Resource-confusion in the Model Context Protocol Python SDK (pip package mcp) causes server-side bearer authentication to accept a token that was issued for a different service. The flaw affects HTTP servers built on the SDK that configure auth=AuthSettings(...) with a token_verifier, and it only bites when the same authorization server issues tokens for multiple resources and the deployment's TokenVerifier does not itself check the token's aud audience; in that setup an attacker who already holds a valid bearer token for another service can present it to the wrong MCP server and exercise the access it carries (CVSS 6.8, AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N, CWE-863). Affected builds are mcp 1.10.0 through 1.29.1 and 2.0.0 through 2.1.1; single-resource deployments, verifiers that already validate aud, and correctly configured patched versions are not exposed. No public exploit code has been identified at time of analysis and there is no CISA KEV entry; exploitation requires a pre-existing token plus a specific multi-resource authorization-server topology.
Client-side server-side request forgery and denial of service in the official Model Context Protocol Python SDK: when a connected MCP server declares a tool outputSchema containing an $id or an out-of-document $ref/$dynamicRef (http://, https:// or file://), the SDK's ClientSession, ClientSessionGroup and 2.x Client classes resolve that reference with jsonschema's default resolver, so the client fetches the URL or reads the local file from its own network and filesystem position and blocks the asyncio event loop for every session in the process while doing so. Applications using the SDK purely as a server are not affected; the vulnerable code runs only when a client invokes tools on a server the operator does not fully control. Versions 1.10.0 through 1.29.1 and 2.0.0 through 2.1.1 are affected and are fixed in 1.30.0 and 2.2.0 respectively; no public exploit has been identified at time of analysis, the fetched content is never returned to the malicious server (blind SSRF), and the CVSS 6.5 score reflects availability impact (A:H) rather than confidentiality.
Unbounded baggage processing in the optional OpenTelemetry Python Jaeger propagator (opentelemetry-propagator-jaeger before 1.45.0) lets a remote sender force unnecessary CPU work and short-lived heap allocations by supplying a carrier with numerous or oversized uberctx-* entries, degrading availability of the receiving service. According to the CVSS vector, no authentication is required (PR:N), but exploitation depends on specific deployment conditions (AT:P): the separately installed Jaeger propagator must be explicitly enabled - it is not part of the default OpenTelemetry Python configuration - and the service must accept untrusted inbound propagation headers. Practical impact is modest because common Python servers cap request headers before they reach the propagator (Gunicorn defaults to 100 header fields and 8,190 bytes per field; Uvicorn/h11 buffers incomplete events at 16,384 bytes), with materially higher exposure for non-HTTP transports, custom TextMapGetter implementations, or deployments that have raised or disabled server and gateway limits. No public exploit code has been identified at time of analysis, and the vendor has released a fix in 1.45.0.
Cross-origin redirect handling in the Model Context Protocol Python SDK (published on PyPI as `mcp`) leaks caller-supplied custom credential headers, and on 307/308 responses the request body, to any host a trusted MCP endpoint redirects to. Affected are HTTP client paths using `streamable_http_client`, `streamablehttp_client`, `sse_client`, `ClientSessionGroup` with HTTP server parameters, the OAuth client providers, or the internal `create_mcp_http_client` helper in versions 1.8.0 through 1.29.1 and 2.0.0 through 2.1.1, where redirect following was enabled by default or by a caller-supplied client with `follow_redirects=True`. Impact is conditional: a lone `Authorization` bearer header is dropped by the HTTP library on cross-origin hops, the body is only re-sent on 307/308, MCP servers and stdio clients are unaffected, and a malicious MCP server gains nothing because it already receives the requests directly, so exploitation depends on an attacker influencing where a trusted endpoint redirects (stale redirect to a lapsed domain, misrouted proxy rule, attacker-influenced redirect logic). No public exploit code or CISA KEV entry was identified at time of analysis, and the vendor-released fix is available in 1.30.0 (1.x) and 2.2.0 (2.x).
SQL injection in oretnom23 php-travel-agency-system (commit 4e28b8f84d72420373dd15c3ae32900beb7e0635) lets remote attackers manipulate the 'Search' argument handled by traceapplication.php to inject arbitrary SQL. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) scores 5.5 (medium) with limited confidentiality, integrity and availability impact, and requires no authentication, user interaction or non-default configuration per that vector. A public PoC reference exists in the form of a GitHub issue report; it is not verified as working exploit code, and the project has not responded or released a fix.
