TypeScript
Monthly
Cross-tenant conversation-state leakage in the Strands Agents SDK A2A server allows an authenticated remote caller in a multi-tenant deployment to read other tenants' conversation history and plant persistent instructions that alter model behavior for subsequent callers by referencing a different context_id. Python strands-agents before 1.43.0 and TypeScript @strands-agents/sdk before 1.5.0 are affected; single-tenant or single-user deployments are not exposed. No public exploit was identified at time of analysis, and fixes are available in 1.43.0 and 1.5.0.
OS command injection in zosmaai's pi-llm-wiki through 0.11.7 lets an attacker who can invoke the wiki_capture_source MCP tool run arbitrary operating-system commands on the host by manipulating the tool's url argument, which is passed unsanitized into a shell command used for source extraction. Publicly available exploit code exists (referenced in the project's issue tracker), and the flaw is fixed in version 0.11.8; there is no indication of confirmed active exploitation in CISA KEV. The CVSS v4.0 score is 8.6 (with an assessed CVSS v3.1 equivalent of 8.8), reflecting high confidentiality, integrity, and availability impact, though the vector requires authorized tool access (PR:L) and real-world risk is bounded by the project's very small deployment footprint and whether the MCP tool endpoint is remotely reachable.
A remote, unauthenticated denial-of-service condition in the NestJS (Nest) microservices framework lets an attacker crash a service on demand by sending a single message whose 'pattern' field is a deeply nested object. Only deployments using the TCP transport (ServerTCP) or the RabbitMQ transport (ServerRMQ) are exposed, because those paths pass a client-controlled, non-string pattern into JSON.stringify to compute the handler lookup key; sufficient nesting throws 'RangeError: Maximum call stack size exceeded', and the unhandled promise rejection terminates the Node.js process under default behavior. Affected versions are prior to 11.2.4 and prior to 12.0.2; the CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects pure availability loss with no confidentiality or integrity impact, and no public exploit has been identified at time of analysis. Risk is highest where the raw TCP port or consumed RabbitMQ queue/exchange is reachable by untrusted parties, since these are typically internal service-to-service surfaces.
A credential-isolation flaw in geelen mcp-remote 0.1.16 through 0.1.38 allows a remote attacker who controls or can predict the MCP server URL a victim configures to cause MD5-derived credential-store paths to collide or match, potentially exposing or overwriting another server's cached OAuth tokens via the getServerUrlHash function in src/lib/utils.ts. The package is an npm bridge that connects local MCP clients to remote MCP servers, so practical exploitation depends on the victim adding the attacker's server URL and on the OAuth credential-persistence feature being in use (user interaction), which is inconsistent with the no-interaction AV:N/AC:L/PR:N/UI:N profile of the 9.8 headline score. No public exploit code was identified at time of analysis and EPSS is low (0.29%, 19th percentile), so the CWE-94 arbitrary-code-execution framing should be treated as unverified rather than confirmed remote code execution.
Code generation in orval before 8.29.0 writes the raw OpenAPI operationId into a single-quoted object literal inside generated TanStack Query mutator metadata, so a crafted operationId can break out of the string and inject arbitrary JavaScript that executes when the generated query or mutation hooks are called. Practical exploitation requires a developer or CI pipeline to run orval codegen against an OpenAPI document whose operationId is attacker-controlled and then to execute the generated hooks - a conditional path that hinges on the trust boundary of the ingested spec, even though PR:N appears in the vector; the independent assessment (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects this required victim interaction, while the headline CVSS 4.0 score of 9.3 (UI:N) overstates how freely the flaw triggers. No public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS score was provided; a vendor patch is available (orval 8.29.0).
Code injection in orval before 8.29.0 lets an attacker who controls or influences the OpenAPI specification being processed smuggle executable JavaScript into the generated client: media-type (Content-Type) keys are written into single-quoted string literals without escaping, so punctuation in a crafted key terminates the literal and injects arbitrary statements into the emitted code. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) makes this an unauthenticated remote code-injection flaw at 9.3, but exploitation in practice is gated by the victim actually running orval over the malicious spec and then invoking the generated fetch operation or mock resolver - our independent assessment therefore applies UI:R (CVSS 3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), and teams that only generate clients from their own trusted specifications are not realistically exposed. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor has released a fix in orval 8.29.0.
Code injection in the Orval OpenAPI-to-TypeScript client generator (@orval/core) before 8.30.0 lets an attacker who controls the default value of a date or date-time field in an OpenAPI schema splice arbitrary JavaScript into generated factory code, which then executes with the privileges of whatever process consumes the generated client. Exploitation is not remote against a deployed service: it requires the non-default factoryMethods and useDates options to be enabled, a developer running codegen against a spec the attacker can influence, and the resulting factory client being executed, giving an assessed CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (the advisory lists 9.2 under CVSS 4.0). No public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV); the vendor has shipped a fix in 8.30.0.
Code injection in the Orval OpenAPI client generator's @orval/effect package (versions 8.14.0 through 8.28.1) lets an attacker who can influence an OpenAPI schema embed arbitrary JavaScript expressions in the generated validation module, which execute at module scope as soon as that generated code is built or imported. The injection point is the schema `default` value, which the effect generator rewrites into a template literal so that `${...}` syntax (or a literal backtick) re-arms interpolation, with numeric constraints such as minimum/maximum/multipleOf similarly emitted as unquoted expressions; exploitation is remote and does not require prior credentials per the vendor vector (PR:N), but it does require the victim to run the generator against an untrusted or third-party spec and then build or import the output, giving injected code the developer's build-time privileges. No public exploit code has been identified at time of analysis and the issue is patched upstream, so real-world urgency is lower than the vendor's CVSS 4.0 score of 9.3 suggests - this is a build-time/developer-tooling flaw rather than a network-facing service exposure (independent assessment: CVSS 3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, reflecting the victim interaction the vendor rating understates).
Code injection in orval's opt-in @orval/hono generator (all versions before 8.29.0) lets an attacker who controls an OpenAPI document plant an apostrophe in a static path segment and break out of the single-quoted route literal, injecting arbitrary JavaScript that runs whenever the generated TypeScript module is imported or built. This is a build-time supply-chain style flaw rather than a runtime flaw in a network service: the affected party must run orval code generation against an untrusted spec and then import the generated output, and the CVSS v4.0 score of 9.3 reflects high confidentiality, integrity and availability impact on the build/developer environment. Exploitation is not confirmed in the wild (no CISA KEV entry) and no public exploit code was identified at time of analysis, though the upstream patch and the exact vulnerable code path are publicly documented.
Missing authentication on Postiz's enterprise/reseller organisation provisioning endpoint lets an authenticated low-privilege user escalate into full control of a newly minted top-tier organisation. Because the enterprise controller was omitted from the authentication middleware's allow-list, the route is network-reachable without any session, and its sole gate - a signature check on a token in the request body - is satisfied by the attacker's own ordinary login token, since login tokens are signed with the same instance secret and carry no purpose, audience or expiry claim. The endpoint then creates an organisation on the highest subscription tier flagged lifetime with an oversized channel allowance, provisions an owner account for the attacker, and returns a working API key for the public API in the response body (CVSS 3.1 7.1, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L; CWE-306). No public exploit code has been identified at time of analysis, but the attacker only needs any valid account on the instance, which on self-registration-enabled deployments means anyone. Vendor-released patch: v2.24.0.
Dokploy instances running versions prior to 0.29.13 disclose stored Git provider secrets - GitHub App private keys, OAuth tokens and client secrets, webhook secrets, and Gitea/Bitbucket access tokens, refresh tokens, and app passwords - to authenticated organization members who were never granted access to those providers. The protected tRPC procedures github.one, gitlab.one, gitea.one, and bitbucket.one return full provider rows without applying getAccessibleGitProviderIds or an organization check, and application.one returns the same secrets as nested relations from findApplicationById even when hasGitProviderAccess is false. Exploitation requires an authenticated Dokploy account (PR:L) holding application read access or knowledge of a provider identifier, and the practical impact is confidentiality: a restricted member can use the leaked credentials to read private repositories or manipulate external CI/CD and webhook workflows. No public exploit code has been identified at time of analysis.
