Python

Authentication denial of service in free5GC AUSF v1.4.4 and current main allows an attacker with access to the AUSF SBI/N12 interface to permanently block a target subscriber from completing 5G authentication by flooding the AUSF with concurrent POST /nausf-auth/v1/ue-authentications requests for the same SUPI. Each concurrent request silently overwrites the active EAP-AKA' session context stored under that SUPI key, so the legitimate UE's EAP response is validated against mismatched cryptographic material (K_aut, XRES) and fails AT_MAC verification. No vendor patch has been released; a working proof-of-concept was reproduced in a controlled lab and is documented in the upstream GHSA advisory, with no CISA KEV listing identified at time of analysis.

Exponential backtracking ReDoS in Protego (pip/protego <= 0.6.1) allows any party who can serve a crafted robots.txt to freeze the `can_fetch()` call indefinitely, denying service to any application using this library for robots.txt compliance. A working proof-of-concept is publicly available in the GitHub security advisory GHSA-wjmf-p669-5m5p; the CVSS 4.0 score of 7.1 (VA:H) reflects meaningful availability risk for web-crawling deployments. No public exploit identified at time of analysis beyond the published PoC, and no CISA KEV listing exists.

Privilege escalation in piccolo_admin 1.13.0 and earlier allows any non-superuser admin to permanently elevate to superuser by exploiting a two-flaw chain: the `superuser_validators` access-control function uses a deny-list that omits GET, and the `SessionsBase.token` column is stored as plaintext Varchar without `secret=True`, causing it to appear in every GET /api/tables/sessions/ response. An authenticated low-privilege admin can harvest the superuser's live session token in a single unauthenticated-to-superuser GET request, replay it to issue a PATCH that sets `superuser=true` on their own row, and permanently retain elevated access - the stolen cookie is then discarded. A publicly available proof-of-concept with full reproduction steps was included in the GitHub security advisory (GHSA-2gh4-jmwq-rr8w); no CISA KEV listing is present at time of analysis.

Blind SQL injection in WsgiDAV's MySQLBrowserProvider sample module (versions <= 4.3.4) allows unauthenticated network attackers to read arbitrary data from the backing MySQL database via URL path manipulation. The record key segment of the URL is concatenated directly into a WHERE clause without escaping, enabling a boolean status-code oracle that supports full character-by-character data extraction. A secondary typo in the numeric-type check (`INTT` instead of `INT`) ensures all primary key types take the vulnerable quoted branch, and a working PoC with complete extraction script has been publicly confirmed. No public exploit identified as confirmed actively exploited (CISA KEV), but the PoC lowers the exploitation bar significantly.

Cross-project Kanban data destruction in Vikunja allows any authenticated user to permanently wipe `task_buckets` and `task_positions` for any project view in the entire instance, regardless of project membership. Affecting versions 0.24.6 through 2.4.0, the `ProjectView.Delete` method performs two unscoped cascading SQL deletes using only the URL-supplied view ID after an authorization check that verifies admin rights on the attacker's own project - never confirming the target view belongs to that project. A working PoC is publicly available via the GHSA advisory; view IDs are auto-increment integers, making full-instance enumeration trivial with no prior reconnaissance.

Remote code execution in BISHENG's workflow engine (versions before 2.6.0) allows any authenticated user to submit crafted Code node definitions to the POST /api/v1/workflow/run_once endpoint, where they are evaluated via Python's exec() built-in without sandboxing or process isolation. Successful exploitation grants full server-side code execution with access to the host filesystem, stored credentials, and internal network resources reachable from the BISHENG backend process. No public exploit or CISA KEV listing has been identified at time of analysis, but the low-complexity, authenticated network attack path represents a critical risk especially in multi-tenant or shared-access deployments.

Arbitrary code execution in SpeechBrain before v1.1.1 is triggered during checkpoint candidate enumeration when PyYAML's unsafe loader parses attacker-controlled CKPT.yaml files in the configured checkpoint path. An attacker who can plant a crafted CKPT.yaml - for example via a malicious pretrained model distributed through a public model repository - can embed !!python/object/apply YAML tags that cause Python to instantiate arbitrary objects at parse time, achieving code execution before any checkpoint is ever selected for recovery. No public exploit specific to this CVE has been identified at time of analysis, and it is not listed in the CISA KEV catalog, but the underlying PyYAML unsafe deserialization class is extensively documented and exploit techniques are widely known.

Uncontrolled recursion in NLTK's FeatStructReader component (all versions before 3.10.3) enables unauthenticated remote attackers to crash any Python application that parses user-supplied feature structures or feature grammars. Attackers submit trivially crafted payloads containing deeply nested brackets, exhausting Python's call stack and raising an unhandled RecursionError that terminates the application process. No active exploitation has been confirmed by CISA KEV, and no public exploit code has been identified at time of analysis; a vendor patch is available in NLTK 3.10.3.

Unauthenticated remote code execution affects mims-harvard ToolUniverse through 1.2.6, where the python_code_executor tool runs caller-supplied Python in a sandbox that can be escaped and the HTTP/MCP servers listen on all interfaces with no authentication. Any attacker who can reach the exposed port executes arbitrary code as the server process, since the deny-list source inspection can be bypassed via dunder attribute traversal and a per-call flag that widens the import allow-list. No public exploit code is identified at time of analysis, but the flaw is reported by VulnCheck and carries a CVSS 4.0 base score of 9.3; it is fixed in version 1.3.0.

Remote code execution in Flowintel's alerts settings update endpoint (versions >= 3.3.0) allows an authenticated high-privileged attacker to inject arbitrary Python statements into the application's live configuration module. The vulnerable endpoint in app/alerts/alerts.py interpolated attacker-supplied configuration keys directly into Python source written to conf/config_module.py, then triggered importlib.reload() - executing injected code in the server process. No public exploit has been identified and the vulnerability is not listed in CISA KEV, but successful exploitation yields full server-side code execution with the privileges of the Flowintel process.

Frappe's REST API before v15.115.0 contains an access control bypass (CWE-863) that allows any low-privileged authenticated user to read fields from Linked DocType records outside their permitted scope. When a document is fetched via the REST API, the framework resolves Link field references to other DocTypes but inconsistently re-applies the linked DocType's own permission rules, enabling horizontal data leakage across role boundaries. No confirmed active exploitation or public exploit code has been identified, but the low attack complexity and network-accessible vector create meaningful data exfiltration risk in multi-role or multi-tenant Frappe/ERPNext deployments.

