2026-11-03
Symlink following in Docker Sandboxes' `sbx cp` command allows a malicious sandbox to redirect a user-initiated copy outside the shared workspace, pulling host files into the sandbox or pushing sandbox-controlled content onto host paths with the invoking user's permissions. All releases prior to v0.51.0 are affected (CPE `docker:docker_sandboxes:*`), and exploitation is conditional: an attacker must already be running code inside a sandbox that shares a workspace with the host, plant a symlink there, and wait for the user to run `sbx cp` (UI:R, PR:N, AV:L). Impact is high for confidentiality and integrity but bounded by the invoking user's own filesystem permissions; there is no public exploit identified at time of analysis and no CISA KEV entry, and v0.51.0 strengthens workspace-copy and credential protections per the vendor release notes.
Arbitrary command execution in nnn through 5.3 (CVSS 8.4 High) occurs when the togglex plugin processes selected filenames containing a double quote and shell syntax, allowing an unauthenticated local attacker who can plant such a filename to run commands as the user invoking togglex. The victim must actively run togglex on a selection that includes the malicious file; simply opening the directory is not enough, and there is no remote or unauthenticated network path. No public exploit was identified at time of analysis, and an upstream fix commit is referenced (released patched version not independently confirmed).
bbs-go through 4.4.6 disables TLS certificate verification when sending SMTP email, so a network-positioned attacker who can intercept the connection between the bbs-go server and its configured mail server can present any certificate and be trusted. Interception exposes SMTP PLAIN authentication credentials and lets the attacker read or tamper with outgoing password-reset and account-verification messages. The flaw requires an active man-in-the-middle position plus a bbs-go deployment that sends mail over a TLS/STARTTLS SMTP connection; no authentication or user interaction against bbs-go itself is needed once that position exists, and no public exploit code was identified at the time of analysis.
Nodemailer 3.0.0 through 10.1.3 misparses angle-addresses in its addressparser, letting a crafted recipient value such as `<"a@evil.com>"@good.com>` validate as an allowed domain but be delivered to an attacker-chosen domain. The flaw crosses the application's recipient allow-list boundary, disclosing whatever message content the application sends, and also affects standalone parser consumers such as mailparser. Exploitation additionally requires an application that both passes attacker-influenced address text to Nodemailer and enforces a domain allow list validated with a conformant parser; no application access or user interaction is needed, and a public proof-of-concept reference exists but is not verified as working exploit code. No public exploit has been identified at time of analysis, EPSS is unavailable in the provided data, and the reported severity is 8.3 (CVSS 4.0).
Nodemailer 3.0.0 through 10.1.3 contains a recipient-injection flaw in its bundled addressparser: a semicolon inside a quoted display name or comment inside an RFC 5322 group terminates the group early, so text a conformant parser treats as display text is re-parsed as a live recipient address. An application that validates user-supplied recipient lists with a conformant parser and then hands the same text to Nodemailer can be made to deliver mail to an attacker-chosen address outside its allow list - for example `G: (a; <evil@evil.com>) <v@victim.com>;` is approved as v@victim.com but resolved by Nodemailer to evil@evil.com, disclosing message content and suppressing delivery to the intended recipient. The vendor fixed this in 10.1.4; a public proof-of-concept reference is documented in the GitHub advisory, and no confirmed active exploitation or public working exploit code was identified at time of analysis.
Nodemailer's addressparser (versions 3.0.0 through 10.1.3) terminates a nested RFC 5322 comment at the first closing parenthesis instead of the one that closes the outermost comment, so a value such as `Victim (x(y) <evil@evil.com>) <v@victim.com>` - which conformant parsers read as the address v@victim.com - is parsed by Nodemailer as evil@evil.com. Unauthenticated remote attackers who can influence address text handed to sendMail, or the From/To header of an inbound message parsed with mailparser, can therefore redirect mail intended for an approved recipient to an attacker-chosen domain or make a mailparser-based layer disagree with a conformant DMARC/display check about the author of the same message, crossing recipient allow-list and sender/author boundaries. The vendor advisory publishes a PoC reference (a code snippet demonstrating the mis-parse); it is not verified as working exploit code, no active exploitation is confirmed, and the practical impact is bounded to deployments that actually enforce conformant validation plus an allow list or author check. Fixed in 10.1.4.
