Monthly
Cross-origin data exposure in LoopX's local status server lets an attacker-controlled web page read control-plane state from an operator's machine. From version 0.0.1 up to but not including 0.4.5, `loopx serve-status` (`loopx/status_server.py`) emits `Access-Control-Allow-Origin: *` on unauthenticated responses bound to predictable loopback ports, so any website the operator visits while the server is running can script cross-origin requests to `GET /status.json`, `GET /review-material?goal_id=...&path=...`, `GET /`, and `POST /control-plane/configure-goal/dry-run`, harvesting goal and run metadata, absolute local paths, private Markdown files under registered goal roots, and dry-run configuration projections. The request vector is unauthenticated (CVSS PR:N) but exploitation requires the user-interaction step of visiting malicious web content (UI:P), and the affected routes are strictly read-only. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; it is a genuine but bounded-impact information disclosure best treated as medium priority, with the upstream fix released in 0.4.5.
Cache poisoning and private-data disclosure in undici affect versions 7.0.0 through 7.30.0 and 8.0.0 through 8.12.1 when an originless Agent, a shared cache store, and a redirect-before-cache interceptor composition are all present. A remote unauthenticated attacker who controls the target of a redirect from a trusted URL can have the redirected response stored under the original trusted URL, causing persistent cache poisoning or exposure of user-specific private data to later callers. This is a conditionally exploitable, non-default configuration issue rather than a drop-everything priority; no public exploit identified at time of analysis, and vendor fixes are available in undici 7.30.1 and 8.12.2.
Passkey assertion forgery in the AliasVault browser extension prior to 0.29.4 allows a malicious website to supply forged origin and relying-party identifier values and, if the victim approves the AliasVault passkey prompt, obtain a valid WebAuthn assertion generated for a different website (CWE-346, origin validation error; CVSS 3.1 base 8.1). The assessed vector is remotely reachable and unauthenticated (AV:N/PR:N) with high confidentiality and integrity impact, but it mandates user interaction (UI:R) and a tight prerequisite chain: the extension must be installed, unlocked, and explicitly configured as the active passkey provider, and the victim must already have a stored passkey for the exact site being impersonated, so the flow is not silent and cannot be triggered by an attacker alone. Only the browser extension passkey provider is implicated - the server, web application, and mobile applications are explicitly unaffected - and the vendor ships a fix in 0.29.4. No public exploit identified at time of analysis.
An origin-validation bypass in the Legacy Update ActiveX control (versions 1.12.0 through 1.13.1) allows a malicious webpage opened in Internet Explorer to call control methods that should have been blocked, letting the page enumerate update and system information, install updates without consent, display dialogs, or trigger a restart when a reboot is already pending. The flaw stems from the IsPermitted method returning S_OK for any hostname that is not on the permitted list instead of failing with E_ACCESSDENIED, and it requires the victim to visit an attacker-controlled page on a host where the vulnerable control is registered. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor has released Legacy Update 1.13.2 with a fix that sets E_ACCESSDENIED on non-permitted origins.
An origin validation error (CWE-346) in Microsoft Power Apps allows an authenticated attacker to achieve remote code execution against affected client deployments by inducing a legitimate user to interact with attacker-controlled content. Only Microsoft Power Apps for Android before 3.26085.7 and Power Apps 1710 (9.2.23071.136) before 2608.5 are affected; patched builds are not vulnerable. Exploitation requires a valid authorized identity in the Power Apps environment (PR:L) plus victim interaction (UI:R), CISA's SSVC assessment records no observed exploitation and rates the attack as not automatable, and no public exploit identified at time of analysis; treat this as an elevated-priority but non-emergency patch item.
Privasys ra-tls-clients verifiers before 0.11.0 accept TEE attestation evidence without binding it to an explicitly authorized platform identity, so an unauthenticated remote attacker (CVSS vector PR:N) who can either forge attestation evidence or extract attestation secrets from a separate compromised-but-still-unrevoked Intel SGX/TDX or AMD SEV-SNP platform can present valid measurements from that other machine and impersonate the attested TLS endpoint to the verifier. Exploitation is gated by high attack complexity (AC:H, AT:P) because the attacker must actually control or forge a genuine unrevoked TEE platform, but confidentiality and integrity impact is rated High (assessed CVSS:3.1 8.1; vendor CVSS 4.0 score 9.1), and affected deployments are precisely those running the default policy with an empty platform allow-list. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; the flaw is fixed by ra-tls-clients 0.11.0, which introduces platform allow-listing that fails closed.
Cross-origin requests to the obsidian-tc Model Context Protocol HTTP transport let any web page a victim visits read from and write to the entire Obsidian vault, because releases before 1.3.1 performed no Host or Origin header validation and ran with DNS-rebinding protection disabled. The issue affects deployments that run the Streamable HTTP transport bound to loopback under the documented auth.mode 'none' configuration, where inbound requests receive full wildcard vault scopes; the attacker needs remote, unauthenticated reach via the browser (PR:N) but must convince the victim to load an attacker-controlled page while the server is running (UI:R), yielding high confidentiality and integrity impact (CVSS 8.8, CWE-346). No public exploit was identified at time of analysis, and exploitation does not apply to server-to-server MCP clients (which send no Origin header), to deployments that configure any authentication mode other than 'none', or to version 1.3.1 and later, where host, origin, and DNS-rebinding validation are enabled by default.
