victim, giving high confidentiality and integrity impact at CVSS 6.8. Standalone exploitation is gated by two assessed preconditions: the account holder must have triggered the reset themselves (UI:R) and the attacker must infer server time from network or email metadata (AC:H), so mass exploitation is not trivial. No public exploit code was identified at time of analysis; the vendor fixed the flaw in 26.05, and the advisory notes that chaining it with CVE-2026-46346 (GHSA-gj5g-4rxf-8rmq) removes the victim-interaction requirement and reaches a combined severity of 9.1 Critical.
Cross-site scripting in ACF Extended and ACF Extended PRO versions 0.8.9.4 through before 0.9.2.8 allows authenticated users with contributor-level privileges to have arbitrary script run in a victim's browser, including a logged-in administrator, when the victim opens a crafted link or page. The issue is an incomplete fix for CVE-2023-5292: the earlier deny-list covered only the three HTML wrapper attributes, leaving other form shortcode attributes able to take values from the visitor's request and be output without escaping. No public exploit code has been identified at time of analysis, and version 0.9.2.8 resolves the flaw.
Stored cross-site scripting in the User Profile Builder WordPress plugin before 4.0.5 allows authenticated users with a role as low as contributor to inject script through an unescaped shortcode attribute that is output in a redirect message, executing in the browser of a higher-privileged user who submits the affected form. The authoritative assessment is CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, meaning exploitation requires prior authenticated access and victim interaction; the supplied score is 6.8. No public exploit was identified at time of analysis and CISA SSVC lists exploitation as none, with a vendor fix available in 4.0.5.
Stored cross-site scripting in the Otter Blocks WordPress plugin before version 3.2.8 lets users with contributor-level access or higher inject arbitrary web scripts through crafted block styling values that the plugin writes unsanitized into an inline stylesheet. The payload persists in the affected post and executes in the browser of any visitor who later views it, including an administrator, which can lead to session or privilege compromise. Exploitation requires an authenticated contributor account and victim interaction (viewing the poisoned post); no public exploit has been identified at time of analysis, SSVC records Exploitation as none and Automatable as no, and the vendor has released a patch in 3.2.8.
Authenticated low-privileged users of Zimbra Collaboration Suite 10.1.16 and 10.1.20 can exhaust another mailbox's finite quota by repeatedly sharing and revoking a document with that recipient, with no victim interaction required. Each share creates a shared-file record that charges the document size to mailbox-wide usage, but revocation deletes the record and reverses only the folder counters, leaving the mailbox-wide charge in place, so repeated normal share notifications silently accumulate quota consumption after the visible records are gone. The result is availability-only impact (no data read or modification): once the quota is consumed, incoming mail and other size-increasing operations fail; accounts configured with unlimited quota are unaffected, and no public exploit or confirmed active exploitation was identified at time of analysis (decision priority: this_month).
Missing authorization in the Magepeople Car Rental Manager WordPress plugin through 1.5.3 allows authenticated low-privilege users to access data beyond their intended permissions, affecting confidentiality only; this is a moderate-priority issue, not an emergency. Exploitation requires a running WordPress site with the plugin and a valid low-tier account, so sites that allow self-registration or customer accounts are more exposed. No KEV entry is present, and no public exploit is identified at time of analysis.
Off-path DNS answer spoofing against the Zephyr DNS stub resolver (subsys/net/lib/dns, builds with CONFIG_DNS_RESOLVER) is made practical by a single static UDP source port that is bound once at resolver initialisation and reused for every query, so only the 16-bit transaction identifier varies - contrary to RFC 5452 section 9.2, which requires both to change. A remote attacker with UDP reachability to the device (same LAN, Wi-Fi or mesh segment, or a globally routable address) can learn that port from any observed query or by scanning for the one ephemeral port that stays silent instead of returning ICMP port-unreachable, then flood forged answers across the identifier space during a query window and race the legitimate server; a win makes the application resolve an attacker-chosen address, and with CONFIG_DNS_RESOLVER_CACHE enabled the forged record persists for its attacker-chosen TTL. Affected versions are >= 1.8.0 through <= 4.4.2; no public exploit code or active exploitation is confirmed, exploitation is probabilistic (the race must be won, and a predictable name must be in flight), and endpoints whose TLS certificates are validated are largely protected. The assessed vector is AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N (6.5), and vendor fixes are merged on main and the v4.4, v4.3 and v3.7 branches with a projected release in 4.5.0.