Response mispairing in the MongoDB Node.js driver can return one request's database reply to a different request, potentially disclosing other users' records and producing incorrect results or failed legitimate requests when an application enables the optional client-side operation timeout. An unauthenticated remote party able to send ordinary requests through such an application can trigger the condition, but exploitation is opportunistic and timing-dependent because an earlier operation must time out and leave data outstanding on a pooled connection. No public exploit or active exploitation is identified in the available data, and the decision label is this_week rather than emergency.
DLL hijacking in SolarWinds Dameware installers lets a local attacker who can write a malicious DLL into a location searched by setup execute code in the installer's context when a victim runs the installation. The issue is limited to installation time and is not exploitable against an already-installed or running Dameware instance; the CVSS 8.2 score reflects high confidentiality, integrity, and availability impact plus a scope change, not remote reachability. The vector requires local access and user action to launch the installer, and the description additionally cites admin privileges; no public exploit was identified at time of analysis.
WPPConnect Server through 2.10.74 allows unauthenticated remote attackers to send arbitrary WhatsApp text or file messages from a connected session by POSTing crafted Chatwoot webhook payloads to /api/:session/chatwoot, a route registered without the verifyToken middleware. Exploitation is constrained: the endpoint must be reachable and the attacker must know or guess a session name whose client is in CONNECTED status; random or secret session names reduce risk, while default or disclosed names make abuse straightforward. No public exploit was identified at time of analysis, and the vendor references an upstream fix in PR #2702.
cordova-plugin-advanced-http 1.5.0 through 3.3.1 on native iOS and Android can leak cookies to a third-party host when a request to an origin with stored cookies is redirected and the plugin's native HTTP stack follows the redirect. The JavaScript layer builds Cookie headers from the plugin cookie jar and passes them as ordinary request headers, so an open or attacker-influenced redirect can forward them across origins; the upstream fix tests also show Authorization and Proxy-Authorization being dropped on cross-origin hops. No public exploit identified at time of analysis; unauthenticated attackers need the app to hold cookies for the original origin and to follow a redirect to an attacker-influenced host.
CPU exhaustion in enshrined/svg-sanitize 1.0.0 occurs when removeRemoteReferences(true) is enabled: crafted SVG CSS containing many unclosed -webkit-image-set( tokens drives super-linear regex matching in stripRemoteCssTokens(), holding a PHP worker for tens of seconds. If PCRE hits its backtrack or JIT limits, preg_replace() returns null and sanitize() throws a TypeError instead of failing closed, so an application that stores the upload before sanitizing in place may retain unsanitized content. The vendor advisory includes a proof-of-concept harness; no CISA KEV entry is indicated, and impact is availability-focused with conditional integrity exposure.
Denial of service in Parse Server (npm package parse-server) lets a remote client terminate the Node.js process by sending an object update whose dot-notation key targets the object identifier of a pointer field on a class that has an afterSave trigger registered. All clients lose service until the server is restarted. The request is unauthenticated (CVSS PR:N) only when the targeted object is writable without a session; otherwise the attacker needs whatever write access the object's ACL/CLP grants, and classes without an afterSave trigger or without pointer fields complete the identical request normally, which bounds the set of exposed deployments. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; the vendor has released fixes in 8.6.110 and 9.10.6-alpha.2.
FreeRDP clients and freerdp-proxy instances running releases before 3.32.2 can be aborted by an oversized X.224 routing token, which drives the one-byte X.224 length indicator past UINT8_MAX and trips a reachable assertion in tpdu_write_header; with the default eight-byte RDP_NEG_REQ the threshold is a 240-byte token (a 239-byte control does not abort). Impact is availability only and limited to assertion-enabled builds, and the two routes differ in prerequisites: the direct-client path needs the client to connect to a malicious or compromised RDP server that returns a Server Redirection PDU carrying an oversized LoadBalanceInfo which is then reused as a routing token on reconnect, while the proxy path needs freerdp-proxy configured with FixedTarget=true (false by default) and a front peer that negotiates RDP security without RDP_NEG_REQ. This CVE is not in CISA KEV, and the advisory ships a public reproduction harness that is a PoC reference, not verified working exploit code.