Session token theft in Open WebUI 0.7.0 through 0.11.3 lets any website a signed-in user visits post an unvalidated 'verify:chat' message that the SyncStatsModal component accepts without checking the sender's origin, ultimately returning the victim's JWT and granting full API access to their account. The attack is client-side and remote, scoring 8.6 (CVSS 4.0) and independently assessed at CVSS 3.1 8.x severity (AV:N/AC:L/PR:N/UI:R, C:H/I:H); it requires no server-side authentication, but does require that the victim hold a live session and interact with an attacker-controlled page. No public exploit code or active exploitation has been identified at time of analysis, and the vendor has released a fix in 0.11.4.
Insufficient isolation in Progress MarkLogic Server 12.x before 12.1.0 and 11.x before 11.3.7 allows code executed through REST Client API and XDBC evaluation paths to reach the surrounding HTTP request, response, and session state, enabling unauthorized actions or compromise of an authenticated user's session. The vendor scores this 9.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), but the scope change and full confidentiality/integrity/availability impact only materialize when an attacker can reach an evaluation interface and a victim with an authenticated session triggers it; our assessment rates the prerequisite as authenticated (PR:L) rather than unauthenticated, so exposure is limited to deployments where these endpoints are reachable and in use. No public exploit code has been identified at time of analysis, and the flaw is not confirmed as actively exploited (no CISA KEV listing) as of this report.
Attestation bypass in the Privasys rustls fork (versions prior to privasys-v0.8.1) lets an attacker who already holds a genuine enclave's TLS private key relay that enclave's RA-TLS quote onto a separate, attacker-terminated TLS 1.3 connection, causing the relying party to treat the attacker's connection as the attested enclave. Because the channel just needs to be mounted over the network with no privileges and no user interaction, the published CVSS 4.0 base score is 9.1 (Critical), though the same vector records AC:H and AT:P - reflecting that the attacker must first obtain the enclave private key and then successfully replay a valid quote, which materially constrains real-world exploitation. The flaw is fixed in privasys-v0.8.1 via a 32-byte channel binder derived from the TLS 1.3 handshake key schedule; no public exploit code was identified at time of analysis and the issue is not listed as actively exploited.
Cross-origin data exposure in LoopX's local status server lets an attacker-controlled web page read control-plane state from an operator's machine. From version 0.0.1 up to but not including 0.4.5, `loopx serve-status` (`loopx/status_server.py`) emits `Access-Control-Allow-Origin: *` on unauthenticated responses bound to predictable loopback ports, so any website the operator visits while the server is running can script cross-origin requests to `GET /status.json`, `GET /review-material?goal_id=...&path=...`, `GET /`, and `POST /control-plane/configure-goal/dry-run`, harvesting goal and run metadata, absolute local paths, private Markdown files under registered goal roots, and dry-run configuration projections. The request vector is unauthenticated (CVSS PR:N) but exploitation requires the user-interaction step of visiting malicious web content (UI:P), and the affected routes are strictly read-only. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; it is a genuine but bounded-impact information disclosure best treated as medium priority, with the upstream fix released in 0.4.5.
Cache poisoning and private-data disclosure in undici affect versions 7.0.0 through 7.30.0 and 8.0.0 through 8.12.1 when an originless Agent, a shared cache store, and a redirect-before-cache interceptor composition are all present. A remote unauthenticated attacker who controls the target of a redirect from a trusted URL can have the redirected response stored under the original trusted URL, causing persistent cache poisoning or exposure of user-specific private data to later callers. This is a conditionally exploitable, non-default configuration issue rather than a drop-everything priority; no public exploit identified at time of analysis, and vendor fixes are available in undici 7.30.1 and 8.12.2.
Passkey assertion forgery in the AliasVault browser extension prior to 0.29.4 allows a malicious website to supply forged origin and relying-party identifier values and, if the victim approves the AliasVault passkey prompt, obtain a valid WebAuthn assertion generated for a different website (CWE-346, origin validation error; CVSS 3.1 base 8.1). The assessed vector is remotely reachable and unauthenticated (AV:N/PR:N) with high confidentiality and integrity impact, but it mandates user interaction (UI:R) and a tight prerequisite chain: the extension must be installed, unlocked, and explicitly configured as the active passkey provider, and the victim must already have a stored passkey for the exact site being impersonated, so the flow is not silent and cannot be triggered by an attacker alone. Only the browser extension passkey provider is implicated - the server, web application, and mobile applications are explicitly unaffected - and the vendor ships a fix in 0.29.4. No public exploit identified at time of analysis.
