Unauthenticated remote code execution is possible against ClickHouse Server under certain conditions, with a CVSS 4.0 score of 9.5 reflecting full confidentiality, integrity and availability impact. The flaw is rooted in an integer overflow (CWE-190) and reachable over the network without authentication or user interaction, though a high attack complexity metric and the vendor's 'under certain conditions' qualifier indicate a situational prerequisite that the available sources do not enumerate. No public exploit code or confirmed active exploitation is referenced; the priority decision is act_now, driven by the severity and the unauthenticated network vector.
Stored cross-site scripting in the PDF Invoices & Packing Slips for WooCommerce plugin (5.16.2 up to, but not including, 5.16.5) allows unauthenticated guest shoppers to persist malicious script in billing address, shipping address, or customer order-note fields, which executes when a shop administrator views a generated invoice or packing slip. The assessed vector requires administrator interaction (UI:R), so execution timing is not attacker-controlled and exploitation is not fully automatable; stores that disable guest checkout are not exposed by this path. A public PoC reference exists; it is not verified as working exploit code, and no KEV active-exploitation status is supplied.
Improper certificate validation in the HTTPS API listener of Canonical LXD lets an unauthenticated remote attacker present a crafted certificate chain that is accepted as an already-trusted client, granting full access to the LXD cluster and the virtual machines it manages. Affected builds are 4.0.14, 5.0.10, 5.21.8, and 6.9 and earlier within each branch; the fixed releases are 4.0.15, 5.0.11, 5.21.9, and 6.10.1. Exploitation requires that the HTTPS listener be enabled and network-reachable, so installations restricted to the local Unix socket are not remotely exposed; clustered LXD and MicroCloud deployments, which depend on this listener, carry the most risk. The vulnerability is rated 10.0 under CVSS 4.0 with no privileges or user interaction required (PR:N/UI:N), and no public exploit code was identified at time of analysis, though the vendor rates the issue as requiring immediate action.
WIT SynApps Runtime through 1.4.11 ships its OAuth confidential-client clientId and clientSecret inside frontend JavaScript such as parameters.js, so any unauthenticated party who can reach the web interface can read static application credentials directly out of the served assets. Those credentials let an attacker reproduce the application portion of the REDY authentication flow against /web/api/v1/auth/token, undermining confidential-client assurance; the assessed impact is confidentiality-only (VC:L) and the data does not establish that it yields user credentials or a complete authentication bypass. A public PoC reference exists in a GitHub exploit repository covering CVE-2026-7003/7004/7005, but it is not verified as working exploit code, and the supplied intelligence does not indicate a CISA KEV listing or active exploitation.
Any remote, unauthenticated caller who can reach a Bazarr instance's `/api/plex/` endpoints can persistently rewrite its Plex configuration: `POST /api/plex/oauth/logout` clears the stored token, API key and server URL and disables the integration outright, while `POST /api/plex/apikey` stores an attacker-chosen key, and the unauthenticated `/api/plex/oauth/pin` plus `pin/<id>/check` pair lets an attacker bind their own Plex account token to the instance. The root cause is that the `api_ns_plex` namespace in `bazarr/api/plex/oauth.py` ships without the per-handler `@authenticate` decorator that all 65 sibling API handlers carry, and no global authentication hook compensates. Every release up to and including 1.5.6 is affected, and the vendor closed the anonymous API-mutation path in 1.5.7-beta.14; the CVE record is scored CVSS 10.0 and the vulnerability carries an act_now priority decision, though no public exploit code was identified at time of analysis. Attackers can additionally abuse attacker-supplied server URLs that are later fetched with the configured API key in an `X-Plex-Token` header, producing server-side request forgery and credential exposure against instances where a Plex integration is already configured.
Arbitrary host file write as root in SOCFortress CoPilot prior to 0.1.77: the ScoutSuite GCP report upload endpoint accepts a caller-supplied multipart filename and joins it with os.path.join into the scoutsuite-report directory, so a '../'-laden filename escapes the intended folder and writes attacker-controlled bytes anywhere the backend process can reach. Exploitation requires a valid analyst- or admin-scoped bearer token (the assessed vector is PR:L, not the PR:N shown in the original CVSS string) plus an uploaded body that passes GCPScoutSuiteJSON content validation, which a syntactically valid GCP service-account JSON satisfies trivially; because the published backend image runs as root, writes land root-owned in /tmp and in the application source directory. A proof-of-concept documented as confirmed live against the published ghcr.io/socfortress/copilot-backend image is public, and escalation to code execution depends on choosing an exploitable destination such as a cron directory, a loaded Python module or a startup script; the advisory's broader claims of unrestricted-content and unconditional cross-tenant compromise are not established by the demonstrated primitive. The issue is rated act_now because a working write primitive with root privileges in a default deployment is a direct path to full platform and stored connector-credential compromise, though the mandatory authentication, JSON content validation and non-root deployment architecture are genuine limiting factors. No CISA KEV entry is associated with this CVE.
