Monthly
Constraint bypass in Ash Framework's CiString type allows storing string values that violate configured length or match constraints after case-folding. Any application built on ash versions 1.29.0-rc0 through 3.32.2 that defines a CiString attribute with both a casing option (:lower or :upper) and a max_length, min_length, or match constraint is affected. An attacker who can submit input to such a field can craft a value whose pre-fold form satisfies constraints but whose stored, case-folded form violates them - silently defeating application-defined data integrity rules. No public exploit code exists and no CISA KEV listing is present; the CVSS 4.0 score of 2.1 reflects the narrow, low-severity nature of the flaw.
Directory traversal in the cohttp OCaml HTTP library before version 6.3.0 allows unauthenticated remote attackers to read arbitrary files outside the configured document root by supplying percent-encoded path traversal sequences such as `..%2f..%2f` in HTTP request URIs. The root cause (CWE-180) is that `Cohttp.Path.resolve_local_file` validated and stripped `.` and `..` segments before percent-decoding the URI, meaning encoded traversal bypassed sanitization entirely. No public exploit code or CISA KEV listing has been identified at time of analysis, but the network-accessible, zero-authentication attack surface makes this a straightforward read primitive for any server using cohttp's static file resolution.
CSS sanitizer bypass in maalfer Pentestify 1.2.0-2.3.2 allows an authenticated low-privilege user to inject CSS that victim users' browsers silently execute, leaking their real IP address and User-Agent string to an attacker-controlled endpoint. The root cause (CWE-180) is that the report theme sanitizer evaluates its blocklist against raw user input before decoding CSS hex escape sequences, so the literal substring 'url(' never appears in the checked text and the block is trivially evaded using sequences like '\75 rl('. No active exploitation is confirmed (not in CISA KEV) and no standalone public exploit code has been identified, though the Secur0 advisory and vendor commit together form a near-complete reproduction recipe.
Account takeover in NextAuth.js / Auth.js email (magic-link) sign-in lets a remote unauthenticated attacker who knows a victim's address hijack the passwordless login. The built-in defaultNormalizer checks for a single ASCII '@' before applying Unicode NFKC normalization, so a homoglyph such as U+FF20 (FULLWIDTH COMMERCIAL AT) passes validation but canonicalizes to a second '@' in a downstream SMTPUTF8/internationalized mailer, misrouting the sign-in link to an attacker mailbox. No public exploit is identified at time of analysis, but a regression test and full commit-level detail are public, and vendor-released patches exist (@auth/core 0.41.3, next-auth 4.24.15 and 5.0.0-beta.32).
Account takeover via recovery-code bypass in AnythingLLM 1.0.0-1.15.0 allows an unauthenticated remote attacker to seize full control of any user account, including administrator accounts, in multi-user mode. The flaw resides in server/utils/PasswordRecovery/index.js: raw recovery codes are deduplicated before whitespace trimming, so a single code submitted twice with differing surrounding whitespace satisfies the two-distinct-code requirement, and the hash-matching loop does not consume matched hashes, permitting one known code to match the same stored bcrypt hash twice. No confirmed active exploitation or public proof-of-concept is identified at time of analysis, but the technique is directly derivable from the published GitHub advisory GHSA-vv8w-wg6r-hq56.
Host confusion in GuzzleHttp Guzzle before 7.15.2 and 8.0.1 allows remote attackers who can influence a fetched URI to bypass application-level host validation and reach network hosts the application intended to block, including loopback and internal addresses. The divergence occurs because PHP's filter_var() and Guzzle's own host checks operate on the literal URI text while libcurl independently percent-decodes and IDNA-maps the authority before resolving and connecting, meaning the application and transport disagree on which host is being contacted. No public exploit has been identified and the vulnerability is absent from the CISA KEV catalog, but any application that implements SSRF mitigations via URI host inspection before passing a user-supplied URL to Guzzle is directly undermined.