Code injection in whichllm's run and snippet CLI commands allows a network-positioned attacker who controls a HuggingFace repository to achieve full arbitrary code execution on any victim's machine by publishing a repository containing a crafted GGUF filename with Python metacharacters. The script generation function in cli.py interpolates the HuggingFace Hub API siblings rfilename field directly into dynamically generated Python source without escaping, enabling a string-literal breakout that fires injected code before any model download occurs. No active exploitation is confirmed in CISA KEV and no public proof-of-concept is referenced; vendor-released patch v0.5.16 is available and directly remediates the root cause.

Unauthenticated remote code execution in SENAITE.CORE (senaite.core) 2.0.0 through 2.6.0 lets any network-reachable attacker run arbitrary Python in the Zope worker process by chaining a missing authorization check with an eval() sink in the JSON API. The anonymous-reachable /@@API/update route calls eval() on attacker-supplied RecordsField/RecordField values before any permission or write check fires, and a public working PoC (tested against the stock senaite/senaite:v2.6.0 Docker image) demonstrates credential-free command execution. Publicly available exploit code exists; the flaw is not listed in CISA KEV, so there is no confirmation of active exploitation.

Remote code execution in Google langfun before 0.1.2 arises because the default lf.query Python protocol evaluates model-generated Python expressions with no sandbox, letting remote unauthenticated attackers run arbitrary code in the host application by supplying crafted prompt inputs that steer the model into emitting executable code. Because langfun embeds directly in LLM-driven Python applications, any deployment that pipes untrusted prompt content through lf.query is exposed. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the CVSS 4.0 base score of 9.2 (CRITICAL) reflects full confidentiality, integrity, and availability impact.

Starlette-Admin, the Python ASGI-based administrative UI framework, fails to validate sort and filter parameters against configured field allowlists on its backend API, allowing any authenticated user to bypass the frontend field restrictions and query hidden or non-sortable columns as an information-disclosure oracle. Additionally, passing special Python attribute names such as `__class__` or `metadata` as field values triggers unhandled exceptions that return HTTP 500 responses, creating a limited denial-of-service condition against targeted list endpoints. All versions prior to 0.16.1 are affected; no public exploit code has been identified and this vulnerability is not in CISA KEV.

ReDoS in NLTK's tgrep module exposes applications to indefinite CPU saturation when user-controlled tgrep patterns containing /regex/ nodes reach the _tgrep_node_action function, which compiles and executes them via Python's re.search without validation or timeout. All NLTK versions before 3.10.3 are affected when tgrep_positions() or tgrep_compile() accept external input. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; exploitation is conditional on a non-default, externally-exposed API configuration.

Catastrophic regex backtracking in NLTK before 3.10.0 allows unauthenticated remote attackers to saturate CPU and deny service to all users sharing the Python process by supplying crafted patterns to the Text.findall() or TokenSearcher.findall() methods. Any Python application that exposes NLTK regex search functionality to user-controlled input is affected across all platforms. No public exploit has been identified at time of analysis, but the vulnerability class (ReDoS) is well-understood and trivial to weaponize once the targeted endpoint is known.

Arbitrary file write and directory deletion in compliance-trestle's catalog-generate, profile-generate, and ssp-generate author commands exposes CI/CD pipelines to workspace-escape attacks when output arguments are derived from untrusted data. The affected commands construct output paths by joining a user-supplied argument onto the Trestle workspace root, but apply only a task-name-collision check rather than the PathSecurityValidator guard already used by the jinja command - allowing absolute paths or traversal sequences to escape the workspace entirely. With --force-overwrite, the primitive escalates to recursive deletion of an attacker-chosen directory tree followed by file creation, enabling indirect code execution by overwriting files (e.g., .github/workflows, .git/hooks, shell profile scripts) that a downstream pipeline subsequently executes. No public exploit is identified at time of analysis, though the GHSA advisory for the related jinja variant (GHSA-4q5v-7g7x-j79w) contains a detailed reproduction procedure.

Server-side template injection in Compliance-Trestle's custom Jinja2 include tags (`mdsection_include` and `md_clean_include`) allows a low-privileged local attacker to achieve arbitrary code execution when attacker-controlled OSCAL data containing Jinja2 syntax is processed during template rendering. All versions prior to 3.12.4 and the 4.0.0-4.0.3 line are affected; the fix is version 4.1.0. No CISA KEV listing or standalone public exploit has been identified at time of analysis, though security test payloads demonstrating the RCE gadget chain are present in the upstream fix commits.

Server-side template injection in compliance-trestle's custom Jinja2 tags enables remote code execution when the tool processes attacker-controlled Markdown or YAML content. Versions before 3.12.4 and the 4.0.x series through 4.0.3 are affected; the root flaw is that MDCleanInclude and MDSectionInclude re-parse included content using a non-sandboxed jinja2.Environment, allowing injected expressions to traverse Python object internals and invoke arbitrary OS commands as the Trestle process user. No public exploit or CISA KEV listing has been identified at time of analysis, but the attack surface is realistic in supply-chain workflows where users import third-party SSP or YAML documents.

Worker-thread exhaustion in Mesop's debug-mode hot-reload endpoint (prior to version 1.3.3) allows an unauthenticated remote attacker to render the server completely unavailable with minimal effort. The GET /hot-reload endpoint in debug mode enters an unbounded loop controlled by the attacker-supplied counter parameter, holding worker threads indefinitely until the thread pool is exhausted and the server stops responding to all requests. Recovery requires a manual server restart. No public exploit has been identified at time of analysis, but the attack mechanism is trivially simple and fully automatable.

Unauthenticated arbitrary file write in DB-GPT 0.8.0 lets remote attackers achieve remote code execution through the skill_upload endpoint, which builds an upload path by joining the user-controlled multipart filename to the upload directory without canonicalisation or containment checks. Because the route's only auth dependency (get_user_from_headers) returns an admin-role request even when no credentials are supplied, an attacker with no account can write a .py file such as ../../../tmp/x or /tmp/x anywhere the server process can write, then plant or overwrite a Python module that executes when next imported. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV, but the flaw is trivially exploitable and fixed in v0.8.1.

Heap buffer overflow in PyOpenEXR Python bindings versions 3.3.0-3.3.12 and 3.4.0-3.4.13 causes memory corruption and process crash when opening a crafted deep scanline EXR file. A specific channel naming collision - a literal channel 'left' coexisting with layer-prefixed 'left.R', 'left.G', 'left.B' - causes the wrapper to allocate scalar-shaped deep sample storage and then write into it at RGB stride (three lanes), overflowing the heap allocation. No public exploit or CISA KEV listing exists at time of analysis; vendor-confirmed fixes are available in versions 3.3.13 and 3.4.14.