Denial of service in FreeRDP before 3.32.2 affects freerdp-proxy deployments that use the dyn-channel-dump module: a malicious or compromised backend RDP target can send dynamic channel data while the front client is disconnecting, triggering a cross-thread use-after-free that crashes the proxy process. The issue is availability-only, with no confidentiality or integrity impact and no indication of code execution, and the timing-dependent race is reflected in the high attack complexity and attack-requirements-present metrics. No CISA KEV entry or public exploit was identified at time of analysis.
Unauthenticated remote attackers can obtain a logged-in WordPress administrator session on sites running the Easy Digital Downloads plugin up to and including 3.7.2 by entering an administrator's email address into a PayPal guest checkout and completing the payment flow, resulting in full account takeover. The plugin trusts the guest-supplied email as proof of identity, rebinds the resulting order to the matching WordPress user, and the PayPal capture handler then issues an authenticated session cookie for that user via wp_set_auth_cookie(). The assessed vector is AV:N/AC:H/PR:N/UI:N, so no authentication or victim interaction is needed, but exploitation requires the EDD PayPal gateway to be configured and usable and the targeted administrator to have no existing EDD customer record; no public exploit was identified at time of analysis.
Authenticated users holding a FluentCart custom-level role or higher can delete arbitrary files on a WordPress server running the FluentCart eCommerce plugin through version 1.6.2, because the plugin's deleteFile routine in LocalDriver.php does not properly validate the supplied file path. The flaw is reachable over the network through the plugin's file-upload controller and its REST route, requires no user interaction, and carries high integrity and availability impact; deleting a critical file such as wp-config.php can force a WordPress reinstall flow or knock the site offline, which the advisory cites as the realistic path toward code execution. The primary limiting factor is that the attacker must already hold a qualifying FluentCart account, so anonymous visitors cannot exploit it. No public exploit code or CISA KEV entry is associated with this issue at time of analysis, and it is assessed as a genuine, prioritizable problem that should be handled in this week's maintenance cycle rather than an emergency.
Unauthenticated account takeover affects WordPress sites running the SureCart plugin through version 4.9.5, where the passwordless one-time-code login REST route resolves an attacker-supplied login to any WordPress user - including administrators - and issues a valid authenticated session cookie once a six-digit code is guessed. No authentication or user interaction is required (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, 8.1), but exploitation depends on knowing or enumerating a target login and sustaining enough request volume to brute-force a roughly one-million-value code space, since the affected code path has no per-account attempt counter and no persistent email/IP lockout, and the upstream CDN throttle is reported to be bypassable through IP rotation. This is assessed as a credible, high-priority issue rather than a CVSS-inflated one, though the practical bar is non-trivial; no public exploit code and no confirmed active exploitation were identified in the available data at time of analysis.
SAML authentication bypass in ManageEngine Key Manager Plus before 7151 allows remote attackers to log in with a SAML assertion that the identity provider issued for a different service provider, because the product does not verify that the assertion's audience and recipient are Key Manager Plus itself. Exploitation requires SAML single sign-on to be enabled and a shared or trusted identity provider relationship with at least one other service provider, and the attacker must first obtain a genuine assertion issued to that other SP, which is reflected in the high attack complexity. No public exploit was identified at time of analysis and there is no confirmed active exploitation; the vendor fix is version 7151 or later, and the priority is scheduled remediation this week rather than emergency response.
ManageEngine Log360 and EventLog Analyzer builds 13071 and below allow an unauthenticated, network-reachable actor to register a local collector by sending a specially crafted registration request, bypassing authentication on that interface. The issue is rated CVSS 7.5 with confidentiality-only impact (C:H/I:N/A:N) and maps to CWE-284 improper access control. No public exploit was identified at time of analysis.
Offline recovery of the CFNext admin password allows anyone holding a valid subscription link to take over the admin panel and read stored Trojan, Clash, Telegram and Cloudflare API secrets in all versions before 3.1.0. The subscription UUID is an MD5 hash of the admin password combined with a fixed, publicly known salt, so the UUID functions as an offline password verifier that can be attacked with unlimited guesses because no rate limiting applies. Exploitation is constrained: the attacker must first obtain a subscription link, and the brute-force only succeeds against an admin password weak enough to crack; no public exploit code was identified at time of analysis, and a vendor fix exists in CFNext 3.1.0 (commit ca8ad82).
