DOM-based cross-site scripting in the AivahThemes Hostme v2 WordPress theme (versions through 7.0) allows remote attackers to execute script in a victim's browser session on an affected site. The flaw is rated CVSS 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L): no attacker authentication is required, but exploitation depends on a targeted victim visiting or clicking attacker-supplied content that the theme's client-side JavaScript renders into the DOM without neutralization, and the scope change means injected code can act beyond the vulnerable component. The exact vulnerable parameter and DOM sink are not described in the available sources; no public exploit code was identified at time of analysis and there is no CISA KEV confirmation, and the advisory reference does not state a fixed version.
Client-IP spoofing in dadrus Heimdall (versions up to and including 0.17.16) lets remote attackers inject arbitrary strings, malformed IP literals, RFC 7239 'unknown' values and obfuscated identifiers into Request.ClientIPAddresses whenever the optional trusted_proxies setting is enabled, because the Forwarded (for=) and X-Forwarded-For values are never checked for syntactic validity and the Forwarded parser splits on ',' and ';' without honoring quoted strings. The practical consequence is deployment-dependent: rules that consume ClientIPAddresses (for example a CEL authorizer using networks() for IP-range checks, or a Remote authorizer forwarding the client IP) can be made to evaluate against attacker-chosen values, and in proxy mode the injected values are passed upstream unchanged in X-Forwarded-For/Forwarded headers. Exploitation is gated on non-default configuration (trusted_proxies), on attacker influence over the forwarding headers, and for the access-control path on rules actually referencing ClientIPAddresses; no public exploit code was identified at time of analysis and the issue is not in CISA KEV, with remediation available in 0.17.17.
Local privilege escalation and potential host compromise in the Linux kernel's arm64 KVM nested virtualization (NV) support, caused by a use-after-free of the nested_mmus shadow page-table array. Affected builds are those containing the NV nested_mmus implementation introduced by commit 4f128f8e1aaac189f83d0f828bcdb2986d8d2e51 (from Linux 6.11 onward) and running on arm64 hosts that actually enable the experimental, non-default NV feature; fixed versions are 6.12.113, 6.18.56, 7.2.9 and 7.3. An authenticated, local actor with guest/VMM-level privileges (CVSS PR:L, AV:L) must drive a VCPU_INIT that relocates the array while another vCPU is actively executing an L2 context, a narrow concurrency window (AC:H), which yields high confidentiality, integrity and availability impact (CVSS 7.0). There is no KEV listing and no confirmed working public exploit; EPSS is 0.21% (11th percentile), consistent with a constrained, hard-to-trigger local issue rather than a mass-exploitation emergency.
An undocumented root-level backdoor in the DJI CrystalSky ZS600C 'assistant' daemon allows a physically present attacker with USB access to execute arbitrary OS commands as root on firmware 0.3.9.7 through 0.6.6.9. Sending the hard-coded string 'dji26656677' to /dev/ttyGS0 unlocks a mode in which each subsequent line is passed to system(), with no authentication or user interaction required once USB access is obtained. The physical-access prerequisite is the dominant limiting factor: devices kept in continuous custody are not exposed, while units that leave custody during shipping, loan, resale or shared use are at risk; no public exploit identified at time of analysis.
Linux kernel builds for T-Head C9xx RISC-V CPUs can silently skip the GHOSTWRITE errata mitigation when ERRATA_THEAD_GHOSTWRITE is enabled but ERRATA_THEAD_MAE is disabled, leaving xtheadvector active and sysfs incorrectly reporting "Not affected." The flaw is local-only and high-complexity: an attacker needs a low-privileged local account on the vulnerable hardware plus a kernel built with that non-default configuration, so practical exposure is narrow despite CVSS 7.0. A vendor patch is available; no public exploit has been identified at time of analysis and EPSS is 0.21%.
A use-after-free-style lifetime bug in the net/mlx5 hardware steering (HWS) code can leave a dangling reference in a miss table's list when a flow-steering table that uses a default miss table is destroyed, allowing a local user with the privilege to create and tear down steering tables to corrupt kernel memory. Only hosts running the mlx5 driver against NVIDIA/Mellanox ConnectX hardware with HWS enabled and a miss table registered via the mlx5hws_table_set_default_miss API are affected; the attack surface is local and gated on CAP_NET_ADMIN-equivalent privileges and specialized non-default hardware, with High attack complexity. No public exploit code or active exploitation has been identified at time of analysis, and EPSS is low (0.21%, 10th percentile); fixed kernels are available from the vendor.
