Denial of service in the ag-ui TypeScript client SDK (versions up to and including 0.0.58) allows a party that controls the interrupt/event producer to permanently wedge a conversation thread by emitting one or more Interrupt objects that omit the expiresAt field. isInterruptExpired treats a missing expiresAt as 'never expires', and the client's resume-coverage check requires every pending interrupt to be addressed before the thread can run again, so the thread stays blocked; before the fix there was also no cap on how many pending interrupts were tracked per thread. No public exploit code has been confirmed (a public PoC reference exists; it is not verified as working exploit code), CVE is not in CISA KEV, and impact is availability-only with no data exposure or modification.
Denial of service in the ag-ui TypeScript client SDK (versions up to 0.0.58) where the SSE/protobuf stream parser fails to cap buffered data, so a malicious or compromised AG-UI server can force excessive memory consumption in the consuming client. Exploitation requires control over the data delivered into the event stream and a low-privileged stream connection (CVSS PR:L), confining impact to low availability loss with no confidentiality or integrity effect; a public PoC reference exists but is not verified as working exploit code, and no active exploitation has been reported. Priority signals consistently place this as a low-severity, monitor-level issue.
Resource exhaustion in the ag-ui Protocol TypeScript client SDK (versions up to and including 0.0.58) allows a hostile or compromised HTTP endpoint to force the client process to buffer an unbounded error-response body, degrading availability of that client. The flaw sits in the HTTP Transport error path of runHttpRequest, which read non-success response bodies in full with no size limit, so an attacker who controls, has compromised, or can man-in-the-middle the server the client talks to can return an oversized or never-ending body on a non-2xx status and exhaust process memory. Impact is availability-only for the initiating client - no data disclosure or modification - and a public PoC reference exists (GitHub issue 2521); it is not verified as working exploit code. An upstream fix is proposed in pull request 2698 but is not yet merged or released, and the current assessment rates this as a medium-severity, availability-only issue rather than a top-priority emergency.
Improper input validation in the AG-UI protocol SDK transport decoder path affects ag-ui versions up to and including 0.0.58, allowing crafted event content to be parsed without proper text handling and producing limited confidentiality, integrity and availability impact. The attack is remote and requires low-level privileges (PR:L with no user interaction), meaning the attacker must be an authorized participant able to submit events over an AG-UI transport rather than an anonymous internet user. A public PoC reference exists (GitHub issue 2524) but it is not verified as working exploit code, and the vendor fix is available in 0.0.59 via commit 660182b973a44b8eda5484b14b88eb9cc251edc4.
Cross-site scripting in the PostyBirb Plus submission description editor affects versions through 3.1.75. Crafted description markup loaded through the editor's defaultValue or overwriteDescriptionValue paths can execute in the Electron renderer, but exploitation requires an authenticated local user of the desktop app and user interaction, and impact is limited to integrity with no confidentiality or availability loss. Version 3.1.76 fixes the issue by sanitizing those loaded values; a public PoC reference exists, but it is not verified as working exploit code.
Cross-site scripting in the Cloud Management web interface of Ruijie RG-ES series switches (RG-ES205GC, RG-ES206GC-P, RG-ES208GC, RG-ES210GC-LP and RG-ES210GS-P running firmware ESW_1.0(1)B1P48) lets an administrator who already holds high-privilege access inject script through the 'url' argument of set_cloud_serverUrl.cgi, with the payload running in a victim's browser only after that victim interacts with the resulting page. Scoring reflects that constraint: CVSS 4.0 rates it 1.9 with PR:H and UI:P, and the independent assessment lands on CVSS 3.1 AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:L/A:N, meaning the realistic ceiling is limited integrity impact on page content rather than credential theft or device takeover. A public PoC reference exists in a GitHub repository, but it is not verified as working exploit code; there is no KEV listing and the current decision label is monitor.
Predictable session-ID generation in Oray Pugongying X5 Pro up to 7.6.1 lets an authenticated ordinary user recover another user's password by manipulating the _user argument in the session_get function of session.lua. The published CVSS 4.0 score is 1.3, and the independent assessment uses CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N: remote reachable, high complexity, and limited to confidentiality with no integrity or availability impact. A public PoC reference exists but is not verified as working exploit code, no CISA KEV status is reported, and the issue is low priority despite remote reachability because an existing low-privilege account is required.
Pages rendered by Apache Wicket 10.10.0, 10.11.0 and 9.24.0 can be served without any Content-Security-Policy header when the page's render request handler is wrapped in more than one IRequestHandlerDelegate, because the framework unwraps only a single delegate level when deciding whether a request renders a page; with a deeper chain - for example an application-provided delegating request mapper combined with CryptoMapper - CSP is silently skipped with no error or warning, and the nonce-based protection for inline scripts and styles plus any other configured directives are lost for those pages. Only applications that wrap request handlers themselves in a non-default deployment are exposed; stock Wicket applications are not affected, and because the defect removes a protective control rather than providing an injection primitive, actual content injection additionally requires a separate injection vector on such a page and a victim rendering it (passive user interaction). This is a low-severity, configuration-dependent regression - versions before 10.10.0 and 9.24.0 handled nested delegates correctly - and no public exploit has been identified at time of analysis, with CISA KEV status absent and the vulnerability not listed as actively exploited.
