Monthly
openvpnserv on Windows insufficiently validates command line arguments received from its control socket before passing them to the openvpn.exe process, allowing a low-privileged local user to circumvent administrator-defined restrictions on permitted OpenVPN configuration directories. Affected installations span OpenVPN 2.4.0 through 2.6.21 and 2.7_alpha1 through 2.7.5 on Windows; fixed releases 2.6.22 and 2.7.6 shipped August 5, 2026. No public exploit or CISA KEV listing has been identified at time of analysis, though the CVSS 4.0 SC:H metric indicates that bypassing config directory controls could allow rogue VPN configurations to be loaded, with high downstream confidentiality impact on subsequent network systems.
NO_PROXY bypass in axios Node.js HTTP client exposes local services to configured proxies when requests target 0.0.0.0. Affected versions 1.15.0-1.17.x and 0.31.0-0.32.x omit 0.0.0.0 from loopback address recognition in shouldBypassProxy.js, causing traffic intended to bypass proxy routing to instead be forwarded through HTTP_PROXY or HTTPS_PROXY. Plain HTTP requests are most exposed since the proxy receives the full request URL, headers, and body; HTTPS is partially mitigated by CONNECT tunneling. No public exploit or CISA KEV listing identified at time of analysis, but exploitation requires only attacker-controlled URL input in an otherwise common Node.js proxy deployment.
OAuth 2.0 authorization-code theft in Dromara MaxKey through 4.1.12 lets remote attackers hijack a victim's authorization code and exchange it for an access token, taking over the victim's federated identity. The flaw lives in DefaultRedirectResolver.hostMatches(), where a naive endsWith() suffix comparison lets an attacker-controlled domain that ends with a registered redirect URI hostname pass validation. Publicly available exploit code exists and a vendor patch (commit ddbb72f) is available; no active exploitation has been confirmed (not in CISA KEV).
A CORS misconfiguration in Jan up to version 0.8.4 allows network-adjacent attackers to bypass trusted host restrictions when the server is bound to 0.0.0.0, enabling unauthorized access to the OpenAI-compatible API for model enumeration, inference, and MCP tool invocation. A publicly available exploit exists, and CISA KEV does not list active exploitation; EPSS score is low at 0.19%, indicating limited real-world exploitation risk.
Cross-site scripting via data URI injection in PasswordPusher before 2.8.1 allows unauthenticated attackers to create URL pushes containing data:text/html payloads that execute arbitrary JavaScript in victims' browsers under the trusted PasswordPusher origin. The root cause is the valid_url function accepting data: URI schemes as valid URLs, meaning any attacker with push creation access can craft a link that, when clicked by a recipient, renders attacker-controlled HTML and JavaScript within the trusted application domain - enabling convincing phishing pages or session cookie harvesting. No public exploit has been identified at time of analysis, but a vendor-released patch (2.8.1) is available per the GitHub security advisory.
Authenticated command execution in Appsmith versions prior to 2.1 lets any administrator run arbitrary OS commands inside the application's Docker container. The bundled supervisord exposes an XML-RPC management interface on port 9001, which Appsmith's Caddy reverse proxy publishes externally at /supervisor/* on the public ingress; combined with the supervisord password being readable through GET /api/v1/admin/env, an admin can authenticate to supervisord and abuse twiddler.addProgramToGroup to spawn programs that execute shell commands. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV. Fixed in 2.1.
Cross-origin data exposure in Glances XML-RPC server (versions 4.5.3 through 4.5.4) allows any malicious web page to read full system monitoring data from a victim's browser because the CORS allowlist silently collapses to 'Access-Control-Allow-Origin: *' whenever two or more origins are configured. This is an incomplete fix for CVE-2026-33533: the CORS header is computed once at startup and never validated against the request's Origin. Publicly available exploit code exists in the GHSA advisory, but there is no public exploit identified at time of analysis as actively exploited.
Local privilege abuse in ASUS Armoury Crate (versions up to and including 6.4.12) allows a local administrator to bypass input validation and perform arbitrary kernel memory read/write or trigger a system crash (BSOD). The flaw is reported by ASUS and tracked as EUVD-2026-38205; no public exploit identified at time of analysis. CVSS 4.0 base score is 7.1 with high attack complexity and high privileges required, reflecting that exploitation needs an existing administrative foothold.
Out-of-band data exfiltration in Claude Code (npm/@anthropic-ai/claude-code versions 0.2.54 through 2.1.162) allows a prompt-injection attacker to silently exfiltrate files, environment variables, and command output by exploiting a pre-approved bare hostname bypass in the WebFetch tool. Because huggingface.co was whitelisted at the hostname level only, any path on that domain - including attacker-controlled model repository paths - was auto-approved without triggering a permission prompt and without being constrained by --allowedTools restrictions. The prerequisite is the ability to inject untrusted content into a Claude Code context window (e.g., via a malicious README, dependency file, or data file read during a session); no public exploit code has been identified at time of analysis, and the vulnerability has been patched in version 2.1.163.
