Monthly
Microsoft QUIC (MsQuic) can be made to bypass a security feature over the network because a security-relevant variable is initialized to an insecure default (CWE-453), producing a CVSS 7.5 condition with no confidentiality impact, limited integrity impact and full availability impact (AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:H). The issue is unauthenticated and requires no user interaction, but is only reachable on hosts that actually run a network-exposed QUIC listener - HTTP/3 or SMB over QUIC - and the high attack complexity reflects a timing/transient-state prerequisite the attacker cannot directly control. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV; the MSRC update guide is the authoritative source for affected builds and fixes.
Sandbox escape in the vm2 Node.js sandboxing library before 3.11.7 lets an attacker who supplies a malicious script file to the vm2 command-line tool execute arbitrary code in the host Node.js process, gaining access to host modules such as fs and child_process. The vulnerable entry point is the CLI utility specifically, not the library's programmatic VM/NodeVM API: an attacker-crafted script uses require(__filename) to re-execute itself in the host realm and slip past the sandbox membrane. Exploitation is local rather than network-facing (CVSS 4.0 AV:L/UI:P, PR:N), requiring a victim or automated job to invoke the vm2 CLI against the attacker-controlled file; the vendor rating is 9.3 (critical), but the local vector and required user interaction make real-world exposure materially narrower than the network-facing vm2 escapes, and there is no public exploit identified at time of analysis.
Local privilege escalation in Google Android's NFC subsystem allows unprivileged local apps to gain special app access permissions without user interaction, due to an insecure default value in NfcDispatcher.tryStartActivity. Affected Android builds are covered by the Android Security Bulletin (android-17 reference). No public exploit identified at time of analysis; tagged as Privilege Escalation by the Android reporter.
Information disclosure in libsndfile 1.2.2 and earlier allows remote attackers to trigger use of an uninitialized variable when a crafted WAV file is parsed through wavlike_subchunk_parse in src/wavlike.c, exposing a limited amount of memory contents (CVSS 3.1: 5.3-equivalent vector rated C:L, I:N, A:N; CVSS 4.0 base score 2.1). Affected are applications that link libsndfile and accept attacker-supplied WAV input up to and including version 1.2.2; no authentication is required but the victim must passively process or open the malicious file (UI:P), so there is no zero-interaction remote trigger. Publicly available exploit code exists and was disclosed alongside a project issue report that upstream has not yet responded to, but the issue is not confirmed as actively exploited (not in CISA KEV), and the low-severity, read-only impact keeps overall risk low despite the public PoC.
OpenClaw before version 2026.3.31 fails to sanitize environment variables in its host exec policy, allowing authenticated local attackers to override proxy, TLS, Docker, and Git TLS security controls. An attacker with local access and limited privileges can bypass intended security restrictions by injecting malicious environment variables, potentially disabling certificate verification or redirecting traffic through unauthorized proxies. No public exploit code has been identified, and the vulnerability requires process interaction (AT:P) to trigger.
Webhook authentication bypass in the Allstar Reviewbot component (Allstar releases prior to v4.5) lets an unauthenticated remote attacker forge inbound GitHub webhook requests, because the component validates signatures against a hard-coded, shared secret ('FooBar') compiled into the binary rather than a configurable value. Attackers who can reach the Reviewbot endpoint can trigger review actions, post automated comments/reviews, and otherwise manipulate repository workflow signals - integrity is impacted (CVSS 3.1 I:H) with no confidentiality or availability effect. Impact is gated by deployment: Reviewbot is not enabled in standard Allstar setups and the endpoint must be network-reachable; deployments on v4.5+ or without Reviewbot exposed are unaffected. No public exploit code and no CISA KEV entry were identified at time of analysis, and EPSS is low at 0.40% (32nd percentile), consistent with the narrow, non-default deployment precondition.