Authenticated remote code execution in ThingLinks below 1.4.0 lets any low-privilege account submit attacker-controlled Groovy script content to the /groovyScriptTest/registerScript endpoint, which is compiled and instantiated without a sandbox and therefore executes server-side with the application's privileges. The flaw sits in the rule engine's Groovy script test/register flow and is fixed in 1.4.0; no public exploit code was identified at time of analysis, but the only prerequisites are a valid authenticated session and network reachability to the endpoint, so risk is highest where the management interface is exposed to untrusted or lower-trust users. This is a genuine high-priority issue rather than a high-score-but-low-risk artifact, and the vendor advisory plus upstream commit and 1.4.0 release tag are all publicly available.
Unauthenticated PHP object injection in the Gravity Forms WordPress plugin, affecting every version up to and including 3.1.2, lets a remote attacker push a serialized payload into post meta through a Post Custom Field configured with the List input type. The flaw exists because GFFormsModel::create_post() hands the submitted row value to WordPress' global maybe_unserialize() instead of the plugin's own hardened GFCommon::maybe_unserialize() introduced in 3.1.1; the impact of the resulting object injection depends on a gadget chain supplied by another plugin or theme, and a self-contained remote code execution path is described when the field is mapped to _wp_page_template on hosts with a readable PEAR install and register_argc_argv enabled. No public exploit code was identified at time of analysis, and the vulnerability is not in CISA KEV; the assessor's own vector is AC:H rather than the reported AC:L, because exploitation requires a non-default form configuration (a List-type Post Custom Field with a content template) plus, for RCE, specific host conditions. The vuln.today decision label is act_now and the finding is reported by Wordfence, so it should still be triaged as a priority despite the narrowing prerequisites.
Stored cross-site scripting in SOCFortress CoPilot lets any authenticated portal user, including the lowest-privilege customer_user role, plant HTML/JavaScript through POST /api/incidents/db_operations/alert/comment that is later rendered unsanitized via v-html in AlertComment.vue, executing on the application origin whenever a viewer opens the poisoned alert. Because the customer portal persists access and refresh tokens in JavaScript-readable storage and sends them as bearer headers rather than HttpOnly cookies, an injected script can read both tokens and mint fresh ones through /auth/refresh, so an analyst or administrator who views the poisoned content hands over a persistent privileged session, enabling cross-tenant data access, incident modification or deletion, and subversion of detection and response. Snapshots preceding 0.1.70 (health-check sink) and 0.1.76 (comment and other SOC sinks) are affected, the vendor advisory includes a proof-of-concept demonstrated live against the published ghcr.io/socfortress/copilot-backend image, and priority is act_now. Per the assessed vector the attacker must be authenticated (PR:L) and the issue is scored at 9.9 with scope change.
Unauthenticated PHP object injection in the FunnelKit Automations WordPress plugin through 3.8.6.1 lets network attackers reach a deserialization path without credentials or user interaction, carrying a 9.8 CVSS rating for potential high confidentiality, integrity, and availability impact. The available sources do not describe the specific vulnerable input or confirm a POP gadget chain that would turn object injection into code execution, so impact beyond object injection is not demonstrated. No public exploit identified at time of analysis, but the act_now priority and severe rating justify urgent review.
Unauthenticated first-run administrator takeover in TAKO AI Agent for Okta (pip package okta-ai-agent) v3.0.0-beta: the POST /api/auth/setup endpoint in src/api/routers/auth.py performs no authentication, requires no one-time bootstrap token, and applies no network restriction, so any remote attacker who reaches a freshly deployed instance before the legitimate owner completes setup can create the sole admin account and receive a valid fctr_session JWT cookie. Because the default docker-compose.yml publishes port 8001 on all interfaces and the Dockerfile binds uvicorn to 0.0.0.0, a default deployment reachable from untrusted hosts is exploitable with a single HTTP request and no Okta tenant access; the attacker then controls Okta-synced user data, stored API tokens, chat history, and integration credentials. A public advisory includes full reproduction artifacts and working step-by-step exploit instructions (publicly available exploit code exists), and the release fixing the issue is v3.0.1-beta, which introduces an ephemeral in-memory setup token and binds the published port to 127.0.0.1 by default. Exploitation is limited to the first-run window: once setup is completed the endpoint returns HTTP 400, and deployments bound to localhost or an internal interface reduce exposure.