Missing authorization in the Knit Pay WordPress plugin through version 9.6.3.0 allows unauthenticated remote attackers to reach functionality that should be access-controlled, with low confidentiality and integrity impact. The flaw is rated CVSS 6.5 (AV:N/AC:L/PR:N/UI:N) and requires the plugin to be installed and active on a network-reachable WordPress site; the specific endpoint or feature lacking the check is not described in the available sources. No public exploit or active exploitation is identified at time of analysis, and the supplied priority label is this_month.
Missing server-side authentication on four Jakarta WebSocket endpoints in goobi-viewer-core (DownloadTaskEndpoint, CampaignEndpoint, AutocompleteEndpoint, UserEndpoint) lets any remote client open a connection without proving its HttpSession belongs to a logged-in user; versions 4.11.0 through 26.05 are affected. Through CampaignEndpoint an unauthenticated party can pollute the in-process crowdsourcing page-lock map and broadcast forged lock messages, disrupting reviewers working in active crowdsourcing campaigns, and because no endpoint checks the Origin header, logged-in users who visit an attacker-controlled page are exposed to cross-site WebSocket hijacking. Impact is confined to workflow integrity and limited confidentiality rather than system compromise, no public exploit was identified at time of analysis, and the vendor has released a patch in version 26.05.
Unauthenticated remote attackers can force a password reset on any Goobi Viewer Core account prior to 26.05 because the reset token is derived predictably from the request timestamp. An attacker who knows the target's registered email address and can reach the exposed /user/resetpw/ endpoint can brute-force the token and invalidate the account password, locking the victim out. The flaw does not by itself disclose the new password or grant access; full unauthenticated account takeover requires chaining it with CVE-2026-46347. No confirmed public exploit code and no CISA KEV status were identified at time of analysis. The vendor-released fix is version 26.05.
An authenticated user holding only theme-file VIEW permission on a baserCMS 5.0.0-through-5.4.1 installation can read arbitrary .php, .css, .js and .ctp files outside the theme directory, including config/install.php which the installer writes with the plaintext database password and config/app_local.php which may expose the Security.salt fallback. The read path ThemeFilesService::get() is the one path-handling sink in the bundled but default-disabled BcThemeFile plugin that never received the assertWithinThemeDir() guard applied to every write sink, so a legitimate view-only grant becomes application source and credential disclosure; because authorization is evaluated against the unresolved request path, this also constitutes privilege escalation. The issue is not listed in CISA KEV, a public PoC reference exists in the upstream GHSA advisory (which reports reproduction on 5.4.1 with MySQL and includes request-level screenshots) but it is not independently verified as working exploit code, and the vendor has released fixed versions 5.3.2 and 5.4.2.
Server-side request forgery in the open-source Event Schedule platform (versions 1.0.0 and earlier) lets an authenticated user who holds a curator role store a crafted import URL that defeats the App\Utils\UrlUtils::isUrlSafe() guard, so the application later fetches internal or localhost services via ImportCuratorEvents and imports the response body as event data. Two bypasses are documented: bracketed IPv6 literals that parse_url leaves un-normalized, and an A-record-only resolver that fails open for AAAA-only or rebindable hostnames. Rated CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), the flaw is limited by the curator-role requirement; no vendor-released patch was identified at time of analysis, and a public PoC reference (ported guard logic with sample outputs) accompanies the advisory.
Denial of service in Eclipse KeyPont Gose affects the AES-CBC-HMAC direct decryption path (NewJweDirectDecryptorBlock) in Go module github.com/ThalesGroup/gose v0.9.0 through v0.13.0-rc1: an unvalidated 64-bit plaintext length from the _thales_aad protected header causes a nil dereference, a BigEndian.Uint64 panic on short input, an unbounded allocation, or a slice-bounds panic after the HMAC check. The advisory includes an executed reproducer and notes that the same 11 releases carry GHSA-h6w5-722x-2h3m, whose constant, message-independent HMAC tag lets an attacker who has seen one valid JWE reuse its tag so the length field is reachable without the MAC key; confidentiality and integrity are unaffected. Active exploitation is not confirmed (no CISA KEV data is provided), the advisory contains an executed reproducer for the panic and oversized-length behavior, and the vuln.today priority is this_month.