SameSite attribute parsing in undici's cookie implementation uses substring matching instead of the case-insensitive exact match required by RFC 6265, enabling a malicious or non-compliant upstream server to silently downgrade a cookie's SameSite enforcement to a more permissive value. All undici installations from v5.15.0 onward through the unpatched release branches are affected when consuming Set-Cookie headers via undici's fetch or proxy code paths and forwarding or relying on the parsed sameSite attribute. No public exploit has been identified and no CISA KEV listing exists at time of analysis; however, the integrity impact is concrete in architectures where SameSite policy enforcement is delegated to the parsed cookie attribute.
openvpnserv on Windows insufficiently validates command line arguments received from its control socket before passing them to the openvpn.exe process, allowing a low-privileged local user to circumvent administrator-defined restrictions on permitted OpenVPN configuration directories. Affected installations span OpenVPN 2.4.0 through 2.6.21 and 2.7_alpha1 through 2.7.5 on Windows; fixed releases 2.6.22 and 2.7.6 shipped August 5, 2026. No public exploit or CISA KEV listing has been identified at time of analysis, though the CVSS 4.0 SC:H metric indicates that bypassing config directory controls could allow rogue VPN configurations to be loaded, with high downstream confidentiality impact on subsequent network systems.
NO_PROXY bypass in axios Node.js HTTP client exposes local services to configured proxies when requests target 0.0.0.0. Affected versions 1.15.0-1.17.x and 0.31.0-0.32.x omit 0.0.0.0 from loopback address recognition in shouldBypassProxy.js, causing traffic intended to bypass proxy routing to instead be forwarded through HTTP_PROXY or HTTPS_PROXY. Plain HTTP requests are most exposed since the proxy receives the full request URL, headers, and body; HTTPS is partially mitigated by CONNECT tunneling. No public exploit or CISA KEV listing identified at time of analysis, but exploitation requires only attacker-controlled URL input in an otherwise common Node.js proxy deployment.
OAuth 2.0 authorization-code theft in Dromara MaxKey through 4.1.12 lets remote attackers hijack a victim's authorization code and exchange it for an access token, taking over the victim's federated identity. The flaw lives in DefaultRedirectResolver.hostMatches(), where a naive endsWith() suffix comparison lets an attacker-controlled domain that ends with a registered redirect URI hostname pass validation. Publicly available exploit code exists and a vendor patch (commit ddbb72f) is available; no active exploitation has been confirmed (not in CISA KEV).
A CORS misconfiguration in Jan up to version 0.8.4 allows network-adjacent attackers to bypass trusted host restrictions when the server is bound to 0.0.0.0, enabling unauthorized access to the OpenAI-compatible API for model enumeration, inference, and MCP tool invocation. A publicly available exploit exists, and CISA KEV does not list active exploitation; EPSS score is low at 0.19%, indicating limited real-world exploitation risk.
Cross-site scripting via data URI injection in PasswordPusher before 2.8.1 allows unauthenticated attackers to create URL pushes containing data:text/html payloads that execute arbitrary JavaScript in victims' browsers under the trusted PasswordPusher origin. The root cause is the valid_url function accepting data: URI schemes as valid URLs, meaning any attacker with push creation access can craft a link that, when clicked by a recipient, renders attacker-controlled HTML and JavaScript within the trusted application domain - enabling convincing phishing pages or session cookie harvesting. No public exploit has been identified at time of analysis, but a vendor-released patch (2.8.1) is available per the GitHub security advisory.
Authenticated command execution in Appsmith versions prior to 2.1 lets any administrator run arbitrary OS commands inside the application's Docker container. The bundled supervisord exposes an XML-RPC management interface on port 9001, which Appsmith's Caddy reverse proxy publishes externally at /supervisor/* on the public ingress; combined with the supervisord password being readable through GET /api/v1/admin/env, an admin can authenticate to supervisord and abuse twiddler.addProgramToGroup to spawn programs that execute shell commands. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV. Fixed in 2.1.
Cross-origin data exposure in Glances XML-RPC server (versions 4.5.3 through 4.5.4) allows any malicious web page to read full system monitoring data from a victim's browser because the CORS allowlist silently collapses to 'Access-Control-Allow-Origin: *' whenever two or more origins are configured. This is an incomplete fix for CVE-2026-33533: the CORS header is computed once at startup and never validated against the request's Origin. Publicly available exploit code exists in the GHSA advisory, but there is no public exploit identified at time of analysis as actively exploited.
Local privilege abuse in ASUS Armoury Crate (versions up to and including 6.4.12) allows a local administrator to bypass input validation and perform arbitrary kernel memory read/write or trigger a system crash (BSOD). The flaw is reported by ASUS and tracked as EUVD-2026-38205; no public exploit identified at time of analysis. CVSS 4.0 base score is 7.1 with high attack complexity and high privileges required, reflecting that exploitation needs an existing administrative foothold.
Out-of-band data exfiltration in Claude Code (npm/@anthropic-ai/claude-code versions 0.2.54 through 2.1.162) allows a prompt-injection attacker to silently exfiltrate files, environment variables, and command output by exploiting a pre-approved bare hostname bypass in the WebFetch tool. Because huggingface.co was whitelisted at the hostname level only, any path on that domain - including attacker-controlled model repository paths - was auto-approved without triggering a permission prompt and without being constrained by --allowedTools restrictions. The prerequisite is the ability to inject untrusted content into a Claude Code context window (e.g., via a malicious README, dependency file, or data file read during a session); no public exploit code has been identified at time of analysis, and the vulnerability has been patched in version 2.1.163.
SameSite attribute parsing in undici's cookie implementation uses substring matching instead of the case-insensitive exact match required by RFC 6265, enabling a malicious or non-compliant upstream server to silently downgrade a cookie's SameSite enforcement to a more permissive value. All undici installations from v5.15.0 onward through the unpatched release branches are affected when consuming Set-Cookie headers via undici's fetch or proxy code paths and forwarding or relying on the parsed sameSite attribute. No public exploit has been identified and no CISA KEV listing exists at time of analysis; however, the integrity impact is concrete in architectures where SameSite policy enforcement is delegated to the parsed cookie attribute.