Missing authorization in the admin interface of code-projects Simple Content Management System 1.0 lets remote attackers reach the /web/admin/welcome.php endpoint and manipulate the 'addnews' argument without passing any access-control check. Per the supplied CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) the request needs no authentication and no user interaction, although impact is limited to low confidentiality, integrity and availability effects (base score 5.5). A public PoC reference exists on GitHub; it is not verified as working exploit code, there is no CISA KEV listing, and EPSS is only 0.39% (33rd percentile), consistent with a this_month priority driven mainly by the niche, hobby-grade footprint of the product.
Unrestricted file upload in oretnom23's PHP Travel Agency System lets an attacker who can reach the administrative employee-creation endpoint (admin/employee_insert.php) submit an arbitrary file through the 'employee photo' field, with no validation of type or content described. The project's CPE is a wildcard with no version bounds, and EUVD maps the issue to three specific commits (2592d60, 4e28b8f, b58513f), so all builds of the open-source codebase should be assumed affected. Remote exploitation is possible, but the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, 5.5 vendor score) treats the attacker as holding administrative privileges because the vulnerable script is an admin function; full server compromise is only possible if the uploaded file lands in a web-accessible, script-executable directory, which the sources do not confirm. A public PoC reference exists in the project's GitHub issue tracker; it is not verified as working exploit code, and there is no KEV listing, so the practical priority is moderate (vuln.today decision: this_month).
An out-of-bounds read (CWE-125) exists in Tencent RapidJSON up to and including 1.1.0, reachable through the library's Regex Parser component when the templated GenericStringStream<UTF8<char>>::Take function in include/rapidjson/stream.h is exercised; a successful trigger reads memory adjacent to the intended buffer, producing partial information disclosure and/or a crash rather than code execution. Exposure is conditional: because RapidJSON is a header-only C++ library with no network surface of its own, only applications that pass attacker-influenced data into the regex/schema validation path inherit the flaw - deployments that never use regex or schema functionality are not exposed. A public PoC reference exists (upstream GitHub issue #2401); it is not verified as working exploit code, and there is no CISA KEV entry, though SSVC records exploitation status as 'poc' and the EPSS score of 0.30% (23rd percentile) reflects low predicted exploitation activity.
Price and title tampering in SourceCodester Online Food Ordering System 1.0 allows remote attackers to alter submitted order values because order.php trusts client-side price/title fields instead of revalidating them server-side. The CVSS 4.0 score is 5.5 with PR:N in the vector, but the independent assessment notes that reaching the order workflow may in practice require a customer session, so that prerequisite should be verified; overall it is a genuine but low-severity issue, not an emergency. No CISA KEV entry is present, EPSS is 0.30% (23rd percentile), and a public PoC reference exists; it is not verified as working exploit code.
Unauthenticated SQL injection in the contact form handler (contact_insert.php) of oretnom23's PHP Travel Agency System allows remote attackers to inject arbitrary SQL through the name, company, email, topic, phone and comments parameters, which the code feeds into database queries without sanitization. The project is a small demo/tutorial-grade codebase with a correspondingly limited deployment footprint, and the reported impact is Low across confidentiality, integrity and availability. A public PoC reference exists in the project's GitHub issue tracker; it is not verified as working exploit code, and there is no CISA KEV entry or other confirmation of active exploitation, with EPSS-type urgency reflected only in a this_month priority label.
SQL injection in the admin record pages of oretnom23's PHP Travel Agency System lets remote attackers inject arbitrary SQL through the costomer_id, ticket_id, emp_id, salary_id and page_id parameters of admin/customer_detail.php. The product is distributed as source with no tagged releases; the European advisory lists affected snapshots at commits b58513f8371d098650fac656001bf8f59f795d25, 4e28b8f84d72420373dd15c3ae32900beb7e0635 and 2592d60d8f2c6e199f02c828c6d6fbc7b5298c96, and the wildcard CPE implies all versions are presumed affected. A public PoC reference exists (the upstream issue report) but it is not verified as working exploit code; the maintainer was notified via that issue and has not responded, so no fixed version is available and the priority is assessed as this_month.