An origin-validation bypass in the Legacy Update ActiveX control (versions 1.12.0 through 1.13.1) allows a malicious webpage opened in Internet Explorer to call control methods that should have been blocked, letting the page enumerate update and system information, install updates without consent, display dialogs, or trigger a restart when a reboot is already pending. The flaw stems from the IsPermitted method returning S_OK for any hostname that is not on the permitted list instead of failing with E_ACCESSDENIED, and it requires the victim to visit an attacker-controlled page on a host where the vulnerable control is registered. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor has released Legacy Update 1.13.2 with a fix that sets E_ACCESSDENIED on non-permitted origins.
An origin validation error (CWE-346) in Microsoft Power Apps allows an authenticated attacker to achieve remote code execution against affected client deployments by inducing a legitimate user to interact with attacker-controlled content. Only Microsoft Power Apps for Android before 3.26085.7 and Power Apps 1710 (9.2.23071.136) before 2608.5 are affected; patched builds are not vulnerable. Exploitation requires a valid authorized identity in the Power Apps environment (PR:L) plus victim interaction (UI:R), CISA's SSVC assessment records no observed exploitation and rates the attack as not automatable, and no public exploit identified at time of analysis; treat this as an elevated-priority but non-emergency patch item.
Privasys ra-tls-clients verifiers before 0.11.0 accept TEE attestation evidence without binding it to an explicitly authorized platform identity, so an unauthenticated remote attacker (CVSS vector PR:N) who can either forge attestation evidence or extract attestation secrets from a separate compromised-but-still-unrevoked Intel SGX/TDX or AMD SEV-SNP platform can present valid measurements from that other machine and impersonate the attested TLS endpoint to the verifier. Exploitation is gated by high attack complexity (AC:H, AT:P) because the attacker must actually control or forge a genuine unrevoked TEE platform, but confidentiality and integrity impact is rated High (assessed CVSS:3.1 8.1; vendor CVSS 4.0 score 9.1), and affected deployments are precisely those running the default policy with an empty platform allow-list. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; the flaw is fixed by ra-tls-clients 0.11.0, which introduces platform allow-listing that fails closed.
Cross-origin requests to the obsidian-tc Model Context Protocol HTTP transport let any web page a victim visits read from and write to the entire Obsidian vault, because releases before 1.3.1 performed no Host or Origin header validation and ran with DNS-rebinding protection disabled. The issue affects deployments that run the Streamable HTTP transport bound to loopback under the documented auth.mode 'none' configuration, where inbound requests receive full wildcard vault scopes; the attacker needs remote, unauthenticated reach via the browser (PR:N) but must convince the victim to load an attacker-controlled page while the server is running (UI:R), yielding high confidentiality and integrity impact (CVSS 8.8, CWE-346). No public exploit was identified at time of analysis, and exploitation does not apply to server-to-server MCP clients (which send no Origin header), to deployments that configure any authentication mode other than 'none', or to version 1.3.1 and later, where host, origin, and DNS-rebinding validation are enabled by default.
Session token theft in Open WebUI 0.7.0 through 0.11.3 lets any website a signed-in user visits post an unvalidated 'verify:chat' message that the SyncStatsModal component accepts without checking the sender's origin, ultimately returning the victim's JWT and granting full API access to their account. The attack is client-side and remote, scoring 8.6 (CVSS 4.0) and independently assessed at CVSS 3.1 8.x severity (AV:N/AC:L/PR:N/UI:R, C:H/I:H); it requires no server-side authentication, but does require that the victim hold a live session and interact with an attacker-controlled page. No public exploit code or active exploitation has been identified at time of analysis, and the vendor has released a fix in 0.11.4.
Insufficient isolation in Progress MarkLogic Server 12.x before 12.1.0 and 11.x before 11.3.7 allows code executed through REST Client API and XDBC evaluation paths to reach the surrounding HTTP request, response, and session state, enabling unauthorized actions or compromise of an authenticated user's session. The vendor scores this 9.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), but the scope change and full confidentiality/integrity/availability impact only materialize when an attacker can reach an evaluation interface and a victim with an authenticated session triggers it; our assessment rates the prerequisite as authenticated (PR:L) rather than unauthenticated, so exposure is limited to deployments where these endpoints are reachable and in use. No public exploit code has been identified at time of analysis, and the flaw is not confirmed as actively exploited (no CISA KEV listing) as of this report.
Attestation bypass in the Privasys rustls fork (versions prior to privasys-v0.8.1) lets an attacker who already holds a genuine enclave's TLS private key relay that enclave's RA-TLS quote onto a separate, attacker-terminated TLS 1.3 connection, causing the relying party to treat the attacker's connection as the attested enclave. Because the channel just needs to be mounted over the network with no privileges and no user interaction, the published CVSS 4.0 base score is 9.1 (Critical), though the same vector records AC:H and AT:P - reflecting that the attacker must first obtain the enclave private key and then successfully replay a valid quote, which materially constrains real-world exploitation. The flaw is fixed in privasys-v0.8.1 via a 32-byte channel binder derived from the TLS 1.3 handshake key schedule; no public exploit code was identified at time of analysis and the issue is not listed as actively exploited.