Denial of service in Eclipse KeyPont gose occurs when a JWK declares kty EC with a non-EC alg and is passed directly to the exported LoadPublicKey or LoadPrivateKey loader; an unchecked ECDSAOptions type assertion panics the process. Affected releases are github.com/eclipse-keypont/gose before 1.0.0-rc4 and the deprecated github.com/ThalesGroup/gose path through 0.13.0-rc1, while gose's own NewVerificationKey/JWKS path gates EC algorithms and is not vulnerable. Exploitation is conditional on a consuming application forwarding externally supplied JWKs to those loaders; no CISA KEV listing or verified public exploit code is indicated, the advisory includes a reproducer, and the vendor rates the issue CVSS 4.0 6.3 with high attack complexity and availability-only impact.
JwksTrustStore.Get in the Eclipse KeyPont gose JOSE library (formerly github.com/ThalesGroup/gose) can return the last key parsed from a JWKS document, with a nil error, when the caller asks for a kid that is not present in that document - so absent-key lookups silently succeed against the wrong key instead of failing as 'not found'. The flaw exists in every release from v0.7.5 through v1.0.0-rc3 of the eclipse-keypont module path, and in the deprecated ThalesGroup path up to its final tag v0.13.0-rc1; it is fixed in v1.0.0-rc4. It is not an authentication bypass: JwtVerifierImpl.Verify still enforces algorithm match and signature verification against whatever key it receives, so a token signed by an unrelated key is still rejected; the realistic impact is broken kid-to-key binding during key rotation and any downstream logic that treats kid as a trusted decision input, which is why the maintainers rate integrity impact Low with High attack complexity. There is no KEV listing and no public exploit code identified at time of analysis; the upstream advisory publishes a reproducer that demonstrates the wrong-key return against an httptest JWKS server, and the recommended handling is to fold the fix into a routine monthly patch cycle rather than an emergency response.
An out-of-bounds heap read in open-iscsi's iscsiuio daemon allows an attacker on the same network segment to crash the daemon, overwrite a single heap byte, or corrupt the stored iSCSI initiator name by sending a crafted DHCPv6 Advertise message. The flaw is in the DHCPv6 option parser, which calls strlen() on raw option data that carries no guaranteed NUL terminator, so the scan walks past the end of the buffer; open-iscsi packages as shipped in Red Hat Enterprise Linux 6, 7, 8, 9 and 10 are listed as affected, but only hosts that actually run iscsiuio and obtain iSCSI parameters over DHCPv6 (offload/boot deployments) are exposed, since the daemon is not default-active on typical systems. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; combined with the adjacency-only attack path this yields a medium severity (CVSS 6.3) and a this-month rather than emergency priority.
Eclipse KeyPont gose (formerly github.com/ThalesGroup/gose) fails to enforce the JWS `crit` header: any token carrying a non-empty `crit` array should be rejected per RFC 7515 §4.1.11 because gose implements no header extensions, yet affected verifiers accept such tokens and report successful verification. Because `crit` lives inside the signed protected header, this is not reachable by an unauthenticated attacker without the signing key; the realistic risk is cross-context replay, where a trusted issuer constrains a token's use with a critical extension (RFC 7797 `b64:false`, RFC 7800 `cnf`, or an ecosystem `must-revoke-check`) and a gose-backed verifier silently drops that mandatory constraint. Signatures and claims remain authentic, so integrity impact is limited; no public exploit code is identified at time of analysis and the issue is not in CISA KEV. Fixed in eclipse-keypont/gose v1.0.0-rc4 (commit be2277b, merged as 692c25c); the legacy ThalesGroup module path ends at v0.13.0-rc1 and remains vulnerable.
