Unauthenticated path traversal in Paisa before v0.7.8 lets remote attackers read arbitrary server-readable files and delete backup files by supplying '../' sequences in the file name accepted by the editor file handlers (GetFile, GetSheet) and the delete_backups handlers (DeleteBackups, DeleteSheetBackups). The flaw is rated CVSS 4.0 8.8 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L) and the vendor has released a fix in v0.7.8, so any default deployment reachable over the network is exposed until upgraded; no public exploit code was identified at time of analysis, and practical risk is bounded mainly by whether the instance is bound beyond localhost. Confidentiality impact is high because reads are limited only by the permissions of the server process account, while integrity impact is low and confined to removal of .backup.* files.
Reflected cross-site scripting in the SiYuan knowledge-management kernel (versions 2.9.0 through 3.8.6) lets a crafted /check-auth?to= link inject a javascript: URI that executes in the authenticated kernel origin once the victim logs in, after which the injected script can call same-origin kernel APIs to read or modify workspace content and settings. Exploitation requires a two-step user interaction: the victim must open the attacker-supplied link and then enter a valid access auth code on that page, so the CVSS 4.0 score is 7.6 (High) with AC:H/UI:P; the assessed CVSS 3.1 vector is AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N. The issue is a reflected flaw with no persistence, was verified end to end by the reporter on v3.8.6, and proof-of-concept details are published in the vendor GHSA advisory; it is not listed in CISA KEV, and no EPSS score was supplied with the intelligence.
Privilege escalation in the Duplicator WordPress plugin before 5.0.0 lets an administrator of a WordPress Multisite child site who is not a network administrator use the plugin's one-click upgrade routine to install and execute arbitrary PHP in the network-wide shared plugin directory. The assessed vector requires high privileges (an existing subsite administrator account) and no user interaction; the description's additional claim that the routine is exposed without authentication is unresolved in the available data. No CISA KEV entry is present, a public PoC reference exists but is not verified as working exploit code, and EPSS is low at 0.17% (percentile 7).
Server-side request forgery in vLLM 0.9.2 through 0.23.x lets an API caller force a P2pNcclConnector prefill worker to open an outbound ZMQ connection to an attacker-chosen host by embedding a `___decode_addr_<host>:<port>` token in the `X-Request-Id` header, exposing the NCCL communicator unique_id and the KV-cache tensors of the targeted request and potentially stalling the worker on a blocking `ncclCommInitRank`. The flaw is conditional: it only applies to disaggregated-serving deployments started with `--kv-transfer-config` selecting the V1 `P2pNcclConnector` in the `kv_producer` role, and default vLLM installations are unaffected. The CVSS:4.0 vector indicates no privileges required (PR:N), with the caveat that a valid API key is needed when `--api-key` is configured. No public exploit was identified at time of analysis, and the vendor closed the issue in 0.24.0 by removing the affected connector.
Unauthenticated SQL injection in YesWiki's public Bazar entries search API allows a remote attacker to place a backtick-containing field name into a backtick-quoted SQL alias and execute arbitrary SELECT subqueries, reading data such as user password hashes and using SLEEP() to exhaust database threads. The package advisory lists vulnerable ranges >=4.6.7, <4.7.0 and >=5.0.0-alpha1, <5.0.0-alpha4, fixed in 4.7.0 and 5.0.0-alpha4; the published description also names 4.6.0 before 4.7.0, while source analysis confirms the documented end-to-end chain from 4.6.7. Published CVSS is 8.8 (independent CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H); a public PoC reference exists but is not verified as working exploit code, and there is no CISA KEV confirmation of active exploitation.
Unauthenticated SQL injection in YesWiki 4.5.0 through 4.6.7 lets an attacker break out of the double-quoted time literal that PageManager::save() builds from the reserved date_maj_fiche field, turning a single Bazar entry-creation INSERT into a read oracle against wiki_users and exposing password hashes. On a default installation (Bazar module ACL '*', use_captcha false, bazarIgnoreAcls true) the sink is reachable without credentials via POST action=saisir_fiche, while a registered account can reach the same sink through POST /?api/entries/{formId}. The vendor's GitHub advisory (GHSA-wjf7-hrf3-9gcx) publishes a proof-of-concept request; active exploitation in the wild is not confirmed in the available data, no EPSS or KEV signal is present, the vuln.today priority is this_week, and the issue is fixed in 4.7.0.