Writing encrypted data on Linux kernel 6.19 through 7.2 can trigger a NULL pointer dereference in ext4_finish_bio, crashing the kernel from the ext4-rsv-conversion workqueue. The flaw appears when the ext4 'encrypt' feature is enabled on an already-mounted filesystem, which bypasses the mount-time check that normally disables large folios for encrypted inodes; the crash path is local, requires a privileged administrative action (toggling a filesystem feature on a live mount), and affects availability only. The vendor fix ships in 7.2.10 (commit 40554d1221e3d2ff2e0d192b74a05d89eb3620e7), 7.3 is not affected due to later refactoring, EPSS is low at 0.19% (8th percentile), and no public exploit or CISA KEV entry was identified at time of analysis.
Local apps on DJI CrystalSky ZS600C devices can invoke system-privileged actions-including a factory reset that wipes user data, shutdown, clock/timezone changes, and a firmware-apply hand-off-because the DJIUpdateService binder does not verify caller identity or permissions. The flaw affects firmware v0.3.9.7 through v0.6.6.9 and is reachable by an installed app with no permissions and no user interaction. No public exploit has been identified at time of analysis; the issue is access-gated to local code execution on the specific device but warrants this-week prioritization because successful abuse is destructive and disruptive.
Forwarded-header injection in Heimdall (dadrus/heimdall) proxy mode up to and including 0.17.16 lets an unauthenticated remote attacker place commas and semicolons into the Host header so that Heimdall copies them verbatim into the RFC 7239 Forwarded header it sends upstream, producing attacker-controlled for= entries that can appear to originate from trusted addresses such as 127.0.0.1 or 10.0.0.1. This is a conditional, chained access-control-bypass flaw rather than a direct compromise of the proxy: Heimdall itself suffers no confidentiality, integrity or availability impact, and impact only materializes when an upstream service parses Forwarded per RFC 7239 and makes IP-based trust or allowlist decisions on the for= value on its own rather than relying on Heimdall's access-control capabilities. No authentication is required, no public exploit code was confirmed at time of analysis (the advisory supplies a curl-based proof-of-concept reference), and version 0.17.17 fixes the issue by hardening Host, Forwarded and X-Forwarded-For handling.
Server-side request forgery in AWS Multi Model Server 1.1.11 and earlier lets remote attackers steer the model download path at internal network destinations by supplying a crafted model URL, so the server itself issues the request into a separate internal trust boundary (CVSS 5.8, scope-changed, confidentiality-only impact). The vendor has declared the project end of life and states that no fixed version is available, so the only supported remediation is to discontinue use and migrate to a supported model-serving solution. No public exploit identified at time of analysis, and the real-world exposure hinges on whether the model-management/download interface is reachable by the attacker in a given deployment, which the available sources do not state.
The cgm-updater process shipped with CGM CLININET exposes a network listener that performs no authentication, so anything that can reach that port can interact with the updater service directly. The behaviour is confirmed in versions up to 2026.MS3, and the vendor material does not rule out later builds. Impact is bounded - confidentiality, integrity and availability are all rated Low in the assessed vector - and no public exploit code has been identified at time of analysis; the practical exposure depends on whether the updater port is reachable from untrusted network segments, which in hospital deployments is typically an internal-network question rather than an internet-facing one.
Lookyloo through 1.39.3 misassigns request parameters in the unauthenticated /json/<uuid>/report endpoint (CaptureReport), so a supplied email string lands in the as_admin slot and evaluates as true, forcing admin-mode processing. On instances that have a MISP backend configured, this makes each report request trigger a MISP search query and embed matching URLs in the notification sent to the analyst, which the vendor describes as a potential denial-of-service vector against that subsystem; there is no leak to the submitter and no confidentiality or integrity impact. A public PoC reference (a curl request) is included in the GHSA advisory but is not verified as working exploit code, no KEV entry exists, and the vuln.today decision label is this_month, so the issue is genuine but limited in severity.
Cleartext transmission of the sensitive ecos_pw value in the Tenda F6 router (firmware 12.02.01.73) web management interface exposes that value to anyone positioned on the network path between the management client and the device. The flaw is rated low severity (CVSS 4.0 score 2.9; assessed CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) because confidentiality impact is limited and exploitation requires the attacker to already be able to observe the traffic, which the vendor describes as difficult. Only a public PoC reference exists; it is not verified as working exploit code, and no confirmed active exploitation or fixed firmware version is documented in the available sources.
