A use-after-free in Chrome's ImageCapture component lets remote attackers who convince a victim to open a crafted HTML page execute arbitrary code - but, per the advisory, that execution is confined to the renderer sandbox rather than the host. Chrome builds prior to 156.0.8078.73 are affected and the vendor has released a fix; exploitation requires user interaction (CVSS UI:R) with no authentication or special configuration needed. No public exploit or active exploitation is identified in the supplied data, and the assessed priority places remediation in the near-term 'this week' window rather than emergency status, because host compromise would additionally require a separate sandbox-escape flaw.
Improper input validation in SVG handling in Google Chrome before 156.0.8078.73 allows a remote, unauthenticated attacker to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page containing malicious SVG (CVSS 3.1: 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Successful exploitation is gated by mandatory user interaction - the victim must open the attacker-supplied page in a vulnerable build - and the resulting code execution is confined to the Chrome sandbox, so full host compromise requires an additional, separate sandbox-escape vulnerability. No public exploit code has been identified at time of analysis and the flaw does not appear on CISA KEV; EPSS is 0.21% (11th percentile), and Google rates the Chromium security severity as High with a fix already shipped in the stable channel.
Stored cross-site scripting in Ubiquiti airMAX M devices running firmware before 6.3.26 allows an attacker positioned on the adjacent network to plant script content that executes when a victim views it, and Ubiquiti states this can escalate privileges on the device. Exploitation requires adjacent-network access (AV:A) and user interaction (UI:R) with a victim, most plausibly an administrator, viewing the poisoned page, and the vendor further limits the issue to 'certain conditions' that the available sources do not specify; authentication is not required to trigger per the PR:N vector. Signals are moderate-to-elevated but not emergency-grade: EPSS is only 0.19% (9th percentile), there is no CISA KEV listing and no public exploit identified at time of analysis, and a vendor patch is available in firmware 6.3.26.
Improper input validation in the Metrics component of Google Chrome for macOS allows remote code execution inside the browser sandbox when a victim opens a crafted HTML page in any build prior to 156.0.8078.73. The attack is unauthenticated and network-delivered (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8), but it is gated on user interaction and confined to the renderer sandbox - escaping to the host would require a separate, distinct sandbox-escape flaw that is not described here. There is no CISA KEV listing and no public exploit identified at time of analysis, so this is a moderate-urgency, patch-this-week item rather than a drop-everything emergency; a vendor patch (156.0.8078.73) is available.
Use-after-free memory corruption in Google Chrome on Windows allows a remote attacker to execute arbitrary code inside the browser sandbox when a victim loads a crafted HTML page in any build prior to 156.0.8078.73. Exploitation is not zero-click - it requires the user to navigate to or be served the malicious content (the UI:R factor in the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) - and the resulting code execution is confined to the Chrome sandbox, so host-level compromise would additionally require a separate sandbox-escape chain. Google rates the issue Chromium security severity High and has released a stable-channel fix; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the flaw is tracked with a this_week remediation priority.
Type confusion (CWE-843) in Microsoft Edge (Chromium-based) allows an unauthenticated remote attacker to execute arbitrary code in the browser when a victim loads attacker-controlled web content, as reflected by the CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H vector (8.8 High). Affected builds are those below 154.0.4258.48, and the flaw is delivered through drive-by or social-engineering browsing rather than unattended remote exploitation because user interaction (UI:R) is required. This is a genuine prioritization candidate for this week's patch cycle but not an emergency; no confirmed active exploitation (CISA KEV) and no public exploit code were identified at time of analysis.
Memory-safety flaw in Microsoft Edge (Chromium-based) that can lead to remote code execution. All builds from 1.0.0.0 through 154.0.4258.48 are affected; an attacker who lures a user to a malicious or compromised web page can corrupt memory and, potentially, run code in the browser's context. The host is network-reachable and unauthenticated (AV:N/PR:N), though exploitation is not fully automatic because the victim must render the attacker's content (UI:R). No public exploit code or active exploitation has been confirmed by the available sources, and a vendor patch - Edge 154.0.4258.48 - is published and should be applied this week per the priority signal.