Predictable, non-cryptographic credential generation in Postiz (gitroomhq/postiz-app, all versions prior to v2.24.0) allows unauthenticated remote attackers to reconstruct the V8 xorshift128+ PRNG state and derive OAuth access tokens, authorization codes, client secrets, organization API keys and PKCE verifiers issued to other users and organizations. Practical exploitation is limited by the requirement that the unauthenticated OAuth dynamic client registration endpoint be enabled and network-reachable, since that endpoint is what returns freshly generated client credentials supplying the consecutive PRNG output needed to solve for internal state; concurrent credential generation by other users interleaves draws and degrades recoverability, which is why the assessed vector carries high attack complexity. No public exploit code was identified at time of analysis and the issue is not in CISA KEV, but successful exploitation yields high confidentiality and integrity impact across tenants, and a vendor patch is available in v2.24.0 (advisory PSA-2026-TD98KY).
Field-level read permission bypass in Twenty CRM before 2.22.0 lets an authenticated workspace member or API key that is allowed to read an object but explicitly denied read on a specific field still reference that denied field inside GraphQL or REST filter predicates, turning the returned totalCount and row presence into a boolean/count oracle that can reconstruct the hidden values. The vulnerability is a bounded confidentiality issue: exploitation requires a principal whose role actually configures field-level read restrictions, and reconstruction only works against records already visible under that principal's row-level policy, and it is iterative across many queries rather than a single-shot dump. There is no evidence of active exploitation (not listed in CISA KEV) and no public exploit code identified at time of analysis; the vendor has released a patch in Twenty 2.22.0.
Authentication bypass in Joplin Server prior to 3.7.2 allows an unauthenticated remote attacker who can control or influence a SAML identity assertion to obtain a valid session for an existing local password-based account purely by matching the asserted email address, granting read and write access to that user's notes, files, and settings without knowledge of the local password. The defect is gated to deployments running mixed authentication - local password accounts and SAML SSO enabled together (SAML_ENABLED=true) - so SAML-only, local-only, and default single-auth installations are not exposed. The issue is fixed in version 3.7.2 via a check that rejects SSO login for non-external accounts; no public exploit identified at time of analysis.
Stored cross-site scripting in Joplin Server before 3.7.7 allows an authenticated, low-privileged user to publish an empty-title resource whose attacker-controlled MIME type (image/svg+xml) is served inline, so a crafted SVG executes in a victim's browser when the public share link is opened. The flaw lives in the GET /shares/:id?resource_id= route, which reflects the user-supplied MIME and omits Content-Disposition when the resource title is empty; under the default configuration user content shares the Joplin Server application origin, so the script can read same-origin administrative data and anti-CSRF tokens and, against an authenticated victim, act with that victim's session. Installations that set a separate USER_CONTENT_BASE_URL still execute the script, but confined to the user-content origin; the issue is fixed in 3.7.7 and no public exploit code was identified at time of analysis.
Joplin Server instances prior to 3.7.2 expose an SSO login-code redemption endpoint (GET /api/login_with_code/:id) that is not protected by the limiterLoginBruteForce rate limiter, allowing an unauthenticated remote attacker to make unlimited guesses against a nine-digit authentication code whose lifetime is only ten minutes; a single correct guess yields a full session token granting read and write access to the victim's notes, notebooks, and account settings. Successful exploitation is constrained by timing and throughput: the attacker must target a user during an active SSO login, know the login id, and search roughly 10^9 possible codes inside a 600-second window (about 1.6 million requests per second for reliable coverage), so the flaw is only practical against servers reachable at high request rates. The issue is confirmed by the vendor fix diff (CWE-307, missing limiterLoginBruteForce) and is fixed in 3.7.2; no public exploit code was identified at time of analysis and the flaw is not listed in CISA KEV.
Authenticated clients on deepstream.io 10.1.0 can bypass record-write authorization and modify arbitrary protected records, corrupt application state, or cause service disruption when the server is configured with permission.type 'config'. The root cause is an omitted PATCH_MULTI entry in the permission rules map, which makes the config permission engine treat the absent rule specification as an unconditional allow instead of requiring write permission. Any user holding valid credentials can exploit this remotely with no user interaction (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H per independent assessment), and no public exploit code has been identified at time of analysis; deployments using the default permission.type 'none' already permit all operations and are not additionally affected.
Remote code execution affects Univer v1.0.0-alpha.2 through its Uniscript feature: the UniscriptExecutionService.execute() function in /services/script-execution.service.ts evaluates attacker-influenced script content (CWE-94), allowing arbitrary code execution with the privileges of the hosting process. The input CVSS vector rates this 9.8 (AV:N/AC:L/PR:N/UI:N), but the authoritative assessment refines the privilege requirement to PR:L, meaning an attacker generally needs a delivery channel - and for most deployments at least application-level access - to place a crafted script into the execution service, and the exposure is further limited to deployments that actually enable Uniscript on this early alpha build. No confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; EPSS is 0.21% (11th percentile), indicating low modeled near-term exploitation likelihood.
Unauthenticated passkey enrollment in OpenReception appointment-booking software prior to 1.1.1 lets remote attackers inject a controlled WebAuthn credential for a guessed userId and then log in as that staff member, yielding a valid STAFF session without any credentials. The attacker only needs the tenant's public tenant ID and a target staff email address, plus reachability of the public booking API, to run an inject-then-login oracle that identifies the matching userId and completes authentication with their own assertion. Successful hijacking of a STAFF account exposes tenant data, and escalation to TENANT_ADMIN identifiers allows modification or deletion of tenant resources and key shares, which can render appointment data permanently undecryptable and take booking services offline; GLOBAL_ADMIN accounts are not reachable through this tenant-scoped path. There is no public exploit identified at time of analysis, though the vendor has released a fix in version 1.1.1 and the code diff demonstrates the defect unambiguously.
Path traversal in decap-server 3.10.0 and earlier lets unauthenticated remote attackers read, write, and delete files in sibling directories that merely share the leading string of the configured local_git repository path. The flaw sits in the Joi input validator that guards the CORS-enabled /api/v1 JSON API: path.join plus a raw startsWith(repoPath) prefix check cannot distinguish a genuine child path from a sibling such as 'decaporg__decap-cms-owned' next to 'decaporg__decap-cms', so crafted '../<sibling>/file' payloads reach the getMediaFile, persistMedia and deleteFile handlers and achieve high-confidentiality, high-integrity and high-availability impact on files outside the repository root. Exploitation is constrained by deployment exposure (the package is a local development proxy usually bound to localhost) and by the prefix-collision requirement, which rules out arbitrary filesystem traversal to any absolute path; a public PoC reference exists but it is not verified as working exploit code, there is no confirmed actively exploited (CISA KEV) status, and EPSS is low at 0.29% (22nd percentile) even though the vuln.today priority label is act_now. Vendor-released patch: 3.11.0.
Server-side request forgery in Nango through version 0.70.4 lets an authenticated user steer server-side HTTP requests to attacker-chosen destinations by supplying malicious values in connection configuration fields that Nango interpolates into provider token and proxy URL templates. Successful abuse can reach internal-only services or cloud instance metadata endpoints (for example 169.254.169.254) and potentially exfiltrate provider credentials held by the Nango deployment. Authentication with the ability to supply connection configuration is required (CVSS 4.0 vector shows PR:L), no public exploit code was identified at time of analysis, and there is no confirmed active exploitation (CISA KEV) - the practical risk is rated moderate because the primary limiter is the pre-existing authenticated access and the payoff depends heavily on the deployment's cloud/network egress posture.
Trigger.dev before 4.6.0 allows an authenticated low-privilege user to bind an arbitrary GitHub App installation to their own organization, because the platform does not verify that the user controls that installation. By replaying a valid OAuth state cookie and supplying sequential GitHub App installation identifiers, an attacker can gain unauthorized access to the victim's repositories in multi-tenant or shared self-hosted deployments where multiple organizations connect GitHub Apps. Exploitation requires winning a timing race and is not push-button; no public exploit code or active exploitation has been identified at time of analysis.
Twenty CRM before 2.35.0 fails to enforce field- and row-level permission checks inside the groupBy-with-records GraphQL resolver, letting an authenticated user who holds canReadObjectRecords permission read field values they are explicitly denied by canReadFieldValue. The result is read-only disclosure of restricted record data to a partially privileged account - no modification or denial of service - and no public exploit code has been identified at time of analysis. The vendor has shipped a fix in version 2.35.0, and the flaw carries a CVSS 4.0 base score of 7.1 (our independent assessment scores it CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), reflecting a genuine but moderate-severity authorization defect rather than a high-severity emergency.