SQL injection can result in HoneySQL (Clojure; Maven/Clojars coordinate com.github.seancorfield/honeysql) versions 2.0.0 through 2.7.1391 when an application calls `keyword` or `symbol` on untrusted input to build DSL entities and the rendered SQL string is then executed unchanged by a JDBC driver, because several formatters emit those entity names without applying the library's existing suspicious-character check. The CVSS vector is AV:N/AC:L/PR:N/UI:N (unauthenticated, network-reachable), and the impact is bounded by the privileges of the database connection that runs the generated statement; applications that never route arbitrary data through `keyword`/`symbol` entity construction are not exploitable even on vulnerable versions. No public exploit code was identified at time of analysis, and the maintainer-designated fix is release 2.7.1392, with a vuln.today decision label of act_now reflecting the 9.8 severity score and CWE-89 classification.
SQL injection in Apache Fineract through 1.15.0 allows a caller of the /fineract-provider/api/v1/search/advance endpoint to inject arbitrary SQL through the outStandingAmountPercentageCondition parameter, giving full confidentiality and integrity impact on the Fineract database. The issue is confirmed by the Apache oss-security advisory and by upstream fix PR #6153, which removed the weak SqlValidator check and replaced it with strict allowlist validation of that condition plus the related outstandingAmountCondition and loanDateOption values. No public exploit code and no CISA KEV entry were identified at time of analysis (EPSS 0.23%, 14th percentile); NVD scores the flaw 9.8 with PR:N, while the assessed vector uses PR:L because the /api/v1 interface normally requires authentication in hardened deployments.
Object injection in the Drupal Block AJAX module, affecting versions 0.0.0 through 3.0.2, allows remote attackers to influence dynamically determined object attributes through the module's AJAX request-handling path, with a CVSS 3.1 score of 9.8 indicating high confidentiality, integrity and availability impact. The assessed vector assumes network reachability, low complexity, no privileges and no user interaction, but the available sources do not confirm whether a specific Drupal permission, authenticated session or non-default configuration is required. No public exploit is identified at time of analysis, EPSS is 0.19% (9th percentile), the vendor fix is Block AJAX 3.0.2, and the vuln.today priority label is act_now.
Unauthenticated privilege escalation in the WordPress plugin SMS Alert Order Notifications through version 4.0.2 lets remote attackers obtain elevated privileges without authentication or user interaction, with high confidentiality, integrity, and availability impact (CVSS 9.8). The issue is classified as CWE-266 incorrect privilege assignment and was reported by Patchstack; the vulnerable endpoint or feature that triggers the escalation is not described in the available sources. The vuln.today priority is act_now, no public exploit was identified at time of analysis, and there is no CISA KEV confirmation.
Unauthenticated PHP object injection in the LeadSnap WordPress plugin through version 1.25 can let a remote attacker reach a PHP unserialize() path with attacker-influenced data, carrying a CVSS 3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and CWE-502. The supplied CPE identifies the LeadSnap plugin, and the Patchstack advisory is the sole reference in the provided intelligence; no CISA KEV entry or public exploit code is reported, so no public exploit identified at time of analysis. The C:H/I:H/A:H rating is a worst-case assumption: effects beyond object instantiation depend on a usable POP gadget chain in the plugin or co-installed components, which the available evidence does not confirm.
PHP object injection in the ThemeREX Royal Event WordPress theme affects versions up to and including 2.0: attacker-supplied serialized data reaching an unserialize() call can instantiate arbitrary objects. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H, 9.8) describes a network-reachable, low-complexity, unauthenticated flaw with full confidentiality, integrity and availability impact, and the vuln.today decision label is act_now. No public exploit code or CISA KEV entry is reported in the available data, and the actual impact hinges on whether a usable POP gadget chain exists in the theme, WordPress core or an installed plugin; the specific triggering endpoint and parameter are not described in the available sources.