Unauthenticated remote code execution in Chainlit (2.4.0rc0 through 2.11.x) occurs when features.mcp.enabled is set to true, exposing the POST /mcp endpoint that accepts a user-controlled stdio command string. Because the allowlist only validates the executable name and passes arguments unchecked, an attacker can supply 'npx -y -c <payload>' to run arbitrary shell commands as the Chainlit process. Publicly available exploit code exists (working PoC from the reporting researchers and in the advisory); it is not listed in CISA KEV, and MCP has been disabled by default since v2.7.0, limiting the exposed population.

Remote code execution in Amazon Strands Agents Tools before 0.8.5 lets an attacker abuse the python_repl tool to run arbitrary Python on the agent's host by defeating its human-in-the-loop consent gate. A crafted prompt smuggles the non_interactive_mode flag as a keyword argument through the batch tool, causing python_repl to execute without operator approval. No public exploit has been identified at time of analysis, but the CVSS 4.0 base score is 9.2 (Critical) given full confidentiality, integrity, and availability impact on the host.

PyOpenEXR Python bindings in OpenEXR versions 3.3.0-3.3.12 and 3.4.0-3.4.13 leak uninitialized same-process heap memory to calling Python code when processing crafted deep scanline EXR files that contain layer-prefixed RGB channels. The flaw originates in PyPart::setDeepSliceData(), where lane assignment uses exact unprefixed string matching, leaving the green and blue NumPy array lanes uninitialized before returning them to the caller. Python applications ingesting untrusted EXR files that subsequently log, serialize, or transmit the resulting arrays may inadvertently expose heap contents; no public exploit code has been identified at time of analysis, and this vulnerability is not listed in CISA KEV.

CPU exhaustion denial-of-service in eml_parser (Python pip package, versions prior to 3.0.2) stems from a quadratic-time regex fix-point loop in the `noparenthesis` function used to strip parenthesized CFWS comments from `Received:` email headers. Remote, unauthenticated attackers can submit small, specially crafted EML files containing deeply nested parentheses that consume multiple seconds of CPU time per parsed message, degrading throughput and causing queue backpressure or service-level outages in synchronous email gateways, sandboxes, and real-time triage pipelines. No public exploit has been identified at time of analysis, but the attack is trivially reproducible from first principles using only the published advisory description.

Denial of service in GOVCERT-LU's eml_parser Python library (versions prior to 3.0.2) allows a network-reachable attacker to abort SOC pipeline email parsing by submitting a crafted EML file containing deeply nested CFWS (Comment/Folding White Space) constructs in address-bearing headers such as To, From, Cc, or Bcc. The RecursionError raised internally by Python's email.utils.getaddresses() propagates uncaught through eml_parser, halting analysis of the entire message rather than just the offending header. No public exploit or active exploitation has been identified at time of analysis; the vendor notes partial mitigation because callers already need to handle exceptions from other pathological EML inputs.

URL extraction bypass in GOVCERT-LU eml_parser prior to version 3.0.2 allows a remote sender to craft phishing emails containing HTML-entity-encoded URLs that evade the library's URL extraction entirely. Security gateways and SOC pipelines relying on eml_parser to produce IOC lists will silently omit these obfuscated links, preventing submission to threat-intelligence feeds, URL reputation services, and sandboxes. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the regression test added in the fix commit provides a clear reproduction template.

Remote code execution in qwed 5.1.1 allows any authenticated tenant to execute arbitrary Python code inside the API server process by submitting crafted mathematical expressions to the POST /verify/math or POST /verify/batch endpoints. User accounts are freely self-registerable via the default-enabled /auth/signup endpoint - no invitation code or administrator approval required - making the effective exploitation barrier nearly equivalent to unauthenticated. A complete, functional proof-of-concept exploit script is publicly available in the GitHub advisory (GHSA-q27q-98j4-9pfv), and a vendor-released patch is available in version 5.1.2.

Authentication bypass in djust's WebSocket LiveView consumer allows unauthenticated remote clients to invoke protected event handlers on views gated by login_required, permission_required, or redirecting on_mount hooks. All djust versions prior to 1.0.4 are affected: handle_mount sends a navigate/redirect frame on auth denial but neither closes the WebSocket nor clears self.view_instance, leaving the socket open and exploitable. Because handle_event never rechecks authentication after mount, a non-browser WebSocket client that ignores the redirect can send arbitrary event frames and execute state-mutating or data-reading handlers without an authenticated session. No public exploit identified at time of analysis beyond the WebsocketCommunicator proof-of-concept reproducer disclosed in GHSA-xx4j-w367-7247; this vulnerability is not listed in CISA KEV.

Arbitrary OS command execution in mcp-shell's default Docker image allows any MCP tool caller to bypass the secure-mode executable allowlist by supplying `/bin/bash -c <payload>` to the `shell_exec` tool, running commands as `mcpuser` (UID 1000) inside the container. The validator in `security.go` extracts only the first whitespace-delimited token as the executable, approves `/bin/bash` against the default allowlist, and passes the `-c` flag through the metacharacter check unchallenged because the default `blocked_patterns` array is empty. A fully working PoC is included in the GitHub Security Advisory GHSA-3x77-wg38-92r3; no public exploit identified at time of analysis beyond the researcher-provided PoC, and no CISA KEV listing exists. Vendor-released patch v0.6.0 is confirmed.

OS command injection in mcp-shell's 'secure mode' allows any MCP client to execute arbitrary shell commands by exploiting Git's runtime alias mechanism. The security validator in security.go blocks common shell metacharacters but omits '!', the prefix Git uses to invoke shell aliases via '-c alias.NAME=!CMD'. Because /usr/bin/git is in the default allowed_executables list and the CVSS PR:N vector confirms no authentication is required, all default Docker deployments (mcpuser, UID 1000, Git pre-installed) are exploitable by any entity with MCP connectivity. A fully functional PoC is published in the GHSA advisory; no CISA KEV listing is present at time of analysis.

Arbitrary code execution in QWED-MCP before 0.2.1 stems from its verify_math_expression() library function feeding attacker-controlled expression and claimed_result strings into SymPy's parse_expr() with an unrestricted built-in namespace, turning a math-verification routine into a Python eval() sink. Any downstream integration that forwards untrusted input to this public API lets an attacker run OS commands as the qwed-mcp process user (root-level RCE confirmed in a container by the vendor advisory). Publicly available exploit code exists via the GHSA advisory PoC, but this is not listed in CISA KEV; the published CVSS is 9.8 while real reach depends on how the library is wired up.

