Monthly
Remote code execution on TechDocs build hosts affects Backstage deployments running the @backstage/plugin-techdocs-node mkdocs generator prior to 1.14.6 (and 1.15.x prior to 1.15.4). An authenticated user holding the privilege to register or update catalog entities can commit a crafted mkdocs.yml whose markdown_extensions entries point at dangerous Python callables such as subprocess:Popen, os:system, or plantuml_markdown's plantuml_cmd, which mkdocs instantiates and executes while building the docs; the flaw requires authentication and an entity-registration permission rather than anonymous access, and deployments that publish pre-built docs or build in isolated disposable runners have a much smaller blast radius. The upstream fix, which extends MkDocs configuration sanitization to cover nested configuration keys, hyphenated extension names, and theme options, is available in vendor-released versions 1.14.6 and 1.15.4, and no public exploit code tied to this CVE was identified at time of analysis beyond the payload fixtures included in the upstream fix commit.
OAuth 2.0 authorization-code theft in Dromara MaxKey through 4.1.12 lets remote attackers hijack a victim's authorization code and exchange it for an access token, taking over the victim's federated identity. The flaw lives in DefaultRedirectResolver.hostMatches(), where a naive endsWith() suffix comparison lets an attacker-controlled domain that ends with a registered redirect URI hostname pass validation. Publicly available exploit code exists and a vendor patch (commit ddbb72f) is available; no active exploitation has been confirmed (not in CISA KEV).
Authenticated command execution in Appsmith versions prior to 2.1 lets any administrator run arbitrary OS commands inside the application's Docker container. The bundled supervisord exposes an XML-RPC management interface on port 9001, which Appsmith's Caddy reverse proxy publishes externally at /supervisor/* on the public ingress; combined with the supervisord password being readable through GET /api/v1/admin/env, an admin can authenticate to supervisord and abuse twiddler.addProgramToGroup to spawn programs that execute shell commands. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV. Fixed in 2.1.
Cross-origin data exposure in Glances XML-RPC server (versions 4.5.3 through 4.5.4) allows any malicious web page to read full system monitoring data from a victim's browser because the CORS allowlist silently collapses to 'Access-Control-Allow-Origin: *' whenever two or more origins are configured. This is an incomplete fix for CVE-2026-33533: the CORS header is computed once at startup and never validated against the request's Origin. Publicly available exploit code exists in the GHSA advisory, but there is no public exploit identified at time of analysis as actively exploited.
Local privilege abuse in ASUS Armoury Crate (versions up to and including 6.4.12) allows a local administrator to bypass input validation and perform arbitrary kernel memory read/write or trigger a system crash (BSOD). The flaw is reported by ASUS and tracked as EUVD-2026-38205; no public exploit identified at time of analysis. CVSS 4.0 base score is 7.1 with high attack complexity and high privileges required, reflecting that exploitation needs an existing administrative foothold.
Remote code execution against users of picklescan versions prior to 1.0.4 is achievable by smuggling any blocked function past its scanner using pkgutil.resolve_name as an indirection primitive. Because pkgutil.resolve_name is not on the blocklist, an attacker can chain two REDUCE opcodes to resolve and invoke os.system, builtins.exec, subprocess.call, or any other dangerous function while the scanner reports the pickle as CLEAN - a universal blocklist bypass that defeats picklescan's entire safety premise. No public exploit is identified in CISA KEV, but the GHSA advisory authored by VulnCheck publishes a complete working technique, so weaponization is trivial.
Credential theft via SSRF in HAX open-apis (npm @haxtheweb/open-apis) before version 26.0.0 allows remote unauthenticated attackers to capture HTTP Basic authentication intended for hard-coded trusted domains. The flaw stems from substring-only hostname validation in cacheAddress.js, JOSHelpers.js, and elmslnToSite.js, which lets an attacker craft a URL containing the trusted substring but pointing to attacker infrastructure. A proof-of-concept exists and the maintainer confirmed the leaked credentials grant access to unreleased LMS content on downstream systems, though no public exploitation has been observed.
Remote code execution in NetBox 4.3.5-4.5.4 allows authenticated users with exporttemplate or configtemplate permissions to execute arbitrary Python code as the NetBox service user by injecting malicious callables into Jinja2 template environment parameters. Attackers bypass SandboxedEnvironment protections by setting the finalize parameter to dangerous imports like subprocess.getoutput, which executes on every rendered expression outside sandbox call interception. Public proof-of-concept exploit exists (chocapikk.com), and upstream patch available via GitHub PR #22078 implements an allowlist-based validation mechanism that blocks unauthorized callable resolution at both save-time and render-time.
OpenClaw package manager allows supply chain attacks through incomplete environment variable sanitization before version 2026.3.22. Attackers can hijack approved package installation or execution requests by injecting environment variables that redirect package resolution to malicious infrastructure, enabling trojanized code execution with high impact to confidentiality, integrity, and availability. This requires local access and user interaction to trigger package manager operations, limiting remote exploitation but creating significant insider threat and social engineering risk vectors.
NO_PROXY protection bypass in Axios HTTP client (versions 1.0.0-1.15.0 and ≤0.31.0) lets an attacker who controls a request's target URL route loopback-bound traffic through an attacker-configured proxy by using any address in the 127.0.0.0/8 range other than 127.0.0.1 (e.g. 127.0.0.2, 127.1.2.3). This is an incomplete fix for CVE-2025-62718: the patch hardcoded only localhost, 127.0.0.1, and ::1 as loopback, ignoring RFC 1122's full /8 loopback block. Publicly available exploit code exists, but no public active exploitation is identified and EPSS is low (0.03%); it is fixed in 1.15.1 and 0.31.1.