SQL injection in the admin/customer_search.php search page of oretnom23's php-travel-agency-system allows remote attackers to manipulate the customer_name, voucher_no and emp_name parameters and alter the SQL query the page builds, giving low-impact reads and writes against the backend database. The CVSS 4.0 score is 5.5 (Medium) with all vulnerable-system impacts rated Low, and the supplied vector marks PR:N, although the endpoint sits under the admin/ directory, so whether an administrative session is required in practice is unresolved and should be verified per deployment. A public PoC reference exists (the upstream GitHub issue) but it is not verified as working exploit code; there is no CISA KEV entry, the project was notified early via that issue report and has not responded, and the vendor has not released a patch.
OS command injection in the desmondmorris node-tesseract npm library (versions 0.2.0 through 0.2.7) allows remote attackers to execute arbitrary shell commands when a consuming application passes unsanitized input into the 'image' argument of the process() function in lib/tesseract.js, because the Command Builder concatenates that value into the Tesseract OCR shell invocation. The package is not exploitable in isolation: reachability, authentication requirements and real-world impact depend entirely on the host application that exposes the image parameter to untrusted input. A public PoC reference exists in the project's GitHub issue tracker; it is not verified as working exploit code, and no vendor fix has been released because the maintainer has not responded to the report.
Legacy WebRTC input handling in Neko 3.0.0 through 3.1.4 incorrectly treats an authenticated room member as a host, allowing that member to inject mouse and keyboard events through the legacy data channel even while controls are locked or the member lacks authorization under the modern control API. Only deployments running legacy mode with session.implicit_hosting enabled are exposed; the modern HTTP/WebSocket control path enforces authorization correctly and is not affected. The flaw is rated CVSS 3.1 5.4 (Medium, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L), no public exploit code was identified at time of analysis, and the vendor has released a fix in v3.1.5.
The PayDunya WooCommerce Payment Gateway WordPress plugin through 1.1.6 lets unauthenticated remote attackers mark arbitrary WooCommerce orders as paid and completed, because incoming payment notifications are not checked for authenticity and, while the gateway remains unconfigured, are validated with a value derived from an empty secret that anyone can compute. Sites running WordPress with WooCommerce and this plugin active are exposed with no credentials required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, score 5.3), and the impact is confined to order-state fraud rather than data exposure or outage. There is no CISA KEV entry and no confirmed exploitation; a public PoC reference exists but is not verified as working exploit code, and EPSS is 0.11% (1st percentile).
OS command injection in the tmpServer/TDDPv1 service of the TP-Link RE305 V3 range extender lets a low-privileged local attacker run arbitrary operating-system commands as root on the device. The service listens only on the local loopback interface, so the attacker must already hold some on-device execution foothold; there is no network-reachable path and no scope change beyond the extender itself. No public exploit code was identified at time of analysis, and TP-Link has released firmware 1.1.8 Build 20260921 Rel. 42853 that removes the flaw, making this a moderate, situational priority (patching this month) rather than an emergency.
Race condition in the a2a-js Task Status Update Handler (versions 1.0 and 1.1.0) lets a remote caller have a task cancellation overwrite a status written by a concurrently finishing executor - or have the CANCELED write lost - corrupting the persisted task record. The window exists because cancelTask on the no-event-bus path of DefaultRequestHandler performs load→check→mutate→save without taking the per-(tenant, owner, taskId) write lock or checking whether the task has already reached a terminal state. Impact is confined to task integrity and availability (CVSS 3.1 AV:N/AC:H/PR:N/UI:N/C:N/I:L/A:L); exploitation is non-deterministic, requiring a narrow timing race against the executor's completion, and no public exploit code was identified at time of analysis. Rated this_month priority - a medium-severity integrity/availability issue rather than an emergency.
REST API authentication in Veeam Backup for Microsoft 365 8.0 through 8.6.0.1102 can be bypassed by a remote, unauthenticated attacker using a forged federation token, but responses are limited to endpoints that do not call the backup service. That confines impact to low confidentiality exposure on that endpoint subset, with no integrity or availability impact and no access to backup-service operations. The issue is rated CVSS 6.9, no public exploit was identified at time of analysis, and the precise cryptographic verification flaw is not described in the available sources.
Heap-based buffer overflow in DevilutionX 1.4.0 through 1.5.5 corrupts memory when the engine loads a crafted MPQ archive whose block table count exceeds its hash table count, overflowing a memcpy inside the bundled libmpq libmpq__archive_dup routine during startup; the confirmed outcome is a crash of the game (availability impact, no confidentiality impact and no demonstrated code execution). Exploitation is local: an attacker must first place the malicious archive in the game data the engine reads at startup, and the victim must then launch the game, so passive user interaction is required and no privileges are needed on the victim side. The issue is rated medium (CVSS 4.0 6.9, independently assessed CVSS 3.1 AV:L/AC:L/PR:N/UI:R with A:H only), EPSS is 0.13% (3rd percentile), it is not in CISA KEV, and no confirmed public exploit code has been identified at time of analysis - the only public material is a technical write-up. Priority guidance places it at this_month rather than emergency.