Denial of service in Eclipse KeyPont's `gose` JOSE/JWT Go library: `JwtClaims.MarshalJSON` builds a runtime struct with `reflect.StructOf`, naming each field `"A" + claimName`, which panics whenever an untyped claim key is not a valid Go identifier (for example the URL-namespaced `https://example.com/roles` claims that OIDC and Auth0 mandate) or collides after prefixing (`utomaticJwtClaims`, `ettableJwtClaims`). All releases of `github.com/ThalesGroup/gose` from v0.7.3 through v0.13.0-rc1 are affected and that module path is deprecated and unpatched, while `github.com/eclipse-keypont/gose` is affected below v1.0.0-rc4 and fixed in v1.0.0-rc4. Impact is availability only (assessed CVSS:3.1 AV:N/AC:L/PR:N/UI:N/C:N/I:N/A:L, vendor CVSS 4.0 6.9 Medium with VA:L), the panic is reachable from legitimate standards-compliant IdP tokens without any attacker, and it only bites callers that call `json.Marshal` on the `*jose.JwtClaims` returned by `JwtVerifierImpl.Verify` without recovering; a reproducer is documented in the upstream advisory, and no public exploit code or active exploitation is confirmed (no CISA KEV listing).
CPU exhaustion in the Go JOSE library Eclipse KeyPont gose (formerly github.com/ThalesGroup/gose) allows a hostile JWK/JWKS document to pin one CPU core for roughly 15 seconds, because the duplicate key_ops validation in jwkFields.CheckConsistency runs an all-pairs nested loop whose cost grows with the square of the entry count (CWE-407). Because that check executes on every JWK and JWKS unmarshal, any consumer that parses a JWKS body from an attacker-controlled or attacker-influenced source - a compromised or malicious identity provider, a misconfigured discovery URL, or an application that accepts a JWKS URL as user input - is exposed; the authoritative assessment rates the impact as availability-only (CVSS:3.1 AV:N/AC:H, no confidentiality or integrity effect), with the higher AC reflecting the precondition that the victim must actually fetch from the hostile endpoint rather than any attacker-uncontrolled timing condition, and notes a trusted, pinned IdP deployment is not triggerable. All releases since the earliest tag are affected on the ThalesGroup module path (>= 0.7.3, <= 0.13.0-rc1, which is deprecated and unpatched) and on the Eclipse path (< 1.0.0-rc4), with the fix first shipped in v1.0.0-rc4; there is no CISA KEV listing and no public exploit identified at time of analysis.
Denial of service in the Eclipse Keypont gose Go JWE library (published historically as github.com/ThalesGroup/gose) where AesGcmCryptor.Open forwards a caller-supplied, wire-derived nonce to crypto/cipher AEAD Open without a length check, causing the Go standard library to panic instead of returning an error. Any party able to submit a compact JWE to a gose-backed decryptor can trigger it without key material or credentials (CVSS 4.0 base 6.9; assessed CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) - they only need a kid matching a key in the decryptor's keystore, alg=dir with a matching enc, and an IV whose decoded length is anything other than 12 bytes. Impact is bounded by the caller's panic posture: under net/http the panic is recovered per request and only that request fails, while a worker, daemon or CLI without recovery has its process terminated; confidentiality and integrity are unaffected because the panic occurs before plaintext is produced. No public exploit code was identified at time of analysis, although the advisory ships a unit-test reproducer that demonstrates the panic; this_month priority, not KEV-listed.
Eclipse KeyPont GoSE's JWE decryptor panics instead of returning an error when a compact JWE carries an incorrectly sized initialization vector, giving a denial of service to anyone holding the recipient's public key. The flaw affects github.com/eclipse-keypont/gose releases from v0.8.0 up to but excluding v1.0.0-rc4, and the deprecated github.com/ThalesGroup/gose module through v0.13.0-rc1. A public PoC reference and a working reproducer are documented in the upstream advisory; it is not confirmed as actively exploited (no KEV entry), and the practical impact ranges from a single failed HTTP request to full process termination depending on the caller's panic recovery posture.
Parsing an attacker-supplied PLY file with RPly 1.1.4 or earlier can crash a host application on the ASCII parsing path and corrupt memory on the binary parsing path, because the library accepts the token 'list' as the length type or value type of a list property and then indexes handler tables out of bounds. The weakness sits in ply_read_header_property() and is reached through ply_read_list_property(); an application is only exposed if it ingests a crafted PLY, so delivery is local and requires victim-side file processing (CVSS 3.1 AV:L/UI:R, no attacker authentication), not a remote network trigger. No confirmed in-the-wild exploitation or public exploit code was identified at time of analysis, though a public technical writeup of the property list type confusion exists; independent assessment rates this a genuine but moderate-priority issue to be handled within the current monthly patch cycle rather than an emergency.