Two-factor authentication bypass in ManageEngine Key Manager Plus builds before 7150 lets an attacker who already possesses valid account credentials finish the login flow without entering a verification code. The vendor rates the issue CVSS 7.4, but our independent assessment treats it as a moderate-priority authenticated problem: exploitation requires prior credential compromise and an account or instance with 2FA enabled, so it erodes defense-in-depth rather than enabling unauthenticated access. No public exploit code has been identified at time of analysis, and the vendor advisory documents the fixed build.
An authenticated account holder can bind a TOTP authenticator secret they control onto another user's account in AshAuthentication 5.0.0-rc.0 through 5.0.0-rc.15, then sign in as that user (when sign_in_enabled? is true) or quietly hold their second factor. The exposure is conditional rather than universal: it requires the application to expose the TOTP setup or confirm_setup action on a record the caller names - for example through AshJsonApi, AshGraphql, or a custom controller that passes a looked-up user into AshAuthentication.Strategy.Totp.Actions.confirm_setup/3 - and requires the attacker to be able to read the victim's user record, whereas the built-in AshAuthentication and AshAuthenticationPhoenix routes always operate on the signed-in user and are not affected. Fixed in 5.0.0-rc.16; no public exploit code identified at time of analysis, and only pre-release builds are in scope.
Denial of service in Elasticsearch lets an unauthenticated, network-positioned attacker terminate a node by sending a crafted request containing deeply nested serialized data to the remote cluster/server interface; repeating the request against each reachable node can take down multiple nodes. The issue is uncontrolled recursion (CWE-674), is rated CVSS 7.5 with high availability impact, and is fixed in Elasticsearch 8.19.24, 9.4.9, and 9.5.6 according to the vendor advisory. No public exploit code has been identified at time of analysis, and exposure depends on whether node interfaces are reachable from untrusted networks.
Heap exhaustion in the vertx-stomp module (Eclipse Vert.x) allows any connected peer to crash the affected JVM process, causing a complete denial of service; versions 4.0.0 through 4.5.35 and 5.0.0 through 5.2.2 are affected. Because FrameParser builds its RecordParser without a maxRecordSize limit, a peer that streams bytes without ever sending a newline makes the parser buffer indefinitely until JVM heap is exhausted. Both roles are exposed: a malicious STOMP client can attack a server before or after authentication, and a malicious STOMP server can attack a client that connects to it. No public exploit code was identified at time of analysis, but the flaw is remotely reachable without authentication or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5 High) and vendor fixes exist in 4.5.36 and 5.2.3.
Eclipse Vert.x Web Client (maven io.vertx:vertx-web-client) versions 4.0.0 through 4.5.35 and 5.0.0 through 5.2.2 can leak one user's HTTP response to another user or to an anonymous caller when a single CachingWebClient is shared across user principals - the documented pattern of a per-user WebClientSession layered over a shared caching client. A user-specific but cacheable response that the origin did not mark private or no-store is written into the client-level shared cache tier under a key with no per-user marker, so a later session-private miss or an anonymous request for the same URL is served the stored body, disclosing authenticated content or, where the response carries Set-Cookie, a session identifier that can support session fixation or hijacking. The disclosed score of 7.5 reflects unauthenticated network access, but practical exposure is conditional: the shared-client deployment pattern and a permissive origin caching policy must both be present, no public exploit code has been identified at time of analysis, and the affected version ranges are bounded by fixed releases 4.5.36 and 5.2.3.
Heap-based buffer overflow in the Space Packet Protocol (SPP) parser of µD3TN v0.15.1 allows an unauthenticated remote attacker to reliably crash the DTN node, a denial-of-service condition rated CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). The off-by-one out-of-bounds write corrupts heap memory and aborts the process; confidentiality, integrity, and code-execution impacts are not confirmed in the available sources. No public exploit was identified at time of analysis, and the CVE is not listed in CISA KEV.
Memory exhaustion through amplified BPv6 EID reference handling in µD3TN can let remote attackers degrade or crash a network-reachable node by sending crafted bundles, requiring no authentication or user interaction. The flaw is a CWE-401 memory leak affecting versions matched by the vendor CPE; the precise malformed EID reference is not described in the available sources, and no fixed version is listed. No public exploit identified at time of analysis and no CISA KEV entry is present, but the vendor work item and this_week priority warrant prompt triage for network-reachable BPv6 deployments.