Integer overflow in llama.cpp's GGUF loader (gguf_init_from_reader) lets a crafted model file defeat the size validation added for CVE-2025-53630: a tensor whose computed byte size lands near SIZE_MAX pads to zero, so the loader accepts an undersized data blob that downstream consumers then read past. Builds b5854 up to but not including b11275 are affected, along with the corresponding 0.1.0 to before-0.6.0 semver range. Exploitation requires a victim to open a malicious GGUF file (local attack vector, user interaction, no authentication), and impact is bounded to out-of-bounds reads - crashes, denial of service, and limited information disclosure - rather than code execution; exploitation is not observed in the wild (SSVC exploitation: none) and EPSS is low at 0.13% (2nd percentile), with the vendor fix shipping in b11275.
Out-of-bounds memory access in llama.cpp builds b10398 through b11300 arises because a crafted GGUF model file can declare tensor dimensions whose product overflows INT64_MAX and wraps to zero, slipping past the element-count validation in gguf_init_from_reader so that ggml_nbytes() and stride calculations size buffers far too small. The flaw is only reachable when a vulnerable build loads and parses an attacker-supplied model: the assessed vector is local (AV:L) with user interaction required (UI:R), so there is no remote, network-triggered or unauthenticated path, and risk is concentrated in workflows that ingest third-party GGUF artifacts such as model hubs, shared storage, or services accepting user-uploaded models. Exploitation yields limited confidentiality and integrity impact with a high availability impact, but no public exploit code has been identified at time of analysis, EPSS is only 0.13% (2nd percentile), and the issue is not in CISA KEV; a vendor patch is available in b11301 and the prioritization signal is this_month rather than act_now.
Hard-coded AES-128 key and IV values in TP-Link RE305 V3 and Archer C7 V5 configuration backups allow anyone who obtains an exported backup file to decrypt it and recover administrator passwords and Wi-Fi credentials. Affected firmware is RE305 V3 before 1.1.8 Build 20260921 Rel. 42853 and Archer C7 V5 before 1.3.1 Build 20260821 Rel. 41256; exploitation requires possession of a backup file and has no remote path against a running device (CVSS 4.0 base 6.9, local vector). Vendor patches are available, and no public exploit was identified in the supplied intelligence at time of analysis.
Local privilege escalation in the Asterisk PBX `ast_loggrabber` diagnostic script lets an attacker who already holds an interactive shell account on the Asterisk server plant a malicious Python helper in the world-writable `/tmp` directory, which is then executed if an administrator later runs `ast_loggrabber` as a user with elevated privileges. Affected builds are Asterisk up to and including 20.20.0, 21.12.2, 22.10.0 and 23.4.0, plus Certified Asterisk up to 20.7-cert10 and 22.8-cert2; fixes are published in 20.20.1, 21.12.3, 22.10.1, 23.4.1, 20.7-cert11 and 22.8-cert3. Exploitation is constrained by two preconditions that must both hold - existing authenticated shell access and a privileged manual invocation of the diagnostic script - and there is no public exploit identified at time of analysis, no confirmed active exploitation (CISA KEV) and no EPSS signal supplied in the available data.
Repeated remote Cancel requests against a2a-go's Distributed Manager can leak resources and degrade availability in versions 2.0 through 2.4.0. When the ContextCodec fails to encode context during a Cancel call, the handler returns the error without closing the associated event-queue reader, so each failed cancellation strands a reader; sustained triggering can exhaust resources and produce a denial of service. The issue is reachable by remote, unauthenticated callers of a service that exposes the Cancel operation (per the assessed AV:N/PR:N vector), but availability impact is rated low and exploitation depends on the encode-failure branch being forced repeatedly. Version 2.5.0 fixes the leak, and no public exploit code has been identified at time of analysis.