Forged remember-me cookies in Part-DB allow unauthenticated remote attackers who meet one prerequisite to authenticate as arbitrary users, including admin, on default Docker deployments that retain the bundled APP_SECRET. The flaw affects Part-DB Server through 2.12.0 and the official jbtronics/part-db1 image; exploitation requires either the target user's bcrypt password hash or interception of any valid REMEMBERME cookie, so deployments with a custom random APP_SECRET are not exposed. Version 2.12.1 fixes the issue and the GHSA advisory includes proof-of-concept scripts with live validation, but there is no CISA KEV entry and the vendor rates this specific issue MEDIUM.
Server-side request forgery in the Pestle importer of Tandoor Recipes through 2.6.15 allows an authenticated user with only the standard space 'user' role to make the server issue GET requests to arbitrary internal or external hosts by supplying a crafted image URL in a Pestle JSON import. It is a genuine but moderate-priority issue rather than a top-tier emergency: the flaw is reachable through POST /api/import/ with type=PESTLE, a default-available feature since v2.6.15, and the advisory documents a PoC with reproduced loopback fetch and storage of the internal response as a recipe image. No CISA KEV listing accompanies this CVE in the supplied data; 2.7.0 is the vendor-released fix.
SSRF denylist bypass in the npm package mcp-from-openapi (2.2.0 through 2.8.0) lets an attacker who controls the OpenAPI spec URL passed to fromURL - or a redirect target it follows - reach hosts the operator listed in refResolution.blockedHosts simply by appending a trailing root dot (http://internal.corp./), because DNS resolves the dotted FQDN to the same host while the library compares raw URL.hostname strings. The same release range separately forwarded caller-supplied Authorization and Cookie headers to cross-origin redirect targets, handing bearer tokens to an open redirect on the spec host. Impact is limited to fetching operator-blocked content (low confidentiality, no integrity or availability effect), exploitation depends on non-default reliance on blockedHosts as the host guard, no CISA KEV listing exists, and the upstream advisory documents proof-of-concept reproductions; 2.9.0 normalizes hostnames on both sides of the comparison and drops caller headers once a redirect leaves the spec origin.
Credential exposure in the npm package mcp-from-openapi (versions 2.5.0 up to but not including 2.9.0) lets a malicious or compromised spec host harvest the caller's Authorization, Cookie and Proxy-Authorization headers, because the library's manual redirect loop in safeFetch() re-sends those headers unchanged to every hop - including hops that leave the spec URL's origin, which native fetch would strip. An attacker who controls the host serving the OpenAPI document, or who can exploit an open redirect on that host, receives the bearer token or cookie that the caller supplied to fromURL(); impact is confidentiality-only and bounded to the single credential handed over (higher only when that token is high-privilege), and no leak occurs when no credential headers are passed or when followRedirects is disabled. The same advisory bundles a lower-severity blockedHosts denylist bypass (a trailing root dot, e.g. http://internal.corp./, fails the exact-string comparison), relevant only to deployments that rely on blockedHosts with allowInternalIPs enabled. A vendor fix is available in 2.9.0; no public exploit code was identified at time of analysis, though the upstream advisory documents reproduction steps, and the vendor rates the issue CVSS 4.0 6.3 while our independent assessment scores it CVSS 3.1 5.9-class AV:N/AC:H with low confidentiality impact only.
Path traversal in Entire CLI 0.7.6 and earlier lets a collaborator who can push to the shared `entire/checkpoints/v1` branch overwrite arbitrary files on another user's machine: when the victim runs `entire session resume` or `entire checkpoint rewind`, a crafted SessionID in checkpoint metadata is used to build restore filesystem paths without validation, so attacker-controlled transcript data is written outside the expected session directory. Both the push access to the checkpoints branch and the victim's explicit invocation of resume/rewind are required, which keeps this a precondition-heavy, supply-chain-style issue rather than a drive-by exploit; no public exploit code or confirmed active exploitation has been identified at time of analysis, and notification is tracked as a moderate-priority this-month item. Successful abuse yields high integrity impact on other systems' components (scope change) and limited availability impact.