Cross-tenant authorization bypass in TinaCMS self-hosted deployments allows any holder of a legitimate TinaCloud account and its valid bearer token to read, create, update, delete, and manage media on a victim site without any victim account or interaction. The flaw affects @tinacms/auth before 1.1.4 and the next-tinacms-azure adapter before 15.0.1, where the server-side isAuthorized helper trusts a request-supplied clientID and therefore validates the attacker's token against the attacker's own TinaCloud app rather than the site's configured app (CWE-639, CVSS 8.8, PR:L). Exploitation is authenticated from the attacker's perspective - the attacker must already control a TinaCloud-verifiable token, so any TinaCloud account suffices - while no public exploit code was identified at time of analysis and the vendor has released patched versions.
Server-side request forgery in mcp-searxng before 1.7.1 lets an unauthenticated network client coerce the MCP server into fetching internal-only resources. The web_url_read tool validates only the literal hostname string before handing the URL to undici's fetch, so an attacker-controlled hostname that DNS-resolves to a loopback, private, link-local, or cloud-metadata address passes the lexical check and is connected to by the OS resolver. Successful abuse can read internal HTTP services, leak credentials or service tokens, and enumerate reachable internal hosts; publicly available exploit code exists and EPSS remains low (0.14%, 3rd percentile), so this is a real but conditional risk concentrated in deployments that expose the default HTTP transport without the MCP_HTTP_HARDEN authorization layer.
Unauthenticated access to the AgentOS HTTP server shipped in the npm `praisonai` package (versions 1.6.0 through 1.7.1) allows any remote caller who can reach the service to read configured agent names, roles and the first 100 characters of each agent's instructions via GET /api/agents, and to invoke a chosen agent through POST /api/chat, potentially reaching that agent's tools, memory, external APIs, credentials and workflow state. The default configuration binds to 0.0.0.0 with corsOrigins set to ['*'] and registers both routes without any authentication or authorization middleware (CWE-306), so the missing-authentication weakness applies unauthenticated over the network (CVSS 3.1 PR:N); version 1.7.2 is the vendor-released fix. No public exploit code has been identified at time of analysis, EPSS is low at 0.56% (45th percentile) and the issue is not in CISA KEV, but CISA SSVC rates it automatable with total technical impact and the exposure depends entirely on whether an operator has left AgentOS reachable on a routable interface.
Code escaping sandbox in the PraisonAI npm package's built-in codeMode tool (praisonai 1.4.0 through 1.7.1) lets anyone who can influence the code string read host files, write or modify files, spawn subprocesses, and consume host process resources, despite the tool advertising a sandbox boundary. The implementation blocks a handful of literal source patterns and shadows process and require with undefined properties, but untrusted code can walk the JavaScript prototype chain (for example ({}).constructor.constructor) to recover the real Function constructor and reach process.mainModule.require, bypassing both controls at low complexity. The vulnerability is rated 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) with the vector indicating some prior privilege or context is needed to reach the tool; EPSS is low (0.65%, 49th percentile) and no public exploit code or confirmed active exploitation was identified at time of analysis, but the low attack complexity and high confidentiality, integrity, and availability impact make this a genuine high-priority fix rather than an inflated score.
OS command injection in the Git Remove MCP Tool of 0xshariq github-mcp-server (all revisions up to commit 52e764a7d66eac1726fce02ca7bb5a638571801a) lets an attacker who can influence the tool's 'File' argument inject shell metacharacters that are executed by child_process.exec in src/github.ts. Publicly available exploit code exists (reported via a GitHub issue on the project's own repository), but there is no evidence of confirmed active exploitation in CISA KEV, and the vendor has not responded to the report. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) rates confidentiality, integrity and availability impact as high, although the practical exposure depends heavily on how the MCP server is deployed - a network-accessible MCP transport makes the AV:N path realistic, whereas a local stdio deployment limits reach to whatever can feed input into the connected LLM client.
KitchenAsty versions through 0.3.0 expose an object-level authorization flaw in the reservations API: the authenticated endpoint GET /api/reservations/:id returns whatever reservation record matches the caller-supplied identifier without ever comparing reservation.customerId to the authenticated principal, allowing any logged-in low-privilege customer to read other customers' reservation data. Because the authenticate middleware is enforced, an anonymous attacker cannot reach the handler, which is the main constraint on exploitation; the impact per request is a read-only disclosure of a single reservation record and the assessed severity is correspondingly low (CVSS 3.1 base 4.3, PR:L). No confirmed active exploitation (CISA KEV) and no public exploit code were identified at time of analysis, though the attack requires only a valid account plus enumeration of sequential or guessable reservation identifiers.
OpenClaw versions before 2026.9.4 contain an incorrect authorization flaw (CWE-863) in the mcp.app.view method that lets a holder of a read-scoped operator.read Gateway token mint a standalone MCP App ticket and redeem it at the /__openclaw__/mcp-app/view endpoint to invoke state-changing MCP tools through tools/call - operations that should require operator.write scope. Exploitation is authenticated (PR:L) and remote, requires the originating run to carry an App-tool grant (allowedAppToolNames defined and not readOnly), and needs no user interaction; the primary impact is integrity (VI:H) with no confidentiality or availability loss per the assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N vector. There is no public exploit code or confirmed active exploitation identified at time of analysis, and an independent assessment rates this as a genuine but moderate-severity authorization bypass rather than a high-severity emergency.
Sandbox isolation bypass in OpenClaw before 2026.9.5 allows an attacker who controls a sandboxed session to read files belonging to sibling session sandboxes or shared workspace directories through the Gateway's media pipeline. The root cause is an incorrect authorization check (CWE-863): the Gateway's local media root allowlist is overbroad, so media and attachment path resolution is not confined to the active session, and untrusted content can drive the same read path. Impact is confidentiality-only, is gated on a multi-session or untrusted-content deployment that exercises the media staging path, and no public exploit has been identified at time of analysis; the vendor shipped a fail-closed fix in 2026.9.5.
Path traversal in the DeepSeek deepseek-harness boot tooling (through 0.1.7-rc.2) lets an attacker who can influence the dsh.bundle.patch argument read files outside the intended bundle path via the loadProfile function in packages/boot/app-boot/src/profile.ts. The issue is remotely triggerable with no privileges required (PR:N), but CVSS 4.0 rates it AC:H with UI:P, meaning a victim must load or apply the attacker-controlled bundle patch input, and VulDB itself characterizes exploitability as 'difficult'. Publicly available exploit code exists, but impact is confined to low confidentiality (CVSS 4.0 score 2.3; independent assessment CVSS 3.1 2.0/2.3-class finding AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N), so this is a low-real-risk issue despite the public proof-of-concept.
Local information disclosure in deepseek-ai DeepSeek Harness through 0.1.5-rc.3 allows an authenticated local attacker with low privileges to manipulate the E2B_API_KEY argument in packages/e2b/e2b/src/index.ts (dsh component), causing the application to rely on untrusted input in a security decision. Publicly available exploit code exists, and the vendor was contacted early but did not respond; the issue is assessed as low severity with only limited confidentiality impact and no integrity or availability effect.
Uncaught exception handling in the A2A middleware of ag-ui-protocol ag-ui (all versions up to 2026-09-07) allows an attacker who can control the arguments of a tool call to crash or permanently hang an agent run stream. Supplying malformed JSON, or valid JSON that is not a usable object (null, a bare number, a string, or an array), reaches an unguarded JSON.parse path in the middleware's conversion logic and throws before any error-catching exists, leaving the run neither completed nor errored. The issue is network-reachable but requires low-level/authenticated privilege to inject the crafted tool-call arguments (CVSS 4.0 base 5.3, PR:L; independent assessment CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L), and impact is limited to availability of the affected run with no confidentiality or integrity effect. There is no public exploit identified at time of analysis; the vendor fixed the flaw in release 2026-09-08.
Incomplete cleanup of per-run state in the ag-ui TypeScript client SDK's FilterToolCallsMiddleware allows disallowed tool-call events from one agent run to escape filtering - or valid events from another run to be wrongly blocked - when a single middleware instance or subscription serves more than one run. Affected deployments are those using ag-ui (ag-ui-protocol) client SDK builds up to 2026-09-07 that rely on FilterToolCallsMiddleware with a disallowedToolCalls list as a real security control, in a pattern where runs overlap, stall, or reuse runId/toolCallId values. The issue is rated CVSS 4.0 5.3 (assessed as CVSS 3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L) - an authenticated, low-privileged party who can start agent runs is the relevant actor; impact is bounded to filter bypass and mis-blocking rather than code execution, and no public exploit identified at time of analysis. Vendor-released patch: 2026-09-08.