Resource exhaustion in the a2a-go A2A SDK (versions 2.0 through 2.4.0) allows an unauthenticated remote client to leave server goroutines permanently parked in the REST server-sent-events streaming handler. The trigger shown by the vendor's regression test is a sequence rather than a single packet: the client disconnects, the main select loop in handleStreamingRequest returns, and the event-producing goroutine then panics and blocks forever trying to send on a panic channel that no longer has a reader. Impact is availability-only and incremental - each occurrence leaks resources instead of causing instant denial of service - no public exploit code was identified at time of analysis, and the vendor has released a fix in v2.5.0.
Unauthenticated remote access to service functionality in BMC Control-M/Enterprise Manager and Control-M/Server 9.0.20 up to but excluding 9.0.22 can expose information or degrade service availability, with low confidentiality, integrity and availability impact and no scope change (CVSS 4.0 base 6.9; assessed CVSS 3.1 7.5-equivalent vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). Per the CVSS vector, no credentials (PR:N) and no user interaction (UI:N) are required once the affected service is reachable, so exposure is governed primarily by whether the Control-M instance is network-accessible to untrusted clients; earlier unsupported versions are also listed as potentially affected. Exploitation status: no public exploit identified at time of analysis, and the issue is not in CISA KEV. Vendor-released patch: 9.0.22 for both Control-M/Enterprise Manager and Control-M/Server.
Unauthenticated path traversal in EasyImages2.0 (versions 0 through 2.8.6) lets a remote attacker read files outside the configured upload directory by sending '../' sequences in the dw, history, or img parameter of app/down.php, app/thumb.php, or app/info.php. No credentials, user interaction, or special configuration are required against a default install, but disclosure is bounded: the application only serves files whose extension is in the allowed upload-extension set, so exposure is limited to files carrying an image-like extension rather than arbitrary server files, which is why the impact is scored as low confidentiality only (CVSS v4.0 6.9; assessed CVSS:3.1 6.9 with C:L). The flaw is tracked as EUVD-2026-110844 and reported by VulnCheck; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV, with the vuln.today priority label indicating remediation this month.
Unauthenticated server-side request forgery in Artalk versions before 2.10.1 lets remote attackers make the comment server fetch attacker-chosen URLs by submitting an anonymous comment to /api/v2/comments with page_key set to an internal or external address. The fetched resource's HTML title is then exposed through the public comment list, giving an attacker title-level read access to internal endpoints; the trigger is confined to deployments that perform automatic page-title fetching on comment submission, and the independent assessment rates the impact as limited-confidentiality (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). No public exploit has been identified at time of analysis, the issue is not in CISA KEV, and vendor patches are available in the 2.10.1 release.
Authorization bypass in RSSAnt 1.9.0 through 1.9.1 lets unauthenticated attackers read stories from feeds whose owners never published them, by calling the anonymous publish.story_get endpoint. Because UnionStory.get_by_feed_offset ignores the only_publish flag, a request carrying any valid publish unionid in the X-RSSANT-PUBLISH header plus an enumerated feed_id and offset returns private feed story content instead of the expected 'does not exist' rejection. Exposure is conditional on the instance's publishing feature being enabled by at least one user, and the attacker must guess encoded unionid feed identifiers and offsets; impact is limited to confidentiality of unpublished feed content with no integrity or availability effect, and no public exploit code or active exploitation was identified at time of analysis.
A stack out-of-bounds read in SDL_image's ILBM/LBM loader (IMG_LoadLBM_IO in src/IMG_lbm.c) lets a crafted image with the HAM flag set and more than 8 bitplanes drive the palette loop past the 256-entry colormap stack array, crashing the host application and potentially leaking adjacent stack memory. Both branches are affected: 3.0.0 through 3.4.8 and 0 through 2.8.12. The impact is a read primitive only, so the realistic worst case is denial of service plus limited information disclosure rather than code execution; exploitation requires an application using the library to open the attacker-supplied file (UI:P, AV:L, PR:N - unauthenticated), and no public exploit was identified at time of analysis. Vendor fixes are published as upstream commits 5cfbe85f3a783417eec4d5aa0660b40c2cff5292 and 9c0622c36cf01e9ecba4bfdd6c4aa2b21c8cf996, which add explicit HAM bitplane validation.
Loading a crafted BMP with CImg 4.0.6 or earlier can crash the host application and copy heap memory into the decoded image, because the BMP loader's row byte-count computation in _load_bmp() overflows on an oversized header width. The flaw is a local, file-processing vector: an application must invoke CImg's BMP decoder on attacker-supplied data (CVSS 4.0 AV:L/UI:P, PR:N), and impact is limited to availability loss plus low-confidentiality heap disclosure, with no integrity or code-execution path indicated. No public exploit or CISA KEV entry is associated with this CVE at time of analysis, an upstream fix commit is available, and the issue is assessed as moderate priority ('this_month') rather than an emergency. CImg is a header-only C++ library, so every project that vendors a copy of CImg.h inherits the exposure until it recompiles against the patched header.
