Monthly
Local privilege escalation in Nix (before 2.35.3) and Lix (before 2.95.4) allows an unprivileged local user to escalate to the privileged nix-daemon account-typically root-by exploiting a repair operation that destroys and replaces a store path before verifying its content. The flaw is a timing-sensitive incorrect behavior order (CWE-696) that only affects multi-user daemon deployments; single-user installs are far less exposed. No public exploit code has been identified at time of analysis.
A label-enforcement bypass in the External Secrets Operator (ESO) webhook generator lets any Kubernetes principal that is permitted to create webhook generator resources point a generator at a victim's Secret that was never labelled for webhook use, and then have its contents exfiltrated to an attacker-controlled URL. The flaw affects ESO releases from 0.10.0 up to (but not including) 1.3.2 and stems from an initialization-order bug that cleared the EnforceLabels flag after it had been set, so the provider-side check for the external-secrets.io/type=webhook label was skipped instead of failing. Exploitation is conditional: it requires an affected version, the webhook generator feature in use, and delegated RBAC rights to create generators.external-secrets.io/v1alpha1 Webhook objects, which is why the assessed vector carries PR:L; clusters that never use webhook generators or that tightly constrain generator creation are not exposed. No public exploit code was identified at time of analysis and the issue is not in CISA KEV, and a vendor patch is available in 1.3.2.
Import-time code execution in Docling 2.27.0 through 2.131.0 lets any distribution already present in the same Python environment that registers an entry point in the 'docling' group run arbitrary code as soon as Docling's plugin factories initialize - even when allow_external_plugins is set to false, because the plugin manager imports every registered module before the namespace allow-list is applied and then misleadingly logs that the plugin was skipped. The assessed vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) confirms this is a local, supply-chain-style prerequisite: an attacker must first get a third-party or compromised package installed and registered, and Docling must then be started by a user, so there is no remote network exploitation path. No public exploit code or active exploitation is known at time of analysis (EPSS 0.11%, percentile 1%; CISA SSVC exploitation: none), and the vendor has shipped a fix in 2.131.0.
Unauthenticated attackers positioned on the same Layer 2 broadcast segment as an Arista EOS device can force that device to tear down an established IS-IS adjacency by sending a crafted IS-IS Hello P
Full system compromise of Phoenix Contact CHARX SEC EV charging controllers (SEC-3000/3050/3100/3150, versions 1.0.0 through 1.9.0) is possible because an incorrect script execution order tears down the firewall too early during system shutdown, briefly exposing internal-only services to the network. During this transient window a remote unauthenticated attacker can reach services that are normally firewalled off and gain complete control of the device. No public exploit identified at time of analysis, but the flaw is vendor-confirmed (CERT@VDE / advisory VDE-2026-008) and carries a CVSS 4.0 base score of 9.3.
Password overwrite and administrative unavailability on an unspecified
Remote code execution in GitHub Copilot CLI versions prior to 1.0.43 allows attackers to execute arbitrary commands via malicious bare git repositories embedded in project directories. When the CLI agent performs routine git operations, git's automatic bare repository discovery triggers execution of commands specified in config keys like core.fsmonitor. Attackers can deliver the malicious repository through pull requests, compromised dependencies, or pre-existing cloned repositories. No public exploit identified at time of analysis, though the attack technique leverages well-documented git behavior. The vendor-released patch (version 1.0.43) sets safe.bareRepository=explicit to block automatic bare repository discovery.
Session isolation bypass in OpenClaw 2026.3.11 through 2026.3.24 allows authenticated attackers to access parent or sibling sessions bypassing visibility restrictions. The vulnerability exploits session_status logic that resolves sessionId to canonical session keys before enforcing explicit sessionKey-based access controls, enabling sandboxed child sessions to read data from sessions they should not access. No public exploit identified at time of analysis. Impacts confidentiality of session data across isolation boundaries in multi-tenant or sandboxed deployment scenarios.
Argument/command injection in OpenSSH before 10.3 lets shell metacharacters embedded in an untrusted username trigger command execution on the SSH-client host. It affects deployments that both feed an attacker-influenced username to the ssh command line and use a non-default ssh_config where %-token expansion (e.g. in ProxyCommand/LocalCommand) is enabled. There is no public exploit identified at time of analysis, EPSS is negligible (0.01%), and it is not in CISA KEV; a fixed release (10.3/10.3p1) is available.
TYPO3 CMS versions 14.0.0 through 14.3.8 contain an information disclosure flaw where forms using FileUpload or ImageUpload elements with a custom non-default saveToFileMount store uploaded files in the public 1:/user_upload/ folder instead of the configured restricted storage. This allows unauthenticated remote attackers to access files that were intended to be protected, as they are served without the access checks normally applied to non-public storages, but exploitation requires a specific form configuration and depends on whether sensitive files are uploaded and enumerable. No public exploit code or active exploitation has been reported; the vendor-assigned CVSS 4.0 score is 6.3 (moderate), while our independent assessment yields a lower CVSS 3.1 score due to high attack complexity (AC:H).