Remote code execution on TechDocs build hosts affects Backstage deployments running the @backstage/plugin-techdocs-node mkdocs generator prior to 1.14.6 (and 1.15.x prior to 1.15.4). An authenticated user holding the privilege to register or update catalog entities can commit a crafted mkdocs.yml whose markdown_extensions entries point at dangerous Python callables such as subprocess:Popen, os:system, or plantuml_markdown's plantuml_cmd, which mkdocs instantiates and executes while building the docs; the flaw requires authentication and an entity-registration permission rather than anonymous access, and deployments that publish pre-built docs or build in isolated disposable runners have a much smaller blast radius. The upstream fix, which extends MkDocs configuration sanitization to cover nested configuration keys, hyphenated extension names, and theme options, is available in vendor-released versions 1.14.6 and 1.15.4, and no public exploit code tied to this CVE was identified at time of analysis beyond the payload fixtures included in the upstream fix commit.
OAuth 2.0 authorization-code theft in Dromara MaxKey through 4.1.12 lets remote attackers hijack a victim's authorization code and exchange it for an access token, taking over the victim's federated identity. The flaw lives in DefaultRedirectResolver.hostMatches(), where a naive endsWith() suffix comparison lets an attacker-controlled domain that ends with a registered redirect URI hostname pass validation. Publicly available exploit code exists and a vendor patch (commit ddbb72f) is available; no active exploitation has been confirmed (not in CISA KEV).
Authenticated command execution in Appsmith versions prior to 2.1 lets any administrator run arbitrary OS commands inside the application's Docker container. The bundled supervisord exposes an XML-RPC management interface on port 9001, which Appsmith's Caddy reverse proxy publishes externally at /supervisor/* on the public ingress; combined with the supervisord password being readable through GET /api/v1/admin/env, an admin can authenticate to supervisord and abuse twiddler.addProgramToGroup to spawn programs that execute shell commands. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV. Fixed in 2.1.
Cross-origin data exposure in Glances XML-RPC server (versions 4.5.3 through 4.5.4) allows any malicious web page to read full system monitoring data from a victim's browser because the CORS allowlist silently collapses to 'Access-Control-Allow-Origin: *' whenever two or more origins are configured. This is an incomplete fix for CVE-2026-33533: the CORS header is computed once at startup and never validated against the request's Origin. Publicly available exploit code exists in the GHSA advisory, but there is no public exploit identified at time of analysis as actively exploited.
Local privilege abuse in ASUS Armoury Crate (versions up to and including 6.4.12) allows a local administrator to bypass input validation and perform arbitrary kernel memory read/write or trigger a system crash (BSOD). The flaw is reported by ASUS and tracked as EUVD-2026-38205; no public exploit identified at time of analysis. CVSS 4.0 base score is 7.1 with high attack complexity and high privileges required, reflecting that exploitation needs an existing administrative foothold.
Remote code execution against users of picklescan versions prior to 1.0.4 is achievable by smuggling any blocked function past its scanner using pkgutil.resolve_name as an indirection primitive. Because pkgutil.resolve_name is not on the blocklist, an attacker can chain two REDUCE opcodes to resolve and invoke os.system, builtins.exec, subprocess.call, or any other dangerous function while the scanner reports the pickle as CLEAN - a universal blocklist bypass that defeats picklescan's entire safety premise. No public exploit is identified in CISA KEV, but the GHSA advisory authored by VulnCheck publishes a complete working technique, so weaponization is trivial.
Credential theft via SSRF in HAX open-apis (npm @haxtheweb/open-apis) before version 26.0.0 allows remote unauthenticated attackers to capture HTTP Basic authentication intended for hard-coded trusted domains. The flaw stems from substring-only hostname validation in cacheAddress.js, JOSHelpers.js, and elmslnToSite.js, which lets an attacker craft a URL containing the trusted substring but pointing to attacker infrastructure. A proof-of-concept exists and the maintainer confirmed the leaked credentials grant access to unreleased LMS content on downstream systems, though no public exploitation has been observed.
Remote code execution in NetBox 4.3.5-4.5.4 allows authenticated users with exporttemplate or configtemplate permissions to execute arbitrary Python code as the NetBox service user by injecting malicious callables into Jinja2 template environment parameters. Attackers bypass SandboxedEnvironment protections by setting the finalize parameter to dangerous imports like subprocess.getoutput, which executes on every rendered expression outside sandbox call interception. Public proof-of-concept exploit exists (chocapikk.com), and upstream patch available via GitHub PR #22078 implements an allowlist-based validation mechanism that blocks unauthorized callable resolution at both save-time and render-time.
OpenClaw package manager allows supply chain attacks through incomplete environment variable sanitization before version 2026.3.22. Attackers can hijack approved package installation or execution requests by injecting environment variables that redirect package resolution to malicious infrastructure, enabling trojanized code execution with high impact to confidentiality, integrity, and availability. This requires local access and user interaction to trigger package manager operations, limiting remote exploitation but creating significant insider threat and social engineering risk vectors.
NO_PROXY protection bypass in Axios HTTP client (versions 1.0.0-1.15.0 and ≤0.31.0) lets an attacker who controls a request's target URL route loopback-bound traffic through an attacker-configured proxy by using any address in the 127.0.0.0/8 range other than 127.0.0.1 (e.g. 127.0.0.2, 127.1.2.3). This is an incomplete fix for CVE-2025-62718: the patch hardcoded only localhost, 127.0.0.1, and ::1 as loopback, ignoring RFC 1122's full /8 loopback block. Publicly available exploit code exists, but no public active exploitation is identified and EPSS is low (0.03%); it is fixed in 1.15.1 and 0.31.1.