PraisonAI's async Jobs API FastAPI service exposes all seven `/api/v1/runs` endpoints - submit, list, status, result, cancel, delete, and stream - with zero authentication on every route, allowing any network-reachable caller to execute arbitrary prompts against the operator's configured LLM credentials and enumerate or exfiltrate cross-tenant job outputs. Publicly available exploit code is documented in GHSA-2jgc-f764-c5r2, with all five attack primitives confirmed via proof-of-concept returning HTTP 202/200/204 with no credentials. This is a distinct, unpatched sibling of CVE-2026-44338 - the Flask server fix at 4.6.34 did not touch the FastAPI jobs module, which remained fully unauthenticated through version 4.6.51.

Unbounded memory allocation in CPython's zipfile module allows a crafted archive to exhaust process memory during decompression of bzip2, LZMA, or Zstandard members. The ZipExtFile._read1() method lacked the max_length output bound that the DEFLATE code path already enforced, permitting a small compressed member with an attacker-controlled declared size to expand into unlimited memory per read call. No public exploit is identified at time of analysis; exploitation requires user interaction (opening the archive), and the CVSS 4.0 base score of 2.1 reflects the low, availability-only impact.

Server-Side Request Forgery in PraisonAI's Jobs API (pip/praisonai < 4.6.58) results from two compounding flaws: a fail-open DNS error handler in `JobSubmitRequest.validate_webhook_url()` that silently accepts any webhook URL when `socket.gaierror` is raised, and a TOCTOU race where `JobExecutor._send_webhook()` performs a completely independent DNS resolution via `httpx.AsyncClient` minutes to hours after validation. Authenticated attackers with a valid API bearer token can submit a job whose `webhook_url` hostname returns NXDOMAIN at validation time, then update DNS to a private IP before job completion, causing the executor to POST job result data to internal infrastructure. A detailed proof-of-concept is publicly available in GHSA-rg5q-pp8p-f7jm; no public exploit identified at time of analysis beyond the PoC, and this CVE is not listed in CISA KEV.

Authentication bypass in PraisonAI's HTTP agent-serving layer allows unauthenticated remote invocation of registered agents despite the operator having configured an API key via --api-key. The root defect is in _create_agents_app(): it never reads config["api_key"] and never attaches a FastAPI Depends() auth dependency to POST /agents and POST /agents/{agent_name}, making the advertised --api-key flag a no-op. A public proof-of-concept confirms HTTP 200 responses to credentialless requests on all agent invocation routes while sibling /api/v1/ routes correctly return 401; no CISA KEV listing was identified at time of analysis.

Workspace boundary escape in PraisonAI's praisonai.code CODE_TOOLS exposes three independent path traversal vectors affecting all file operation and command execution tools exported for use by AI agents. Agents configured with a workspace parameter - intended as a filesystem security boundary - can be manipulated via prompt injection or untrusted input to read, write, enumerate, and execute commands outside that boundary, bounded only by the process user's OS permissions. Publicly available proof-of-concept code demonstrates all six bypass paths against real praisonai.code agent tools; no CISA KEV listing exists at time of analysis.

Origin header validation bypass in PraisonAI's MCP HTTP Stream transport allows a malicious webpage to invoke unauthenticated MCP tool calls against a locally-running server by exploiting a Python `startswith()` prefix match that accepts `http://localhost.evil.example` as a trusted localhost origin. Affected are all pip/praisonai installations prior to version 4.6.58 running the MCP HTTP Stream server under the CLI-default configuration (no API key). A functional proof-of-concept is included in the GitHub security advisory demonstrating local file read via `praisonai.files.create` and arbitrary state writes via `praisonai.todo.add`; no public exploit identified at time of analysis beyond this researcher-provided PoC.

Server-Side Request Forgery in praisonaiagents (pip package, versions < 1.6.58) allows any attacker who can influence an AI agent's crawl target - via crafted task instructions or prompt injection embedded in previously crawled content - to exfiltrate cloud instance metadata (including IAM credentials), internal localhost services, and RFC1918 API endpoints. The web_crawl tool's SSRF protection validates only the initial URL's hostname IP, then invokes httpx with follow_redirects=True, allowing an attacker-controlled public URL to 302-redirect the agent to 169.254.169.254 or 127.0.0.1 without any re-validation. This is an incomplete fix for a prior SSRF class in the same component. A fully functional proof-of-concept is publicly documented in GHSA-5r34-2g38-6569, and no public exploit identified at time of analysis beyond the PoC; no CISA KEV listing is present.

Arbitrary code execution in NLTK (Natural Language Toolkit) through 3.9.4 allows attackers to run Python code when a victim application loads a malicious transition-parser model file. The TransitionParser.parse() method deserializes model data via pickle with restricted=False, so an attacker-supplied model embedding pickle gadget chains executes with the privileges of the loading process. No CISA KEV listing or public exploit code is identified at time of analysis, though this class of pickle-RCE bug is trivially weaponizable once a malicious model is delivered.

Denial-of-service in Mistune Python Markdown parser versions 3.3.0-3.3.2 allows remote unauthenticated attackers to crash any process that renders user-supplied Markdown by submitting input with hundreds of consecutive asterisk characters. The recursive HTMLRenderer.render_token() traversal grows proportionally to emphasis nesting depth and exceeds Python's default recursion limit, raising an unhandled RecursionError that terminates the parsing process. No public exploit identified at time of analysis, though the fix commit itself demonstrates the attack pattern explicitly in its regression test suite.

Issuer-validation bypass in joserfc (Python JOSE library) prior to version 1.7.3 allows an attacker to craft a JWT with an array-valued `iss` claim - e.g., `["expected-issuer"]` - that passes the JWTClaimsRegistry equality check via Python membership matching (`in` operator on a list) rather than strict string equality. The same flaw affects `sub` claim validation. No public exploit has been identified at time of analysis, but the commit diff confirms the root cause and fix; EPSS data was not provided in the input.

Insecure file creation in RansomLook (≤ 2.0.0) exposes the Flask session-signing secret to any local OS user with read access to the application home directory, enabling complete authentication bypass. The secret key governs Flask session cookie signing and the legacy API-key derivation function; possession of it allows an attacker to forge valid session cookies and impersonate any user, including administrators. In LDAP-configured deployments, exploitation is especially direct because the session user loader accepts arbitrary usernames without verifying their existence against any user store. No public exploit has been identified at time of analysis.