Local privilege escalation in Nix (before 2.35.3) and Lix (before 2.95.4) allows an unprivileged local user to escalate to the privileged nix-daemon account-typically root-by exploiting a repair operation that destroys and replaces a store path before verifying its content. The flaw is a timing-sensitive incorrect behavior order (CWE-696) that only affects multi-user daemon deployments; single-user installs are far less exposed. No public exploit code has been identified at time of analysis.
A label-enforcement bypass in the External Secrets Operator (ESO) webhook generator lets any Kubernetes principal that is permitted to create webhook generator resources point a generator at a victim's Secret that was never labelled for webhook use, and then have its contents exfiltrated to an attacker-controlled URL. The flaw affects ESO releases from 0.10.0 up to (but not including) 1.3.2 and stems from an initialization-order bug that cleared the EnforceLabels flag after it had been set, so the provider-side check for the external-secrets.io/type=webhook label was skipped instead of failing. Exploitation is conditional: it requires an affected version, the webhook generator feature in use, and delegated RBAC rights to create generators.external-secrets.io/v1alpha1 Webhook objects, which is why the assessed vector carries PR:L; clusters that never use webhook generators or that tightly constrain generator creation are not exposed. No public exploit code was identified at time of analysis and the issue is not in CISA KEV, and a vendor patch is available in 1.3.2.
Import-time code execution in Docling 2.27.0 through 2.131.0 lets any distribution already present in the same Python environment that registers an entry point in the 'docling' group run arbitrary code as soon as Docling's plugin factories initialize - even when allow_external_plugins is set to false, because the plugin manager imports every registered module before the namespace allow-list is applied and then misleadingly logs that the plugin was skipped. The assessed vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) confirms this is a local, supply-chain-style prerequisite: an attacker must first get a third-party or compromised package installed and registered, and Docling must then be started by a user, so there is no remote network exploitation path. No public exploit code or active exploitation is known at time of analysis (EPSS 0.11%, percentile 1%; CISA SSVC exploitation: none), and the vendor has shipped a fix in 2.131.0.
Unauthenticated attackers positioned on the same Layer 2 broadcast segment as an Arista EOS device can force that device to tear down an established IS-IS adjacency by sending a crafted IS-IS Hello P
Full system compromise of Phoenix Contact CHARX SEC EV charging controllers (SEC-3000/3050/3100/3150, versions 1.0.0 through 1.9.0) is possible because an incorrect script execution order tears down the firewall too early during system shutdown, briefly exposing internal-only services to the network. During this transient window a remote unauthenticated attacker can reach services that are normally firewalled off and gain complete control of the device. No public exploit identified at time of analysis, but the flaw is vendor-confirmed (CERT@VDE / advisory VDE-2026-008) and carries a CVSS 4.0 base score of 9.3.
Password overwrite and administrative unavailability on an unspecified
Remote code execution in GitHub Copilot CLI versions prior to 1.0.43 allows attackers to execute arbitrary commands via malicious bare git repositories embedded in project directories. When the CLI agent performs routine git operations, git's automatic bare repository discovery triggers execution of commands specified in config keys like core.fsmonitor. Attackers can deliver the malicious repository through pull requests, compromised dependencies, or pre-existing cloned repositories. No public exploit identified at time of analysis, though the attack technique leverages well-documented git behavior. The vendor-released patch (version 1.0.43) sets safe.bareRepository=explicit to block automatic bare repository discovery.
Session isolation bypass in OpenClaw 2026.3.11 through 2026.3.24 allows authenticated attackers to access parent or sibling sessions bypassing visibility restrictions. The vulnerability exploits session_status logic that resolves sessionId to canonical session keys before enforcing explicit sessionKey-based access controls, enabling sandboxed child sessions to read data from sessions they should not access. No public exploit identified at time of analysis. Impacts confidentiality of session data across isolation boundaries in multi-tenant or sandboxed deployment scenarios.
Argument/command injection in OpenSSH before 10.3 lets shell metacharacters embedded in an untrusted username trigger command execution on the SSH-client host. It affects deployments that both feed an attacker-influenced username to the ssh command line and use a non-default ssh_config where %-token expansion (e.g. in ProxyCommand/LocalCommand) is enabled. There is no public exploit identified at time of analysis, EPSS is negligible (0.01%), and it is not in CISA KEV; a fixed release (10.3/10.3p1) is available.
TYPO3 CMS versions 14.0.0 through 14.3.8 contain an information disclosure flaw where forms using FileUpload or ImageUpload elements with a custom non-default saveToFileMount store uploaded files in the public 1:/user_upload/ folder instead of the configured restricted storage. This allows unauthenticated remote attackers to access files that were intended to be protected, as they are served without the access checks normally applied to non-public storages, but exploitation requires a specific form configuration and depends on whether sensitive files are uploaded and enumerable. No public exploit code or active exploitation has been reported; the vendor-assigned CVSS 4.0 score is 6.3 (moderate), while our independent assessment yields a lower CVSS 3.1 score due to high attack complexity (AC:H).