Missing authorization in Parse Server before 8.6.101 and 9.0.0 before 9.10.4-alpha.4 allows unauthenticated REST API clients on MongoDB deployments to delete the internal _SCHEMA collection, stripping class field definitions, class-level permissions and protected fields so affected data becomes readable and modifiable by any client. PostgreSQL deployments are explicitly not affected and object ACLs continue to apply; no public exploit has been identified at time of analysis. The vendor and independent assessment rate this high severity (CVSS 8.8, assessed CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L) and a near-term priority for MongoDB-backed installations with reachable REST endpoints; vendor patches are available for both affected release branches.
Path traversal in rclone's `serve webdav` front-end, in every build up to and including 1.75.1, lets remote unauthenticated attackers write outside the directory rclone was told to serve: a single `MKCOL /..` request plants a VFS node whose backend path is literally `..`, after which PUT, MOVE, COPY, MKCOL and DELETE all resolve above the served root - creating, overwriting, moving out and (by known name, after a client PUT) deleting other tenants' files. Impact is integrity-only: reads and enumeration above the root still fail with 404 because the read path filters entries through the existing `RemoteEscapesRoot`/`RemoveEscaping` predicate while the write path never asks it. Vendor-released patch: 1.75.2; the GitHub advisory carries detailed public reproduction steps (a public PoC reference exists, not verified as working exploit code), there is no CISA KEV confirmation of active exploitation in the supplied data, and the vuln.today priority label is `this_week`.
Cross-organization authorization bypass in Dokploy through 0.30.10 lets an authenticated owner or admin of one organization control another tenant's applications by supplying a foreign applicationId to procedures such as saveEnvironment, updateTraefikConfig, deploy, and stop. Successful exploitation can overwrite environment variables and build secrets, repoint application sources, and disrupt other tenants' workloads. The flaw requires a multi-tenant Dokploy deployment and org-level owner or admin credentials; no public exploit has been identified at time of analysis, and a vendor fix is available via the referenced upstream commit.
Memory exhaustion in vLLM 0.18.0 through 0.30.x lets a client crash or OOM-kill the serving frontend by setting media_io_kwargs.video.num_frames to -1 (or an arbitrarily large positive value) alongside a large inline video/jpeg payload, so the API decodes and stacks every frame. Only deployments serving a video-capable multimodal model and honoring per-request media_io_kwargs are exposed; text-only instances are not affected, and versions before 0.18.0 lack runtime media_io_kwargs support. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N/VA:H) rates this a high-availability-impact, confidentiality- and integrity-neutral flaw, and no public exploit code has been identified at time of analysis, though the trigger is a simple documented parameter override.
SAML assertion replay in Snipe-IT 8.4.1 and earlier lets an attacker who has already captured one valid SAML assertion submit it concurrently to /saml/acs and walk away with multiple simultaneous authenticated sessions for the same victim, so a later IdP-side revocation only kills one of them. The flaw is a time-of-check/time-of-use defect in the SP-side nonce deduplication: the nonce column is not UNIQUE and the count-then-insert check straddles Auth::login() without a transaction, letting two parallel POSTs both observe zero rows and both mint a session. Exploitation is conditional rather than universal - SAML SSO must be enabled and correctly configured, the attacker must first obtain a genuine assertion via a man-in-the-middle position, a hostile browser extension, or a log/Referer leak, and must land both requests inside a sub-second window; no public exploit code has been identified at time of analysis and there is no KEV listing, so this is a credible but prerequisite-heavy risk best handled in the current weekly patch cycle.
Memory exhaustion in vLLM's Nemotron-VL processor path allows unauthenticated remote callers to OOM-kill the inference worker and deny service to co-tenants. The Nemotron-VL processor modules set Pillow's Image.MAX_IMAGE_PIXELS to None at import time, permanently disabling the process-global decompression-bomb guard for every image decode in that process, so a pathological image submitted to /v1/chat/completions expands into unbounded memory. Exposure is limited to deployments that serve a Nemotron-VL model or otherwise import the affected processor modules, and the vendor fix ships in vLLM 0.25.0 via PR #47010; no public exploit code has been identified at time of analysis, and scoring is availability-only (CVSS 4.0 base 8.7, PR:N/UI:N).
An object-level authorization bypass in phpMyFAQ before 4.1.10 allows unauthenticated visitors to rewrite or, under one optional administrator setting, permanently delete any visitor-submitted open question by sending an arbitrary openQuestionID to POST /api/faq/create. The only gate in front of the endpoint is the guest-submission feature switch, which defaults to enabled; the graphical CAPTCHA the attacker must solve is an anti-automation measure, not an authorization control, and it is the main practical limit on mass abuse. In the shipped default configuration the impact is integrity-only (CVSS 4.0 8.7, CVSS 3.1 7.5): category and answer link are overwritten and a forged 'answered' entry is written to faqquestion_history; if records.enableDeleteQuestion is turned on, the same request deletes the question outright with no soft-delete and no revision trail, matching the advisory's 9.1 Critical variant. No KEV listing or confirmed active exploitation is reported, and no standalone public exploit code has been identified at time of analysis, although the advisory itself publishes a step-by-step reproduction; this should be scheduled in the current weekly patch cycle.
