Monthly
Privilege escalation and remote code execution in NVIDIA OpenShell for Linux stem from an incomplete deny-list in its sandbox provisioning API, letting an authenticated attacker submit inputs that were meant to be blocked but were not. Because the flaw crosses the sandbox boundary (CVSS scope change), a successful exploit can yield code execution, privilege escalation, information disclosure, data tampering, and denial of service against the host. No public exploit identified at time of analysis, and the issue is not in CISA KEV.
Incomplete destructive-command denylist in Continue CLI's headless and auto modes enables indirect prompt injection to trigger irreversible data destruction on the invoking user's filesystem. The sole safety gate, isCriticalCommand in packages/terminal-security/src/evaluateTerminalCommandSecurity.ts, blocks only eight path prefixes and misses /home, /root, /var, /opt, and /srv entirely; a secondary bypass exists because shell-quote reduces $HOME to an empty token during the path check while the shell correctly re-expands the variable at execution. Because the agent autonomously consumes untrusted content - fetched web pages, repository files, and issue text - a malicious payload planted in any such source can cause an unattended run to destroy user data; no public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.
Shell-command parser bypass in Omnigent's policy layer allows an authenticated or prompt-injected agent to push code to unauthorized GitHub repositories or escape workspace confinement in all versions prior to 0.3.0. The parser in omnigent/policies/builtins/_shell.py fails to extract the real command when it is wrapped with process utilities (timeout, nice, setsid, stdbuf), combined interpreter flags (bash -lc), command substitutions ($(...) or backticks), or the background operator - returning no recognized tokens, causing both the github.py repository/branch allowlist and working_dir.py workspace confinement policies to abstain and implicitly permit the command. No public exploit code has been identified and no CISA KEV listing exists, but the bypass technique is directly derivable from the published advisory and PR diff.
Username denylist bypass in Limit Login Attempts Security (Limit Login Attempts Reloaded) before version 3.3.5 allows a WordPress user who has been explicitly blocked by an administrator to successfully authenticate by varying the case of their username or by supplying the account's associated email address instead. This is a logic flaw in the plugin's denylist enforcement, entirely defeating the access control that a site administrator intended to impose on specific accounts. A publicly available proof-of-concept is documented in the WPScan advisory; the low CVSS score of 3.7 with AC:H reflects that successful exploitation requires the attacker to already hold valid credentials for the denylisted account.
Arbitrary code execution in jahlives openssl_encrypt before 1.4.0 stems from an inconsistent sandbox: the runtime PluginImportGuard and the static AST analyzer enforce two different blocklists, so an attacker who slips past the AST's DANGEROUS_MODULES check can still import high-risk modules at runtime. By using string obfuscation or encoding to hide imports of sys, shutil, multiprocessing, importlib, or pickle, a supplied plugin escapes the sandbox and runs on the host. Reported by VulnCheck with a vendor patch available; no public exploit has been identified at time of analysis and it is not listed in CISA KEV.
Sandbox escape in Flowise's Python code execution layer (pythonCodeValidator.ts) allows authenticated low-privilege users to invoke native Pandas DataFrame methods - to_csv, to_json, pipe, and query - that the validator's denylist fails to restrict. All Flowise deployments prior to version 3.1.3 are vulnerable, with a CVSS 4.0 score of 8.6 reflecting high confidentiality and high integrity impact. A successful attacker can exfiltrate uploaded CSV data or write arbitrary files to the server filesystem; no public exploit has been identified at time of analysis, but the attack primitives are fully documented in the advisory.
Cross-site scripting bypass in Loofah 2.25.0-2.25.1 allows attackers to smuggle `javascript:` URIs past the `allowed_uri?` helper by inserting HTML5 named whitespace character references (`	` or `
`) into the scheme. This is a partial bypass of the earlier fix for GHSA-46fp-8f5p-pf2m, which patched numeric character references but not named forms. Only callers that invoke `allowed_uri?` directly with HTML-encoded strings are vulnerable - including Action Text 8.2 markdown link validation - while Loofah's default `sanitize()` pipeline is explicitly unaffected. No public exploit identified at time of analysis; vendor-released patch in version 2.25.2.