Local sandbox escape in deepseek-ai deepseek-harness up to 0.1.7-rc.2 lets a low-privileged attacker who already has code execution inside the Landlock-backed local sandbox break the intended isolation boundary through crafted mount profiles in packages/sandbox/sandbox-local/src/profiles.ts (CWE-653). The impact is limited to confidentiality, integrity, and availability (all Low), scored 4.8 under CVSS 4.0, and it is only relevant where the harness local sandbox is actually used as a trust boundary for untrusted agent or tool code; it is not remotely reachable and requires no user interaction but does require local, low-privileged access (AV:L/PR:L/UI:N). Publicly available exploit code exists (a GitHub write-up demonstrates the mount-escape technique), the vendor was contacted early but did not respond, and no vendor-released patch has been identified, making this a genuine but low-to-moderate priority local sandbox-escape issue rather than a remote critical.
Refly through 1.1.0 uses a hard-coded JWT signing secret in apps/api/src/modules/config/app.config.ts, allowing unauthenticated remote attackers to forge authentication tokens and impersonate any user when deployments retain the default 'test' secret. Publicly available exploit code exists, and the vendor did not respond to the disclosure. The configuration is the limiting factor: operators who override the JWT secret with a strong environment-provided value are not exploitable.
Unauthenticated WebSocket access in the Penpot MCP server plugin's browser bridge (PluginBridge) lets attackers on adjacent networks impersonate the Penpot browser plugin, intercept MCP task payloads, and return forged results when Penpot runs in single-user mode. Affected versions are before 2.18.0, and exploitation requires local network reachability to the exposed WebSocket port, with impact capped at plugin impersonation and confidentiality/integrity loss (CVSS 5.3) rather than code execution. No public exploit code or CISA KEV listing was identified at time of analysis, and the separate ReplServer /execute RCE (GHSA-22qr) is an unrelated defect with different prerequisites.
Fee-sponsoring servers built on mppx before 0.8.2 can be induced by any client with access to the sponsorship endpoint to pay roughly five times the intended gas fee on otherwise-valid transactions. The FeePayerPolicy validator in src/tempo/internal/fee-payer.ts decoded client-supplied calldata with viem's decodeFunctionData but never rejected trailing bytes, so an attacker could append nonzero padding to a legitimate tip20/stablecoinDex call (transfer, approve, transferWithMemo, swapExactAmountOut) and inflate intrinsic calldata gas while gas_limit and max_fee_per_gas stayed inside the policy caps the server checks. Exploitation is unauthenticated and requires no user interaction, but impact is inherently bounded economic griefing: the demonstrated overpayment was limited to about 5x by the 16KB header ceiling (~5,500 padding bytes), and only operators who actually offer fee sponsorship are exposed. No public exploit code was identified at time of analysis and the issue is fixed in 0.8.2.
OS command injection in Moonshot AI's Kimi Code (versions 0.31.0 and earlier) lets an attacker-controlled .mcp.json file in an untrusted workspace be auto-spawned by the MCP Configuration Loader before any trust confirmation, executing arbitrary OS commands on the developer's machine. Exploitation requires the victim to open or operate on the malicious workspace (user interaction) and to run a pre-0.31.1 version; publicly available exploit code exists, but there is no confirmed active exploitation (no CISA KEV). Although the vendor rates this CVSS 4.0 at only 2.1, an independent assessment scores it 7.8 (CVSS 3.1, AV:L/AC:L/PR:N/UI:R, C:H/I:H/A:H) because CWE-78 command injection inside an AI agent's configuration loader normally yields full code execution.
Server-side request forgery in FastGPT versions prior to 4.15.2 lets an authenticated user with access to any server-side URL-consuming feature - a safe-Axios-backed HTTP tool, workflow HTTP node, external file-fetch integration, or similar integration - bypass the platform's built-in private-address block and reach loopback, private, link-local, or cloud instance-metadata services. The bypass works because the safe Axios interceptor in packages/service/common/api/axios.ts validates the hostname with isInternalAddress() before a separate HTTP connection performs its own DNS lookup, opening a time-of-check/time-of-use (DNS rebinding) window in which an attacker-controlled hostname resolves publicly during validation and to an internal address at connection time; the same independent re-resolution occurs after each manual redirect hop. Exploitation requires authentication, attacker-controlled authoritative DNS, and winning the resolution race, so while impact is high (read access to internal services and metadata, scope-changed), practical exploitation is non-trivial; no public exploit code or confirmed active exploitation was identified at time of analysis.
Stored cross-site scripting (CWE-79) in the LightRAG WebUI prior to 1.5.5 lets an attacker who can ingest a document persist raw HTML that the query path later returns and renders as active content, executing JavaScript in the WebUI origin for any user who views the poisoned answer. The vulnerable sinks are ChatMessage.tsx, which renders answer and thinking content through react-markdown with rehypeRaw and skipHtml=false but no HTML sanitizer, and a Mermaid rendering path configured with securityLevel 'loose' that injects generated SVG via innerHTML; an attacker-supplied iframe srcdoc or crafted mermaid block is sufficient to run script. Successful exploitation lets the attacker read the API token held in the victim's localStorage and perform API actions as that user, so the assessed scope is changed (S:C) with limited confidentiality and integrity impact. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N (6.1), meaning the attacker requires authenticated ingestion capability and the victim must run a query that surfaces the content and view it in the WebUI; no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV).
Cross-environment integration tampering in Novu before 3.18.0 lets an authenticated caller who holds an environment-scoped API key or a dashboard (JWT) session for one environment act on an integration that belongs to a different environment within the same organization, deleting it, rewriting its provider credentials, promoting it to primary, or triggering auto-configuration by supplying the target environment's integrationId. The advisory-defined scope covers both environment API keys and dashboard sessions, but the v3.18.0 release closes only the environment-scoped API-key path (HTTP 403, 'is scoped to a single environment') while its own tests deliberately preserve cross-environment dashboard-session behavior, so 3.18.0 is a partial remediation and installations at or above that version remain exposed through the JWT/dashboard vector. Severity is moderate (CVSS 6.5, CWE-639): integrity and availability are fully impacted while confidentiality is not, no cross-organization access is possible, exploitation requires existing authenticated access plus knowledge or enumeration of a target integrationId, and no public exploit code or confirmed active exploitation has been identified at time of analysis.
Server-side request forgery in Novu prior to 3.18.0 allows an authenticated user to make the notification worker issue attacker-directed POST requests to internal or otherwise restricted network services by supplying a chat webhook URL through subscriber credentials.webhookUrl, channel endpoint.url, event payload.webhookUrl, or event overrides.webhookUrl. The Slack, Discord, Mattermost, Microsoft Teams, Grafana On-Call, Ryver, Rocket.Chat, GetStream, and Zulip chat providers pass that URL straight into raw HTTP requests in send-message-chat.usecase.ts without the normalizeOutboundHttpUrl, assertSafeOutboundUrl, or DNS-pinned safeOutboundJsonRequest guards that protect Novu's generic webhook providers, resulting in a largely blind, POST-only SSRF whose impact is bounded to interactions or actions offered by the reached internal service (CVSS 5.3; assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N). Exploitation requires a valid authenticated account and worker-level network reachability to the intended target; no public exploit code has been identified at time of analysis and there is no confirmation of active exploitation (CISA KEV). The issue is fixed in version 3.18.0.
Stored cross-site scripting in Joplin (including Joplin Server deployments) before 3.7.2 lets a low-privileged authenticated Server user publish a crafted HTML note as a public share whose javascript: link passes the renderer's internal-resource validation. Exploitation is heavily constrained: the victim must middle-click or use 'Open in new tab' on the link and be running an older or non-hardened browser, because current Chrome and Firefox block javascript: new-tab navigation, and ordinary left-click is already blocked; if execution succeeds while the victim is signed in, script runs in the Joplin Server origin and can read page-visible content and issue authenticated same-origin requests. Rated CVSS 4.4 (AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N), no public exploit code identified at time of analysis and no confirmed active exploitation (not in CISA KEV); a vendor-released patch (3.7.2) is available.