Command injection in Tanium Certificate Manager allows an authenticated attacker with low-level access to execute unauthorized code on the affected module. Certificate Manager 1.17 before 1.17.417, 1.18 before 1.18.368, and 1.22 before 1.22.119 are affected; the vendor has released fixed builds and vuln.today assigns this_week priority. No public exploit identified at time of analysis.
Command injection in Tanium Threat Response allows an authenticated low-privilege attacker to execute unauthorized code remotely, with high confidentiality, integrity, and availability impact (CVSS 8.8; AV:N/AC:L/PR:L/UI:N). Affected branches are 4.17 before 4.17.327, 4.12 before 4.12.349, and 4.9 before 4.9.476, and the vendor has released fixed builds. No public exploit identified at time of analysis; active exploitation is not confirmed in the provided sources, and the vuln.today priority is this_week, reflecting a credible near-term priority rather than an inflated high-CVSS score.
Authlib 0.15 through 1.9.0 can let a party holding any valid RFC 7592 registration access token read, modify, or delete a different client's registration record, because the library's documented example implementations of ClientConfigurationEndpoint.authenticate_client and check_permission never bind the presented token to the target client. The exposure is conditional: it applies to deployments that expose the ClientConfigurationEndpoint and implemented those two methods by copying the shipped docstring examples, which resolve the target from the request-supplied client_id and check only client.editable. Exploitation is authenticated (CVSS PR:L - a valid registration_access_token is required) and also needs the victim's client_id, but under the common open/anonymous RFC 7591 self-registration model an attacker can self-issue a qualifying token for free, after which redirect_uri rewriting enables authorization code or token interception and deletion causes denial of service. Authlib 1.9.1 fixes the flaw; no public exploit was identified at time of analysis, and the overall signal is a conditional this-week remediation priority rather than a mass-exploitation emergency.
Privilege escalation in Mozilla Firefox's DOM: Navigation component allows remote attackers to gain elevated privileges within the browser when a victim loads attacker-controlled web content, with the flaw resolved in Firefox 159. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R, score 8.8) indicates no prior authentication or attacker privileges are needed, but the required victim interaction is the primary limiting factor and is consistent with CISA SSVC scoring of Automatable: no and Exploitation: none. No public exploit code or active exploitation has been identified at time of analysis, and the vendor-reported issue is tracked as Mozilla Bugzilla 2075440 with advisories mfsa2026-118 and mfsa2026-121.
Authenticated SQL injection in Dolibarr ERP/CRM through version 23.0.0 lets any user holding the standard 'Third Party: Create/Edit' permission - not just an administrator - read or rewrite arbitrary database content. The unescaped lt1/localtax1_value (and lt2/localtax2_value) POST parameter is concatenated into an UPDATE statement in an unquoted numeric context, so an attacker can append a second SET clause and copy a target value such as a user's password hash into a field they can then read, potentially escalating to admin and onward to RCE via admin-only modules. The vendor advisory GHSA-v5fq-cf5m-vwv7 ships a complete reproduction including working request payloads; no confirmed active exploitation (CISA KEV) has been reported, and no fixed release is listed yet - the package data records composer/dolibarr/dolibarr as vulnerable at <= 23.0.0 with 'not yet patched'. With a CVSS 3.1 vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (8.8) and a this_week decision label, this is a genuine, actionable priority rather than an inflated CVSS score.
Remote, unauthenticated attackers can upload files of any type to arbitrary writable paths in PuMuKIT and can also delete files, according to CVE-2026-4337. The impact can extend to code execution when an uploaded file is placed in a web-accessible directory that executes that file type; otherwise the exposure is integrity and availability damage within the web server user's write scope, and the exact triggering endpoint is not described in the available sources. No public exploit code or CISA KEV entry has been identified at time of analysis.
Sensitive configuration data disclosure in WatchGuard Fireware OS stems from XPath injection in the management SSH authentication process, allowing a remote, unauthenticated attacker who can reach that interface to submit a crafted request and extract configuration data. Affected releases are Fireware OS 2025.1 before 2026.4 and 12.0 before 12.5.22 or 12.12.4; the vendor has released fixes, and no public exploit is identified at time of analysis, with no CISA KEV listing. Exposure is the key risk factor: appliances whose management SSH interface is reachable from untrusted networks are most at risk, while restricting that interface to trusted management networks substantially reduces exposure.
