Monthly
Directive injection in NGINX Gateway Fabric lets an authenticated namespaced tenant escape the auth_basic "<realm>"; quoting rendered into a shared data-plane nginx.conf and inject arbitrary NGINX directives. Exploitation requires a multi-tenant deployment in which several namespaces share one Gateway/data plane, plus namespaced RBAC to create an AuthenticationFilter CRD and attach it via spec.basic.realm or spec.jwt.realm to an HTTPRoute or GRPCRoute bound to that Gateway (CVSS vector shows PR:L and UI:N, so valid authenticated credentials are required and no user interaction is needed). The impact is control-plane only, with no data-plane exposure, but a successful attacker could read co-located tenants' mounted secrets, perform SSRF through proxy_pass, read the pod ServiceAccount token, or hijack other tenants' routes; no public exploit code has been identified at time of analysis, and the issue is not confirmed actively exploited (CISA KEV).
Annotation injection in F5 NGINX Ingress Controller allows any authenticated Kubernetes principal with write access to Ingress resources to embed arbitrary NGINX configuration directives through unsanitized annotation fields. The configuration generator passes multiple user-controllable annotation values directly into the generated nginx.conf without sanitization, enabling an attacker to inject directives that create or delete files, disable services, or manipulate NGINX routing behavior. Impact is confined to the Kubernetes control plane; the NGINX data plane itself is not directly reachable through this vulnerability.
Configuration injection in NGINX Gateway Fabric allows authenticated Kubernetes users with CRD or Secret write permissions to embed arbitrary NGINX directives into the generated server configuration. The vulnerability originates in the NGINX configuration generator component, which renders Authentication Filter fields - clientID, cookieName, and clientSecret - directly into configuration templates without sanitization. Successful exploitation is limited to the control plane; no data-plane traffic is directly manipulated, but an attacker can introduce directives that compromise confidentiality and integrity of the NGINX Plus configuration. No public exploit has been identified and the issue is not listed in CISA KEV at time of analysis.
SSRF filter bypass in the dssrf npm library (versions <= 1.0.3) lets attackers defeat the is_url_safe() guard by prefixing a URL with a userinfo component (e.g. http://evil.com@127.0.0.1/). Because remove_at_symbol_in_string() strips the '@' from the raw string before new URL() parses it, the hostname is corrupted into a non-resolving string that passes all internal-IP checks, while an HTTP client fed the original URL still connects to the internal host. Publicly available exploit code exists (working PoC using nock/got in the advisory), though there is no evidence of active exploitation; this vector was missed by the earlier GHSA-8p33-q827-ghj5 fix.
Configuration injection in F5 NGINX Ingress Controller lets an authenticated Kubernetes user with rights to create or modify Ingress CRDs or annotations smuggle arbitrary NGINX directives into the generated configuration. Because multiple user-controllable fields are written to the config without sanitization, an attacker can inject directives that create or delete files and disable services on the control plane. No public exploit identified at time of analysis; this is a control-plane-only issue with no data plane exposure, but the CVSS 4.0 score of 8.7 (High) reflects strong confidentiality and integrity impact.
Configuration injection in F5 NGINX Gateway Fabric lets an authenticated Kubernetes user who can create or modify NginxProxy or AuthenticationFilter Custom Resources inject arbitrary NGINX directives into generated data-plane configuration. The flaw lives in the control-plane config generator, which renders the serverTokens and extraAuthArgs fields into NGINX templates without escaping, so any tenant holding RBAC rights over these CRDs can rewrite the NGINX Plus config that gets deployed. There is no public exploit identified at time of analysis and EPSS is low (0.36%), but SSVC rates the technical impact as total.