Joplin Server prior to 3.7.7 lets an authenticated low-privileged user who holds a *pending* (not yet accepted) folder-share invitation write new items directly into that shared folder, because ItemModel.checkIfAllowed() accepts any share_users row for the caller without requiring ShareUserStatus.Accepted. The injected content is then pushed out to the share owner and already-accepted participants by ShareModel.updateSharedItems3() before the attacker ever accepts the invitation, giving unauthorized content injection into another user's notebook. The flaw requires the invitation precondition, so it is not exploitable against arbitrary shares or default configurations with no pending invite; impact is integrity-only (CVSS 3.1 base 4.3, C:N/I:L/A:N, PR:L), no public exploit code was identified at time of analysis, and the issue is fixed in 3.7.7.
Path traversal in 0215AndrewFeng ACE-MCP through 4.10.8 lets an authorized MCP tool client read arbitrary files from the host via the get_file_snippet tool: the attacker supplies both projectRootPath and filePath, and because projectRootPath is treated as trusted, setting projectRootPath=/etc with filePath=hosts satisfies the isPathInsideProjectRoot guard and exposes /etc/hosts. Exploitation requires the ability to invoke the MCP server's tool interface (authenticated, CVSS PR:L), needs no user interaction or special server configuration, and yields read-only confidentiality impact (no write or code execution). Publicly available exploit code exists and the issue was reported to the vendor, which has not responded or shipped a fix; the independent assessment rates confidentiality impact High, materially higher than the 2.1 CVSS 4.0 base score in the report, and no CISA KEV entry indicates confirmed active exploitation at time of analysis.
Command injection in the nexus_reauth MCP tool of 0-Gaurav-0/nexus-mcp lets an attacker who can invoke that tool and control its 'url' argument run arbitrary operating-system commands through the unsanitized child_process.exec call in src/auth/browser.ts. Publicly available exploit code exists (the CVSS 4.0 vector carries E:P), the project was notified via an issue report but has not responded, and because the project uses a rolling release model no fixed version is identified; the CNA scores the issue 2.1 under CVSS 4.0 while our independent assessment rates it 8.8 under CVSS 3.1, reflecting high confidentiality, integrity and availability impact on successful injection. Exploitation requires the nexus_reauth tool to be reachable and invokable and, per the PR:L vector, some low-level tool-invocation privilege rather than fully unauthenticated access, and the practical remote (AV:N) reach depends on whether the MCP server is actually network-exposed instead of local stdio only.
Guest-level users on kan through 0.6.0 can create boards they are not entitled to create by invoking the GitHub project import mutation, which never applies the board:create permission check that the normal board-creation path enforces. The impact is an authenticated, integrity-only authorization bypass (assessed CVSS 3.1 base 5.3, AV:N/AC:L/PR:L/UI:N/C:N/I:L/A:N) that requires the attacker to already hold a low-privilege account on the target instance; there is no disclosure of other users' data and no availability impact. No public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited (CISA KEV), so this is a genuine but low-severity permission-model defect rather than an emergency.
Path traversal in the Redocly CLI `split` command (@redocly/cli prior to 2.33.2, and the 1.x line prior to 1.34.17) lets a crafted OpenAPI or AsyncAPI document place or overwrite YAML/JSON files outside the directory supplied to `--outDir`. The command derives output filenames from untrusted component names, path keys, and `x-codeSamples` lang values without confirming the resolved target stays inside the chosen directory, so literal `../` segments in those fields escape the output tree. Impact is deliberately bounded - content is limited to YAML/JSON and code-sample filenames stay based on the HTTP method - yielding an integrity-only file write rated CVSS 4.4 (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L), with unauthenticated (PR:N) exploitation that nonetheless requires a victim to run `split` on the malicious spec; no public exploit identified at time of analysis.
Cache-key pollution in the @orpc/server CORS plugin (oRPC versions prior to 1.14.8) allows remote, unauthenticated clients to inject arbitrary Vary header values that are copied verbatim into HTTP responses, poisoning the cache keys used by shared caches, CDNs, or reverse proxies and producing inconsistent CORS enforcement for other clients. No authentication or user interaction is required (CVSS 4.0 vector shows PR:N/UI:N), but the impact is gated by deployment topology: per the vendor and independent assessment, default non-cached configurations have no established confidentiality, integrity, or availability impact, so single-instance or non-CDN deployments are effectively unaffected. The realistic exposure is a low-to-moderate integrity issue - scoped to the vulnerable component (S:C with I:L) - rather than the code-execution problem the misleading 'Code Injection' tag implies, and no public exploit code or CISA KEV entry was identified at time of analysis.
SQL injection in the ORDER BY direction handling of MikroORM (a TypeScript ORM for Node.js) lets authenticated remote attackers append arbitrary SQL fragments to generated queries, enabling blind or boolean-based extraction of data readable by the configured database account. Affected are SQL drivers in versions prior to 6.6.16 and 7.0.0 through 7.1.6 (SQLite, PostgreSQL, MySQL, MariaDB, MSSQL, libSQL, Oracle); MongoDB is not affected. Exploitation is conditional - the application must bind attacker-controlled request data directly to the orderBy direction in em.find(), em.findOne(), em.findAndCount(), QueryBuilder.orderBy(), or QueryBuilderHelper.getQueryOrderFromObject(); the field key is already validated against entity metadata, and there is no public exploit identified at time of analysis. Vendor-released fixes exist in 6.6.16 and 7.1.7.
Unauthenticated information disclosure in Rallly before 4.15.0 allows remote attackers who possess a poll's urlId to retrieve the names and email addresses of scheduled-event invitees through the polls.get tRPC procedure, regardless of the poll's privacy settings. The urlId is embedded in the public invite links Rallly generates and shares, so no credentials, user interaction, or non-default configuration are needed; CVSS 3.1 rates this 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). There is no public exploit code identified and no indication of active exploitation at time of analysis, and the vendor has released a fix in version 4.15.0.
An elevation of privilege vulnerability exists in Visual Studio and Visual Studio Code when they load software dependencies, aka 'Visual Studio and Visual Studio Code Elevation of Privilege. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Improper Privilege Management vulnerability could allow attackers to escalate privileges to gain unauthorized elevated access.
Cross-tenant conversation-state leakage in the Strands Agents SDK A2A server allows an authenticated remote caller in a multi-tenant deployment to read other tenants' conversation history and plant persistent instructions that alter model behavior for subsequent callers by referencing a different context_id. Python strands-agents before 1.43.0 and TypeScript @strands-agents/sdk before 1.5.0 are affected; single-tenant or single-user deployments are not exposed. No public exploit was identified at time of analysis, and fixes are available in 1.43.0 and 1.5.0.
OS command injection in zosmaai's pi-llm-wiki through 0.11.7 lets an attacker who can invoke the wiki_capture_source MCP tool run arbitrary operating-system commands on the host by manipulating the tool's url argument, which is passed unsanitized into a shell command used for source extraction. Publicly available exploit code exists (referenced in the project's issue tracker), and the flaw is fixed in version 0.11.8; there is no indication of confirmed active exploitation in CISA KEV. The CVSS v4.0 score is 8.6 (with an assessed CVSS v3.1 equivalent of 8.8), reflecting high confidentiality, integrity, and availability impact, though the vector requires authorized tool access (PR:L) and real-world risk is bounded by the project's very small deployment footprint and whether the MCP tool endpoint is remotely reachable.
A remote, unauthenticated denial-of-service condition in the NestJS (Nest) microservices framework lets an attacker crash a service on demand by sending a single message whose 'pattern' field is a deeply nested object. Only deployments using the TCP transport (ServerTCP) or the RabbitMQ transport (ServerRMQ) are exposed, because those paths pass a client-controlled, non-string pattern into JSON.stringify to compute the handler lookup key; sufficient nesting throws 'RangeError: Maximum call stack size exceeded', and the unhandled promise rejection terminates the Node.js process under default behavior. Affected versions are prior to 11.2.4 and prior to 12.0.2; the CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects pure availability loss with no confidentiality or integrity impact, and no public exploit has been identified at time of analysis. Risk is highest where the raw TCP port or consumed RabbitMQ queue/exchange is reachable by untrusted parties, since these are typically internal service-to-service surfaces.