Remote code execution in Mistral Vibe before 3.0.3 occurs when the CLI is launched with --worktree against an untrusted repository: a crafted .git/config defines Git filter drivers and .gitattributes binds them to files, so git worktree add runs smudge, clean, or process commands before Vibe's trusted-folder check. The commands execute with the invoking user's privileges, and exploitation requires the user to add the malicious repository in worktree mode. The vendor released 3.0.3; no public exploit was identified at time of analysis and EPSS is 0.43% (37th percentile).
Authentication bypass in the TDDP v2 service of the TP-Link RE305 V3 range extender lets an unauthenticated attacker on the same local network forge protocol packets using a fixed, derivable cryptographic key and reach privileged TDDP operations, including functionality that can result in operating-system command execution with root privileges. Only devices running RE305 V3 firmware before 1.1.8 Build 20260921 Rel. 42853 are affected, and exploitation requires the TDDP service to be running and reachable from the attacker's adjacent network segment (CVSS 4.0 8.7 / assessed CVSS 3.1 8.7, AV:A). A vendor patch is available and no public exploit has been identified at time of analysis; the priority label is this_week because the flaw yields full confidentiality, integrity and availability impact once an attacker has local network presence.
Denial of service in WatchGuard Fireware OS lets remote unauthenticated attackers with network reachability to the management interface crash the management service by sending a crafted login request. Repeated attempts terminate active administrator sessions and block management operations while firewall traffic processing remains unaffected; affected branches are Fireware OS 2025.1 before 2026.4, 12.0 before 12.12.4, and 12.0 before 12.5.22, and the vendor reports a patch is available. The vendor CVSS 4.0 score of 8.7 (High) reflects availability-only impact (VA:H with VC:N/VI:N), and no public exploit was identified at the time of analysis.
Member-only content gated by the MembershipWorks plugin for WordPress before 6.17 can be retrieved by unauthenticated visitors through the WordPress REST API, exposing posts and pages the plugin is meant to hide from non-members. The plugin's protected-content filter is only registered during normal front-end request handling, so REST responses return the raw rendered content instead of the stripped version; no authentication or user interaction is required, and only confidentiality of the gated content is affected (assessed CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, 8.7). No public exploit code has been identified at time of analysis, and the practical impact depends entirely on whether the site actually uses MembershipWorks content protection; sites in that configuration should plan to update this week.
Unauthenticated visitors to Grav 1.7.53.3 through 1.7.53.5 can read stored Clockwork profiler records when the debugger is enabled with the Clockwork provider and Grav sits behind a same-host reverse proxy; those records can include submitted administrator login passwords unless debugger.censored is enabled, plus configuration credentials from system and plugin settings. The flaw is an authorization bypass in Debugger::isDebuggerRequestAuthorized() that trusts a loopback REMOTE_ADDR fallback, so a tokenless request arriving from the local proxy is accepted; direct-server deployments and sites with the debugger disabled are not exposed. It carries CVSS 4.0 8.7 and a this_week priority, making it a credible high-impact information-disclosure case whose real-world risk is strongly gated by deployment topology; no public exploit was identified at time of analysis.
Unauthenticated arbitrary file read in Hitachi Energy TRO600 Series firmware 9.0.0.0 through 9.1.1.0 lets remote attackers with network reachability to the device's management interface disclose sensitive files, including configuration and password data. The flaw is a missing-authentication condition (CWE-306) with confidentiality-only impact, and the available intelligence does not confirm active exploitation; no public exploit identified at time of analysis. Risk is real within the product's deployment niche but bounded by footprint and exposure.
svg-sanitizer 0.5.3 through 1.0.0 can be driven into quadratic CPU consumption when Sanitizer::sanitize() strips PHP tags from attacker-supplied SVG content, letting an unauthenticated user who can submit an SVG occupy a PHP worker for seconds to minutes in the default configuration. The pre-parse loop removes overlapping PHP tags one pass at a time while rescanning the entire input, and because it executes before XML parsing the allowHugeFiles setting does not mitigate it. The vendor fixed this in 1.1.0, and the GHSA advisory includes a proof-of-concept input generator; the supplied data contains no CISA KEV entry.
