Monthly
Release-gate substitution in the Zuke GitHub orchestration package @zuke/gh before 1.10.0 lets a party who can dispatch the external workflow satisfy or block a release gate without the gated suite ever validating the shipped artifact. The githubWorkflow(...) gate located the run it had just dispatched purely by a display-title marker echoed into the run list, so anyone able to read that marker and dispatch the same workflow could raise a substitute run whose conclusion the gate adopted; a passing run authorizes an unvalidated release and a failed or cancelled run holds a valid release closed, and the persisted run ID keeps the substitution across build resume. Exploitation requires marker-mode use plus a separate repository whose workflow_dispatch / actions:write holders are not equally trusted by the releasing repository; no public exploit code was identified at time of analysis, and the issue is fixed in 1.10.0. CVSS 3.1 base score 7.1 (High) with integrity as the dominant impact.
Unauthenticated webhook forgery in Juspay Hyperswitch before 1.128.0 allows an attacker who knows a merchant_id and the matching Worldpay orderCode to POST unsigned XML into the worldpayxml webhook endpoint and drive payment state transitions - most damagingly a lastEvent value of SETTLED that marks an unpaid order as charged, with refund, dispute and payout events reachable by the same path. Only deployments that have the Worldpayxml connector enabled are exposed, and the connector's verify_webhook_source returned true unconditionally, so no signature check or mTLS stood between the request and the state machine. No CISA KEV entry has been recorded for this issue and there is no confirmation of active exploitation; a public research writeup describing the unsigned-webhook technique exists but is not verified as working exploit code, and the vendor has released fixes in v1.128.0 and 2026.10.01.0.
Apache Kafka brokers that run SASL/OAUTHBEARER with the default DefaultJwtValidator and leave sasl.oauthbearer.jwks.endpoint.url unset silently fall back to a validator that performs no JWT signature, algorithm, or issuer checks, allowing unauthenticated remote attackers with listener reachability to forge tokens for arbitrary principals, including configured superusers, and gain full cluster access. The flaw is a residual of CVE-2026-33557 and only affects brokers in this specific OAUTHBEARER-without-JWKS-URL configuration with no custom verification key resolver; brokers that set the JWKS URL verify signatures and are not affected. No CISA KEV listing or public exploit code is identified in the available data, no public exploit identified at time of analysis, and no EPSS score is provided.
Arbitrary code execution and privilege escalation on Juniper Networks Session Smart Router and Session Smart Conductor occur when the PCLI component processes cache files whose authenticity it never verifies. Exploitation is not remote against a default install: consistent with the assessed vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, an attacker must already hold write access to the model cache directory so that PCLI will ingest the tampered cache file - an authenticated, low-privileged local foothold, even though Juniper's published 8.8 score uses AV:N/AC:L/PR:L/UI:N. No public exploit code was identified in the available intelligence at the time of analysis; the vendor reference is advisory JSA112183, and impact once triggered is full loss of confidentiality, integrity and availability.
Missing 3D Secure hash verification in mews/pos (CVE-2026-118377) through 2.0.0 allows unauthenticated remote attackers to forge payment callbacks for GarantiPos, PayForPos, and InterPos 3D Pay and 3D Host transactions, potentially completing orders without payment. The flaw affects applications using those three gateways in those two 3D models; integrity impact is high while confidentiality and availability are unaffected. VulnCheck assigns a this_week priority, an upstream fix is available via PR #305/commit 7c59d42, and no public exploit identified at time of analysis.
Unauthenticated payment reuse in the Craft Commerce Mollie plugin (versions 2.1.1 through 4.4.2) allows anyone holding a single valid paid Mollie payment ID from the merchant's account to pair it with an arbitrary Craft Commerce transaction hash, causing that target transaction to be marked paid for its full amount and releasing goods or services without payment. No authentication or user interaction is required; the one concrete prerequisite is obtaining a genuinely paid payment ID belonging to the same merchant account, for example via a low-value legitimate purchase. The plugin is fixed in 4.4.3, and no public exploit has been identified at time of analysis.