A credential-isolation flaw in geelen mcp-remote 0.1.16 through 0.1.38 allows a remote attacker who controls or can predict the MCP server URL a victim configures to cause MD5-derived credential-store paths to collide or match, potentially exposing or overwriting another server's cached OAuth tokens via the getServerUrlHash function in src/lib/utils.ts. The package is an npm bridge that connects local MCP clients to remote MCP servers, so practical exploitation depends on the victim adding the attacker's server URL and on the OAuth credential-persistence feature being in use (user interaction), which is inconsistent with the no-interaction AV:N/AC:L/PR:N/UI:N profile of the 9.8 headline score. No public exploit code was identified at time of analysis and EPSS is low (0.29%, 19th percentile), so the CWE-94 arbitrary-code-execution framing should be treated as unverified rather than confirmed remote code execution.
Code generation in orval before 8.29.0 writes the raw OpenAPI operationId into a single-quoted object literal inside generated TanStack Query mutator metadata, so a crafted operationId can break out of the string and inject arbitrary JavaScript that executes when the generated query or mutation hooks are called. Practical exploitation requires a developer or CI pipeline to run orval codegen against an OpenAPI document whose operationId is attacker-controlled and then to execute the generated hooks - a conditional path that hinges on the trust boundary of the ingested spec, even though PR:N appears in the vector; the independent assessment (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects this required victim interaction, while the headline CVSS 4.0 score of 9.3 (UI:N) overstates how freely the flaw triggers. No public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS score was provided; a vendor patch is available (orval 8.29.0).
Code injection in orval before 8.29.0 lets an attacker who controls or influences the OpenAPI specification being processed smuggle executable JavaScript into the generated client: media-type (Content-Type) keys are written into single-quoted string literals without escaping, so punctuation in a crafted key terminates the literal and injects arbitrary statements into the emitted code. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) makes this an unauthenticated remote code-injection flaw at 9.3, but exploitation in practice is gated by the victim actually running orval over the malicious spec and then invoking the generated fetch operation or mock resolver - our independent assessment therefore applies UI:R (CVSS 3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), and teams that only generate clients from their own trusted specifications are not realistically exposed. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor has released a fix in orval 8.29.0.
Code injection in the Orval OpenAPI-to-TypeScript client generator (@orval/core) before 8.30.0 lets an attacker who controls the default value of a date or date-time field in an OpenAPI schema splice arbitrary JavaScript into generated factory code, which then executes with the privileges of whatever process consumes the generated client. Exploitation is not remote against a deployed service: it requires the non-default factoryMethods and useDates options to be enabled, a developer running codegen against a spec the attacker can influence, and the resulting factory client being executed, giving an assessed CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (the advisory lists 9.2 under CVSS 4.0). No public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV); the vendor has shipped a fix in 8.30.0.
Code injection in the Orval OpenAPI client generator's @orval/effect package (versions 8.14.0 through 8.28.1) lets an attacker who can influence an OpenAPI schema embed arbitrary JavaScript expressions in the generated validation module, which execute at module scope as soon as that generated code is built or imported. The injection point is the schema `default` value, which the effect generator rewrites into a template literal so that `${...}` syntax (or a literal backtick) re-arms interpolation, with numeric constraints such as minimum/maximum/multipleOf similarly emitted as unquoted expressions; exploitation is remote and does not require prior credentials per the vendor vector (PR:N), but it does require the victim to run the generator against an untrusted or third-party spec and then build or import the output, giving injected code the developer's build-time privileges. No public exploit code has been identified at time of analysis and the issue is patched upstream, so real-world urgency is lower than the vendor's CVSS 4.0 score of 9.3 suggests - this is a build-time/developer-tooling flaw rather than a network-facing service exposure (independent assessment: CVSS 3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, reflecting the victim interaction the vendor rating understates).
Code injection in orval's opt-in @orval/hono generator (all versions before 8.29.0) lets an attacker who controls an OpenAPI document plant an apostrophe in a static path segment and break out of the single-quoted route literal, injecting arbitrary JavaScript that runs whenever the generated TypeScript module is imported or built. This is a build-time supply-chain style flaw rather than a runtime flaw in a network service: the affected party must run orval code generation against an untrusted spec and then import the generated output, and the CVSS v4.0 score of 9.3 reflects high confidentiality, integrity and availability impact on the build/developer environment. Exploitation is not confirmed in the wild (no CISA KEV entry) and no public exploit code was identified at time of analysis, though the upstream patch and the exact vulnerable code path are publicly documented.
Missing authentication on Postiz's enterprise/reseller organisation provisioning endpoint lets an authenticated low-privilege user escalate into full control of a newly minted top-tier organisation. Because the enterprise controller was omitted from the authentication middleware's allow-list, the route is network-reachable without any session, and its sole gate - a signature check on a token in the request body - is satisfied by the attacker's own ordinary login token, since login tokens are signed with the same instance secret and carry no purpose, audience or expiry claim. The endpoint then creates an organisation on the highest subscription tier flagged lifetime with an oversized channel allowance, provisions an owner account for the attacker, and returns a working API key for the public API in the response body (CVSS 3.1 7.1, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L; CWE-306). No public exploit code has been identified at time of analysis, but the attacker only needs any valid account on the instance, which on self-registration-enabled deployments means anyone. Vendor-released patch: v2.24.0.
Dokploy instances running versions prior to 0.29.13 disclose stored Git provider secrets - GitHub App private keys, OAuth tokens and client secrets, webhook secrets, and Gitea/Bitbucket access tokens, refresh tokens, and app passwords - to authenticated organization members who were never granted access to those providers. The protected tRPC procedures github.one, gitlab.one, gitea.one, and bitbucket.one return full provider rows without applying getAccessibleGitProviderIds or an organization check, and application.one returns the same secrets as nested relations from findApplicationById even when hasGitProviderAccess is false. Exploitation requires an authenticated Dokploy account (PR:L) holding application read access or knowledge of a provider identifier, and the practical impact is confidentiality: a restricted member can use the leaked credentials to read private repositories or manipulate external CI/CD and webhook workflows. No public exploit code has been identified at time of analysis.
Predictable, non-cryptographic credential generation in Postiz (gitroomhq/postiz-app, all versions prior to v2.24.0) allows unauthenticated remote attackers to reconstruct the V8 xorshift128+ PRNG state and derive OAuth access tokens, authorization codes, client secrets, organization API keys and PKCE verifiers issued to other users and organizations. Practical exploitation is limited by the requirement that the unauthenticated OAuth dynamic client registration endpoint be enabled and network-reachable, since that endpoint is what returns freshly generated client credentials supplying the consecutive PRNG output needed to solve for internal state; concurrent credential generation by other users interleaves draws and degrades recoverability, which is why the assessed vector carries high attack complexity. No public exploit code was identified at time of analysis and the issue is not in CISA KEV, but successful exploitation yields high confidentiality and integrity impact across tenants, and a vendor patch is available in v2.24.0 (advisory PSA-2026-TD98KY).
Field-level read permission bypass in Twenty CRM before 2.22.0 lets an authenticated workspace member or API key that is allowed to read an object but explicitly denied read on a specific field still reference that denied field inside GraphQL or REST filter predicates, turning the returned totalCount and row presence into a boolean/count oracle that can reconstruct the hidden values. The vulnerability is a bounded confidentiality issue: exploitation requires a principal whose role actually configures field-level read restrictions, and reconstruction only works against records already visible under that principal's row-level policy, and it is iterative across many queries rather than a single-shot dump. There is no evidence of active exploitation (not listed in CISA KEV) and no public exploit code identified at time of analysis; the vendor has released a patch in Twenty 2.22.0.
Authentication bypass in Joplin Server prior to 3.7.2 allows an unauthenticated remote attacker who can control or influence a SAML identity assertion to obtain a valid session for an existing local password-based account purely by matching the asserted email address, granting read and write access to that user's notes, files, and settings without knowledge of the local password. The defect is gated to deployments running mixed authentication - local password accounts and SAML SSO enabled together (SAML_ENABLED=true) - so SAML-only, local-only, and default single-auth installations are not exposed. The issue is fixed in version 3.7.2 via a check that rejects SSO login for non-external accounts; no public exploit identified at time of analysis.