Reflected cross-site scripting in the Zimbra Collaboration Suite (ZCS) login page lets an unauthenticated remote attacker run JavaScript under the legitimate Zimbra origin when a victim opens a crafted 'relogin' URL carrying a malicious zrememberme parameter. The parameter is reflected into a hidden input attribute of the two-factor error display without HTML encoding, so an attacker can substitute page content - such as a replacement login form - to capture credentials. ZCS 10.1.16 and 10.1.17 are confirmed affected (EUVD lists ≤10.1.17), severity is CVSS 6.1 with a scope change, and exploitation is strictly conditional on the victim opening the crafted link; the relogin path also logs out any existing session before rendering, so the demonstrated attack does not inherit mailbox access. No public exploit code is confirmed at time of analysis, though Rapid7 has published a technical write-up describing the demonstrated attack chain.
Cross-namespace data exposure in the Postgres- and SQLite-backed LangGraph stores (langgraph-checkpoint-postgres before 3.1.3 and langgraph-checkpoint-sqlite before 3.1.2) lets an authenticated, low-privileged caller who can influence a namespace label read, overwrite, or delete items stored under a different tenant's namespace. The stores flatten a namespace with ".".join(namespace), so a single label such as ("tenant.bob",) resolves to the same stored text as ("tenant", "bob"); only put/aput validated labels, while get, search, delete, list_namespaces, their async variants, and ops passed straight to batch/abatch accepted dotted labels unchecked. Exposure is deployment-dependent rather than universal: it requires an application that relies on namespace tuples to isolate tenants and passes untrusted input into those calls, InMemoryStore is unaffected because it compares namespace tuples, and there is no public exploit identified at time of analysis. The reported CVSS 4.0 score is 6.0, while the independent assessment rates it CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N.
Stored HTML injection in Part-DB through 2.12.0 lets an authenticated user with edit rights on an entity store a crafted name on a named collection sub-element (Part Parameter, Attachment, PartLot, Orderdetail and similar) and have that markup emitted unescaped when a higher-privileged victim opens the activity log at /log (requires system.show_logs, typically an admin or auditor) or the affected element's history table; the root cause is a single missed htmlspecialchars() in the CollectionElementDeleted branch of LogEntryExtraFormatter. The vendor advisory documents a proof-of-concept in which the stored payload parses into live img-onerror and script nodes in the victim's page, but the shipped Content-Security-Policy (script-src 'self' 'wasm-unsafe-eval', no unsafe-inline, plus X-Content-Type-Options: nosniff) blocks inline JavaScript execution, so on a default deployment the realistic impact is HTML and inline-CSS injection, content spoofing, UI redressing and img-src beaconing rather than script execution; full script execution requires a relaxed or non-default CSP or another rendering context. The issue is fixed in 2.12.1, and the overall read is a genuine but moderate-priority defect rather than a drop-everything emergency.
NetBox MCP Server 1.2.0 and earlier, when started with TRANSPORT=http, exposes its MCP HTTP endpoint with no authentication at all, so any host that can reach the listening port can open a valid MCP session and call all four NetBox read tools without supplying a token or credential. The flaw is conditional rather than universal: the default stdio transport is unaffected, and exposure requires an operator to select HTTP transport and leave the endpoint (default port 8000) network-reachable - a configuration the project README's three Docker examples actively encourage by pairing HOST=0.0.0.0 with -p 8000:8000 and no authentication guidance. The impact is read-only disclosure of the NetBox inventory and audit data (devices, IPs, VLANs, racks, circuits, VMs, changelogs including usernames), with no integrity or availability effect, and the advisory includes reproduction steps confirmed against v1.2.0 while no CISA KEV entry or other active-exploitation reporting was supplied.
Heap memory corruption, task reference-count corruption and assertion panics can occur in Tokio 1.54.0 when an application polls tokio::time::Interval on the multi-threaded runtime, because Interval::poll_tick (including .tick().await) may drop an internal timer entry without synchronizing with the time driver thread that is firing it, yielding a use-after-free on the timer's waker and task state in safe Rust. The exposure is narrow: only the single affected release (since yanked) combined with the multi-threaded runtime flavor and use of Interval, while Sleep and Timeout are explicitly unaffected. This is a memory-safety and reliability defect driven by the application's own concurrent timer usage rather than attacker-controlled input - no public exploit code has been identified at time of analysis, and realistic adversarial exploitation is strongly limited; a fix ships in Tokio 1.54.1.