Apache Wicket's native WebSocket support keeps serving a session after the servlet container has ended it: because each connection resolves its Wicket session from a copy taken at handshake time, an authenticated user holding an open socket continues to be treated as signed in - with the original session attributes and, in wicket-auth-roles applications, the signed-in state - for as long as the connection stays open. Affected are Wicket 8.0.0 through 8.19.0, 9.0.0 through 9.24.0 and 10.0.0 through 10.11.0 (older unsupported 6.x releases from 6.0.0 are also affected), but only where an application uses native WebSocket pages or WebSocketResource endpoints that require an authenticated session and terminates sessions through the container (idle timeout, filter or security-framework HttpSession#invalidate(), container-managed logout, or session replacement) rather than through Wicket. Severity is low (CVSS 4.0 base score 2.3; assessed CVSS 3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N) since the attacker must already hold such an authenticated connection, and no public exploit has been identified at time of analysis.
Missing authorization in Apache Wicket's native WebSocket support lets a client's text and binary messages reach a WebSocketBehavior's onMessage() callbacks even when the component that behavior is attached to is hidden, disabled, or denied by the application's IAuthorizationStrategy. Only applications that override onMessage() on a WebSocketBehavior attached to (or beneath) such a restricted component are affected, and an attacker must hold their own valid session and open their own page containing that component, since messages are delivered only within the client's own page store and never to another user's session or connection. Affected releases are 8.0.0 through 8.19.0, 9.0.0 through 9.24.0 and 10.0.0 through 10.11.0 (with older unsupported 6.x-and-later releases also affected); no public exploit code has been identified at time of analysis, the issue is not in CISA KEV, and priority signals point to monitoring rather than urgent action.
Catastrophic backtracking in loguru's ANSI color-markup parser (AnsiParser.feed in loguru/_colorizer.py, with the CPE covering 0.7.3 and, as a wildcard range, other versions) lets an attacker who can get crafted text into a colorized log message exhaust CPU and degrade availability. Reachability is integration-specific: only host applications that route attacker-controlled strings through the colorization/markup path with markup enabled are exposed, which is why our assessed vector rates attack complexity High with Availability-only impact. There is no CISA KEV entry; the disclosure states the exploit is now public, but that has not been verified as working exploit code, and the vendor did not respond to the report, so no fixed version is identified at time of analysis.
Schema validation bypass in the lud jsv JSON Schema validator (versions 0.1.0 through 0.26.1) lets an unauthenticated remote attacker slip input past `pattern`, `patternProperties`, `propertyNames` and `not` constraints. The root cause is that jsv's backtracking-limited regex helper runs :re.run/3 without :report_errors, so a PCRE match_limit exhaustion is returned as :nomatch and treated as a genuine non-match - a failed `pattern` under `not`, `anyOf`, `oneOf`, `if` or `contains` can therefore make the parent schema succeed, and a skipped `patternProperties` subschema leaves the value checked against `additionalProperties` or not at all. Exploitation is conditional: the deployed schema must already contain a regex with nested quantifiers or overlapping alternatives that forces backtracking before the matching branch, which is why the assessed vector is network-reachable but high-complexity with only low integrity impact (CVSS 3.1 AV:N/AC:H/PR:N/UI:N/C:N/I:L/A:N; vendor CVSS 4.0 base 2.1); the vendor advisory publishes a proof-of-concept walkthrough, but it is not verified as working exploit code and there is no evidence of active exploitation (not in CISA KEV), with the overall priority rated monitor.
Incorrect ordering of security checks in Apache Wicket 9.1.0 through 9.24.0 and 10.0.0 through 10.11.0 allows a cross-origin request to bypass the opt-in ResourceIsolationRequestCycleListener when an application refuses unauthenticated visitors with RestartResponseAtInterceptPageException and later calls continueToOriginalDestination(), so a victim who follows an attacker-supplied top-level navigation and then signs in resumes a form whose query-string field values were chosen by another origin. Impact is confined to integrity of form values read from the query string on the resumed GET; request-body parameters stored with the intercepted URL are not replayed, already-authenticated visitors are unaffected, and user interaction is required. The vulnerability is assessed as low severity (CVSS 3.1 base 2.1-equivalent integrity-only impact) and no public exploit identified at time of analysis.
Stored cross-site scripting in the Typemill flat-file CMS through 2.26.0 allows an authenticated user with media/image upload rights to upload a crafted SVG that executes script in a victim's browser when the file is later opened or rendered. The sanitizer in system/typemill/Models/SvgSanitizer.php accepted SVG files carrying a DOCTYPE (DTD) declaration and left XML processing instructions and comments in place, which per the patch can trigger XSLT transformations in browsers. A public exploit reference has been published and may be used, but this is a moderate, not emergency, priority requiring login, upload permission and a second user viewing the file; upgrading to 2.27.0 resolves it.
Local buffer overflow in Hangzhou Xiongmai Technology's P2P SDK affects P2PAPI.dll 1.3.3.32 on Windows, where a crafted 'input' string passed to P2PAPI_Connect overflows a buffer. Per the independent assessment, exploitation requires local access and low-level privileges (AV:L/PR:L) and is confined to availability impact (VA:L, no confidentiality or integrity loss), scoring 1.9 - a genuinely low-priority, monitor-level issue. The vendor was contacted and did not respond, and the public disclosure includes a linked GitHub gist reference that has not been verified as working exploit code; no CISA KEV entry or other confirmed active exploitation signal is present.