CGM CLININET before 2026.MS3 exposes production database and RabbitMQ broker credentials to any local account because the SysIO.pl configuration file has insecure permissions that make it readable. An attacker with an existing local account on the CLININET application server can read those credentials and use them to attempt access to the production database or message broker, though no remote vector is involved. The issue is rated 6.8 (Medium) by CERT-PL, and no public exploit was identified at the time of analysis.
Predictable replacement-password generation in Goobi Viewer Core (Maven io.goobi.viewer:viewer-core) before 26.05 lets an attacker who can approximate the server-side generation time brute-force the password that is emailed after a reset and log in as the victim, giving high confidentiality and integrity impact at CVSS 6.8. Standalone exploitation is gated by two assessed preconditions: the account holder must have triggered the reset themselves (UI:R) and the attacker must infer server time from network or email metadata (AC:H), so mass exploitation is not trivial. No public exploit code was identified at time of analysis; the vendor fixed the flaw in 26.05, and the advisory notes that chaining it with CVE-2026-46346 (GHSA-gj5g-4rxf-8rmq) removes the victim-interaction requirement and reaches a combined severity of 9.1 Critical.
Cross-site scripting in ACF Extended and ACF Extended PRO versions 0.8.9.4 through before 0.9.2.8 allows authenticated users with contributor-level privileges to have arbitrary script run in a victim's browser, including a logged-in administrator, when the victim opens a crafted link or page. The issue is an incomplete fix for CVE-2023-5292: the earlier deny-list covered only the three HTML wrapper attributes, leaving other form shortcode attributes able to take values from the visitor's request and be output without escaping. No public exploit code has been identified at time of analysis, and version 0.9.2.8 resolves the flaw.
Stored cross-site scripting in the User Profile Builder WordPress plugin before 4.0.5 allows authenticated users with a role as low as contributor to inject script through an unescaped shortcode attribute that is output in a redirect message, executing in the browser of a higher-privileged user who submits the affected form. The authoritative assessment is CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, meaning exploitation requires prior authenticated access and victim interaction; the supplied score is 6.8. No public exploit was identified at time of analysis and CISA SSVC lists exploitation as none, with a vendor fix available in 4.0.5.
Stored cross-site scripting in the Otter Blocks WordPress plugin before version 3.2.8 lets users with contributor-level access or higher inject arbitrary web scripts through crafted block styling values that the plugin writes unsanitized into an inline stylesheet. The payload persists in the affected post and executes in the browser of any visitor who later views it, including an administrator, which can lead to session or privilege compromise. Exploitation requires an authenticated contributor account and victim interaction (viewing the poisoned post); no public exploit has been identified at time of analysis, SSVC records Exploitation as none and Automatable as no, and the vendor has released a patch in 3.2.8.
Authenticated low-privileged users of Zimbra Collaboration Suite 10.1.16 and 10.1.20 can exhaust another mailbox's finite quota by repeatedly sharing and revoking a document with that recipient, with no victim interaction required. Each share creates a shared-file record that charges the document size to mailbox-wide usage, but revocation deletes the record and reverses only the folder counters, leaving the mailbox-wide charge in place, so repeated normal share notifications silently accumulate quota consumption after the visible records are gone. The result is availability-only impact (no data read or modification): once the quota is consumed, incoming mail and other size-increasing operations fail; accounts configured with unlimited quota are unaffected, and no public exploit or confirmed active exploitation was identified at time of analysis (decision priority: this_month).
Missing authorization in the Magepeople Car Rental Manager WordPress plugin through 1.5.3 allows authenticated low-privilege users to access data beyond their intended permissions, affecting confidentiality only; this is a moderate-priority issue, not an emergency. Exploitation requires a running WordPress site with the plugin and a valid low-tier account, so sites that allow self-registration or customer accounts are more exposed. No KEV entry is present, and no public exploit is identified at time of analysis.
Off-path DNS answer spoofing against the Zephyr DNS stub resolver (subsys/net/lib/dns, builds with CONFIG_DNS_RESOLVER) is made practical by a single static UDP source port that is bound once at resolver initialisation and reused for every query, so only the 16-bit transaction identifier varies - contrary to RFC 5452 section 9.2, which requires both to change. A remote attacker with UDP reachability to the device (same LAN, Wi-Fi or mesh segment, or a globally routable address) can learn that port from any observed query or by scanning for the one ephemeral port that stays silent instead of returning ICMP port-unreachable, then flood forged answers across the identifier space during a query window and race the legitimate server; a win makes the application resolve an attacker-chosen address, and with CONFIG_DNS_RESOLVER_CACHE enabled the forged record persists for its attacker-chosen TTL. Affected versions are >= 1.8.0 through <= 4.4.2; no public exploit code or active exploitation is confirmed, exploitation is probabilistic (the race must be won, and a predictable name must be in flight), and endpoints whose TLS certificates are validated are largely protected. The assessed vector is AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N (6.5), and vendor fixes are merged on main and the v4.4, v4.3 and v3.7 branches with a projected release in 4.5.0.