PraisonAI's Discord approval backend (praisonai.bots.DiscordApproval, versions 4.5.2 through 4.6.58) treats any later non-bot message in the configured Discord channel as the approval decision for a pending dangerous tool call, so an authenticated low-privileged Discord user who can post in that channel can reply 'yes' to a pending shell command, file write/delete or deployment request without being the intended approver - the message need not be a reply, thread message, button interaction or token-bound response. Exploitation requires a specific deployment posture: DiscordApproval used as the human gate for high-risk tools, a request already pending with its prompt posted, and attacker write access to that channel; realized impact is bounded by whichever tools the agent exposes behind approval. Vendor-released patch: upgrade pip package praisonai to 4.6.59 or later; no public exploit against live deployments is identified - the accompanying proof-of-concept is a local, mock-based harness that is not verified as working exploit code against real Discord channels.
Denial of service in vLLM before 0.31.0 allows remote attackers to crash the entire serving instance by forging or reusing a client-supplied multimodal UUID so the P0/P1 processor caches disagree on token placeholders and hit a fatal mismatch. The flaw is reachable only when the deployment serves a multimodal model and exposes the multimodal inference API; text-only vLLM deployments are not affected. No public exploit was identified at time of analysis, and authentication requirements are conflicting in the supplied data: the CVSS 4.0 vector is PR:L while the independent assessment uses PR:N and the description says unauthenticated, so exposure depends on whether the endpoint is protected (vLLM's default server has no authentication per the assessment).
A privileged, authenticated attacker who can reach the Advantech ADAM-3600 firmware upgrade function can upload a forged firmware image and achieve persistent compromise of the device. The issue is rated CVSS 4.0 8.6 (HIGH) with network reachability and high confidentiality, integrity, and availability impact, but exploitation requires high privileges (PR:H); no CISA KEV entry or public exploit code is identified in the supplied data.
LangBot through 4.11.0 accepts Lark/Feishu event-subscription callbacks without verifying the X-Lark-Signature header or verification token, so unauthenticated remote attackers who know a bot UUID can POST forged im.message.receive_v1 and card.action.trigger events into the bot. Successful injection drives the LLM pipeline, tools, and approval workflows as spoofed users, yielding high integrity impact with limited confidentiality exposure while the Lark adapter webhook is network-reachable. No public exploit code or active exploitation has been identified at time of analysis; the AC:H rating reflects the requirement to learn a valid bot UUID and reach the webhook directly.
Release-gate substitution in the Zuke GitHub orchestration package @zuke/gh before 1.10.0 lets a party who can dispatch the external workflow satisfy or block a release gate without the gated suite ever validating the shipped artifact. The githubWorkflow(...) gate located the run it had just dispatched purely by a display-title marker echoed into the run list, so anyone able to read that marker and dispatch the same workflow could raise a substitute run whose conclusion the gate adopted; a passing run authorizes an unvalidated release and a failed or cancelled run holds a valid release closed, and the persisted run ID keeps the substitution across build resume. Exploitation requires marker-mode use plus a separate repository whose workflow_dispatch / actions:write holders are not equally trusted by the releasing repository; no public exploit code was identified at time of analysis, and the issue is fixed in 1.10.0. CVSS 3.1 base score 7.1 (High) with integrity as the dominant impact.
Unauthenticated webhook forgery in Juspay Hyperswitch before 1.128.0 allows an attacker who knows a merchant_id and the matching Worldpay orderCode to POST unsigned XML into the worldpayxml webhook endpoint and drive payment state transitions - most damagingly a lastEvent value of SETTLED that marks an unpaid order as charged, with refund, dispute and payout events reachable by the same path. Only deployments that have the Worldpayxml connector enabled are exposed, and the connector's verify_webhook_source returned true unconditionally, so no signature check or mTLS stood between the request and the state machine. No CISA KEV entry has been recorded for this issue and there is no confirmation of active exploitation; a public research writeup describing the unsigned-webhook technique exists but is not verified as working exploit code, and the vendor has released fixes in v1.128.0 and 2026.10.01.0.
Apache Kafka brokers that run SASL/OAUTHBEARER with the default DefaultJwtValidator and leave sasl.oauthbearer.jwks.endpoint.url unset silently fall back to a validator that performs no JWT signature, algorithm, or issuer checks, allowing unauthenticated remote attackers with listener reachability to forge tokens for arbitrary principals, including configured superusers, and gain full cluster access. The flaw is a residual of CVE-2026-33557 and only affects brokers in this specific OAUTHBEARER-without-JWKS-URL configuration with no custom verification key resolver; brokers that set the JWKS URL verify signatures and are not affected. No CISA KEV listing or public exploit code is identified in the available data, no public exploit identified at time of analysis, and no EPSS score is provided.