Unauthenticated stored cross-site scripting in the DJ-HelpfulArticles voting module for Joomla (affected versions 1.0.0 through 1.2.0) lets remote attackers plant persistent script in the site database through the client-supplied 'ip' field of the getDeny, getConfirm and getDenyReason com_ajax handlers, which store the submitted value verbatim rather than deriving it from the connection. The injected payload is later rendered without output escaping in the administrator backend 'Helpful articles' overview (views/items/tmpl/default.php), so it executes only when a logged-in administrator opens that page - a passive user-interaction prerequisite reflected in the assessed vector (UI:R, scope changed C:H/I:H). No public exploit code has been identified at time of analysis, and the vendor has released version 1.3.0 as the fixed release.
Service account impersonation in Octopus Server stems from inconsistent OIDC token issuer validation, allowing a token minted by a non-legitimate issuer to be accepted as if it came from a legitimate trusted issuer. Deployments are exposed only when OIDC is in use for at least one service account identity, and a attacker must additionally know or guess details of that specific identity and operate a rogue issuer that can mint a matching token - conditions that favour targeted attacks over opportunistic scanning. Vendor CVSS 4.0 score is 8.7; the assessed CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N, C:H/I:H/A:H) likewise reflects high complexity and high confidentiality, integrity and availability impact, and no public exploit has been identified at time of analysis.
Semantic MediaWiki before 7.3.1 exposes Special:PropertyLabelSimilarity without an administrator restriction, and a caller-supplied limit of zero or a negative value bypasses the SQL LIMIT, loading the property pool into an O(n^2) pairwise label comparison. Unauthenticated remote attackers can send repeated requests to consume PHP CPU and memory and hold database connections; the impact is availability-only and grows with the number of user-defined properties, so it is most disruptive on large wikis. Active exploitation is not reported (SSVC exploitation: none), and a public proof-of-concept request is documented in the advisory but is not verified as working exploit code.
Semantic MediaWiki 2.5.0 through 7.3.0 lets an editor with ordinary page-edit permission exhaust server CPU, memory and the semantic store by calling the #set_recurring_event parser function with a large caller-controlled limit parameter and no end date, causing the parser to build thousands or millions of date subobjects in a single parse because the smwgMaxNumRecurringEvents ceiling is only enforced in the end-date branch. Exploitation requires the ability to save or render a page that will be parsed - an authenticated editor under the assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, 6.5), rising to unauthenticated if the wiki has anonymous editing enabled (PR:N, 7.5); the CVE record carries a CVSS v4.0 score of 8.7 with PR:N, which reflects that anonymous-editing configuration. There is no CISA KEV entry and no confirmed active exploitation; the upstream advisory includes a bounded proof-of-concept that was run only against an isolated fixture, and impact is availability only with no data disclosure or modification.
Quadratic CPU consumption in Semantic MediaWiki's term parser gives unauthenticated visitors a way to tie up PHP search workers on wikis that run the SMW extended search backend. Versions 3.0.0 through 7.3.0 are affected: a search term packed with thousands of distinct in:(...) / has:(...) expressions makes TermParser::normalize_compact_form() rescan and copy the entire input once per match, and the vendor's own parser-only timings show roughly a 4x cost for each doubling of expression count (about 880 ms for an 8,000-expression, ~104 KB term). Signals point to a genuine but bounded availability risk - the extended search engine is a non-default, explicitly enabled backend, request-size or time limits may blunt the attack, and no worker crash or service-wide outage was demonstrated; a public PoC reference exists (a self-contained PHP script that calls the parser directly), it is not verified as working exploit code against a full wiki, and there is no KEV listing or other confirmation of active exploitation.