Cross-tenant denial of service in vLLM 0.8.5 through 0.31.0 lets one API client crash the shared EngineCore process and drop every co-tenant request on that engine. The crash occurs when a request carrying prompt_logprobs (or echo with logprobs) is issued against a prefix that a KV connector reports as already computed, leaving positions in an uninitialized int32 tensor that the tokenizer then fails to decode, raising OverflowError. Reachability is conditional: the engine must be running the V1 engine with an active KVConnectorBase_V1 subclass returning num_new > 0 (LMCacheConnectorV1, NixlConnector, SharedStorageConnector, P2pNcclConnector, OffloadingConnector, MultiConnector), so plain vLLM without a KV transfer config is not exposed; no public exploit code or CISA KEV entry was identified at time of analysis, and the vendor advisory provides a patch.
Remote denial of service in vLLM 0.22.0 up to but not including 0.24.0 allows remote attackers (CVSS PR:N) to crash EngineCore by sending a single Generate or GenerateStream request to the Rust gRPC frontend with output_logprobs enabled and more than 128 output_candidates.token_ids. The Rust converter copies those IDs into SamplingParams.logprob_token_ids without the Python-side 128-ID cap, vocabulary check, or logprobs-count consistency check, so the V1 GPU logprob sampler raises a fatal exception after execution begins. Only deployments exposing the Rust gRPC path on the vulnerable V1 sampler are affected; no public exploit identified at time of analysis, and the vuln.today priority is this_week.
An unauthenticated remote attacker who can reach the Rust gRPC Generate/GenerateStream frontend of vLLM 0.22.0 through 0.23.x can send a single small request that sets output_candidates.top_n or prompt_candidates.top_n above the server's configured max_logprobs cap - or to a value such as 2,147,483,648 that wraps negative when the protobuf uint32 is cast to i32 - and the unchecked count is forwarded into the V1 sampler's torch.topk call, terminating EngineCore and taking the inference service down for that request. The flaw is a missing validation and checked-conversion step in the Rust gRPC converter, which does not replicate the max_logprobs and negative-count guards that the Python SamplingParams validator already enforces; deployments that only expose the Python or OpenAI-compatible API are not reachable through this vector. Impact is availability only - no code execution, data access or model compromise is claimed - and no public exploit code or active exploitation has been identified at time of analysis; a fixed release (0.24.0) is available.
Unauthenticated remote attackers can crash vLLM 0.20.0 through 0.29.x by submitting inconsistent multimodal metadata to the disaggregated /inference/v1/generate endpoint, which yields a negative text span in Qwen2.5-VL position construction and terminates the engine, denying service to subsequent requests. Exploitation is availability-only and rated high complexity: the attacker must first obtain and replay a valid multimodal item, then tamper with the serialized mm_placeholders, kwargs_data or mm_hashes fields, and the target must expose the scale-out multimodal generate endpoint. No public exploit code was identified at time of analysis; the validation fix ships in vLLM 0.30.0.
A single crafted request to the Rust gRPC Generate or GenerateStream service in vLLM 0.22.0 through 0.23.x can abort EngineCore and leave the inference server unhealthy, producing a remote denial of service against availability only. Because the gRPC handlers forward attacker-supplied pre-tokenized prompt IDs to the engine without checking them against tokenizer or model vocabulary bounds, an out-of-vocabulary value such as 9000000 reaches the embedding lookup and terminates the process; no confidentiality or integrity impact is assessed. The vendor shipped a fix in 0.24.0, and no public exploit code has been identified at time of analysis - the main gating factor is whether the gRPC endpoint is network-reachable, since the advisory notes that deployments restricting it to already-authorized clients require that access and would score lower (PR:L, 6.5).