Authentication bypass in ng-antd-admin (an Angular + NestJS administration system template) before version 22.0, caused by a hardcoded default JWT signing secret that is active silently when a deployment has not overridden it. Unauthenticated remote attackers can sign their own tokens with the shipped secret, impersonate any user including administrators, and reach protected API endpoints for account takeover, data leakage and unauthorized operations; the flaw is only reachable on installs left in out-of-the-box configuration, since any deployment with a custom SECRET is not exposed through this issue. The project ships an explicit fix in 22.0 (release tag v22.0, commit 23e92ff) and the priority decision for this CVE is act_now; no public exploit code was identified at time of analysis.
Vvveb CMS before 1.0.8.7 exposes its password-reset flow to unauthenticated account takeover: an attacker supplies a valid username and a PHP array-style token parameter (for example token[]=), and the handler accepts the reset without a legitimate token. The GitHub advisory documents reproduction steps leading to arbitrary password changes, including administrative accounts, and the vuln.today decision is act_now with a 9.8 CVSS vector (AV:N/AC:L/PR:N/UI:N). A public proof-of-concept is documented in the advisory; no CISA KEV listing is present in the supplied data.
Remote unauthenticated command injection in Dahua Intelligent Connection Center allows network-reachable attackers to execute arbitrary commands with high confidentiality, integrity, and availability impact (CVSS 9.8). The supplied CPE has no version restriction, so all versions of the product family should be considered potentially affected until Dahua confirms fixed releases; the trigger endpoint or parameter is not described in the available sources. No public exploit identified at time of analysis and no CISA KEV entry was provided, but the vuln.today decision label is act_now.
MoLing's SSE server mode (enabled with the non-default -l/ListenAddr flag) exposes the /sse and /message HTTP endpoints without authentication, and the mcp-go dependency hardcodes Access-Control-Allow-Origin: * on /sse, so any web page the victim visits can open a cross-origin EventSource, read the endpoint event, extract the unauthenticated sessionId, and then post unauthorized MCP tool calls to /message. Impact is bounded by which MCP tools are configured but can include local file read/write and command execution, and the vendor notes that binding only to loopback does not stop this because the attack is browser-mediated from the victim's own machine. Versions before 0.5.0 are affected; 0.5.0 adds mandatory token authentication and strips the wildcard CORS header. Exploitation requires the victim to run SSE mode and visit an attacker-controlled page (UI:R); no public exploit code or confirmed active exploitation is identified in the available data, though the advisory includes a simplified proof-of-concept snippet, so a public PoC reference exists but is not verified as working exploit code. The priority decision label is act_now.
Signals diverge in a way worth stating plainly: Google Chrome before 156.0.8078.79 can allow code execution outside the renderer sandbox when a victim loads a crafted HTML page, due to improper input validation in Skia. Exploitation requires user interaction (UI:R) and an unpatched browser, no authentication is needed, and no public exploit has been identified at time of analysis; EPSS is 0.21% and SSVC marks exploitation none and automatable no. The 9.6 CVSS score and act_now decision indicate prompt patching despite those lower exploitation signals.
Memory corruption in Google Chrome's garbage collection before 156.0.8078.79 can let a remote, unauthenticated attacker potentially execute arbitrary code outside the browser sandbox when a victim renders a crafted HTML page. The priority label is act_now despite low EPSS (0.20%, 10th percentile) and SSVC reporting no exploitation and not automatable, while the vendor rates the issue High. Google has released a fixed build, 156.0.8078.79; no public exploit was identified at time of analysis.
Unrestricted file upload in Cak Filemanagement System allows a remote attacker to write an attacker-controlled file to the server through the File argument in admin/add_logs.php. The published CVSS 4.0 vector scores 6.9 with network/low-complexity conditions and no stated privilege or interaction requirement, but Low impact metrics; the independent assessment instead applies CVSS 3.1 with PR:L and High confidentiality, integrity, and availability impact, and notes that the admin/ endpoint likely requires administrative access although enforcement is unconfirmed. A public PoC reference exists but is not verified as working exploit code, and no CISA KEV status is provided, so confirmed active exploitation is not established.
SQL injection in the admin student-save handler (admin/save_student.php) of the open-source 37954679 cak-filemanagement-system allows remote attackers to inject arbitrary SQL through the date, department, subject, forwarded_to, action_taken_by, section, or password parameters that are passed into a mysqli_query call. The project is affected through commit 5e6433246475e66462e1fea980688de96a049297 and the vendor has not responded to the issue report, so no fixed release is identified. Impact is scored Medium (CVSS 4.0 base 6.9 with E:P; independent CVSS 3.1 6.9, C:L/I:L/A:L); a public PoC reference exists in the upstream issue tracker but it is not verified as working exploit code, and there is no evidence of active exploitation. The main open question is the authentication requirement: the supplied vector asserts PR:N while the vulnerable script sits under an admin/ path, and a login gate would materially reduce exploitability.