Missing authorization in the Knit Pay WordPress plugin through version 9.6.3.0 allows unauthenticated remote attackers to reach functionality that should be access-controlled, with low confidentiality and integrity impact. The flaw is rated CVSS 6.5 (AV:N/AC:L/PR:N/UI:N) and requires the plugin to be installed and active on a network-reachable WordPress site; the specific endpoint or feature lacking the check is not described in the available sources. No public exploit or active exploitation is identified at time of analysis, and the supplied priority label is this_month.
Missing server-side authentication on four Jakarta WebSocket endpoints in goobi-viewer-core (DownloadTaskEndpoint, CampaignEndpoint, AutocompleteEndpoint, UserEndpoint) lets any remote client open a connection without proving its HttpSession belongs to a logged-in user; versions 4.11.0 through 26.05 are affected. Through CampaignEndpoint an unauthenticated party can pollute the in-process crowdsourcing page-lock map and broadcast forged lock messages, disrupting reviewers working in active crowdsourcing campaigns, and because no endpoint checks the Origin header, logged-in users who visit an attacker-controlled page are exposed to cross-site WebSocket hijacking. Impact is confined to workflow integrity and limited confidentiality rather than system compromise, no public exploit was identified at time of analysis, and the vendor has released a patch in version 26.05.
Unauthenticated remote attackers can force a password reset on any Goobi Viewer Core account prior to 26.05 because the reset token is derived predictably from the request timestamp. An attacker who knows the target's registered email address and can reach the exposed /user/resetpw/ endpoint can brute-force the token and invalidate the account password, locking the victim out. The flaw does not by itself disclose the new password or grant access; full unauthenticated account takeover requires chaining it with CVE-2026-46347. No confirmed public exploit code and no CISA KEV status were identified at time of analysis. The vendor-released fix is version 26.05.
An authenticated user holding only theme-file VIEW permission on a baserCMS 5.0.0-through-5.4.1 installation can read arbitrary .php, .css, .js and .ctp files outside the theme directory, including config/install.php which the installer writes with the plaintext database password and config/app_local.php which may expose the Security.salt fallback. The read path ThemeFilesService::get() is the one path-handling sink in the bundled but default-disabled BcThemeFile plugin that never received the assertWithinThemeDir() guard applied to every write sink, so a legitimate view-only grant becomes application source and credential disclosure; because authorization is evaluated against the unresolved request path, this also constitutes privilege escalation. The issue is not listed in CISA KEV, a public PoC reference exists in the upstream GHSA advisory (which reports reproduction on 5.4.1 with MySQL and includes request-level screenshots) but it is not independently verified as working exploit code, and the vendor has released fixed versions 5.3.2 and 5.4.2.
Server-side request forgery in the open-source Event Schedule platform (versions 1.0.0 and earlier) lets an authenticated user who holds a curator role store a crafted import URL that defeats the App\Utils\UrlUtils::isUrlSafe() guard, so the application later fetches internal or localhost services via ImportCuratorEvents and imports the response body as event data. Two bypasses are documented: bracketed IPv6 literals that parse_url leaves un-normalized, and an A-record-only resolver that fails open for AAAA-only or rebindable hostnames. Rated CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), the flaw is limited by the curator-role requirement; no vendor-released patch was identified at time of analysis, and a public PoC reference (ported guard logic with sample outputs) accompanies the advisory.
Denial of service in Eclipse KeyPont Gose affects the AES-CBC-HMAC direct decryption path (NewJweDirectDecryptorBlock) in Go module github.com/ThalesGroup/gose v0.9.0 through v0.13.0-rc1: an unvalidated 64-bit plaintext length from the _thales_aad protected header causes a nil dereference, a BigEndian.Uint64 panic on short input, an unbounded allocation, or a slice-bounds panic after the HMAC check. The advisory includes an executed reproducer and notes that the same 11 releases carry GHSA-h6w5-722x-2h3m, whose constant, message-independent HMAC tag lets an attacker who has seen one valid JWE reuse its tag so the length field is reachable without the MAC key; confidentiality and integrity are unaffected. Active exploitation is not confirmed (no CISA KEV data is provided), the advisory contains an executed reproducer for the panic and oversized-length behavior, and the vuln.today priority is this_month.