Cookie domain scope bypass in Guzzle PHP HTTP client (prior to 7.15.2 and 8.0.1) allows improper cookie sharing via non-canonical IP address representations in cookie Domain attributes. The flaw in SetCookie::matchesDomain() fails to recognize hexadecimal (e.g., 0x7f000001), mixed-base octal (e.g., 0177.0.0.0x1), and percent-escaped (e.g., 192.168.0.%31) host spellings as IP literals, so cookies set for such domains incorrectly gain subdomain scope while libcurl resolves the same strings as actual IP addresses. This divergence enables an adversary-controlled host (e.g., evil.0x7f000001) to receive session cookies intended for the target IP, facilitating credential disclosure and session fixation; no public exploit identified at time of analysis.
Path-based access control in @fastify/static is defeated by non-canonical URL paths, allowing unauthenticated attackers to retrieve files that the allowedPath callback was configured to deny. Affected are all versions through 10.1.1 of the plugin for the Fastify Node.js framework. Because the allowedPath callback receives the raw, un-normalized pathname - before dot segments and duplicate separators are resolved - an attacker can craft equivalent paths (e.g., using './' sequences or '//' separators) that bypass the callback's deny logic while the underlying file resolver still serves the intended file. No public exploit has been identified at time of analysis, and active exploitation has not been confirmed.
WAF filtering bypass in OWASP ModSecurity (libmodsecurity) before 3.0.16 lets remote unauthenticated attackers smuggle malicious payloads past inspection rules by exploiting a multipart/form-data parser differential. The engine silently strips embedded line breaks from non-file form-field values before populating ARGS and ARGS_POST, so any rule whose detection depends on a newline (e.g. command, header, or injection syntax spanning a line break) fails to match while the backend still receives and acts on the intact payload. No public exploit identified at time of analysis, but the CVSS base score of 8.6 reflects a scope-changing integrity impact on every application shielded by an affected deployment.
Command-execution permission bypass in Warp's default unsandboxed CLI agent profile (versions 0.2025.10.08.08.12.stable_00 through the fix in 0.2026.05.06.15.42.stable_01) lets denylisted, confirmation-required commands auto-execute. Because the non-interactive CLI agent matched command strings against its denylist before stripping leading environment-variable assignments, an attacker able to influence the agent's emitted command output (e.g., via prompt injection) can prefix a blocked command such as 'rm' with 'X=1' to evade the safety boundary. No public exploit is identified at time of analysis, and it is not listed in CISA KEV.
Constraint bypass in Ash Framework's CiString type allows storing string values that violate configured length or match constraints after case-folding. Any application built on ash versions 1.29.0-rc0 through 3.32.2 that defines a CiString attribute with both a casing option (:lower or :upper) and a max_length, min_length, or match constraint is affected. An attacker who can submit input to such a field can craft a value whose pre-fold form satisfies constraints but whose stored, case-folded form violates them - silently defeating application-defined data integrity rules. No public exploit code exists and no CISA KEV listing is present; the CVSS 4.0 score of 2.1 reflects the narrow, low-severity nature of the flaw.
Directory traversal in the cohttp OCaml HTTP library before version 6.3.0 allows unauthenticated remote attackers to read arbitrary files outside the configured document root by supplying percent-encoded path traversal sequences such as `..%2f..%2f` in HTTP request URIs. The root cause (CWE-180) is that `Cohttp.Path.resolve_local_file` validated and stripped `.` and `..` segments before percent-decoding the URI, meaning encoded traversal bypassed sanitization entirely. No public exploit code or CISA KEV listing has been identified at time of analysis, but the network-accessible, zero-authentication attack surface makes this a straightforward read primitive for any server using cohttp's static file resolution.
CSS sanitizer bypass in maalfer Pentestify 1.2.0-2.3.2 allows an authenticated low-privilege user to inject CSS that victim users' browsers silently execute, leaking their real IP address and User-Agent string to an attacker-controlled endpoint. The root cause (CWE-180) is that the report theme sanitizer evaluates its blocklist against raw user input before decoding CSS hex escape sequences, so the literal substring 'url(' never appears in the checked text and the block is trivially evaded using sequences like '\75 rl('. No active exploitation is confirmed (not in CISA KEV) and no standalone public exploit code has been identified, though the Secur0 advisory and vendor commit together form a near-complete reproduction recipe.