Stored cross-user HTML injection in Part-DB's BOM validation results allows a user who can create or edit a Part name to plant markup that is later rendered unescaped in a different user's browser. The malicious Part name is interpolated into translated validation messages and output through Twig's |raw filter, so it executes as HTML when the victim imports a BOM CSV that references the poisoned Part ID; the advisory reports that the current Content Security Policy blocks inline JavaScript, confining impact to injected links, forms, tracking images and CSS-based UI redressing inside a trusted page rather than script execution or direct data compromise. Exploitation requires two authenticated low-privilege accounts (the advisory reproduced it with the non-admin Editor preset) and victim-side interaction (performing a BOM import), and a public proof-of-concept with payload and reproduction steps is published in the GHSA. Part-DB through 2.12.1 is affected; version 2.12.2 contains the fix.
Wasmtime 46.0.0 through 48.0.6 and 49.0.0 through 49.0.3 can be panicked by a malicious guest that induces a type mismatch when a host-created component-model stream or future is lowered back into guest code with a different payload type. Exposure is narrow: only embedders that create streams or futures with StreamReader::new or FutureReader::new, pass them through guest code, receive them back through a type-erased path such as StreamAny, FutureAny, Val::Stream or Val::Future, and then forward them to a guest function expecting a different payload type are affected; the result is a host crash (denial of service) with no code execution or data exposure. The issue is fixed in 48.0.7 and 49.0.4, and no public exploit was identified at the time of analysis.
Predictable and reused DHCPv4 transaction identifiers in the Zephyr RTOS DHCP client (subsys/net/lib/dhcpv4/dhcpv4.c, versions 1.7.0 through 4.4.2) allow an attacker who has observed or learned a single identifier to forge BOOTP replies that the client accepts. Because parsing applies the router and DNS options to the interface before any state check, one accepted datagram can repoint the device's default gateway and resolvers at attacker-chosen addresses, redirecting its traffic; during RENEWING or REBINDING a forged ACK re-binds the lease with attacker parameters and a forged NAK drops the address and restarts configuration. Remote unauthenticated exploitation is scored CVSS 3.1 5.6 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L), the weakness is rated non-emergency on the available signals, and no public exploit code has been identified at time of analysis; fixes are merged upstream and in the v4.4, v4.3 and v3.7 branches, with 4.5.0 projected as the first fixed release.
Speed Optimizer (a WordPress plugin) before 7.8.5 lets a non-Super-Admin site administrator on a multisite network create or overwrite network-wide options, because the plugin checks neither network-level privilege nor which option is being changed. This is an authenticated privilege-escalation / broken-authorization issue affecting only multisite deployments; single-site WordPress installs are not exposed since they have no Super Admin versus network-option distinction. There is no confirmed active exploitation (not in CISA KEV), no public exploit code identified at time of analysis, and EPSS data was not provided; the practical risk is bounded to trusted or compromised subsite administrators.
Path traversal (CWE-22) in the Apache Camel camel-docling component leaves an absolute-path bypass open after the CVE-2026-40047 fix, letting a party who controls the CamelDoclingCustomArguments header point the docling CLI subprocess at any directory the Camel process can already read. Affected are camel-docling 4.15.0 before 4.18.5 and 4.19.0 before 4.22.2; the 4.15.x-4.17.x and 4.19.x-4.21.x lines are end-of-life and will not be fixed. Rated CVSS 3.1 5.4 medium (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L), exposure is limited to CLI mode (the default) where a route forwards externally influenced values into the Camel header namespace or a consumer maps incoming headers without Camel's default header filtering; no public exploit identified at time of analysis.