Uncaught exception in svg-sanitizer (the enshrined/svg-sanitize Composer package) versions 0.11.0 through 1.0.0 lets remote attackers crash PHP workers with well-formed XML documents that lack exactly one top-level <svg> root. Because Sanitizer::sanitize() builds an XPath object without a try/catch on the documented 'returns false on bad input' path, a non-svg root, a zero-svg document, or an <svg> nested under another root throws an uncaught LogicException instead of returning false - a PHP fatal error or HTTP 500 per request, and potentially a skipped upload-rejection branch. Severity is limited to availability (CVSS v4 6.9 with A:L; independently assessed as CVSS 3.1 AV:N/AC:L/PR:N/UI:N/A:L); there is no confirmed active exploitation (not in CISA KEV) and no public exploit code confirmed working, though a public PoC reference exists in the advisory and the SSVC 'Automatable' rating is yes. Only callers that wrap sanitize() in a broad catch or guard solely on === false are exposed.
Missing authorization in the Semantic MediaWiki smwtask API module allows unauthenticated remote visitors to invoke maintenance operations that the wiki reserves for administrators, affecting releases 3.0.0 through 7.2.1. A caller can read internal store statistics and object-ID space, enqueue arbitrary Semantic MediaWiki jobs, and force synchronous execution of queued jobs, degrading performance and, via entity-disposal tasks aimed at enumerated IDs, altering stored semantic data - with impact scaling to how populated and how large the wiki's store is. There is no confirmed active exploitation (not in CISA KEV; SSVC exploitation is 'none'), though the vendor advisory includes reproduction proof-of-concept requests and exploitation is automatable; the vendor fix is 7.3.0.
Semantic MediaWiki 7.3.0 through 7.3.1-alpha fails to authorize the target page in its smwtask update task, letting a caller holding the wiki-wide edit right force semantic updates on arbitrary page titles. The caller supplies a serialized subject that is deserialized and passed to a forced UpdateJob without a title-level edit check, so the task can trigger reparsing, semantic-store writes, cache invalidation and expensive dependency work on pages outside the caller's authorization boundary; on wikis that permit anonymous editing, anonymous users may hold that edit right. A safe proof-of-concept request is documented in the vendor advisory but is a staged verification recipe, not confirmed working exploit code, and no active exploitation is confirmed; this is a genuine but moderate-priority issue, not a top-tier emergency.
Missing authorization in Semantic MediaWiki 7.3.0 lets unauthenticated remote callers run queued maintenance jobs of arbitrary type and unbounded count and force semantic-store updates for any title, including pages protected to sysop, through the smwtask API module. The per-task authorization model introduced in 7.3.0 maps run-joblist, update and check-query to the MediaWiki 'edit' right, which anonymous users hold on a stock wiki, and the module's CSRF requirement is satisfied by the fixed public anonymous token '+', so no session or credentials are needed; the four administrator tasks stay correctly denied, so an attacker can run already-queued jobs but not enqueue new ones. Fixed in 7.3.1; a public PoC reference exists in the vendor advisory as verbatim request transcripts (not verified as working exploit code), no KEV entry is associated, and the vuln.today priority is this_month rather than act_now.
Credential disclosure in Symantec Ghost Solution Suite's GSS Deployment Server lets an attacker who possesses the product's hardcoded cryptographic key decrypt domain and service-account passwords, task run-as credentials and sysprep passwords that the component stores or transmits. The builds identified by EUVD are GSS 3.3.13, GSS 3.3 RU11 and GSS 3.3 RU12 (CPE cpe:2.3:a:broadcom:symantec_ghost_solution_suite), and exploitation is limited to attackers with an adjacent-network position who can also obtain the credential ciphertext - either by intercepting passwords sent by the Deployment Server or by reading the encrypted credential store on an installation. Severity is rated 6.8 under CVSS 4.0 (independent assessment: CVSS 3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L); there is no KEV listing, no public exploit identified at time of analysis, and EPSS is 0.15% (4th percentile).