Unsafe pickle deserialization in Flair 0.15.0 and 0.15.1 allows arbitrary code execution with the privileges of the loading process when a victim calls ClusteringModel.load() on an attacker-supplied model file. The critical compounding factor is a false remediation: CVE-2024-10073 designated 0.15.0 as the fixed version after clustering was dropped from the documented API, but flair/models/clustering.py remains physically present in the PyPI-distributed wheels for both 0.15.0 and 0.15.1 and is directly importable, voiding the prior CVE's resolution. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Remote code execution in Xinference (all versions before 2.12.0) allows any user with model-launch access to execute arbitrary Python code on the server at worker-process privilege level. Six model loader call sites across the rerank, embedding, and LLM subsystems hardcode trust_remote_code=True when invoking Hugging Face AutoTokenizer.from_pretrained, meaning a registered model with an attacker-controlled path can ship a malicious tokenizer_config.json whose auto_map entries are imported and executed unconditionally upon model load. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but any Xinference deployment that permits user-defined model registration is exposed without the 2.12.0 patch.

Unbounded recursion in NLTK's JSONTaggedDecoder.decode_obj() (nltk/jsontags.py) allows unauthenticated remote attackers to crash the Python process by submitting a deeply nested JSON payload exceeding Python's default recursion limit of 1000. All NLTK releases before 3.9.4 are affected; exploitation depends on whether the calling application exposes JSONTaggedDecoder to externally-supplied JSON input. A public proof-of-concept is included in the GHSA advisory; no confirmed active exploitation (CISA KEV) has been identified at time of analysis.

Remote code execution in Xorbits Inference (Xinference) 2.5.0 and earlier lets a remote attacker run arbitrary OS commands in the server process by abusing an unsafe eval() in the Llama3 tool-call parser. Any request to the OpenAI-compatible /v1/chat/completions endpoint with a tools field triggers evaluation of model-generated Python, so an attacker who steers the model's output via a crafted prompt achieves full server compromise; because authentication is disabled in the default deployment, the vendor advisory rates this exploitable by an unauthenticated remote attacker. This is fixed in 2.7.0; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Arbitrary code execution in Facebook Research Hydra prior to version 1.3.4 allows any party who can supply untrusted configuration - including YAML config files, CLI overrides, or ML model metadata - to invoke dangerous Python callables through hydra.utils.instantiate(). The vulnerability stems from _resolve_target() accepting any Python callable path without restriction, enabling an attacker to trigger functions such as os.system, subprocess.Popen, or builtins.exec inside the consuming application's process. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists; the upstream fix is confirmed shipped in v1.3.4.

Remote code execution in Omnigent's multi-tenant runner allows any authenticated user to hijack the runner process by uploading a crafted agent bundle that specifies a dotted Python import path (e.g., subprocess.check_output) as a server-side callable tool. The server's bundle validator failed to inspect the callable field, so the runner blindly imported and executed the specified Python symbol with its own process permissions. All Omnigent deployments prior to version 0.3.0 running in shared or multi-tenant mode are affected; no public exploit has been identified at time of analysis, though the GHSA advisory and fix PR provide a detailed exploitation roadmap.

Unauthorized page content disclosure in Wagtail's internal Pages admin API allows any authenticated Wagtail admin user to read draft and live page fields - including title, slug, seo_title, search_description, and all custom fields declared in api_fields - for pages outside their permitted access scope. The root cause is CWE-280: the get_base_queryset method on PagesAdminAPIViewSet does not scope its queryset through the page permission policy, bypassing page-level access controls entirely. Patched releases (7.0.9, 7.3.4, 7.4.3, 8.0rc2) are available, and no public exploit or active exploitation has been identified at time of analysis.

Cache isolation failure in django CMS allows unauthenticated network attackers to both read other users' header-personalized page content and poison the page cache with attacker-chosen content. Affected installations must have CMS_PAGE_CACHE enabled and at least one plugin implementing get_vary_cache_on() - when those conditions hold, the page cache key is computed without the plugin-declared header values, so the first cached variant is served to all subsequent visitors regardless of their headers. No public exploit exists and CISA KEV has not listed this vulnerability, but the attack is mechanically straightforward in affected configurations.

Uncontrolled recursion in django CMS prior to 5.0.8 allows an authenticated staff user to corrupt the plugin tree and deny service by exploiting a missing cycle guard in the move_plugin endpoint. By supplying the plugin's own primary key or a descendant's ID as the plugin_parent value in a crafted POST request, the attacker creates a parent-child cycle that causes the _get_descendants_cte and _get_ancestors_cte recursive CTE queries to loop indefinitely, exhausting database recursion limits and consuming web request workers. The same 5.0.8 release also patches a related information disclosure path where clipboard copy operations lacked source-side permission checks, allowing a staff user to exfiltrate plugin content from placeholders they have no access to - consistent with the 'Information Disclosure' tag on this advisory. No public exploit identified at time of analysis.

Stored XSS in django CMS 5.0.8 allows an authenticated editor to execute arbitrary HTML in other staff users' browsers via the edit-mode plugin exception rendering path. When plugin rendering fails in edit mode, ContentRenderer.render_exception in cms/plugin_rendering.py interpolates attacker-controlled values - including get_short_description() output, exception messages, and placeholder source strings - into an HTML heading using an unsafe f-string, then returns the result through mark_safe, bypassing Django's autoescaping. No public exploit has been identified at time of analysis, and this vulnerability is not listed in CISA KEV.

Content exfiltration in django CMS prior to 5.0.9 allows any authenticated staff user holding only page-add permission to read the full plugin content of any page - including restricted, cross-site, and secret pages - by supplying an arbitrary source ID to the page duplication endpoint. The missing object-level authorization check means the only gate (PageAdmin.has_add_permission) verifies only that the user may create pages in general, never that they may access the specific source being copied. Because AddPageForm.save() calls source.copy(..., permissions=False), the resulting duplicate strips view restrictions and becomes readable by anonymous visitors, compounding the confidentiality breach. A detailed proof-of-concept is published in the GHSA advisory; no active exploitation has been confirmed in CISA KEV.

Missing object-level authorization in django CMS's `render_object_structure` endpoint exposes CMS structure metadata of non-PageContent objects to low-privileged staff users. Any active staff account (is_staff=True) can request the `/admin/cms/placeholder/object/<content_type_id>/structure/<object_id>/` endpoint for frontend-editable objects using PlaceholderRelationField, receiving placeholder slot names, plugin trees, plugin identifiers and labels, and object existence - without holding `cms.use_structure` or any model-level view or change permission. No active exploitation confirmed (not in CISA KEV); a working proof-of-concept using the framework's own FancyPoll test model is documented in GHSA-8qj2-c6q4-f399. EPSS data was not provided, but the staff-gated, read-only nature and requirement for ID enumeration limit real-world impact.