Server-side request forgery in rclone's read-only RC file server (--rc-serve) lets unauthenticated users who can reach an exposed RC listener redirect http and netstorage backend requests to attacker-chosen hosts by supplying a root that begins with a double slash on an existing named remote. Successful requests return the target's response body to the requester, leak the named HTTP remote's configured custom headers to the selected host, and - for netstorage remotes - yield valid, time-bound request signatures for attacker-chosen stat and download paths. Exploitation requires a non-default deployment (--rc-serve enabled, listener reachable, no RC HTTP authentication, a known http or netstorage remote name), which is why the supplied assessment scores it CVSS:3.1 5.9 with AC:H despite the 8.2 CVSS 4.0 vector; there is no CISA KEV entry, and the advisory publishes loopback mock reproduction scripts that demonstrate synthetic-credential impact only, so no confirmed exploitation in the wild is indicated.
rotki before 1.44.2 derives the encryption key for its premium cloud backup/sync feature as a single unsalted SHA-256 hash of the user password, so anyone who obtains an uploaded backup blob can run offline, GPU-parallel password guessing against it and decrypt the database it holds - exchange API keys, secrets, wallet addresses and transaction history. The attack is unauthenticated and requires no user interaction once the blob is in hand, and only users of the premium sync/backup feature are affected. There is no KEV entry and no public exploit identified at time of analysis, though the CVSS 4.0 score of 8.2 signals high confidentiality impact; the vendor addressed the issue in rotki 1.44.2.
LDAP credential exposure in Snipe-IT 8.6.2 and earlier lets an on-path attacker capture service-account and end-user passwords in cleartext. Ldap::connectToLdap() called ldap_start_tls() and discarded the boolean result, so when TLS negotiation fails or a man-in-the-middle answers the StartTLS extended request with a 'Protocol error', the subsequent ldap_bind() sends credentials unencrypted while users see a normal, silent login. Only deployments with LDAP authentication enabled and TLS configured (ldap_enabled=1, ldap_tls=1) plus an attacker-reachable network path to the LDAP server are exposed; no public exploit code was identified at time of analysis and the flaw is not listed in CISA KEV, though the vendor advisory publishes the exact code path and trigger.
Signature verification bypass in rclone stable selfupdate (versions 1.55.0 through 1.75.1) lets an attacker who controls the authenticated release-distribution responses prepend an unsigned SHA-256 checksum for a malicious archive ahead of the genuine PGP-clearsigned SHA256SUMS block, causing selfupdate to accept and extract an attacker-controlled rclone executable. Exploitation requires origin, CDN, or TLS-termination compromise or trusted-certificate interception plus a user running stable `rclone selfupdate` without `--check`; the beta channel is unaffected and ordinary unauthenticated interception is insufficient. The issue is rated High (CVSS 4.0 7.7; independent CVSS 3.1 7.5), fixed in 1.75.2, is not listed in CISA KEV in the supplied data, and has a public PoC reference that demonstrates the bypass and archive extraction but does not complete installation.
Cross-site request forgery in the pCloud backend of Rclone 1.52.0 through 1.75.1 lets a malicious web page silently rebind a victim's pCloud remote to an attacker-controlled OAuth token and API host, so subsequent `rclone sync` transfers upload files to the attacker and return attacker-chosen content. The flaw is reachable only while the victim is actively running the interactive authorization flow (`rclone config` or `rclone authorize pcloud`), which leaves the localhost callback listener on the fixed port 127.0.0.1:53682 open; a single stateless cross-site GET to that port during the window is accepted because the pCloud backend is the only one in the tree that sets `StateBlankOK: true`, disabling the OAuth `state` check. No KEV entry and no confirmed active exploitation were reported, but a full local proof-of-concept reproduction is published in the upstream advisory, and Rclone 1.75.2 is the fixed release.
SiYuan 3.6.0 through 3.8.6 accepts and persists the networkServeTLS administrator setting but never enforces it, so the kernel port continues answering plain HTTP with full API access in cleartext while also serving HTTPS on the same port. An operator who enables the toggle believes kernel traffic is encrypted, yet a network-adjacent attacker can sniff the login flow - including the access auth code - and the session cookie, which is issued without the Secure attribute while HTTPS responses omit HSTS, allowing session hijack against the kernel API. Exploitation requires a network-adjacent sniffing position and the operator having enabled the setting, which is why the flaw is rated for adjacency and high complexity rather than internet-wide exposure; a public PoC reference exists describing the verification steps, and it is not confirmed as working exploit code. A vendor fix is available in v3.8.7.
Missing authorization in YesWiki's ActivityPub outbox sync handler (ActivityPubService::syncActorPosts) lets an operator of a malicious federated ActivityPub server use a poisoned outbox to delete, overwrite, or forge wiki entries mirrored from other actors, with the administrator acting as a confused deputy. All releases from 4.6.2 through 4.6.7 are affected - 4.6.7 closed the equivalent holes in the inbox path via the GHSA-rm6r-grfg-4v78 fix but left the sync path unguarded - and the prerelease 5.0.0-alpha1 carries the same unguarded handler; version 4.7.0 contains the fix. Exploitation is conditional rather than ambient: ActivityPub must be enabled on at least one Bazar form, the instance must already hold a mirrored entry from a third-party actor, and an administrator must trigger the GET-based sync action (or be lured into it, since the action carries no CSRF token), while the attacker needs no privileges on the target instance. A proof-of-concept is documented in the upstream advisory, but it is not verified as working exploit code, and there is no confirmed active exploitation (no CISA KEV listing) at time of analysis.