An out-of-bounds read in the libmpq library bundled with DevilutionX 1.4.0 through 1.5.5 lets a crafted .mpq archive crash the game: the file-number lookup routine libmpq__file_number_from_hash uses an unchecked block_table_index from the archive's hash table to index the block table array, reading past the heap buffer (mpq_map) and terminating the process. The attack is not remote - the attacker must first get a malicious archive into the game's data path (for example distributed as a mod) and the victim must then launch DevilutionX and load it, so a legitimate install using only official Blizzard data is not affected. Per the assessed impact the consequence is availability only (crash), with no confidentiality or integrity effect; there is no CISA KEV listing, EPSS is low at 0.12% (2nd percentile), and no working public exploit code is confirmed, although a public technical write-up of the flaw exists.
A heap out-of-bounds read in llama.cpp's vocabulary loader (llama_vocab::impl::print_info) lets a crafted GGUF model crash llama-cli or llama-server during model load; it affects builds prior to b5649. Unauthenticated remote attackers cannot trigger it on their own - the operator must be induced to load an attacker-supplied model (CVSSv4 UI:P, assessed CVSSv3.1 AV:L/UI:R) - and the only demonstrated impact is process termination, with no confidentiality or integrity effect and no code execution shown. A public PoC reference exists; it is not verified as working exploit code. No KEV listing, EPSS 0.12% (2nd percentile), and the vendor fix is available as build b5649, so this is a genuinely medium-tier issue that should not be treated as an emergency and is scheduled for this month's patch cycle.
Kernel-level privilege holders on affected ASUS motherboards can supply an arbitrary memory address through an I/O command to the board firmware, which then dereferences the untrusted pointer, allowing tampering with system information or crashing the system. The flaw is local-only and requires high privileges (ring-0) to reach, so it is not remotely or unauthenticated-reachable; integrity and availability are impacted while confidentiality is untouched. No public exploit code or active exploitation has been identified at time of analysis, EPSS is negligible (0.11%, 1st percentile), and ASUS has published fixed firmware per board series.
Command injection in Supermicro MBD-X12SPI BMC/IPMI firmware 01.07.20 allows a holder of IPMI administrator credentials to execute arbitrary commands as the operating system root user on the BMC. The flaw is reachable over the network without user interaction, but exploitation requires prior administrative access to the IPMI interface, making it a privilege-escalation path from BMC admin to OS root rather than an unauthenticated takeover. No public exploit code or active exploitation is confirmed at time of analysis, and EPSS is 0.54% (45th percentile), indicating low predicted exploitation activity.
Dell PowerProtect Data Domain appliances running Feature Release 7.7.1.0 through 8.7, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, or LTS2026 8.6.1.0 through 8.6.1.20 contain an improper privilege management flaw that lets a remote attacker who already holds a high-privileged account elevate privileges. The CVSS 3.1 score is 6.7 (AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H), and Dell has released fixed versions 8.9.0.0, 8.3.1.50, 8.6.1.30, and 7.13.1.90. No public exploit was identified at the time of analysis, and the requirement for high-privileged credentials limits exposure.
Command execution in JetBrains Junie CLI before 26.8.17 can occur because the command allowlist does not fully validate entries, allowing a command to bypass the intended restriction. This is a moderate-severity, context-dependent issue rather than an emergency: the vector is local, requires low-level host privileges, mandatory user interaction to run the agent, and high attack complexity, and only versions below 26.8.17 are affected. No public exploit has been identified at the time of analysis, and the vendor has released a fixed version.
Sensitive information disclosure in Tanium Reputation allows confidential data handled by the module to be written into Reputation log files, where a party able to read those logs can recover it. Deployments running Reputation 6.6 before 6.6.145, 6.7 before 6.7.138, or 6.8 before 6.8.162 are affected; the assessed vector (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) confines realistic impact to confidentiality loss for an authenticated, highly privileged party that already has log access, rather than to integrity or availability damage. No public exploit code has been identified at time of analysis, and vendor-released patches exist for all three affected branches.
An incorrect privilege assignment flaw (CWE-178) in Tanium Server allows a network-positioned attacker who already holds high privileges on the platform to gain full confidentiality, integrity and availability impact (C:H/I:H/A:H) by meeting a high-complexity precondition that is not detailed in the available sources. Affected releases are Tanium Server below 7.7.3.8351, below 7.8.2.1263 and below 7.8.4.1399; Tanium has published advisory TAN-2026-054 and fixed versions for each branch, so the exposure is limited to unpatched deployments. The vector requires PR:H and AC:H, meaning opportunistic or unauthenticated exploitation is infeasible from this data, and the vendor-reported severity is moderate at CVSS 6.6; no public exploit code or CISA KEV listing is present in the available intelligence, and the priority decision is 'this_month'.