Arbitrary code execution and privilege escalation on Juniper Networks Session Smart Router and Session Smart Conductor occur when the PCLI component processes cache files whose authenticity it never verifies. Exploitation is not remote against a default install: consistent with the assessed vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, an attacker must already hold write access to the model cache directory so that PCLI will ingest the tampered cache file - an authenticated, low-privileged local foothold, even though Juniper's published 8.8 score uses AV:N/AC:L/PR:L/UI:N. No public exploit code was identified in the available intelligence at the time of analysis; the vendor reference is advisory JSA112183, and impact once triggered is full loss of confidentiality, integrity and availability.
Missing 3D Secure hash verification in mews/pos (CVE-2026-118377) through 2.0.0 allows unauthenticated remote attackers to forge payment callbacks for GarantiPos, PayForPos, and InterPos 3D Pay and 3D Host transactions, potentially completing orders without payment. The flaw affects applications using those three gateways in those two 3D models; integrity impact is high while confidentiality and availability are unaffected. VulnCheck assigns a this_week priority, an upstream fix is available via PR #305/commit 7c59d42, and no public exploit identified at time of analysis.
Unauthenticated payment reuse in the Craft Commerce Mollie plugin (versions 2.1.1 through 4.4.2) allows anyone holding a single valid paid Mollie payment ID from the merchant's account to pair it with an arbitrary Craft Commerce transaction hash, causing that target transaction to be marked paid for its full amount and releasing goods or services without payment. No authentication or user interaction is required; the one concrete prerequisite is obtaining a genuinely paid payment ID belonging to the same merchant account, for example via a low-value legitimate purchase. The plugin is fixed in 4.4.3, and no public exploit has been identified at time of analysis.
PraisonAI's Discord approval backend (praisonai.bots.DiscordApproval, versions 4.5.2 through 4.6.58) treats any later non-bot message in the configured Discord channel as the approval decision for a pending dangerous tool call, so an authenticated low-privileged Discord user who can post in that channel can reply 'yes' to a pending shell command, file write/delete or deployment request without being the intended approver - the message need not be a reply, thread message, button interaction or token-bound response. Exploitation requires a specific deployment posture: DiscordApproval used as the human gate for high-risk tools, a request already pending with its prompt posted, and attacker write access to that channel; realized impact is bounded by whichever tools the agent exposes behind approval. Vendor-released patch: upgrade pip package praisonai to 4.6.59 or later; no public exploit against live deployments is identified - the accompanying proof-of-concept is a local, mock-based harness that is not verified as working exploit code against real Discord channels.
Denial of service in vLLM before 0.31.0 allows remote attackers to crash the entire serving instance by forging or reusing a client-supplied multimodal UUID so the P0/P1 processor caches disagree on token placeholders and hit a fatal mismatch. The flaw is reachable only when the deployment serves a multimodal model and exposes the multimodal inference API; text-only vLLM deployments are not affected. No public exploit was identified at time of analysis, and authentication requirements are conflicting in the supplied data: the CVSS 4.0 vector is PR:L while the independent assessment uses PR:N and the description says unauthenticated, so exposure depends on whether the endpoint is protected (vLLM's default server has no authentication per the assessment).
A privileged, authenticated attacker who can reach the Advantech ADAM-3600 firmware upgrade function can upload a forged firmware image and achieve persistent compromise of the device. The issue is rated CVSS 4.0 8.6 (HIGH) with network reachability and high confidentiality, integrity, and availability impact, but exploitation requires high privileges (PR:H); no CISA KEV entry or public exploit code is identified in the supplied data.
LangBot through 4.11.0 accepts Lark/Feishu event-subscription callbacks without verifying the X-Lark-Signature header or verification token, so unauthenticated remote attackers who know a bot UUID can POST forged im.message.receive_v1 and card.action.trigger events into the bot. Successful injection drives the LLM pipeline, tools, and approval workflows as spoofed users, yielding high integrity impact with limited confidentiality exposure while the Lark adapter webhook is network-reachable. No public exploit code or active exploitation has been identified at time of analysis; the AC:H rating reflects the requirement to learn a valid bot UUID and reach the webhook directly.