Denial of service in Eclipse KeyPont gose occurs when a JWK declares kty EC with a non-EC alg and is passed directly to the exported LoadPublicKey or LoadPrivateKey loader; an unchecked ECDSAOptions type assertion panics the process. Affected releases are github.com/eclipse-keypont/gose before 1.0.0-rc4 and the deprecated github.com/ThalesGroup/gose path through 0.13.0-rc1, while gose's own NewVerificationKey/JWKS path gates EC algorithms and is not vulnerable. Exploitation is conditional on a consuming application forwarding externally supplied JWKs to those loaders; no CISA KEV listing or verified public exploit code is indicated, the advisory includes a reproducer, and the vendor rates the issue CVSS 4.0 6.3 with high attack complexity and availability-only impact.
JwksTrustStore.Get in the Eclipse KeyPont gose JOSE library (formerly github.com/ThalesGroup/gose) can return the last key parsed from a JWKS document, with a nil error, when the caller asks for a kid that is not present in that document - so absent-key lookups silently succeed against the wrong key instead of failing as 'not found'. The flaw exists in every release from v0.7.5 through v1.0.0-rc3 of the eclipse-keypont module path, and in the deprecated ThalesGroup path up to its final tag v0.13.0-rc1; it is fixed in v1.0.0-rc4. It is not an authentication bypass: JwtVerifierImpl.Verify still enforces algorithm match and signature verification against whatever key it receives, so a token signed by an unrelated key is still rejected; the realistic impact is broken kid-to-key binding during key rotation and any downstream logic that treats kid as a trusted decision input, which is why the maintainers rate integrity impact Low with High attack complexity. There is no KEV listing and no public exploit code identified at time of analysis; the upstream advisory publishes a reproducer that demonstrates the wrong-key return against an httptest JWKS server, and the recommended handling is to fold the fix into a routine monthly patch cycle rather than an emergency response.
An out-of-bounds heap read in open-iscsi's iscsiuio daemon allows an attacker on the same network segment to crash the daemon, overwrite a single heap byte, or corrupt the stored iSCSI initiator name by sending a crafted DHCPv6 Advertise message. The flaw is in the DHCPv6 option parser, which calls strlen() on raw option data that carries no guaranteed NUL terminator, so the scan walks past the end of the buffer; open-iscsi packages as shipped in Red Hat Enterprise Linux 6, 7, 8, 9 and 10 are listed as affected, but only hosts that actually run iscsiuio and obtain iSCSI parameters over DHCPv6 (offload/boot deployments) are exposed, since the daemon is not default-active on typical systems. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; combined with the adjacency-only attack path this yields a medium severity (CVSS 6.3) and a this-month rather than emergency priority.
Eclipse KeyPont gose (formerly github.com/ThalesGroup/gose) fails to enforce the JWS `crit` header: any token carrying a non-empty `crit` array should be rejected per RFC 7515 §4.1.11 because gose implements no header extensions, yet affected verifiers accept such tokens and report successful verification. Because `crit` lives inside the signed protected header, this is not reachable by an unauthenticated attacker without the signing key; the realistic risk is cross-context replay, where a trusted issuer constrains a token's use with a critical extension (RFC 7797 `b64:false`, RFC 7800 `cnf`, or an ecosystem `must-revoke-check`) and a gose-backed verifier silently drops that mandatory constraint. Signatures and claims remain authentic, so integrity impact is limited; no public exploit code is identified at time of analysis and the issue is not in CISA KEV. Fixed in eclipse-keypont/gose v1.0.0-rc4 (commit be2277b, merged as 692c25c); the legacy ThalesGroup module path ends at v0.13.0-rc1 and remains vulnerable.
Forged remember-me cookies in Part-DB allow unauthenticated remote attackers who meet one prerequisite to authenticate as arbitrary users, including admin, on default Docker deployments that retain the bundled APP_SECRET. The flaw affects Part-DB Server through 2.12.0 and the official jbtronics/part-db1 image; exploitation requires either the target user's bcrypt password hash or interception of any valid REMEMBERME cookie, so deployments with a custom random APP_SECRET are not exposed. Version 2.12.1 fixes the issue and the GHSA advisory includes proof-of-concept scripts with live validation, but there is no CISA KEV entry and the vendor rates this specific issue MEDIUM.
Server-side request forgery in the Pestle importer of Tandoor Recipes through 2.6.15 allows an authenticated user with only the standard space 'user' role to make the server issue GET requests to arbitrary internal or external hosts by supplying a crafted image URL in a Pestle JSON import. It is a genuine but moderate-priority issue rather than a top-tier emergency: the flaw is reachable through POST /api/import/ with type=PESTLE, a default-available feature since v2.6.15, and the advisory documents a PoC with reproduced loopback fetch and storage of the internal response as a recipe image. No CISA KEV listing accompanies this CVE in the supplied data; 2.7.0 is the vendor-released fix.