parisneo/lollms-webui, in its latest version, is vulnerable to remote code execution due to an insecure dependency on llama-cpp-python version. Rated high severity (CVSS 8.4), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
llama-cpp-python is the Python bindings for llama.cpp. Rated critical severity (CVSS 9.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
BerriAI/litellm is vulnerable to Server-Side Template Injection (SSTI) via the `/completions` endpoint. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
This is a reflected cross site scripting vulnerability in the PaperCut NG/MF application server. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Directive injection in NGINX Gateway Fabric lets an authenticated namespaced tenant escape the auth_basic "<realm>"; quoting rendered into a shared data-plane nginx.conf and inject arbitrary NGINX directives. Exploitation requires a multi-tenant deployment in which several namespaces share one Gateway/data plane, plus namespaced RBAC to create an AuthenticationFilter CRD and attach it via spec.basic.realm or spec.jwt.realm to an HTTPRoute or GRPCRoute bound to that Gateway (CVSS vector shows PR:L and UI:N, so valid authenticated credentials are required and no user interaction is needed). The impact is control-plane only, with no data-plane exposure, but a successful attacker could read co-located tenants' mounted secrets, perform SSRF through proxy_pass, read the pod ServiceAccount token, or hijack other tenants' routes; no public exploit code has been identified at time of analysis, and the issue is not confirmed actively exploited (CISA KEV).
Annotation injection in F5 NGINX Ingress Controller allows any authenticated Kubernetes principal with write access to Ingress resources to embed arbitrary NGINX configuration directives through unsanitized annotation fields. The configuration generator passes multiple user-controllable annotation values directly into the generated nginx.conf without sanitization, enabling an attacker to inject directives that create or delete files, disable services, or manipulate NGINX routing behavior. Impact is confined to the Kubernetes control plane; the NGINX data plane itself is not directly reachable through this vulnerability.
Configuration injection in NGINX Gateway Fabric allows authenticated Kubernetes users with CRD or Secret write permissions to embed arbitrary NGINX directives into the generated server configuration. The vulnerability originates in the NGINX configuration generator component, which renders Authentication Filter fields - clientID, cookieName, and clientSecret - directly into configuration templates without sanitization. Successful exploitation is limited to the control plane; no data-plane traffic is directly manipulated, but an attacker can introduce directives that compromise confidentiality and integrity of the NGINX Plus configuration. No public exploit has been identified and the issue is not listed in CISA KEV at time of analysis.
SSRF filter bypass in the dssrf npm library (versions <= 1.0.3) lets attackers defeat the is_url_safe() guard by prefixing a URL with a userinfo component (e.g. http://evil.com@127.0.0.1/). Because remove_at_symbol_in_string() strips the '@' from the raw string before new URL() parses it, the hostname is corrupted into a non-resolving string that passes all internal-IP checks, while an HTTP client fed the original URL still connects to the internal host. Publicly available exploit code exists (working PoC using nock/got in the advisory), though there is no evidence of active exploitation; this vector was missed by the earlier GHSA-8p33-q827-ghj5 fix.
Configuration injection in F5 NGINX Ingress Controller lets an authenticated Kubernetes user with rights to create or modify Ingress CRDs or annotations smuggle arbitrary NGINX directives into the generated configuration. Because multiple user-controllable fields are written to the config without sanitization, an attacker can inject directives that create or delete files and disable services on the control plane. No public exploit identified at time of analysis; this is a control-plane-only issue with no data plane exposure, but the CVSS 4.0 score of 8.7 (High) reflects strong confidentiality and integrity impact.
Configuration injection in F5 NGINX Gateway Fabric lets an authenticated Kubernetes user who can create or modify NginxProxy or AuthenticationFilter Custom Resources inject arbitrary NGINX directives into generated data-plane configuration. The flaw lives in the control-plane config generator, which renders the serverTokens and extraAuthArgs fields into NGINX templates without escaping, so any tenant holding RBAC rights over these CRDs can rewrite the NGINX Plus config that gets deployed. There is no public exploit identified at time of analysis and EPSS is low (0.36%), but SSVC rates the technical impact as total.
parisneo/lollms-webui, in its latest version, is vulnerable to remote code execution due to an insecure dependency on llama-cpp-python version. Rated high severity (CVSS 8.4), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
llama-cpp-python is the Python bindings for llama.cpp. Rated critical severity (CVSS 9.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
BerriAI/litellm is vulnerable to Server-Side Template Injection (SSTI) via the `/completions` endpoint. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
This is a reflected cross site scripting vulnerability in the PaperCut NG/MF application server. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.