Unauthenticated CPU and memory exhaustion in Semantic MediaWiki 3.0.0 up to (but not including) 7.3.1 allows remote attackers to POST a deeply nested <q>...</q> query to the public action=ask / Special:Ask API, tying up PHP request workers. LegacyParser::getSubqueryDescription() recurses once per opening <q> token before the configured smwgQMaxDepth and query-size pruning in the Query layer ever run, so a payload of roughly 120 KB can burn seconds of CPU and tens of MiB of memory per request. Exploitation requires the ask API to be publicly reachable and the deployment to accept a ~120 KB POST body; authentication requirements are unconfirmed for restricted wikis but the assessed vector is PR:N (unauthenticated) for public wikis, a public PoC reference exists and is not verified as working exploit code against a live MediaWiki instance, and the demonstrated outcome is worker consumption and capacity degradation rather than a confirmed service-wide outage.
A stack-based buffer overflow in the certd certificate management process of WatchGuard Fireware OS allows an attacker who already holds high-privileged, authenticated access to the Firebox management interface (CVSS PR:H) and can reach certd over the network to send a crafted request that overflows a stack buffer, crashing the certificate management service and, per the vendor, potentially achieving arbitrary code execution. The confirmed effect is a denial of service against certd; reliable code execution is described only as a potential outcome, and the exact request structure that triggers the overflow is not described in the available sources. Fixed releases are 12.12.4, 12.5.22 and 2026.4; no public exploit has been identified at time of analysis and the issue is not in CISA KEV.
OS command injection in the ATXP Gemini CLI extension through 1.0.0 lets an attacker who controls email or SMS fields such as message_id, subject, or query execute shell commands through MCP tool calls, running at the victim user's privilege level. The victim must be running the extension and route the crafted message through its tools; the supplied CVSS 4.0 score is 8.5 (High), and no public exploit is identified at time of analysis, with no KEV status provided in the supplied data. No fixed version is stated in the available intelligence.
Local code execution in Electrum 4.6.0 through 4.7.1 stems from an authorization bypass in the external plugin loader: a rogue process on the same machine that can write to the Electrum data directory can place plugin code in plugins/ and mark it enabled in the config file, after which Electrum loads the plugin's __init__.py without verifying the plugin-password signature and runs attacker code inside the main Python process. The issue is rated CVSS 4.0 8.6 (High) and assessed CVSS 3.1 AV:L/AC:L/PR:N/UI:N with high confidentiality, integrity and availability impact, although exploitation requires prior local write access at the victim's user level. Electrum 4.7.2 contains the vendor fix, and no public exploit identified at time of analysis.
Cross-site request forgery in REDAXO's backend user administration (page=users/users) lets an attacker who merely gets a logged-in backend user to open a crafted link modify arbitrary user records - granting administrator rights, deactivating accounts, or locking out the only administrator. The vendor's advisory explains that the CSRF token check sat behind a `save` condition that the `FUNC_UPDATE`/`FUNC_APPLY` write path did not share, so a single GET request with `FUNC_UPDATE=1` and no token reached the update logic; because parameters are read through `rex_request()` against `$_REQUEST`, and the session cookie defaults to `SameSite=Lax` (still sent on top-level GET navigation), no form or JavaScript is needed. The attacker needs no account or privilege of their own, but a victim must have an active REDAXO backend session and the `users[]` permission, and the privilege-escalation variant specifically needs that victim to be an administrator; passwords cannot be set through this path because `userpsw` is read via `rex_post()`. No public exploit code or confirmed active exploitation was identified in the supplied sources; the vendor-released fix is 5.21.3 and the priority decision is to act this week.
Privilege escalation in Octopus Server lets an authenticated user who already holds the System Manager role obtain full system Administrator rights, with risk concentrated in environments that grant that role to users not otherwise trusted as full administrators or where such an account is compromised. The affected ranges are 2019.0.0 through <2026.2.13469 and 2026.3.0 through <2026.3.15863, and the CVSS vector's PR:H metric confirms the required high-privileged account, so this is not a remote-unauthenticated attack. No public exploit is identified at time of analysis, the vendor has released a patch, and the supplied priority label is this_week.