URLSecurityValidator SSRF bypass in compliance-trestle <= 4.0.3 allows a network-positioned attacker to reach cloud metadata services, loopback admin interfaces, and RFC 1918 internal networks by embedding IPv4-mapped IPv6 literals (e.g., [::ffff:169.254.169.254]) or the unspecified address 0.0.0.0 in OSCAL artifact import references processed by HTTPSFetcher or SFTPFetcher. Python's ipaddress module silently returns False - rather than raising TypeError - when comparing IPv6Address objects against IPv4Network ranges, so the validator's membership checks pass these forms through to requests.get unchanged. A publicly available proof-of-concept reproduces end-to-end IMDS credential exfiltration; no active exploitation is listed in CISA KEV and EPSS stands at 0.42%.
Unauthenticated access control bypass in Fortinet FortiWeb - spanning the 7.0 line through 8.0.2 - and multiple FortiOS branches stems from an incomplete list of disallowed inputs (CWE-184), allowing remote attackers to circumvent input-filtering enforcement and achieve unauthorized integrity modifications. The vulnerability extends to FortiOS, implicating shared blocklist logic across Fortinet's platform stack according to EUVD-2026-57192 and CPE data. Publicly available exploit code exists (CVSS temporal E:P), an official fix has been released (RL:O/RC:C), and no active exploitation has been confirmed in the CISA KEV catalog at time of analysis.
Arbitrary file read in Craft CMS 4.x and 5.x exposes .env files, database credentials, and security keys by exploiting an incomplete blocklist in the create() Twig function that omits PHP's SplFileObject class. An authenticated administrator with allowAdminChanges=true can plant a malicious entry type title or URI format; when any user subsequently creates an entry in the affected section, the Twig renderer instantiates SplFileObject and renders the contents of arbitrary server files as entry titles. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, but the GitHub Security Advisory GHSA-957r-qf9p-67xw provides full technical disclosure of the technique.
Privilege escalation and remote code execution in NVIDIA OpenShell for Linux stem from an incomplete deny-list in its sandbox provisioning API, letting an authenticated attacker submit inputs that were meant to be blocked but were not. Because the flaw crosses the sandbox boundary (CVSS scope change), a successful exploit can yield code execution, privilege escalation, information disclosure, data tampering, and denial of service against the host. No public exploit identified at time of analysis, and the issue is not in CISA KEV.
Incomplete destructive-command denylist in Continue CLI's headless and auto modes enables indirect prompt injection to trigger irreversible data destruction on the invoking user's filesystem. The sole safety gate, isCriticalCommand in packages/terminal-security/src/evaluateTerminalCommandSecurity.ts, blocks only eight path prefixes and misses /home, /root, /var, /opt, and /srv entirely; a secondary bypass exists because shell-quote reduces $HOME to an empty token during the path check while the shell correctly re-expands the variable at execution. Because the agent autonomously consumes untrusted content - fetched web pages, repository files, and issue text - a malicious payload planted in any such source can cause an unattended run to destroy user data; no public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.
Shell-command parser bypass in Omnigent's policy layer allows an authenticated or prompt-injected agent to push code to unauthorized GitHub repositories or escape workspace confinement in all versions prior to 0.3.0. The parser in omnigent/policies/builtins/_shell.py fails to extract the real command when it is wrapped with process utilities (timeout, nice, setsid, stdbuf), combined interpreter flags (bash -lc), command substitutions ($(...) or backticks), or the background operator - returning no recognized tokens, causing both the github.py repository/branch allowlist and working_dir.py workspace confinement policies to abstain and implicitly permit the command. No public exploit code has been identified and no CISA KEV listing exists, but the bypass technique is directly derivable from the published advisory and PR diff.