Unauthenticated OS command execution is possible on Teltonika Networks RUTOS devices (RUT, RUTX, RUTM, RUTC, ATRM, TAP, CAP, OXA, DAP, TRB, OTD, EBG) running versions 7.22 through 7.24.2 and TSWOS devices (SWM, TSW) running versions 1.9 through 1.10: an attacker who can reach the device's service interface from an adjacent network segment can call internal LUA functions directly, bypassing the validation that normal API requests enforce, and thereby execute operating-system commands with high impact on confidentiality, integrity and availability of both the device and connected systems. No authentication or user interaction is required once that network position is achieved, and the adjacency requirement is the principal limiting factor. No public exploit code has been identified at time of analysis and the issue is not reported as confirmed actively exploited (CISA KEV); the vuln.today decision label is act_now, driven by the unauthenticated code-execution outcome combined with the wide affected device family.
Command injection in pgAdmin 4 before 9.19 lets an authenticated, low-privileged database user execute arbitrary operating-system commands on the pgAdmin host by abusing the Import/Export Data tool's query export. The tool wraps the user-supplied query in a psql \copy (...) TO command and validates parenthesis balance, but a backslash inside a double-quoted identifier makes pgAdmin's validator and psql's parser disagree about where the identifier ends, so a hidden closing parenthesis terminates the wrapper and an appended TO PROGRAM clause is executed by psql as the OS account running pgAdmin before the server rejects the statement. This is a bypass of the fix for CVE-2026-17566; the Import/Export Data permission is granted to non-administrators by default and any ordinary role can set standard_conforming_strings=off for its own session, so no privileged database access is required. No public exploit code has been identified at time of analysis, but the vendor fix is available in pgAdmin 4 9.19 and the priority assessment is act_now.
Remote code execution in Thales Sentinel Keys Server on Windows (versions lower than 1.3.8.0) lets unauthenticated network attackers compromise the service by sending a crafted HTTP request whose first field is overlong, overflowing a stack buffer and leading to code execution as NT AUTHORITY\SYSTEM. The same request path also lacks an authorization check, so no credentials or user interaction are required - the practical gating factor is whether the Sentinel Keys Server HTTP listener is reachable from the attacker. It is scored 9.3 under CVSS v4.0 (independent assessment: CVSS 3.1 AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) and is triaged act_now; no CISA KEV entry is reported and no public exploit code is identified in the provided sources.
Arbitrary code execution in Google Cloud Application Integration affects service versions prior to 2026-09-11: an authenticated attacker (CVSS PR:L) can supply a maliciously crafted serialized object to the SubWorkflow task and execute arbitrary code. The issue carries a supplied CVSS score of 9.4 and the priority signal is act_now, but Google reports the defect was fixed server-side on 11 September 2026 with no customer action required. No public exploit is identified at time of analysis, and no CISA KEV entry is present in the supplied data.
Unauthenticated active-response invocation and alert injection affect SOCFortress CoPilot deployments prior to 0.1.76 that leave GRAYLOG_API_HEADER_VALUE or VELOCIRAPTOR_API_HEADER_VALUE unset or unchanged, because both webhook header validators fall back to the same public constant shipped in `.env.example`. A remote attacker who supplies that known header value bypasses the JWT authentication that gates every other API, reaching POST /api/graylog/invoke to forward attacker-chosen COMMAND, ACTION, VALUE and AGENT_ID to the configured Wazuh manager (without the command-enum validation enforced on the authenticated invocation route), and reaching the threshold and velo-sigma alert routes to forge alerts for arbitrary customer_code values and drive attacker-controlled OpenSearch queries. The vendor's own advisory reports a confirmed live proof of concept against the published copilot-backend image; no CISA KEV entry is recorded and no EPSS score was supplied, but the priority decision label is act_now given the default-deployment exposure. Active-response delivery additionally requires a configured reachable Wazuh manager, and deployments that independently changed both header secrets are not subject to this bypass.