Veeam ONE 13.1 (through build 13.1.0.7233) exposes a global multi-factor authentication toggle that can be used before the operator's own second-factor check completes, so an attacker who already holds valid Administrator credentials can switch MFA off for the whole deployment and then authenticate with the password alone. The CVSS 4.0 score of 8.5 with PR:H reflects that this is not an initial-access path: it converts a stolen or guessed administrator password into full administrative control by removing the second factor, with high confidentiality and integrity impact and no availability impact. No public exploit code and no confirmed active exploitation are identified in the available data, and the priority label places remediation in the current week rather than as an emergency.
Heap out-of-bounds write in llama.cpp builds b5899 through b10260 lets an attacker corrupt heap memory when the victim loads a crafted GGUF model that uses the PLaMo2 tokenizer. A BYTE-typed token whose text parses to a negative value (for example <0x-1>) is used as an index into the tokenizer's bytes_ buffer during model loading, so the write lands before the buffer and can crash the process or potentially enable code execution. The flaw is local in nature (it triggers only when an untrusted model is loaded, per the assessed CVSS:3.1/AV:L/AC:L/PR:N/UI:R vector), a vendor patch is available in build b10261, no public exploit has been identified at time of analysis, and EPSS is low at 0.14% (3rd percentile) with a this_week priority label.
Improper authentication in OAuthLib's RFC 8628 device authorization grant allows a remote caller to obtain a bearer token without ever presenting a valid device_code. The token endpoint accepts any value (or none) in the device_code parameter because DeviceCodeGrant.validate_token_request performs no validation of it, so anyone who knows a client_id registered for the device_code grant can mint a token for that client. Affected are Python projects using oauthlib 3.3.0 through pre-4.0.0 that expose the device workflow at their token endpoint; the vendor-released fix is 4.0.0. No public exploit tooling or active exploitation is confirmed, and the advisory's reproduction scenario additionally depends on the integrator's RequestValidator.authenticate_client accepting public clients, a behavior tied to separate oauthlib issue #919.
OS command injection in the hagent MCP server (masc-ucsc/hagent, through commit 761eec6) lets an MCP client that can reach the hagent_arduino or hagent_esp32 tools run arbitrary shell commands as the MCP server user by placing shell metacharacters in the args parameter, which is interpolated into arduino-cli and idf.py command lines executed with subprocess.run(shell=True). The attacker must already hold the low-privileged position of an MCP client (or drive one through prompt injection), so this is local-vector code execution bounded by the server's account rather than a pre-authentication remote takeover, but any deployment that exposes these embedded-build tools to an untrusted or LLM-driven caller is fully compromised on confidentiality, integrity and availability. No public exploit code has been identified at time of analysis and there is no CISA KEV entry; the EUVD/VulnCheck disclosure and an upstream GitHub issue are the only public signals, and the vulnerability is tracked for patching this week.
OS command injection in Kali-GPT's MCP server (execute_tool() in kali_gpt/tools/mcp_server.py) allows any party able to act as an MCP client - including an AI agent that has been prompt-injected - to run arbitrary shell commands as the MCP server's user by embedding shell metacharacters in scanner parameters such as target, ports, domain, wordlist, or url. All code through commit a608c74e99910232dd208fee99de860458672b82 is affected; the vendor has published no fixed version, and a GitHub issue (#12) is the only upstream tracking reference. CVSS 4.0 scores it 8.5 (assessed CVSS 3.1: AV:L/AC:L/PR:L/UI:N, C/I/A High), reflecting full confidentiality, integrity and availability impact but requiring the attacker to already reach or drive the MCP server rather than attack it anonymously from the internet; no public exploit code and no CISA KEV entry were identified at time of analysis, and the vulnerability is prioritized as a this-week item.
OS command injection in the esp-mcp MCP server (all versions through commit 28afddf9ff41ada117bb45fd49b526d3bf89749e) lets an attacker who can influence LLM agent tool calls - typically through prompt injection - place shell metacharacters into the target, port, project_path or project_name parameters, which are handed to asyncio.create_subprocess_shell at main.py line 80; the injected commands then execute as the user running the MCP server. The assessed vector is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (8.5), so exploitation presupposes low-privileged access to the tool interface plus an agent deployment that actually exposes these tools and accepts attacker-influenced input, rather than a network-reachable default path; no public exploit has been identified at time of analysis and no fixed version is identified in the supplied data. Overall risk signals are mixed, indicating a real but non-urgent and narrowly-scoped issue that should be scheduled for this week rather than treated as an emergency.