Unauthorized content disclosure in django CMS prior to 5.0.8 allows authenticated staff users to exfiltrate plugin content - including secret text, link names, and URLs - from restricted pages and placeholders they are not authorized to access. The vulnerability resides in the copy_plugins admin endpoint (cms/admin/placeholderadmin.py), where the clipboard copy paths validate only the destination (the user's own clipboard) while accepting attacker-controlled source_placeholder_id and source_plugin_id parameters without any source-side authorization check. No active exploitation is confirmed by CISA KEV, but the technical advisory, patch diff, and regression tests are publicly available via GitHub security advisory GHSA-4xfr-4p46-gc6p.

Unauthorized page-content disclosure in django CMS prior to 5.0.8 allows any staff account to retrieve the plugin structure of view-restricted pages by requesting the render_object_structure endpoint, which omits the user_can_view_page() authorization check enforced by the edit and preview endpoints. Exposed data includes plugin short descriptions - link names, target URLs, and text snippets - constituting genuine content disclosure, not merely structural metadata. No public exploit has been identified at time of analysis; exploitation is constrained to authenticated staff users on sites with per-page view restrictions explicitly configured.

Sandbox escape in asteval allows any attacker who can supply expressions to `Interpreter.eval()` to raise `SystemExit`, `KeyboardInterrupt`, `GeneratorExit`, or `BaseException`, bypassing both `run()` and `eval()` exception handlers - which catch only `Exception` - and terminating or disrupting the calling process. All asteval versions through 1.0.6 are affected; version 1.0.9 resolves the issue. No active exploitation has been confirmed (not in CISA KEV), but a working proof-of-concept covering all four variants is included in the public advisory GHSA-89v8-rhwq-hf77, and this is a third distinct sandbox-escape class in asteval following CVE-2025-24359 and GHSA-vp47-9734-prjw.

Remote denial-of-service in vouch-proxy v0.47.2 and earlier crashes the server process with a single unauthenticated HTTP request. The /validate endpoint's multipart cookie reassembly routine in pkg/cookie/cookie.go parses the total part count directly from the attacker-controlled Cookie header name - an N value of 10 billion passed as VouchCookie_1of10000000000 triggers a make([]string, N) call requesting approximately 160 GB of heap, immediately raising a Go runtime fatal out-of-memory error. No authentication, session token, or prior interaction is required; a fully working PoC with Docker reproduction artifacts is publicly disclosed in the GitHub Security Advisory, though no CISA KEV listing is confirmed at time of analysis.

Arbitrary code execution in aeon 1.3.0 is triggered when a user loads a maliciously crafted CSV dataset file via the `load_time_series_segmentation_benchmark` or `load_human_activity_segmentation_datasets` functions, both of which passed CSV column values directly to Python's `eval()` built-in without validation. An attacker who convinces a data scientist or researcher to open a crafted dataset file can execute arbitrary Python code with the privileges of the running process. No public exploit has been identified at time of analysis, but the upstream fix commit is public and the vulnerability class is trivially replicable given the use of bare `eval()`.

Remote code execution in aeon 1.3.0 is possible when a user loads a maliciously crafted CSV dataset via the `load_human_activity_segmentation_datasets` or `load_time_series_segmentation_benchmark` functions, which pass unvalidated column values directly to Python's `eval()`. An attacker who can deliver a malicious file or dataset URL to a target data scientist can execute arbitrary Python code in the victim's process with their full privileges. No public exploit has been identified at time of analysis, though ZDI (ZDI-CAN-29160) holds technical details; the upstream fix replacing `eval()` with `ast.literal_eval()` is available as a commit but a tagged patched release has not been independently confirmed.

Arbitrary file read, write, and Python code execution in Agno's PythonTools (agno.tools.python) exposes any file accessible to the agent process via path traversal sequences injected into the file_name argument of read_file, save_to_file, or run_python_file. The root cause is use of Path.joinpath() without resolving or validating the resulting path against the intended base_dir boundary, enabling escape via sequences such as '../../../../../../etc/passwd'. No public exploit has been identified at time of analysis, but the attack is trivially constructible and can be delivered through direct tool invocation or prompt injection embedded in agent-processed content, giving any untrusted input source a path to OS-level code execution within the agent process.

Remote code execution on the Wazuh cluster master node is achievable by any attacker who controls a cluster worker node, exploiting unsafe Python builtin resolution in the distributed API merge path. Affected versions span 4.0.0 through 4.14.5 and 5.0.0-beta1; the vulnerable code in framework/wazuh/core/results.py called getattr(builtins, type_) with attacker-supplied strings from worker JSON responses, enabling exec or eval injection. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the attack primitive is mechanically trivial once a worker node is controlled, with the payload executing as root on the master.

Authenticated remote code execution affects Talebook (MyBooks/PoxenStudio) ebook management server versions 3.41.2 and earlier, where an administrator can inject arbitrary Python into the auto-generated auto.py settings module via a crafted SOCIAL_AUTH key name. Because the server imports auto.py as a live module and can auto-restart to reload it, injected statements execute with the service account's privileges, enabling data disclosure, file modification, persistence, or service disruption. No public exploit is identified at time of analysis; the fix is version 3.42.0, and chained authorization/registration weaknesses noted by the vendor could lower the effective privilege barrier.

Cross-dataset authorization bypass in GeoLens prior to 1.2.3 allows unauthenticated network callers and low-privileged authenticated users to read private dataset content - including vector tile geometries, raster pixels, backing-table rows, column schemas, and sampled values - that they have no access to. The root flaw is a consistent pattern across six distinct endpoints: the API authorizes the resource named in the URL but fails to re-authorize a second, caller-influenced dataset reached through a relationship, layer reference, VRT mosaic, or request body. No public exploit has been identified at time of analysis, but the most severe findings require zero authentication, making them trivially exploitable by any network-reachable caller.

Cross-site request forgery in MobSF prior to 4.5.1 enables a remote attacker to perform destructive authenticated actions - including scan deletion, password changes, user creation/deletion, and file upload/download - against a logged-in victim's instance. The root cause is a Django migration regression: CsrfViewMiddleware was left in the deprecated MIDDLEWARE_CLASSES setting (ignored since Django 2.0) and never added to the active MIDDLEWARE tuple, leaving all POST endpoints unprotected. A working proof-of-concept is confirmed by the GHSA advisory reporter, who demonstrated complete scan deletion via a plain curl command using only a session cookie - no CSRF token required.