SSRF denylist bypass in the npm package mcp-from-openapi (2.2.0 through 2.8.0) lets an attacker who controls the OpenAPI spec URL passed to fromURL - or a redirect target it follows - reach hosts the operator listed in refResolution.blockedHosts simply by appending a trailing root dot (http://internal.corp./), because DNS resolves the dotted FQDN to the same host while the library compares raw URL.hostname strings. The same release range separately forwarded caller-supplied Authorization and Cookie headers to cross-origin redirect targets, handing bearer tokens to an open redirect on the spec host. Impact is limited to fetching operator-blocked content (low confidentiality, no integrity or availability effect), exploitation depends on non-default reliance on blockedHosts as the host guard, no CISA KEV listing exists, and the upstream advisory documents proof-of-concept reproductions; 2.9.0 normalizes hostnames on both sides of the comparison and drops caller headers once a redirect leaves the spec origin.
Credential exposure in the npm package mcp-from-openapi (versions 2.5.0 up to but not including 2.9.0) lets a malicious or compromised spec host harvest the caller's Authorization, Cookie and Proxy-Authorization headers, because the library's manual redirect loop in safeFetch() re-sends those headers unchanged to every hop - including hops that leave the spec URL's origin, which native fetch would strip. An attacker who controls the host serving the OpenAPI document, or who can exploit an open redirect on that host, receives the bearer token or cookie that the caller supplied to fromURL(); impact is confidentiality-only and bounded to the single credential handed over (higher only when that token is high-privilege), and no leak occurs when no credential headers are passed or when followRedirects is disabled. The same advisory bundles a lower-severity blockedHosts denylist bypass (a trailing root dot, e.g. http://internal.corp./, fails the exact-string comparison), relevant only to deployments that rely on blockedHosts with allowInternalIPs enabled. A vendor fix is available in 2.9.0; no public exploit code was identified at time of analysis, though the upstream advisory documents reproduction steps, and the vendor rates the issue CVSS 4.0 6.3 while our independent assessment scores it CVSS 3.1 5.9-class AV:N/AC:H with low confidentiality impact only.
Path traversal in Entire CLI 0.7.6 and earlier lets a collaborator who can push to the shared `entire/checkpoints/v1` branch overwrite arbitrary files on another user's machine: when the victim runs `entire session resume` or `entire checkpoint rewind`, a crafted SessionID in checkpoint metadata is used to build restore filesystem paths without validation, so attacker-controlled transcript data is written outside the expected session directory. Both the push access to the checkpoints branch and the victim's explicit invocation of resume/rewind are required, which keeps this a precondition-heavy, supply-chain-style issue rather than a drive-by exploit; no public exploit code or confirmed active exploitation has been identified at time of analysis, and notification is tracked as a moderate-priority this-month item. Successful abuse yields high integrity impact on other systems' components (scope change) and limited availability impact.
Reflected cross-site scripting in the Zimbra Collaboration Suite (ZCS) login page lets an unauthenticated remote attacker run JavaScript under the legitimate Zimbra origin when a victim opens a crafted 'relogin' URL carrying a malicious zrememberme parameter. The parameter is reflected into a hidden input attribute of the two-factor error display without HTML encoding, so an attacker can substitute page content - such as a replacement login form - to capture credentials. ZCS 10.1.16 and 10.1.17 are confirmed affected (EUVD lists ≤10.1.17), severity is CVSS 6.1 with a scope change, and exploitation is strictly conditional on the victim opening the crafted link; the relogin path also logs out any existing session before rendering, so the demonstrated attack does not inherit mailbox access. No public exploit code is confirmed at time of analysis, though Rapid7 has published a technical write-up describing the demonstrated attack chain.
Cross-site scripting in the Admin Routing Page of gedelumbung HospitalManagement lets an attacker who controls the 'content' argument processed by the simpan function in application/modules/admin/controllers/routing_pages.php have script run in a user's browser when the affected page renders that content. The project uses a rolling release model, so no version range is published; builds up to and including commit c2d45543789a3887067d3915f69d44cfc2cf76a8 are reported affected. Impact is confined to low integrity with no confidentiality or availability effect, a public PoC reference exists but is not verified as working exploit code, and no CISA KEV entry indicates active exploitation.
Open redirect in gedelumbung HospitalManagement affects the admin routing_pages.php 'simpan' function, where an attacker-supplied url_route value is not adequately validated before being used for a redirect. Remote attackers can craft a link that, when a victim follows it (UI:P), sends the browser to an attacker-chosen destination; no authentication is required (PR:N), but confidentiality and availability impact are none and integrity impact is low. A public PoC reference exists (GitHub issue #17) but is not verified as working exploit code; no CISA KEV entry is available and the project has not responded to the report, with the product on a rolling release and no version-specific fix identified.