An unauthenticated remote heap out-of-bounds write in µD3TN's Bundle Protocol version 6 (BPv6) administrative record parser lets a network attacker reliably crash or destabilize a node, with impact limited to availability (A:H, C:N, I:N) per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, 7.5). Affected are µD3TN deployments that actually receive and parse BPv6 administrative records and are reachable by the attacker; BPv7-only configurations fall outside the described parsing path. No public exploit code or confirmed active exploitation is identified in the available sources, and the issue carries a 'this_week' priority rather than an emergency rating.
Unauthenticated arbitrary file deletion in the WordPress plugin Contact Form Extender for Divi Builder (Submissions DB & Extra Fields) affects every version up to and including 1.0.6: the AJAX handler cfefd_remove_uploaded_file() takes an attacker-supplied path without adequate validation (CWE-22), and the nonce meant to guard that action is printed into the public page source by wp_localize_script, so any anonymous visitor viewing a page that renders the file-upload module can obtain it. Successful abuse lets an attacker unlink arbitrary server-side files, and deleting a sensitive file such as wp-config.php can quickly escalate into remote code execution or a full site takeover. No public exploit code or active exploitation is identified at time of analysis, and there is no KEV listing; the Wordfence-reported issue is prioritised as a fix-this-week item, with urgency bounded by the plugin's install footprint and by whether a publicly reachable page emits the nonce. The vendor correction is version 1.0.7.
Elastic Docker images ship an operating-system certificate bundle whose trust anchors lead to eight eMudhra intermediate CAs with compromised private keys, enabling a network-positioned attacker who holds one of those keys to forge a certificate for any hostname these products trust and intercept or modify TLS traffic. The affected Docker builds cover APM Server; Auditbeat, Filebeat, Heartbeat, Metricbeat and Packetbeat; Elastic Agent including Fleet Server and Cloudbeat; Logstash; Elastic connectors; Universal Profiling (host agent, collector and symbolizer); and Elastic Maps Server when TLS validation uses the OS bundle. Exploitation requires a man-in-the-middle position and key possession; no public exploit code was identified at the time of analysis.
Heap out-of-bounds read and write in NTPsec's NTS client extension-field parser (extens_client_recv) affects releases before 1.2.5 and lets a remote attacker who can deliver NTP server-mode replies to a client corrupt heap memory and crash ntpd. When chained with the NTS-KE client out-of-bounds read fixed in 1.2.4, the same flaw can be escalated to bypassing NTS authentication and setting the client's time; the assessed vector (AV:N/AC:H/PR:N/UI:N, high integrity and availability impact, no confidentiality impact) rates attack complexity as high because the attacker needs an on-path or spoofing position to inject server-mode responses. No public exploit code or confirmed active exploitation was identified at time of analysis, and the current priority signal is a this-week, time-bound fix rather than an emergency.
An out-of-bounds heap read in libslirp's icmp_forward_error() causes host memory to be copied into the ICMP error reply that libslirp sends back to a guest VM or container, disclosing adjacent heap contents across the virtualization boundary. Affected deployments are those using libslirp as their network backend - QEMU user-mode ('slirp') networking and rootless Podman's slirp4netns/slirp4netns-style networking - with packaged builds tracked for Red Hat Enterprise Linux 8, 9 and 10 and Red Hat OpenShift Container Platform 4 and 5. The flaw is scored 7.4 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) with confidentiality-only impact; no public exploit identified at time of analysis, and exploitation requires an attacker who already controls a guest or container on the emulated network and can emit traffic that drives libslirp down the ICMP error path.
Use-after-free in Eclipse ThreadX Modules (6.0.1 through 6.5.2.202603) leaves a user-mode module's trace-buffer-full callback registered after the module is stopped and unloaded, so a later wrap of a still-active kernel-owned trace buffer can call into released module code from privileged thread context and compromise kernel confidentiality, integrity and availability. Reaching it is conditional: a local attacker must already execute code inside a loaded user-mode module, the build must enable TX_ENABLE_EVENT_TRACE with trace-buffer-full notification exposed to modules, and the trace wrap must occur after unload but before the freed code allocation is reused or becomes inaccessible - a sequence the module does not fully control. No public exploit identified at time of analysis; the reporter reproduced the post-unload invocation on a user-mode MPU-protected GNU Cortex-M3 module, and the vendor has fixed the issue in 6.5.2.202603b.