Server-side request forgery in the Red Hat Ansible Automation Platform 2 Controller's HashiCorp Vault credential plugin lets an authenticated user with credential-creation rights force the controller pod to leak its own Kubernetes service account token. When a HashiCorp Vault Secret Lookup credential configured for kubernetes_role authentication is tested, the kubernetes_auth() routine in awx_plugins/credentials/hashivault.py transmits the pod token to an attacker-supplied URL. With that token the attacker gains Kubernetes API access to control-plane namespaces, enabling full pod CRUD and secret reads including database credentials and the Django SECRET_KEY. No public exploit identified at time of analysis, and the flaw is not on the CISA KEV list.

Local privilege escalation in mise (jdx/mise), the polyglot dev tool version manager, allows a local user with UID and GID 1001 to gain ownership of a root-installed system binary. Prior to version 2026.7.1, release tar archives embedded non-root UID/GID 1001 metadata from the build environment, and the standalone install script failed to normalize ownership before placing the binary in shared paths such as /usr/local/bin, leaving the installed executable writable by any user matching that UID/GID pair. No public exploit has been identified at time of analysis, and no CISA KEV listing exists, but the attack path is mechanically straightforward in multi-user environments where a local account happens to share UID/GID 1001 with the build system.

Remote code execution in CodeWhale (packages codewhale and codewhale-tui) versions 0.8.41 through 0.8.63 allows an attacker to execute arbitrary Python code on the victim's machine by exploiting a hardcoded approval bypass in the rlm_eval built-in tool. The tool's approval_requirement() method returned ApprovalRequirement::Auto, causing the engine to silently skip user approval prompts regardless of the operator's configured --approval-policy, enabling prompt injection attacks through any external content the agent reads. No public exploit has been identified at time of analysis, but the attack surface encompasses any CodeWhale agent workflow that fetches untrusted content such as web pages, repository files, or MCP tool results.

Pyenv's version-selection shell scripts silently redirect Python interpreter selection to an unintended installed version when the PYENV_VERSION or .python-version value contains shell glob metacharacters and a matching file exists in the working directory. All seven libexec scripts (pyenv-version-name, pyenv-which, pyenv-prefix, pyenv-local, pyenv-global, pyenv-version, pyenv-versions) expand the version string without disabling glob expansion via set -f, allowing pathname expansion against the current directory's contents. The fix in v2.8.0 adds set -f/set +f guards around all affected expansions. No public exploit identified at time of analysis; the CVSS 4.0 score of 2.0 with AT:P reflects the constrained exploitation conditions.

Stored XSS in the Pandora malware analysis platform's PDF download endpoint allows attacker-controlled JavaScript to execute in the security context of the application when an analyst views a crafted analysis task. An attacker submits a polyglot file that passes Pandora's content-based PDF detection but whose filename or extension causes Flask's send_file() to serve it with an active MIME type such as text/html, with no Content-Disposition: attachment header forcing browser download. Any victim with access to the analysis task who follows the PDF download link will have attacker-supplied script execute in their Pandora session, potentially exposing session data or enabling unauthorized actions. No public exploit identified at time of analysis; a patch is available via upstream commit 668ec65a93cee327e3d925da2698849c9e65625a.

Arbitrary Python code execution in FreeCAD's BIM module (versions 0.19 through pre-1.1.1) is triggered when a user opens a malicious project template file through the BIM Project Manager's Load Template function. The loadTemplate() method in BimProjectManager.py passes FCStd metadata fields (wpposition, wpu, wpv, wpaxis) directly to Python's built-in eval(), enabling an attacker who can deliver a crafted template to achieve full code execution under the victim's user account. No public exploit has been identified at time of analysis; the vendor-released patch is confirmed in version 1.1.1.

Arbitrary Python code execution in FreeCAD's BIM Workbench (versions 0.19 through 1.1.0) is triggered when a user creates a TechDraw page from a malicious SVG template, due to an unsafe eval() call in BimTDPage.py at line 87. Exploitation requires social engineering - an attacker must deliver a crafted SVG template to a victim who then performs the TechDraw page creation action. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but the vulnerability is structurally trivial (direct eval of attacker-controlled input, CWE-95) and the fix is available in version 1.1.1.

Remote code execution via crafted .FCStd document in FreeCAD prior to 1.1.2 allows arbitrary Python execution when a victim opens a malicious file. The deserialization path in PropertyPythonObject::Restore() passes attacker-controlled module names directly to PyImport_ImportModule(), executing module-level Python code on import; the legacy pickle branch additionally invokes an attacker-controlled class constructor via PyObject_CallObject(). No public exploit or CISA KEV listing is identified at time of analysis, but exploit construction is straightforward for any researcher who can craft the FCStd XML schema.

Quadratic CPU consumption in sqlparse versions prior to 0.6.0 allows unauthenticated remote denial-of-service via crafted deeply-nested SQL payloads submitted to any application calling sqlparse.parse(), sqlparse.format(), or sqlparse.split(). A ~2KB malicious input with 500-2000 nesting levels can consume approximately 10 seconds of CPU per request - a ~5000x amplification ratio - before depth or token limits raise a SQLParseError. No active exploitation is confirmed in CISA KEV, though the GHSA advisory includes a detailed proof-of-concept demonstrating the attack; CVSS 4.0 rates availability impact as High (8.7) with no authentication required.

CPU exhaustion via ReDoS in sqlparse affects all Python applications that pass caller-controlled SQL text to sqlparse.parse(), sqlparse.format(), or sqlparse.split() prior to version 0.6.0. The root cause is a backreference regex pattern in the dollar-quoted literal lexer that, combined with the per-position lexer loop, produces O(n²) CPU complexity when processing inputs containing many unique, unclosed dollar-quote openers or multiline comment delimiters — making it trivially exploitable from the network with no authentication. No public exploit code or CISA KEV listing has been identified at time of analysis, but the fix commit includes a purpose-built benchmark script that doubles as a functional reproduction guide.

Quadratic CPU consumption in sqlparse's group_comments function (grouping.py) allows remote unauthenticated denial of service against any Python application that passes attacker-controlled input to sqlparse.parse() or sqlparse.format(sql, strip_comments=True). A comment-only payload of roughly 250 KB forces minutes of CPU burn regardless of the MAX_GROUPING_TOKENS guard, because group_comments executes before that cap is checked. A public proof-of-concept with benchmark data confirms O(n²) scaling: n=4000 comments takes ~1600 ms versus ~106 ms at n=1000; no public exploit identified at time of analysis beyond the researcher's PoC, and the vulnerability is not listed in CISA KEV.