Template-driven Python code execution in pybars3 through 0.9.7 lets anyone who can supply Handlebars template source break out of the generated Python string literals and run arbitrary code inside the host application process. The assessed vector is network-reachable with no privileges required (PR:N), but real exposure hinges on a non-default deployment pattern: applications that compile attacker-controlled or otherwise untrusted template source, while deployments rendering only developer-authored templates are not exposed. There is no CISA KEV listing, no confirmed public exploit, and a low EPSS score (0.37%, 31st percentile) at time of analysis, which is why the priority label is monitor rather than act-now.
Account impersonation in pow-auth Assent's Sign in with Apple strategy (versions 0.1.25 through 0.3.1) allows an unauthenticated remote attacker to override verified ID token claims with a client-controlled callback parameter. An attacker who completes a genuine Sign in with Apple login using their own Apple ID can edit the `user` form parameter so that `sub`, `email`, and other claims are replaced; applications that use those values for account lookup, linking, verification, or access control then act on the attacker's identity. No public exploit code was identified at time of analysis, and a vendor patch is available in version 0.3.2.
Privilege escalation in Kargo versions from 0.6.0 before 1.8.14, 1.9.9, and 1.10.8 lets an authenticated user with a delegated Project RBAC-management permission confer rights beyond their own, potentially reaching Project-administrator access and exposing Project Secrets and external Git, container-registry, or Helm-registry credentials. Exploitation requires an administrator-created custom role that permits editing Project Roles or ServiceAccounts plus control of an account assigned that role; default non-administrator roles do not grant the needed permissions, and escalation is bounded to that Project. Vendor fixes are available in 1.8.14, 1.9.9, and 1.10.8; no public exploit identified at time of analysis.
Cross-origin request forgery in WIT SynApps Runtime through 1.4.11 allows an attacker who can influence the target address supplied during controller onboarding to make a victim's browser issue discovery requests to attacker-chosen hosts at paths such as /easy/GUI/Skins/Default/SiteLogo and /easy/GUI/Skins/Default/Identity. No authentication is required on the SynApps side (CVSS 4.0 PR:N), but exploitation needs a victim to be actively running the onboarding/discovery workflow and to accept a supplied address (UI:P). The real risk is boundary crossing: the victim's browser can reach loopback addresses, local hostnames, or internal-only REDY instances across IT/OT segmentation, though the vulnerable SynApps system itself is not directly compromised and the impact lands on the systems that are probed or enrolled - this_month priority, and a public PoC reference exists; it is not verified as working exploit code.
Unauthenticated SQL injection in the WordPress plugin Transliterator (Serbian Transliteration) at version 2.5.13 and earlier lets a remote attacker reach the plugin's database query path with no credentials, no user interaction and no special configuration, per the assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector. The only prerequisite identified is that the plugin be installed and active at a vulnerable version on the target WordPress site; the specific vulnerable parameter and endpoint are not described in the available sources. Patchstack rates the flaw 9.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L) while our independent assessment scores it CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N - high confidentiality impact with limited integrity impact and no availability impact; no public exploit code or CISA KEV entry was identified at time of analysis, and the vulnerability carries an act_now priority label.
Unauthenticated remote code execution in InternLM LMDeploy versions 0.9.0 through 0.18.0 lets remote attackers run arbitrary OS commands as the api_server process by POSTing a base64-encoded crafted pickle in the serialized_named_tensors field of the /update_weights endpoint, which is passed to ForkingPickler.loads without validation. Exploitation requires only network reachability to a management endpoint that these versions expose and deserialize by default with no authentication (CVSS 4.0 vector confirms PR:N/UI:N). Severity is rated 9.3 and the vuln.today decision label is act_now; no public exploit code has been identified at time of analysis, but the attack surface is a plain, unauthenticated HTTP body.
Unauthenticated disclosure of cloud credentials and audit data in SOCFortress CoPilot stems from the `/scoutsuite-report` StaticFiles mount, which bypasses the JWT protection applied to every `/api/...` route. During an admin- or analyst-initiated GCP scan, the platform writes the uploaded Google service-account JSON key into that web-served directory and deletes it only after the scan finishes, so any remote client that can reach the host can fetch the live private key at a predictable path for the scan duration; retained ScoutSuite HTML and `scoutsuite_results_<name>.js` files are likewise readable and expose AWS, Azure and GCP IAM principals, resource inventories, misconfigurations and findings. No authentication, user interaction or special capability is required (CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:C, score 9.3), and the advisory ships a reproduction confirmed against the published `ghcr.io/socfortress/copilot-backend:latest` image; realistic exposure is bounded by the need for an active scan window (key theft) or a retained report (posture disclosure). SOCFortress released credential isolation in v0.1.77, but a release fully remediating the report-disclosure component has not been established.