Path traversal in Kibana's Fleet feature lets a low-privileged user who holds Fleet agent-policies write access steer a later administrative action onto unintended resources, deleting Kibana spaces and other organizational assets that the attacker could not remove directly. Exploitation needs an authenticated account with that non-default Fleet write grant plus a separate Kibana administrator interacting with the affected Fleet interface (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H, 7.3), and it affects Kibana releases before the fixed 9.4.9 and 9.5.6 versions; no public exploit identified at time of analysis. The vendor's advisory is public, so the flaw is discoverable even though the attacker cannot complete the deletion alone.
ManageEngine Key Manager Plus builds up to and including 7150 allow any authenticated low-privileged user to export X.509 certificates owned by other users into a key vault they have registered themselves, defeating the per-user isolation the product relies on in multi-user deployments. The weakness is an access-control granularity flaw (CWE-1220): the application checks that the requester is a valid user but does not enforce object-level ownership before performing the export, so confidentiality impact is high and the CVSS scope is changed because the exposed certificate material belongs to other principals rather than to the vulnerable component itself. Exploitation requires working credentials and a registered key vault to receive the stolen material, no public exploit was identified at time of analysis, and the priority label is 'this week' rather than an emergency response.
Improper access control in ManageEngine Key Manager Plus builds prior to 7151 lets an authenticated user modify another user's ACME certificate deployment credentials, an integrity-only impact confined to that credential functionality. Exploitation requires a valid Key Manager Plus account (PR:L) on an unpatched build, and no public exploit identified at time of analysis. Our assessment rates the issue moderate: the CVE record's published 7.1 vector (AC:H, C:H, changed scope) is more severe than the assessed integrity-only impact, and the 'this_week' decision label places the upgrade in normal weekly remediation rather than emergency response.
SQL injection in the Advanced Shipment Tracking for WooCommerce plugin (all versions up to and including 3.9) allows an authenticated user with Shop Manager-level access or higher to inject SQL through the tracking_provider parameter of the POST /wp-json/wc-ast/v3/orders/<order_id>/shipment-trackings REST route, letting them append additional queries to an existing statement and read data from the WordPress database. The assessed impact is confidentiality-only (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N); integrity and availability effects are not established by the available evidence, and the practical barrier is the Shop Manager privilege requirement rather than any exotic configuration. No public exploit code has been identified at time of analysis, and there is no KEV or other active-exploitation signal in the supplied intelligence.
Authenticated TYPO3 backend users with mail-module access can view, change, send and export mails and recipient groups outside their assigned web mounts because the extension's backend actions and AJAX routes omit page-level authorization checks, exposing recipient personal data. The issue is rated CVSS 7.1 and affects the TYPO3 "mail" extension; exploitation requires a valid backend account with mail-module permissions, and no public exploit was identified at time of analysis.
Authorization bypass in LogChimp 0.9.0-alpha.1 through 0.9.2 allows authenticated post authors to overwrite other users' post title, slug, content, boardId and roadmap_id by sending a PATCH /api/v1/posts request with mismatched postId and id body parameters. The attacker sets postId to a post they own to pass the ownership check and id to an enumerated victim post UUID, which pre-fix was used as the actual update target; there is no confidentiality impact. The vendor fixed this in v0.9.3, no public exploit was identified at the time of analysis, and the priority is this_week - a genuine but not emergency-grade risk.