Stored cross-site scripting in Joplin Server before 3.7.7 allows an authenticated, low-privileged user to publish an empty-title resource whose attacker-controlled MIME type (image/svg+xml) is served inline, so a crafted SVG executes in a victim's browser when the public share link is opened. The flaw lives in the GET /shares/:id?resource_id= route, which reflects the user-supplied MIME and omits Content-Disposition when the resource title is empty; under the default configuration user content shares the Joplin Server application origin, so the script can read same-origin administrative data and anti-CSRF tokens and, against an authenticated victim, act with that victim's session. Installations that set a separate USER_CONTENT_BASE_URL still execute the script, but confined to the user-content origin; the issue is fixed in 3.7.7 and no public exploit code was identified at time of analysis.
Joplin Server instances prior to 3.7.2 expose an SSO login-code redemption endpoint (GET /api/login_with_code/:id) that is not protected by the limiterLoginBruteForce rate limiter, allowing an unauthenticated remote attacker to make unlimited guesses against a nine-digit authentication code whose lifetime is only ten minutes; a single correct guess yields a full session token granting read and write access to the victim's notes, notebooks, and account settings. Successful exploitation is constrained by timing and throughput: the attacker must target a user during an active SSO login, know the login id, and search roughly 10^9 possible codes inside a 600-second window (about 1.6 million requests per second for reliable coverage), so the flaw is only practical against servers reachable at high request rates. The issue is confirmed by the vendor fix diff (CWE-307, missing limiterLoginBruteForce) and is fixed in 3.7.2; no public exploit code was identified at time of analysis and the flaw is not listed in CISA KEV.
Authenticated clients on deepstream.io 10.1.0 can bypass record-write authorization and modify arbitrary protected records, corrupt application state, or cause service disruption when the server is configured with permission.type 'config'. The root cause is an omitted PATCH_MULTI entry in the permission rules map, which makes the config permission engine treat the absent rule specification as an unconditional allow instead of requiring write permission. Any user holding valid credentials can exploit this remotely with no user interaction (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H per independent assessment), and no public exploit code has been identified at time of analysis; deployments using the default permission.type 'none' already permit all operations and are not additionally affected.
Remote code execution affects Univer v1.0.0-alpha.2 through its Uniscript feature: the UniscriptExecutionService.execute() function in /services/script-execution.service.ts evaluates attacker-influenced script content (CWE-94), allowing arbitrary code execution with the privileges of the hosting process. The input CVSS vector rates this 9.8 (AV:N/AC:L/PR:N/UI:N), but the authoritative assessment refines the privilege requirement to PR:L, meaning an attacker generally needs a delivery channel - and for most deployments at least application-level access - to place a crafted script into the execution service, and the exposure is further limited to deployments that actually enable Uniscript on this early alpha build. No confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; EPSS is 0.21% (11th percentile), indicating low modeled near-term exploitation likelihood.
Unauthenticated passkey enrollment in OpenReception appointment-booking software prior to 1.1.1 lets remote attackers inject a controlled WebAuthn credential for a guessed userId and then log in as that staff member, yielding a valid STAFF session without any credentials. The attacker only needs the tenant's public tenant ID and a target staff email address, plus reachability of the public booking API, to run an inject-then-login oracle that identifies the matching userId and completes authentication with their own assertion. Successful hijacking of a STAFF account exposes tenant data, and escalation to TENANT_ADMIN identifiers allows modification or deletion of tenant resources and key shares, which can render appointment data permanently undecryptable and take booking services offline; GLOBAL_ADMIN accounts are not reachable through this tenant-scoped path. There is no public exploit identified at time of analysis, though the vendor has released a fix in version 1.1.1 and the code diff demonstrates the defect unambiguously.
Path traversal in decap-server 3.10.0 and earlier lets unauthenticated remote attackers read, write, and delete files in sibling directories that merely share the leading string of the configured local_git repository path. The flaw sits in the Joi input validator that guards the CORS-enabled /api/v1 JSON API: path.join plus a raw startsWith(repoPath) prefix check cannot distinguish a genuine child path from a sibling such as 'decaporg__decap-cms-owned' next to 'decaporg__decap-cms', so crafted '../<sibling>/file' payloads reach the getMediaFile, persistMedia and deleteFile handlers and achieve high-confidentiality, high-integrity and high-availability impact on files outside the repository root. Exploitation is constrained by deployment exposure (the package is a local development proxy usually bound to localhost) and by the prefix-collision requirement, which rules out arbitrary filesystem traversal to any absolute path; a public PoC reference exists but it is not verified as working exploit code, there is no confirmed actively exploited (CISA KEV) status, and EPSS is low at 0.29% (22nd percentile) even though the vuln.today priority label is act_now. Vendor-released patch: 3.11.0.
Server-side request forgery in Nango through version 0.70.4 lets an authenticated user steer server-side HTTP requests to attacker-chosen destinations by supplying malicious values in connection configuration fields that Nango interpolates into provider token and proxy URL templates. Successful abuse can reach internal-only services or cloud instance metadata endpoints (for example 169.254.169.254) and potentially exfiltrate provider credentials held by the Nango deployment. Authentication with the ability to supply connection configuration is required (CVSS 4.0 vector shows PR:L), no public exploit code was identified at time of analysis, and there is no confirmed active exploitation (CISA KEV) - the practical risk is rated moderate because the primary limiter is the pre-existing authenticated access and the payoff depends heavily on the deployment's cloud/network egress posture.
Trigger.dev before 4.6.0 allows an authenticated low-privilege user to bind an arbitrary GitHub App installation to their own organization, because the platform does not verify that the user controls that installation. By replaying a valid OAuth state cookie and supplying sequential GitHub App installation identifiers, an attacker can gain unauthorized access to the victim's repositories in multi-tenant or shared self-hosted deployments where multiple organizations connect GitHub Apps. Exploitation requires winning a timing race and is not push-button; no public exploit code or active exploitation has been identified at time of analysis.
Twenty CRM before 2.35.0 fails to enforce field- and row-level permission checks inside the groupBy-with-records GraphQL resolver, letting an authenticated user who holds canReadObjectRecords permission read field values they are explicitly denied by canReadFieldValue. The result is read-only disclosure of restricted record data to a partially privileged account - no modification or denial of service - and no public exploit code has been identified at time of analysis. The vendor has shipped a fix in version 2.35.0, and the flaw carries a CVSS 4.0 base score of 7.1 (our independent assessment scores it CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), reflecting a genuine but moderate-severity authorization defect rather than a high-severity emergency.
Cross-tenant authorization bypass in TinaCMS self-hosted deployments allows any holder of a legitimate TinaCloud account and its valid bearer token to read, create, update, delete, and manage media on a victim site without any victim account or interaction. The flaw affects @tinacms/auth before 1.1.4 and the next-tinacms-azure adapter before 15.0.1, where the server-side isAuthorized helper trusts a request-supplied clientID and therefore validates the attacker's token against the attacker's own TinaCloud app rather than the site's configured app (CWE-639, CVSS 8.8, PR:L). Exploitation is authenticated from the attacker's perspective - the attacker must already control a TinaCloud-verifiable token, so any TinaCloud account suffices - while no public exploit code was identified at time of analysis and the vendor has released patched versions.
Server-side request forgery in mcp-searxng before 1.7.1 lets an unauthenticated network client coerce the MCP server into fetching internal-only resources. The web_url_read tool validates only the literal hostname string before handing the URL to undici's fetch, so an attacker-controlled hostname that DNS-resolves to a loopback, private, link-local, or cloud-metadata address passes the lexical check and is connected to by the OS resolver. Successful abuse can read internal HTTP services, leak credentials or service tokens, and enumerate reachable internal hosts; publicly available exploit code exists and EPSS remains low (0.14%, 3rd percentile), so this is a real but conditional risk concentrated in deployments that expose the default HTTP transport without the MCP_HTTP_HARDEN authorization layer.
Unauthenticated access to the AgentOS HTTP server shipped in the npm `praisonai` package (versions 1.6.0 through 1.7.1) allows any remote caller who can reach the service to read configured agent names, roles and the first 100 characters of each agent's instructions via GET /api/agents, and to invoke a chosen agent through POST /api/chat, potentially reaching that agent's tools, memory, external APIs, credentials and workflow state. The default configuration binds to 0.0.0.0 with corsOrigins set to ['*'] and registers both routes without any authentication or authorization middleware (CWE-306), so the missing-authentication weakness applies unauthenticated over the network (CVSS 3.1 PR:N); version 1.7.2 is the vendor-released fix. No public exploit code has been identified at time of analysis, EPSS is low at 0.56% (45th percentile) and the issue is not in CISA KEV, but CISA SSVC rates it automatable with total technical impact and the exposure depends entirely on whether an operator has left AgentOS reachable on a routable interface.