Account takeover in NextAuth.js / Auth.js email (magic-link) sign-in lets a remote unauthenticated attacker who knows a victim's address hijack the passwordless login. The built-in defaultNormalizer checks for a single ASCII '@' before applying Unicode NFKC normalization, so a homoglyph such as U+FF20 (FULLWIDTH COMMERCIAL AT) passes validation but canonicalizes to a second '@' in a downstream SMTPUTF8/internationalized mailer, misrouting the sign-in link to an attacker mailbox. No public exploit is identified at time of analysis, but a regression test and full commit-level detail are public, and vendor-released patches exist (@auth/core 0.41.3, next-auth 4.24.15 and 5.0.0-beta.32).
Account takeover via recovery-code bypass in AnythingLLM 1.0.0-1.15.0 allows an unauthenticated remote attacker to seize full control of any user account, including administrator accounts, in multi-user mode. The flaw resides in server/utils/PasswordRecovery/index.js: raw recovery codes are deduplicated before whitespace trimming, so a single code submitted twice with differing surrounding whitespace satisfies the two-distinct-code requirement, and the hash-matching loop does not consume matched hashes, permitting one known code to match the same stored bcrypt hash twice. No confirmed active exploitation or public proof-of-concept is identified at time of analysis, but the technique is directly derivable from the published GitHub advisory GHSA-vv8w-wg6r-hq56.
Host confusion in GuzzleHttp Guzzle before 7.15.2 and 8.0.1 allows remote attackers who can influence a fetched URI to bypass application-level host validation and reach network hosts the application intended to block, including loopback and internal addresses. The divergence occurs because PHP's filter_var() and Guzzle's own host checks operate on the literal URI text while libcurl independently percent-decodes and IDNA-maps the authority before resolving and connecting, meaning the application and transport disagree on which host is being contacted. No public exploit has been identified and the vulnerability is absent from the CISA KEV catalog, but any application that implements SSRF mitigations via URI host inspection before passing a user-supplied URL to Guzzle is directly undermined.
Cookie domain scope bypass in Guzzle PHP HTTP client (prior to 7.15.2 and 8.0.1) allows improper cookie sharing via non-canonical IP address representations in cookie Domain attributes. The flaw in SetCookie::matchesDomain() fails to recognize hexadecimal (e.g., 0x7f000001), mixed-base octal (e.g., 0177.0.0.0x1), and percent-escaped (e.g., 192.168.0.%31) host spellings as IP literals, so cookies set for such domains incorrectly gain subdomain scope while libcurl resolves the same strings as actual IP addresses. This divergence enables an adversary-controlled host (e.g., evil.0x7f000001) to receive session cookies intended for the target IP, facilitating credential disclosure and session fixation; no public exploit identified at time of analysis.
Path-based access control in @fastify/static is defeated by non-canonical URL paths, allowing unauthenticated attackers to retrieve files that the allowedPath callback was configured to deny. Affected are all versions through 10.1.1 of the plugin for the Fastify Node.js framework. Because the allowedPath callback receives the raw, un-normalized pathname - before dot segments and duplicate separators are resolved - an attacker can craft equivalent paths (e.g., using './' sequences or '//' separators) that bypass the callback's deny logic while the underlying file resolver still serves the intended file. No public exploit has been identified at time of analysis, and active exploitation has not been confirmed.
WAF filtering bypass in OWASP ModSecurity (libmodsecurity) before 3.0.16 lets remote unauthenticated attackers smuggle malicious payloads past inspection rules by exploiting a multipart/form-data parser differential. The engine silently strips embedded line breaks from non-file form-field values before populating ARGS and ARGS_POST, so any rule whose detection depends on a newline (e.g. command, header, or injection syntax spanning a line break) fails to match while the backend still receives and acts on the intact payload. No public exploit identified at time of analysis, but the CVSS base score of 8.6 reflects a scope-changing integrity impact on every application shielded by an affected deployment.
Command-execution permission bypass in Warp's default unsandboxed CLI agent profile (versions 0.2025.10.08.08.12.stable_00 through the fix in 0.2026.05.06.15.42.stable_01) lets denylisted, confirmation-required commands auto-execute. Because the non-interactive CLI agent matched command strings against its denylist before stripping leading environment-variable assignments, an attacker able to influence the agent's emitted command output (e.g., via prompt injection) can prefix a blocked command such as 'rm' with 'X=1' to evade the safety boundary. No public exploit is identified at time of analysis, and it is not listed in CISA KEV.