Plaintext secret disclosure in Dockhand 1.0.47 through 1.0.53 exposes stored stack secrets and values pulled from external providers (1Password, Bitwarden, HashiCorp Vault, Infisical, Doppler, Psono) to authenticated callers who either hold a Git stack's webhook secret or hold the stacks:start permission. The deployStack() result object carries a resolvedSecrets array, and three Git-stack endpoints - the webhook GET/POST, the manual deploy SSE stream, and create-with-'Deploy now' - return that object unfiltered, so the credentials also get persisted in Git forge delivery histories and printed into CI logs. Finsys fixed the leak in 1.0.54; no public exploit identified at time of analysis, and the 7.1 score reflects high confidentiality impact with no integrity or availability effect (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
SurrealDB builds before 3.3.0 abort the entire surreald process when an authenticated user with ordinary table write and read privileges accumulates a deeply nested val::Value one level per request and then triggers a read. The upstream advisory publishes a SQL proof-of-concept sequence (create a record holding an empty array, repeat UPDATE deep:1 SET v = [v] roughly 10,000+ times, then SELECT it) that drives native recursion past the ~8 MiB thread stack limit; because surrealdb-core is compiled with panic = 'abort', the resulting stack overflow is an unconditional process abort affecting every namespace, database and tenant on the instance. Beyond that advisory PoC sequence no public exploit code was identified at time of analysis, and the attack remains credential-gated and request-intensive; the aggravating factor is persistence, since the poisoned record survives restart and re-crashes every subsequent read and the admin EXPORT until it is purged out-of-band.
SurrealDB 2.0.0 through 3.3.0 does not enforce the --deny-funcs function-level security control on method-style function invocations, so an authenticated user who can submit queries can execute function families the operator explicitly denied - for example [1,2].map(...) instead of array::map(...), or $f.put()/$f.get() against a file bucket despite a file::* denial. The gap only exists on deployments that actually configure deny rules (--deny-funcs or SURREAL_DENY_FUNCS); the default 3.x streaming engine performs no capability check at all on this path, while the legacy compute-only path blocks some families and still lets others (math::abs, value::chain, array::any, array::sort::asc, type::string) through. Impact is highest when the experimental Files feature is enabled (3.3.x only) and bucket PERMISSIONS are permissive, allowing file bucket reads and writes under a deny file::* policy. There is no CISA KEV entry and no EPSS score was supplied, so active exploitation cannot be asserted; public reproduction scripts and transcripts are attached to the GHSA advisory.
Heap memory exhaustion in the FreeRDP proxy (versions 3.0.0 through 3.31.1) lets an authenticated client that already holds an RDP session through the proxy retain traffic-proportional heap by declaring a large DATA_FIRST length on an intercepted dynamic virtual channel and never completing the fragmented message. Only proxy deployments that actually enable DVC interception for an attacker-reachable channel are affected; the researcher's reproduction used a target-created AUDIO_INPUT channel with the shipped dyn-channel-dump module and measured roughly 6.55 MiB of retained data per incomplete message (ASan-inflated RSS figures were 324,012 KiB versus a 2,176 KiB control). Impact is availability only (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, CVSS 4.0 VA:H), no public exploit code was identified at time of analysis, and the issue is rated this_week rather than an emergency.
Any client that can authenticate to a FreeRDP shadow server (freerdp-shadow-cli) can abort the server process and drop every active session by joining the remdesk static virtual channel and writing an 8192-byte payload whose eight-byte header declares a total PDU length of eight. FreeRDP versions up to and including 3.32.1 are affected; 3.32.2 fixes the inverted completeness comparison and the buffer management across fragmented PDUs. Exploitation requires valid credentials and the remdesk channel to be joined (CVSS PR:L), and the abort has only been demonstrated on default assertion-enabled builds - source review shows an assert-disabled NDEBUG build falls through to a guarded channel error instead of crashing. Impact is availability-only: no memory corruption, information disclosure, or code execution was demonstrated. No confirmed public exploit code exists, though the vendor advisory publishes a working LD_PRELOAD reproducer, and there is no KEV listing for this CVE.
CPU exhaustion in FreeRDP's shadow server (through 3.32.1) lets an authenticated RDP client pin roughly one to two server CPU cores by sending drdynvc DATA PDUs that carry a valid dynamic-channel ID but zero application payload on the audin or rdpgfx channels; the shadow reader never consumes the zero-byte message and loops until the client disconnects. Only shadow-server deployments such as freerdp-shadow-cli are affected - not ordinary FreeRDP client installations - and because the stock xfreerdp client refuses to serialize a zero-length DVC write, exploitation requires a modified client or a post-serialization PDU shaper. There is no CISA KEV entry and no confirmed active exploitation; a public PoC reference exists in the form of the advisory's LD_PRELOAD shaper and loopback runner, but the input does not record it as confirmed working exploit code. No crash, memory corruption or data disclosure was demonstrated, and the advisory's own testing did not include a many-session exhaustion run.