In onNullBinding of RemoteFillService.java, there is a possible background activity launch due to an insecure default value. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Donetick an open-source app for managing tasks and chores. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Windows Remote Desktop Services Remote Code Execution Vulnerability. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
filestash v0.4 is configured to skip TLS certificate verification when using the FTPS protocol, possibly allowing attackers to execute a man-in-the-middle attack via the Init function of index.go. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Microsoft QUIC (MsQuic) can be made to bypass a security feature over the network because a security-relevant variable is initialized to an insecure default (CWE-453), producing a CVSS 7.5 condition with no confidentiality impact, limited integrity impact and full availability impact (AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:H). The issue is unauthenticated and requires no user interaction, but is only reachable on hosts that actually run a network-exposed QUIC listener - HTTP/3 or SMB over QUIC - and the high attack complexity reflects a timing/transient-state prerequisite the attacker cannot directly control. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV; the MSRC update guide is the authoritative source for affected builds and fixes.
Sandbox escape in the vm2 Node.js sandboxing library before 3.11.7 lets an attacker who supplies a malicious script file to the vm2 command-line tool execute arbitrary code in the host Node.js process, gaining access to host modules such as fs and child_process. The vulnerable entry point is the CLI utility specifically, not the library's programmatic VM/NodeVM API: an attacker-crafted script uses require(__filename) to re-execute itself in the host realm and slip past the sandbox membrane. Exploitation is local rather than network-facing (CVSS 4.0 AV:L/UI:P, PR:N), requiring a victim or automated job to invoke the vm2 CLI against the attacker-controlled file; the vendor rating is 9.3 (critical), but the local vector and required user interaction make real-world exposure materially narrower than the network-facing vm2 escapes, and there is no public exploit identified at time of analysis.
Local privilege escalation in Google Android's NFC subsystem allows unprivileged local apps to gain special app access permissions without user interaction, due to an insecure default value in NfcDispatcher.tryStartActivity. Affected Android builds are covered by the Android Security Bulletin (android-17 reference). No public exploit identified at time of analysis; tagged as Privilege Escalation by the Android reporter.
Information disclosure in libsndfile 1.2.2 and earlier allows remote attackers to trigger use of an uninitialized variable when a crafted WAV file is parsed through wavlike_subchunk_parse in src/wavlike.c, exposing a limited amount of memory contents (CVSS 3.1: 5.3-equivalent vector rated C:L, I:N, A:N; CVSS 4.0 base score 2.1). Affected are applications that link libsndfile and accept attacker-supplied WAV input up to and including version 1.2.2; no authentication is required but the victim must passively process or open the malicious file (UI:P), so there is no zero-interaction remote trigger. Publicly available exploit code exists and was disclosed alongside a project issue report that upstream has not yet responded to, but the issue is not confirmed as actively exploited (not in CISA KEV), and the low-severity, read-only impact keeps overall risk low despite the public PoC.
OpenClaw before version 2026.3.31 fails to sanitize environment variables in its host exec policy, allowing authenticated local attackers to override proxy, TLS, Docker, and Git TLS security controls. An attacker with local access and limited privileges can bypass intended security restrictions by injecting malicious environment variables, potentially disabling certificate verification or redirecting traffic through unauthorized proxies. No public exploit code has been identified, and the vulnerability requires process interaction (AT:P) to trigger.
Webhook authentication bypass in the Allstar Reviewbot component (Allstar releases prior to v4.5) lets an unauthenticated remote attacker forge inbound GitHub webhook requests, because the component validates signatures against a hard-coded, shared secret ('FooBar') compiled into the binary rather than a configurable value. Attackers who can reach the Reviewbot endpoint can trigger review actions, post automated comments/reviews, and otherwise manipulate repository workflow signals - integrity is impacted (CVSS 3.1 I:H) with no confidentiality or availability effect. Impact is gated by deployment: Reviewbot is not enabled in standard Allstar setups and the endpoint must be network-reachable; deployments on v4.5+ or without Reviewbot exposed are unaffected. No public exploit code and no CISA KEV entry were identified at time of analysis, and EPSS is low at 0.40% (32nd percentile), consistent with the narrow, non-default deployment precondition.
In onNullBinding of RemoteFillService.java, there is a possible background activity launch due to an insecure default value. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Donetick an open-source app for managing tasks and chores. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Windows Remote Desktop Services Remote Code Execution Vulnerability. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
filestash v0.4 is configured to skip TLS certificate verification when using the FTPS protocol, possibly allowing attackers to execute a man-in-the-middle attack via the Init function of index.go. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.