Code injection in sqlparse prior to 0.6.0 allows attackers to escape generated Python and PHP source-code snippets by supplying crafted SQL containing backslashes immediately before quote characters, exploiting a missing pre-escaping step in the output formatting filters. The flaw resides in sqlparse/filters/output.py, which escapes quotes without first escaping pre-existing backslashes, causing the generated escape to neutralize the backslash rather than the quote and allowing attacker-controlled content to appear outside the intended string literal as executable code. Publicly available exploit code exists via a validated Docker-based proof-of-concept published in GHSA-3496-9g83-7v6x; no confirmed active exploitation in CISA KEV at time of analysis.

Sandbox escape in the openssl_encrypt Python library (jahlives) before 1.4.0 lets attacker-supplied plugin code break out of the IsolatedPluginExecutor and run arbitrary OS commands. The restricted exec() environment still leaks live Python type objects, so an attacker walks the class hierarchy to reach system primitives despite the intended sandbox. Rated CVSS 4.0 9.3 (critical) and reported by VulnCheck; no public exploit identified at time of analysis and it is not listed in CISA KEV.

Sandbox escape in the openssl_encrypt Python library (jahlives) before 1.4.0 allows attacker-supplied plugins to run without any isolation because the default process-isolation mode silently fails to enforce its sandbox restrictions. An attacker able to supply or influence a plugin gains unrestricted filesystem, network, subprocess, and full Python-module access equivalent to arbitrary code execution. Reported by VulnCheck with a vendor patch available; no public exploit code or CISA KEV listing is identified at time of analysis (CVSS 4.0 base 9.3).

Insecure PRNG import in the jahlives openssl_encrypt Python package (all versions before 1.4.0) places Python's non-cryptographic 'random' module (Mersenne Twister) into openssl_encrypt/modules/pqc.py, though the code makes no calls to it, so no cryptographic operation is presently weakened. VulnCheck reported this as a latent hazard: the import invites future maintainers to reach for random.randint() instead of secrets/os.urandom, which would yield predictable values recoverable from ~624 outputs. There is no public exploit identified at time of analysis and it is not on CISA KEV; the flaw was fixed by removing the import in version 1.4.0.

Cryptographically weak PRNG use in openssl_encrypt before 1.4.0 exposes steganographic pixel selection to full state-recovery attacks. The library's steganography module seeds Python's Mersenne Twister with only 64 bits of SHA-256 hash material derived from the user password, then uses it to select pixel positions for hidden data - a design flaw captured by CWE-338. Any attacker who knows or can brute-force the steganography password can deterministically reconstruct the PRNG sequence and enumerate every pixel carrying concealed data, breaking steganographic confidentiality entirely. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but the MT state-recovery technique is well-documented and requires no novel research.

Arbitrary file write in Pandora (pandora-analysis), an open-source file/malware analysis platform, arises from unsafe TAR extraction where archive member names were passed to Python's tarfile.extract() without a safety filter. An attacker who submits a crafted TAR containing ../ sequences or absolute paths can write files outside the intended extraction directory, potentially overwriting files owned by the Pandora worker and escalating to code execution or denial of service. No public exploit identified at time of analysis, though the upstream fix commit is public and the flaw is trivially reproducible.

Weak session key generation in dtale up to version 3.22.0 allows remote attackers with network access and session cookie capture capability to predict or brute-force the Flask SECRET_KEY and subsequently forge session cookies. The build_secret_key function in dtale/app.py generates a 10-character key using NumPy's non-cryptographic PRNG over a 36-character alphabet, yielding severely insufficient entropy for a security-sensitive value. Publicly available exploit code exists per the CVE description and corroborated by CVSS 4.0 E:P, but no active exploitation has been confirmed by CISA KEV; an upstream fix PR has been submitted but not yet merged.

Unauthenticated path traversal in the token-optimizer-mcp dashboard server (npm package @ooples/token-optimizer-mcp v5.0.1) allows any network-accessible attacker to read arbitrary .jsonl files from the server's filesystem by supplying a crafted sessionId parameter to /api/session-summary or /api/session-events. The CVSS vector (PR:N, AV:N, AC:L, UI:N) confirms zero authentication or user interaction is required, and a working proof-of-concept demonstrating successful out-of-bounds file exfiltration has been publicly disclosed in GHSA-76pc-mqxp-3rq5. No active exploitation has been confirmed by CISA KEV, but the trivial exploitation complexity and public PoC make this an immediate priority for any internet-exposed deployment.

SSRF protection in IBM ContextForge MCP Gateway (mcp-contextforge-gateway) is bypassable via DNS rebinding against the `/admin/gateways/test` endpoint, allowing an attacker with a database-backed `gateways.read` role to reach cloud instance metadata services (including 169.254.169.254) and internal network resources. The root cause is a TOCTOU race between the hostname validation step - which resolves DNS via `socket.getaddrinfo()` and checks the result against blocked private ranges - and the `httpx`-based HTTP client's fully independent DNS re-resolution at connection time, with no IP-pinning or validated-address forwarding bridging the two operations. A detailed proof-of-concept is published in GitHub Security Advisory GHSA-9hgc-g3w5-67cm; the vendor confirmed the fix in release v1.0.3 (2026-06-10); no CISA KEV listing is present at time of analysis.

Unauthenticated remote code execution in MindsDB Minds Platform (version 26.1.0 and earlier) lets any network-reachable attacker run arbitrary OS commands on the host by chaining two unprotected API endpoints. The attacker first sets a controlled LLM API key via the unauthenticated PUT /api/v1/settings/ endpoint, then submits a crafted prompt to POST /api/v1/responses/ that steers the Anton agent into calling its scratchpad tool, which passes attacker-influenced Python directly into exec() with no sandbox. Reported by VulnCheck with a maximum CVSS 4.0 score of 10.0 and CWE-94; no public exploit identified at time of analysis, but the trivial attack complexity and lack of authentication make it high priority.

Stored XSS in django-helpdesk before 2.3.3 enables unauthenticated external attackers to inject arbitrary JavaScript into the authenticated staff interface by submitting HTML-formatted ticket email bodies or uploading .html/.htm file attachments through the public-facing ticket submission channel. The payload persists in the helpdesk database and executes in the browser session of any staff member who opens the attachment during routine triage, enabling session hijacking, credential exfiltration, or unauthorized actions performed under the staff member's identity. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.