HTTP request smuggling in Twisted's twisted.web server (twisted.web.http.HTTPChannel, versions 26.4.0 and earlier) lets remote attackers fold a hidden Content-Length header into an ordinary header value using a bare carriage return or bare line feed, because the parser rejects NUL bytes but not the other two control characters RFC 9110 section 5.5 requires it to reject. The impact is realized only when Twisted sits behind a front-end proxy or load balancer that treats a bare CR or LF as a line terminator: the front end frames one request, Twisted frames another, and the attacker can slip a request past front-end access controls, poison a shared connection so a later client receives the wrong response, or poison a cache. No authentication (PR:N) and no user interaction (UI:N) are required, but attack complexity is high (AC:H) because of the proxy dependency, no code execution results in any configuration, there is no KEV listing or confirmed active exploitation, and the GitHub advisory includes a PoC request sequence that has not been independently verified as working exploit code.
Concurrent booking requests against OpenReception's appointment booking software before 2.2.2 let a booking client holding a valid appointment token place unlimited overlapping appointments into a single agent time slot, corrupting the exclusivity guarantee of the booking calendar and denying availability to other clients. The server-side availability check runs as a plain SELECT that is not atomic with the appointment insert, so a burst of parallel requests with identical agentId, appointmentDate and duration all pass the check before any of them commits. The vendor advisory publishes a reproduction procedure (20 concurrent POSTs to the add-to-tunnel endpoint, all returning 200, followed by a single request returning 409), the issue is rated moderate (CVSS 5.4, PR:L, no confidentiality impact) and is fixed in 2.2.2; vuln.today priority places handling in the this_month bucket, and no active exploitation is confirmed (CISA KEV not listed).
Expression language injection in the Apache Camel camel-aws2-s3 producer allows a user who can choose object names in a bucket that a Camel route consumes to have Simple expressions of their choosing evaluated inside the Camel process, because the object name arriving in the CamelAwsS3Key message header is passed to the Simple language whenever it contains ${ or $simple{. Deployments on 4.8.0 through 4.18.4 and 4.19.0 through 4.22.1 are affected only where a route passes exchanges from an aws2-s3 consumer to an aws2-s3 producer with that header intact; the attacker must already hold write access to the consumed bucket (authenticated, PR:L), and reading an evaluated value back additionally requires visibility of object names in the destination bucket, which is why the assessed severity is medium (CVSS 5.4). No public exploit code or confirmed active exploitation was identified at time of analysis.
OpenStack Ironic deployments running versions before 39.0.1 expose DELETE and GET operations through the vendor_passthru API path, allowing an authenticated low-privileged Ironic API user to proxy those requests to a managed node's Redfish BMC - for example, to delete accounts on the BMC's Redfish service. Scoring 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N), the flaw requires valid Ironic credentials and a node configured with a Redfish-based BMC, so it is not reachable by an unauthenticated attacker and impact is bounded to low confidentiality and integrity effects. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; per the vulnerability priority assessment this is a this-month item rather than an emergency.
Authenticated Zimbra Collaboration Suite users with Briefcase access can publish a document that renders attacker-controlled content under the Zimbra origin, because the DefangFilter stylesheet sanitizer fails to clean the trailing ASCII segment of a stylesheet containing non-ASCII characters. The surviving CSS URL references let a shared application/x-zimbra-doc document pull in external resources and display a credential-collection form built from Zimbra's own visual assets. Exploitation requires the victim to open the document in a browser that renders that content type inline, and credential theft requires a further form submission, so the practical impact is a medium-severity (CVSS 5.4, scope-changed) content-spoofing/phishing primitive rather than direct code execution; no public exploit identified at time of analysis, and ZCS 10.1.16 and 10.1.20 are reported affected (EUVD lists versions up to and including 10.1.20).
Stored cross-site scripting in Part-DB Server 2.12.2 and earlier allows an authenticated user with attachment-upload permission to plant a JavaScript-bearing SVG that executes in the Part-DB origin whenever another user opens the attachment inline at /attachment/{id}/view. Because sanitization is decided from the user-controlled filename extension, naming the SVG payload with a non-SVG extension such as .jpg skips the sanitizer entirely, while the response still carries Content-Type: image/svg+xml; this can lead to session hijacking or account takeover of whichever user - potentially an administrator - views the file. Rated CVSS 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) with the vendor also citing CWE-434 alongside CWE-79; not listed in CISA KEV, and the advisory ships a public proof-of-concept reproduction (curl upload steps) rather than confirmed working exploit code; fixed in 2.12.3.