Authentication bypass in MuseBot releases before 2.0.0 lets remote unauthenticated attackers forge an administrative session by signing a MuseBot-session cookie with the hard-coded default session_key 'muse_bot_session_key', which ships as the built-in default of the -session_key flag. Any deployment whose admin HTTP interface is network-reachable and which never overrode that default is fully compromised: the forged cookie carries an attacker-chosen user_id and yields administrative access to password hashes, chat records and bot configuration, and allows bots to be stopped. The vendor has released 2.0.0, which auto-generates and persists a random key and actively rejects the legacy default; no CISA KEV entry or public exploit code is confirmed at time of analysis, though a public technical writeup of the bypass exists, so exposure of admin endpoints should be treated as urgent.
OpenDeepWiki through 2.0.6 signs HS256 JWT bearer tokens with a hard-coded signing key that is published in src/OpenDeepWiki/appsettings.json and shipped as the default JWT_SECRET_KEY in the project's compose.yaml, compose.pgsql.yaml, Sealos template and publish.bat, so anyone who knows that public string can mint an Administrator token and drive the /api/admin API - creating or modifying users, roles, repositories, global settings and API keys. Exploitation is remote and unauthenticated (CVSS:4.0 9.3, vector PR:N/UI:N) and requires no action from a victim; the sole precondition is that the instance was left running with the shipped default key, meaning out-of-the-box and default Docker Compose deployments are fully compromised while installations that supplied their own strong JWT_SECRET_KEY are not. The issue is rated act_now and fixed upstream in commit 1bf0f4b5ef8d972ca640e5df145b5813a9492544; no CISA KEV entry exists and no verified working exploit code is known, although a public technical writeup demonstrating the administrator-token forgery technique is referenced.
pgAdmin 4 server mode can be forced into unlimited password guessing against internal accounts, including the administrator's, because the three-attempt lockout is not applied consistently across every login path. The bypass is reachable by unauthenticated remote attackers (CVSS v4.0 score 9.2, PR:N) but still depends on guessing a valid password for an existing internal account; the independent assessment rates it CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H and assigns an act_now priority. No public exploit identified at time of analysis.
SQL injection in CakePHP 5.4.3 and earlier allows an attacker who can influence a collation name passed to the StringExpression or IdentifierExpression constructor (or setCollation()) to append arbitrary SQL after the unquoted COLLATE clause, with the injected statement executing under the privileges of the application's database connection on every bundled driver. Exploitation is gated by a real precondition: application code must specifically route attacker-controlled data into a collation argument, which is why the assessed vector carries high attack complexity despite requiring no authentication (PR:N) and no user interaction. Vendor fix commits and PR 19726 are available, no exact patched release number is stated in the advisory, and no public exploit was identified at time of analysis.
SQL injection in CakePHP through 5.4.3 allows an attacker who can influence window-function query parameters to inject SQL that executes with the database connection's privileges, giving full confidentiality, integrity and availability impact and a CVSS 4.0 base score of 9.2. The exposure is conditional: only applications that forward unvalidated user input into a window OVER clause - the frame offsets and directions of WindowExpression::range() and frame(), or the related partition, orderBy and function-name strings - are reachable, so a stock CakePHP deployment without that coding pattern is not exploitable. Attacker authentication at the framework level is not required and no user interaction is needed, vendor fix commits and PR 19735 are available, no confirmed public exploit code is identified in the reporting, and the priority guidance is act_now.
Unauthenticated SQL injection in ThingLinks (mqttsnet) versions prior to 1.4.0 lets remote attackers tamper with TDengine time-series data through the TDS module's /anyUser/tds/insertTableData endpoint, inserting unintended rows or overwriting existing readings. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:N/I:H/A:H, 9.1) reflects an unauthenticated, no-interaction attack whose impact is data integrity and availability rather than disclosure of other data. No public exploit code or CISA KEV entry was identified at the time of analysis, but vuln.today's priority decision is act_now, so exposure of the TDS insert surface should be treated as urgent for affected deployments; the primary caveat is scope, since exploitation requires the thinglinks-tds module to be deployed with a TDengine backend and reachable over the network.