Psono Server 5.3.5 through 7.2.3 allows an attacker who already holds an authenticated session derived from a scope-restricted API key to escalate privileges by claiming an attacker-controlled device code, receiving in return a full read-write session valid for up to 365 days that outlives and exceeds the original token's scope and lifetime limits. The flaw is a missing write-scope enforcement in the permission class on the device-code claim path (CWE-269), rated CVSS 6.5 with PR:L, and it does not bypass two-factor authentication nor directly disclose plaintext secrets. It is not confirmed as actively exploited (CISA KEV) and no public exploit code has been identified at time of analysis; EPSS is low at 0.47% (40th percentile), and the vendor has released a fix in 7.2.4.
Psono Server CE and EE (versions 3.1.0 through 7.2.3) fail to consume the stored WebAuthn challenge after verifying an assertion, enabling a replay of a captured WebAuthn assertion against separate login token requests as long as that stored challenge remains unchanged. The practical effect is a bypass of the WebAuthn second factor, but only for an attacker who already holds the victim's valid password and has captured one valid assertion; the flaw itself does not disclose plaintext secrets. Severity is moderate (CVSS 6.5, AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N) with a low EPSS of 0.41% (35th percentile); no public exploit code and no confirmed active exploitation are indicated in the available data.
Memory exhaustion in the shared knative.dev/pkg admission webhook handler allows a pod-network attacker to OOM-kill any controller built on the library by sending one oversized POST to its admission endpoint. All knative.dev/pkg versions prior to 0.0.0-20260531000007-52dbd5ece63f are affected, and the flaw propagates to every downstream consumer of the shared webhook server - Knative Serving and Eventing, Tekton Pipelines and Triggers, KEDA, Sigstore policy-controller and Kpack - because none of them bound the request body before decoding. Impact is availability-only: with failurePolicy=Fail the OOM becomes a namespace or cluster admission outage, with failurePolicy=Ignore only the affected webhook goes offline; the advisory includes a reproduction script and measured memory-amplification logs, but there is no public exploit identified at time of analysis in the sense of confirmed attack activity and the issue is not in CISA KEV. A vendor patch is available, and the assessed priority is to remediate this month rather than as an emergency.
Broken role-based access control in Grafana 13.0.x through 13.1.x lets an authenticated user who holds dashboard permission-management rights on just one folder be treated as a folder administrator for all folders when listing deleted dashboards. That incorrect authorization decision exposes deleted dashboard listings from folders the user was never granted administrative rights over, although it does not grant broader folder administration or modification capability. The flaw is rated moderate by the vendor and by independent assessment (access-control weakness, confidentiality-only impact); no public exploit code has been identified at time of analysis and CISA KEV does not list it.
Denial of service in Dell PowerProtect Data Domain (Feature Release 7.7.1.0 through 8.7, LTS2024 7.13.1.0 through 7.13.1.70, LTS2025 8.3.1.0 through 8.3.1.30, and LTS2026 8.6.1.0 through 8.6.1.10) can be triggered through crafted certificate content processed by the appliance, where a relative path traversal (CWE-23) is possible. Exploitation requires an authenticated session with high-privilege, administrative access to the appliance over the network (CVSS PR:H); no user interaction is required, and the assessed impact is primarily to availability, with the trigger not detailed in the available sources. The issue is rated CVSS 6.5 (medium) with the real-world risk substantially gated by its administrative prerequisite; no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV), with vendor fixes available and prioritised for remediation this month.
MLflow's CrewAI autologging integration records CrewAI Agent objects without sanitizing nested credential-bearing values, so provider API keys held in an Agent's LLM object are written in plaintext into span attributes and mlflow.spanInputs. Applications running MLflow 2.19.0 through 3.16.x that explicitly enable mlflow.crewai.autolog() with a CrewAI Agent created via LLM(api_key=...) can therefore send plaintext credentials to the MLflow trace backend or a configured OTLP destination, where trace readers can obtain them. Exploitation is confirmed feasible by the upstream advisory's reproduced proof of concept, and the vendor released a fix in MLflow 3.17.0; signals point to a genuine but moderate, non-urgent credential-exposure issue rather than a high-impact remote compromise.