OS command injection in Codefriar sf-mcp through 1.3.2 allows an actor who can supply or influence Salesforce CLI tool flag values to run arbitrary shell commands as the MCP server user. The root cause is escapeValue() in src/utils.ts, which leaves backticks, $() substitution and other shell metacharacters intact, so crafted flag values reach execSync inside executeSfCommand. Both the CVSS 4.0 vector and the independent assessment treat the attack vector as local with low privileges and no user interaction, with high confidentiality, integrity and availability impact to the host running the server; no public exploit code is confirmed in the available sources, and the issue is prioritised for remediation this week.
Command injection in DroidMind through 0.4.0 lets a connected MCP client - including an AI agent subverted through prompt injection - slip past the shell-command allowlist and run blocked operations such as reboot on an attached Android device. The weakness sits in parameters interpolated into Device.run_shell() and in the unvalidated Device.list_directory(), where $(...) and backtick substitution are evaluated by the shell rather than by the allowlist check. The assessed vector is AV:L/PR:L, so an attacker must already be able to supply parameters to the DroidMind MCP interface and an ADB-connected device must be present; no public exploit was identified at time of analysis.
OS command injection in the ai-sdlc plugin MCP server (versions through 0.31.2) allows an attacker who can control the 'repo' argument of the check-issue or check-pr-status tools to run arbitrary shell commands with the privileges of the MCP server user. The unvalidated repo value is interpolated into 'gh issue view' / 'gh pr view' strings executed through execSync(), so a prompt-injected AI agent invoking the tool can turn a crafted repository name into command execution on the host. The vendor has published a fix (commit 717d7ec) and the issue is tracked as EUVD-2026-110836; no public exploit code was identified at time of analysis, and priority guidance places remediation in the current week (this_week).
SQL injection (CWE-89) in NVIDIA NeMo Agent Toolkit versions 1.4 through 1.6 lets an attacker who can reach the toolkit's input path on the local system inject arbitrary SQL, with potential for data tampering, denial of service, and information disclosure. NVIDIA rates the flaw 8.4 (High) and the assessed vector is CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - unauthenticated with no user interaction, but local, so exploitation requires local reachability of the vulnerable query path rather than network access; that AV:L designation is atypical for SQL injection and is the main factor shaping real-world risk. No public exploit code was identified at time of analysis and the issue does not appear in CISA KEV; per the current decision signal this is a this-week priority rather than an emergency.
TensorRT-LLM 1.3.0rc24 can load a tokenizer from an attacker-influenced location during KvCacheAwareRouter initialization, allowing inclusion of functionality from an untrusted control sphere (CWE-829). Because the CVSS vector is AV:L with PR:N and UI:N, the untrusted tokenizer must be reachable inside the local loading path, but once it is, no credentials or user interaction are needed; successful exploitation can yield code execution, information disclosure, data tampering, and denial of service. NVIDIA reports the issue with a base score of 8.4, and no public exploit code or confirmed active exploitation was identified at time of analysis. Only deployments that actually use the KvCacheAwareRouter and load tokenizers from unverified sources sit in the exploitable path.
Cross-site scripting in Sisense Cloud BI Platform lets an authenticated low-privilege user submit a base64-encoded SVG data URI (data:image/svg+xml;base64) to the /api/v2/ai/sessions API, and script tags embedded in that SVG execute when the image is rendered in the AI assistant window, allowing JavaScript to run in the viewer's context and the displayed content to be altered. Successful exploitation requires the attacker to hold a valid account that can reach the sessions endpoint, and execution only occurs when a victim opens the assistant window (UI:A, PR:L per both the CVSS 4.0 vector and the independent assessment), which confines realistic abuse to account-holders or multi-tenant insiders rather than anonymous remote attackers. No public exploit code has been identified at time of analysis and the CVE is not in CISA KEV; EPSS is 0.39% (33rd percentile) and the vuln.today decision label is this_week, consistent with an assessment of a genuine but second-tier priority rather than an emergency.