Username denylist bypass in Limit Login Attempts Security (Limit Login Attempts Reloaded) before version 3.3.5 allows a WordPress user who has been explicitly blocked by an administrator to successfully authenticate by varying the case of their username or by supplying the account's associated email address instead. This is a logic flaw in the plugin's denylist enforcement, entirely defeating the access control that a site administrator intended to impose on specific accounts. A publicly available proof-of-concept is documented in the WPScan advisory; the low CVSS score of 3.7 with AC:H reflects that successful exploitation requires the attacker to already hold valid credentials for the denylisted account.
Arbitrary code execution in jahlives openssl_encrypt before 1.4.0 stems from an inconsistent sandbox: the runtime PluginImportGuard and the static AST analyzer enforce two different blocklists, so an attacker who slips past the AST's DANGEROUS_MODULES check can still import high-risk modules at runtime. By using string obfuscation or encoding to hide imports of sys, shutil, multiprocessing, importlib, or pickle, a supplied plugin escapes the sandbox and runs on the host. Reported by VulnCheck with a vendor patch available; no public exploit has been identified at time of analysis and it is not listed in CISA KEV.
Sandbox escape in Flowise's Python code execution layer (pythonCodeValidator.ts) allows authenticated low-privilege users to invoke native Pandas DataFrame methods - to_csv, to_json, pipe, and query - that the validator's denylist fails to restrict. All Flowise deployments prior to version 3.1.3 are vulnerable, with a CVSS 4.0 score of 8.6 reflecting high confidentiality and high integrity impact. A successful attacker can exfiltrate uploaded CSV data or write arbitrary files to the server filesystem; no public exploit has been identified at time of analysis, but the attack primitives are fully documented in the advisory.
Cross-site scripting bypass in Loofah 2.25.0-2.25.1 allows attackers to smuggle `javascript:` URIs past the `allowed_uri?` helper by inserting HTML5 named whitespace character references (`	` or `
`) into the scheme. This is a partial bypass of the earlier fix for GHSA-46fp-8f5p-pf2m, which patched numeric character references but not named forms. Only callers that invoke `allowed_uri?` directly with HTML-encoded strings are vulnerable - including Action Text 8.2 markdown link validation - while Loofah's default `sanitize()` pipeline is explicitly unaffected. No public exploit identified at time of analysis; vendor-released patch in version 2.25.2.
URLSecurityValidator SSRF bypass in compliance-trestle <= 4.0.3 allows a network-positioned attacker to reach cloud metadata services, loopback admin interfaces, and RFC 1918 internal networks by embedding IPv4-mapped IPv6 literals (e.g., [::ffff:169.254.169.254]) or the unspecified address 0.0.0.0 in OSCAL artifact import references processed by HTTPSFetcher or SFTPFetcher. Python's ipaddress module silently returns False - rather than raising TypeError - when comparing IPv6Address objects against IPv4Network ranges, so the validator's membership checks pass these forms through to requests.get unchanged. A publicly available proof-of-concept reproduces end-to-end IMDS credential exfiltration; no active exploitation is listed in CISA KEV and EPSS stands at 0.42%.
Unauthenticated access control bypass in Fortinet FortiWeb - spanning the 7.0 line through 8.0.2 - and multiple FortiOS branches stems from an incomplete list of disallowed inputs (CWE-184), allowing remote attackers to circumvent input-filtering enforcement and achieve unauthorized integrity modifications. The vulnerability extends to FortiOS, implicating shared blocklist logic across Fortinet's platform stack according to EUVD-2026-57192 and CPE data. Publicly available exploit code exists (CVSS temporal E:P), an official fix has been released (RL:O/RC:C), and no active exploitation has been confirmed in the CISA KEV catalog at time of analysis.
Arbitrary file read in Craft CMS 4.x and 5.x exposes .env files, database credentials, and security keys by exploiting an incomplete blocklist in the create() Twig function that omits PHP's SplFileObject class. An authenticated administrator with allowAdminChanges=true can plant a malicious entry type title or URI format; when any user subsequently creates an entry in the affected section, the Twig renderer instantiates SplFileObject and renders the contents of arbitrary server files as entry titles. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, but the GitHub Security Advisory GHSA-957r-qf9p-67xw provides full technical disclosure of the technique.