Authenticated server-side request forgery in PinePods before 0.9.0 allows a low-privilege user, where self-service signup is supported, to make the server issue GET/HEAD requests to loopback, private-network, and cloud metadata endpoints by subscribing to an attacker-controlled RSS feed. The enclosure URL is stored without host/IP validation and later fetched by reqwest with default redirect following, and downloaded responses are saved and recorded, enabling internal-service enumeration, confidential-data disclosure, and possible metadata credential theft. The GitHub advisory includes a reproducible end-to-end proof-of-concept against a default Docker deployment; the issue is fixed in 0.9.0, the vuln.today decision label is act_now, and no CISA KEV entry or EPSS score is provided in the supplied intelligence.
Hostname verification in the Erlang library ssl_verify_fun (versions 1.0.1 through 1.1.7) mishandles partial-label wildcard certificate identifiers, letting a certificate such as f*.example.net be accepted for f.evil.example.net. A man-in-the-middle holding such a certificate from a CA the victim trusts could impersonate the peer, but only where ssl_verify_fun is the sole hostname check - clients with server_name_indication disabled, TLS servers using it to check client certificates, direct callers of verify_cert_hostname/2, or Erlang/OTP older than 20.0, since OTP 20.0+ with SNI set rejects the mismatch in ssl first. Fixed in 1.1.8; no public exploit identified at time of analysis, though a detailed proof-of-concept procedure is published in the advisory.
Reflected cross-site scripting in WIT SynApps Runtime through 1.4.11 allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser when the victim opens a crafted URL carrying a malicious LINK query parameter to /System/Session-1. User interaction is required (UI:A), the payload is reflected and non-persistent, and impact includes credential harvesting, login-flow manipulation, same-origin requests, and-in Cloud RIA deployments-an origin-switch primitive against the internal controller. No CISA KEV entry confirms active exploitation; a public PoC reference exists but is not verified as working exploit code, and the decision label is this_month.
Remote code execution in the WordPress Widget Options plugin through version 4.2.5 allows authenticated attackers to inject and execute code on vulnerable sites, with the supplied CVSS vector indicating high privileges while the advisory title indicates an Author-level account may suffice. The flaw is network-reachable, low-complexity, requires no user interaction, and is scope-changing with high confidentiality, integrity, and availability impact. No public exploit code or CISA KEV entry was identified in the supplied data; the vuln.today decision label is act_now, so prioritize confirming the exact required role and applying a fix or removing the plugin.
FTPS data connections on vsftpd through 3.0.5 can be hijacked by a second client that resumes its own TLS session ticket against the victim's passive-mode data port, allowing theft of downloaded files or injection of content into uploads. The attacker must not be authenticated and must originate from the same source IP as the victim (shared NAT, VPN/proxy egress, or multi-tenant host) and win a timing race for the PASV connection, which is why the assessed CVSS 3.1 vector is AV:N/AC:H/PR:N/UI:N with confidentiality and integrity impact but no availability impact. No confirmed working exploit code or CISA KEV entry is present in the available data, although the researcher's technical writeup is referenced, and vuln.today assigns an act_now decision label for any environment running FTPS on vsftpd ≤3.0.5.
Authenticated Flowise users can escape the vm2/@flowiseai/nodevm sandbox and execute OS commands as the Flowise process user when the instance runs with ALLOW_BUILTIN_DEP=true. The technique abuses allowlisted langchain and mammoth modules: JavaScript submitted to /api/v1/node-custom-function writes an attacker-controlled file into the mammoth package via LocalFileStore and then requires it, executing outside the sandbox; the CVSS 4.0 score is 9.0 and the vuln.today decision label is act_now, reflecting host-level confidentiality, integrity and availability impact, heightened where Flowise runs as root in the official Docker image. No CISA KEV entry or public exploit code was identified in the provided data, and exploitation requires both an authenticated account and the non-default ALLOW_BUILTIN_DEP=true setting.
JetBrains Toolbox App and IntelliJ IDEA expose a certificate-validation weakness in the jetbrainsd daemon that can let an unauthenticated, network-positioned attacker with a forged certificate chaining to compromised eMudhra intermediate CAs impersonate trusted endpoints and read or modify traffic. Affected versions are Toolbox App before 3.9.1 and 3.8.2 and IntelliJ IDEA before 2026.3 and 2026.2.4; exploitation requires both such a certificate and a man-in-the-middle position, so attack complexity is high even though no authentication or user interaction is needed. No public exploit code has been identified at time of analysis, but the 9.0 severity and vendor-reported root cause make prompt patching the priority.