Cross-site request forgery in YesWiki's {{despam}} administrative action lets an unauthenticated attacker delete arbitrary wiki pages or restore arbitrary past revisions through a logged-in administrator's session. The flaw affects YesWiki releases before 4.7.0 and is exploitable in the default configuration, where any visitor may create pages (default_write_acl='*'), raw HTML in the "".."" construct is emitted without HTMLPurifier, and the default Content-Security-Policy carries only frame-ancestors. The decisive prerequisite is user interaction: an administrator must view the attacker-planted trap page (RecentChanges is a realistic lure), so no authentication is needed to plant the payload and no browser vulnerability is required; a public proof-of-concept request sequence is documented in the GitHub security advisory, and no confirmed active exploitation (CISA KEV) was identified at time of analysis.
Stack-based buffer overflow in ImageMagick's bzip2 image decoding path can crash the process or corrupt stack memory when a crafted bzip2-compressed image is parsed by versions before 6.9.13-58 and 7.x before 7.1.2-33. The assessed impact is high integrity and availability loss with no confidentiality impact; the assessed CVSS 3.1 vector is network-reachable and unauthenticated (PR:N), while the supplied CVSS 4.0 vector reflects a low-privilege context (PR:L), so actual authentication depends on the hosting application that accepts and processes the image. No public exploit was identified at time of analysis, and the issue is labeled for remediation this week.
Out-of-vocabulary stop_token_ids in vLLM 0.20.1 through 0.28.x allow a client able to submit generation requests to terminate the inference engine, causing denial of service for every other user sharing that server; on the V2 runner the same unchecked index can instead write outside the logits buffer and corrupt adjacent logits or other GPU state. The flaw is an input-validation gap: SamplingParams accepted any integer for stop_token_ids and those values became column indices into the model's logits tensor, so the OpenAI chat and completion paths, the legacy generate endpoint, and batch inputs are all affected. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VA:H) puts this at 7.1 with availability-only impact, and the PR:L metric is the main limiting factor, meaning the attacker needs the privileged capability to submit requests rather than being fully anonymous; no public exploit code or active exploitation has been identified at time of analysis, and priority is this-week remediation rather than emergency response.
Memory exhaustion in vLLM's multimodal chat audio path lets an authenticated API user submit a small compressed audio payload to /v1/chat/completions that decodes into very large PCM data, driving up server memory and degrading or halting availability. Deployments in the >= 0.19.0, < 0.24.0 range that accept audio content parts are affected; the fix in 0.24.0 extends the existing decoded-duration guard to AudioMediaIO, which currently calls load_audio(..., sr=None) with no max_duration_s bound. Exploitation requires a valid API key by default (PR:L) and an audio-capable deployment; no public exploit code was identified at time of analysis, and the issue is a sibling of the already-published speech-to-text decompression-bomb advisory.
Path traversal in rclone's local backend (versions through 1.75.1) allows an attacker who can plant a directory named '...rclonelink' inside a source tree to redirect directory metadata operations one level above the destination the operator selected. The flaw only triggers when a sync targets a local destination with both --links/-l and --metadata enabled, and it is metadata-only: content writes remain blocked by the earlier os.Root hardening, and ownership changes require rclone to run as root, while non-root runs are limited to rewriting timestamps and extended attributes of the destination's parent directory. Exploitation status at time of analysis: no public exploit code confirmed by intelligence sources, although the upstream advisory documents a working reproduction; the vendor has released rclone 1.75.2 as the fix, and priority is routine (patch within the current cycle).
Firecrawl before 2.11.586 is affected by a server-side request forgery protection bypass in its Playwright service proxy, where an attacker who controls authoritative DNS for a submitted scrape target can rebind the hostname so the pre-connection validation sees a public address and the later proxy connection reaches a private or link-local address, exposing cloud metadata and internal services. Exploitation requires attacker-controlled DNS, a low or zero TTL, and winning the timing window between the validation lookup and the connection, and applies to the default blocking path unless ALLOW_LOCAL_WEBHOOKS is enabled. This is a genuine but second-tier priority: no public exploit was identified at time of analysis, and the vendor-released fix is Firecrawl 2.11.586.