Stored cross-site scripting in Sisense Cloud BI Platform's BloX widgets allows an authenticated user with widget authoring privileges to place HTML and JavaScript in the 'desc' and 'text' fields via /api/dashboards/<id>/widgets/<id>; the script runs when another user renders the widget, potentially exposing data available to that victim's session. The vendor-assigned CVSS 4.0 base score is 8.3, and exploitation requires a valid low-privilege account plus victim interaction. No public exploit was identified at time of analysis; EPSS is 0.39% (33rd percentile).
A missing authorization check in the Google Compute Engine disks.createSnapshot and regionDisks.createSnapshot APIs let an authenticated Cloud principal request a snapshot of a disk belonging to a different project, exposing cross-project disk data. Google remediated the flaw server-side on 31 August 2026 and states no customer action is needed, so current deployments are not exploitable; the exposure window is historical, covering Compute Engine use before that date. Confidentiality impact is high (disk contents could be read) but integrity and availability are unaffected, and no public exploit code or active exploitation has been identified at time of analysis, with an EPSS score of 0.35% (29th percentile).
Veeam Backup for Microsoft 365 8.0 through 8.5.0.1014 lets an account that already holds the product's Administrator role read arbitrary files on the backup server at LocalSystem privilege level, exposing host files and backup data to a high-privileged insider or to anyone who compromises an admin account. The underlying problem is a missing or incorrect authorization check (CWE-863) reachable over the network with low complexity and no user interaction, but it is gated on Administrator-level console access rather than being anonymously exploitable. No public exploit code has been identified at time of analysis.
A stack buffer overflow in Asterisk's res_pjsip_pubsub module allows a remote sender to corrupt a fixed-size buffer while parsing the Message-Account field of an inbound MWI NOTIFY message-summary body, which can corrupt the underlying SIP transport and permanently disable all SIP functionality until the daemon is restarted. Per the CVSS 4.0 vector (8.2) and the assessed CVSS 3.1 vector the attacker needs no authentication (PR:N) and no user interaction (UI:N), but attack complexity is high (AC:H); the impact is availability only (VC:N/VI:N/VA:H), with no confidentiality or integrity loss and no code execution asserted. All Asterisk branches prior to 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11 / 22.8-cert3 are affected; no public exploit was identified at time of analysis.
Asterisk's REST Interface (ARI) allows a caller holding only read-only credentials to invoke write-capable dialplan functions - most notably FILE() - through the setChannelVar operation, even when live_dangerously is set to no in asterisk.conf, so a supposedly low-privilege ARI user can write files on the PBX host. Affected releases are Asterisk 20.x through 20.20.0, 21.x through 21.12.2, 22.x through 22.10.0, 23.x through 23.4.0, plus Certified Asterisk 20.7-cert10 and 22.8-cert2 and earlier; exposure requires the Asterisk HTTP server to be enabled and reachable and the attacker to already hold valid read-only ARI credentials. No public exploit code was identified at time of analysis, and vendor patches are available in 20.20.1, 21.12.3, 22.10.1, 23.4.1, Certified 20.7-cert11 and Certified 22.8-cert3.
Reflected cross-site scripting in the installation/upgrade script (installation/maj.php) of GRR, the PHP resource-management and reservation application, allows an attacker to run arbitrary JavaScript in a logged-in user's browser by getting that user to open a crafted URL containing a payload in the forcemaj parameter. The decisive precondition is that the installation directory was never deleted after setup - the advisory notes this cleanup is manual and not automatic - so instances where installation/maj.php remains web-accessible are the ones at risk; because the GRR authentication cookie is not marked HttpOnly, injected script can read it and hijack the session, and the same injection enables phishing and redirection to attacker-controlled sites. All versions up to and including 4.4.2 are affected and the issue is fixed in 4.5.0; a public proof-of-concept is not referenced in the available data and there is no confirmed active exploitation (no CISA KEV listing), and the current priority is this_week.