Cross-site request forgery (CWE-352) in the Tenda F6 web management interface (firmware 12.02.01.73) lets an attacker who controls a web page cause a logged-in administrator's browser to submit forged, session-authenticated requests against the router. The attacker needs no credentials (PR:N) but gains nothing without an active admin session to ride, and the victim must be induced to visit the malicious page (UI:P), so impact is bounded to limited integrity per the assessed vector (VI:L, no confidentiality or availability effect). A public PoC reference exists on GitHub (0xWKZER/tenda-f6-vulnerabilities); it is not verified as working exploit code, the issue is not in CISA KEV, and the vuln.today priority label places it in the this_month remediation window rather than an emergency.
Cross-namespace data exposure in the Postgres- and SQLite-backed LangGraph stores (langgraph-checkpoint-postgres before 3.1.3 and langgraph-checkpoint-sqlite before 3.1.2) lets an authenticated, low-privileged caller who can influence a namespace label read, overwrite, or delete items stored under a different tenant's namespace. The stores flatten a namespace with ".".join(namespace), so a single label such as ("tenant.bob",) resolves to the same stored text as ("tenant", "bob"); only put/aput validated labels, while get, search, delete, list_namespaces, their async variants, and ops passed straight to batch/abatch accepted dotted labels unchecked. Exposure is deployment-dependent rather than universal: it requires an application that relies on namespace tuples to isolate tenants and passes untrusted input into those calls, InMemoryStore is unaffected because it compares namespace tuples, and there is no public exploit identified at time of analysis. The reported CVSS 4.0 score is 6.0, while the independent assessment rates it CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N.
Stored HTML injection in Part-DB through 2.12.0 lets an authenticated user with edit rights on an entity store a crafted name on a named collection sub-element (Part Parameter, Attachment, PartLot, Orderdetail and similar) and have that markup emitted unescaped when a higher-privileged victim opens the activity log at /log (requires system.show_logs, typically an admin or auditor) or the affected element's history table; the root cause is a single missed htmlspecialchars() in the CollectionElementDeleted branch of LogEntryExtraFormatter. The vendor advisory documents a proof-of-concept in which the stored payload parses into live img-onerror and script nodes in the victim's page, but the shipped Content-Security-Policy (script-src 'self' 'wasm-unsafe-eval', no unsafe-inline, plus X-Content-Type-Options: nosniff) blocks inline JavaScript execution, so on a default deployment the realistic impact is HTML and inline-CSS injection, content spoofing, UI redressing and img-src beaconing rather than script execution; full script execution requires a relaxed or non-default CSP or another rendering context. The issue is fixed in 2.12.1, and the overall read is a genuine but moderate-priority defect rather than a drop-everything emergency.
Stored cross-site scripting in gedelumbung HospitalManagement lets an authenticated administrator inject script through the Title argument handled by sistem.php::simpan in the admin Settings Handler, and that payload then executes for users who view the page rendering the stored value. Scoring is 4.8 with the assessed vector requiring high privileges and user interaction, so real-world exposure is narrow - the realistic actor is an already-privileged operator or someone who has first taken over an admin session. A public PoC reference exists (the project's issue #15); it is not verified as working exploit code, no active exploitation is confirmed, and the vuln.today priority is this_month.
Path traversal in UbiquitousLearning mllm through 2.0.2 allows local users with low-level privileges to manipulate the shard_file argument passed to load_model in the Convertor component, potentially reaching files outside the intended model-shard path; assessed impact is low for confidentiality, integrity and availability. The attack requires local access rather than network exposure, and a public PoC reference exists but is not verified as working exploit code. No CISA KEV listing or confirmed active exploitation is associated with this CVE.
An out-of-bounds read in Kakao khaiii's neural-network loader (khaiii::nn::Linear::open in src/main/cpp/khaiii/nn/Linear.cpp) is reachable through the JSON Config File Handler when a crafted configuration supplies manipulated hidden_dim or class_num values. Only local, already-privileged attackers can reach it: exploitation presupposes write access to the resource directory passed via --rsc-dir, which the vendor treats as trusted input equivalent to a binary or shared library, and the vendor notes such an attacker could already alter analysis results without this flaw. All affected releases (0.1 through 0.4) are end-of-life and unsupported by the maintainer; a public PoC reference exists, but it is not verified as working exploit code, and there is no confirmed active exploitation (no CISA KEV listing).