Client-side denial of service in FreeRDP xfreerdp before 3.32.2 lets a malicious RDP server crash the connecting Linux X11 client by sending an RDPGFX ResetGraphics PDU with width zero followed by any ordinary bitmap update. The zero dimension passes the RDPGFX parser's bounds check, the resulting failed resize frees and nulls the GDI primary surface without ending the session, and the next bitmap paint dereferences the null pointer in gdi_Bitmap_Paint. Impact is confined to availability (CVSS 4.0 7.1; assessed 3.1 AV:N/AC:L/PR:N/UI:R/A:H with no C or I impact), the user must connect to the attacker-controlled server for exploitation, a public PoC reference exists in the GitHub advisory but is a callback-level harness not verified as working exploit code, and no KEV-listed active exploitation was reported.
CPU exhaustion in FreeRDP 3.32.1 and earlier allows a malicious or compromised RD Gateway to pin one client thread at 100% of a core by completing the RDG tunnel-open exchange and then sending an eight-byte keepalive control header that declares a 65,535-byte body which is never delivered. Only clients that explicitly connect through a gateway (the /gateway option with HTTP or WebSocket transport) are affected; direct RDP connections are not, and the victim must initiate the session, so the practical attack surface is users routed through an untrusted or machine-in-the-middled gateway. Impact is availability-only - the upstream advisory and reproduction confirm CPU spin and a runnable thread, not a crash, memory corruption, data access, or code execution - and the issue is fixed in FreeRDP 3.32.2. The upstream advisory (GHSA-x4x6-2hrm-hvq9) ships a complete proof-of-concept gateway harness that reproduces the spin, but the flaw is not listed in CISA KEV.
Denial of service in FreeRDP 3.17.0 through 3.32.1 can abort the client process when a malicious or relayed RDP server sends a crafted RemoteFX tile and the client is built with verbose WinPR assertions enabled. The abort occurs in the RemoteFX differential decoder and requires the victim to initiate the RDP connection and negotiate the classic RemoteFX surface-bits path; there is no confidentiality, integrity, or memory-corruption impact. A public proof-of-concept is included in the vendor advisory, and the issue is not listed in CISA KEV.
A malicious RDP server can abort a FreeRDP client that has RemoteFX surface decoding enabled by sending a crafted RemoteFX tileset whose RLGR bitstream encodes the value 32767, tripping a checked narrowing conversion in rfx_rlgr_decode and terminating the client process. Only denial of service to that single client process is demonstrated: the advisory explicitly reports no memory corruption, confidentiality or integrity impact, and no effect on other processes. Affected builds are FreeRDP 3.11.0 through 3.32.1 (fixed range ends before 3.32.2, per the published package metadata); the abort is additionally build-dependent because it only fires when the client is compiled with WITH_VERBOSE_WINPR_ASSERT enabled, which is the default in the inspected 3.32.1 CMake configuration but is disabled by some presets and downstream distributions. A complete public proof-of-concept relay script with a documented successful run is included in the upstream advisory; no confirmed active exploitation (CISA KEV) has been reported.
FreeRDP 3.x clients that decode classic RemoteFX graphics and were compiled with WITH_VERBOSE_WINPR_ASSERT=ON can be aborted by a malicious RDP server that sends a crafted RemoteFX region rectangle, giving the server a client-side denial of service (CWE-617 reachable assertion). The malformed rectangle uses x = 65535 while the RDP SurfaceBits destination starts at left = 1, so their sum no longer fits the 16-bit coordinate the client asserts on in rfx_process_message; builds made with verbose WinPR assertions disabled did not crash on the same packet in the vendor's testing, so real-world exposure is gated by build configuration. Exploitation requires a user to connect to an attacker-controlled or redirected RDP server and negotiate RemoteFX (UI:R, PR:N); impact is limited to loss of availability of the connecting client process, with no data, memory-corruption, server, or other-client impact. The issue is not recorded as actively exploited in CISA KEV, while the upstream advisory does publish a detailed loopback proof-of-concept relay script.