Code escaping sandbox in the PraisonAI npm package's built-in codeMode tool (praisonai 1.4.0 through 1.7.1) lets anyone who can influence the code string read host files, write or modify files, spawn subprocesses, and consume host process resources, despite the tool advertising a sandbox boundary. The implementation blocks a handful of literal source patterns and shadows process and require with undefined properties, but untrusted code can walk the JavaScript prototype chain (for example ({}).constructor.constructor) to recover the real Function constructor and reach process.mainModule.require, bypassing both controls at low complexity. The vulnerability is rated 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) with the vector indicating some prior privilege or context is needed to reach the tool; EPSS is low (0.65%, 49th percentile) and no public exploit code or confirmed active exploitation was identified at time of analysis, but the low attack complexity and high confidentiality, integrity, and availability impact make this a genuine high-priority fix rather than an inflated score.
OS command injection in the Git Remove MCP Tool of 0xshariq github-mcp-server (all revisions up to commit 52e764a7d66eac1726fce02ca7bb5a638571801a) lets an attacker who can influence the tool's 'File' argument inject shell metacharacters that are executed by child_process.exec in src/github.ts. Publicly available exploit code exists (reported via a GitHub issue on the project's own repository), but there is no evidence of confirmed active exploitation in CISA KEV, and the vendor has not responded to the report. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) rates confidentiality, integrity and availability impact as high, although the practical exposure depends heavily on how the MCP server is deployed - a network-accessible MCP transport makes the AV:N path realistic, whereas a local stdio deployment limits reach to whatever can feed input into the connected LLM client.
KitchenAsty versions through 0.3.0 expose an object-level authorization flaw in the reservations API: the authenticated endpoint GET /api/reservations/:id returns whatever reservation record matches the caller-supplied identifier without ever comparing reservation.customerId to the authenticated principal, allowing any logged-in low-privilege customer to read other customers' reservation data. Because the authenticate middleware is enforced, an anonymous attacker cannot reach the handler, which is the main constraint on exploitation; the impact per request is a read-only disclosure of a single reservation record and the assessed severity is correspondingly low (CVSS 3.1 base 4.3, PR:L). No confirmed active exploitation (CISA KEV) and no public exploit code were identified at time of analysis, though the attack requires only a valid account plus enumeration of sequential or guessable reservation identifiers.
OpenClaw versions before 2026.9.4 contain an incorrect authorization flaw (CWE-863) in the mcp.app.view method that lets a holder of a read-scoped operator.read Gateway token mint a standalone MCP App ticket and redeem it at the /__openclaw__/mcp-app/view endpoint to invoke state-changing MCP tools through tools/call - operations that should require operator.write scope. Exploitation is authenticated (PR:L) and remote, requires the originating run to carry an App-tool grant (allowedAppToolNames defined and not readOnly), and needs no user interaction; the primary impact is integrity (VI:H) with no confidentiality or availability loss per the assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N vector. There is no public exploit code or confirmed active exploitation identified at time of analysis, and an independent assessment rates this as a genuine but moderate-severity authorization bypass rather than a high-severity emergency.
Sandbox isolation bypass in OpenClaw before 2026.9.5 allows an attacker who controls a sandboxed session to read files belonging to sibling session sandboxes or shared workspace directories through the Gateway's media pipeline. The root cause is an incorrect authorization check (CWE-863): the Gateway's local media root allowlist is overbroad, so media and attachment path resolution is not confined to the active session, and untrusted content can drive the same read path. Impact is confidentiality-only, is gated on a multi-session or untrusted-content deployment that exercises the media staging path, and no public exploit has been identified at time of analysis; the vendor shipped a fail-closed fix in 2026.9.5.
Path traversal in the DeepSeek deepseek-harness boot tooling (through 0.1.7-rc.2) lets an attacker who can influence the dsh.bundle.patch argument read files outside the intended bundle path via the loadProfile function in packages/boot/app-boot/src/profile.ts. The issue is remotely triggerable with no privileges required (PR:N), but CVSS 4.0 rates it AC:H with UI:P, meaning a victim must load or apply the attacker-controlled bundle patch input, and VulDB itself characterizes exploitability as 'difficult'. Publicly available exploit code exists, but impact is confined to low confidentiality (CVSS 4.0 score 2.3; independent assessment CVSS 3.1 2.0/2.3-class finding AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N), so this is a low-real-risk issue despite the public proof-of-concept.
Local information disclosure in deepseek-ai DeepSeek Harness through 0.1.5-rc.3 allows an authenticated local attacker with low privileges to manipulate the E2B_API_KEY argument in packages/e2b/e2b/src/index.ts (dsh component), causing the application to rely on untrusted input in a security decision. Publicly available exploit code exists, and the vendor was contacted early but did not respond; the issue is assessed as low severity with only limited confidentiality impact and no integrity or availability effect.
Uncaught exception handling in the A2A middleware of ag-ui-protocol ag-ui (all versions up to 2026-09-07) allows an attacker who can control the arguments of a tool call to crash or permanently hang an agent run stream. Supplying malformed JSON, or valid JSON that is not a usable object (null, a bare number, a string, or an array), reaches an unguarded JSON.parse path in the middleware's conversion logic and throws before any error-catching exists, leaving the run neither completed nor errored. The issue is network-reachable but requires low-level/authenticated privilege to inject the crafted tool-call arguments (CVSS 4.0 base 5.3, PR:L; independent assessment CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L), and impact is limited to availability of the affected run with no confidentiality or integrity effect. There is no public exploit identified at time of analysis; the vendor fixed the flaw in release 2026-09-08.
Incomplete cleanup of per-run state in the ag-ui TypeScript client SDK's FilterToolCallsMiddleware allows disallowed tool-call events from one agent run to escape filtering - or valid events from another run to be wrongly blocked - when a single middleware instance or subscription serves more than one run. Affected deployments are those using ag-ui (ag-ui-protocol) client SDK builds up to 2026-09-07 that rely on FilterToolCallsMiddleware with a disallowedToolCalls list as a real security control, in a pattern where runs overlap, stall, or reuse runId/toolCallId values. The issue is rated CVSS 4.0 5.3 (assessed as CVSS 3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L) - an authenticated, low-privileged party who can start agent runs is the relevant actor; impact is bounded to filter bypass and mis-blocking rather than code execution, and no public exploit identified at time of analysis. Vendor-released patch: 2026-09-08.
Local sandbox escape in deepseek-ai deepseek-harness up to 0.1.7-rc.2 lets a low-privileged attacker who already has code execution inside the Landlock-backed local sandbox break the intended isolation boundary through crafted mount profiles in packages/sandbox/sandbox-local/src/profiles.ts (CWE-653). The impact is limited to confidentiality, integrity, and availability (all Low), scored 4.8 under CVSS 4.0, and it is only relevant where the harness local sandbox is actually used as a trust boundary for untrusted agent or tool code; it is not remotely reachable and requires no user interaction but does require local, low-privileged access (AV:L/PR:L/UI:N). Publicly available exploit code exists (a GitHub write-up demonstrates the mount-escape technique), the vendor was contacted early but did not respond, and no vendor-released patch has been identified, making this a genuine but low-to-moderate priority local sandbox-escape issue rather than a remote critical.
Refly through 1.1.0 uses a hard-coded JWT signing secret in apps/api/src/modules/config/app.config.ts, allowing unauthenticated remote attackers to forge authentication tokens and impersonate any user when deployments retain the default 'test' secret. Publicly available exploit code exists, and the vendor did not respond to the disclosure. The configuration is the limiting factor: operators who override the JWT secret with a strong environment-provided value are not exploitable.
Unauthenticated WebSocket access in the Penpot MCP server plugin's browser bridge (PluginBridge) lets attackers on adjacent networks impersonate the Penpot browser plugin, intercept MCP task payloads, and return forged results when Penpot runs in single-user mode. Affected versions are before 2.18.0, and exploitation requires local network reachability to the exposed WebSocket port, with impact capped at plugin impersonation and confidentiality/integrity loss (CVSS 5.3) rather than code execution. No public exploit code or CISA KEV listing was identified at time of analysis, and the separate ReplServer /execute RCE (GHSA-22qr) is an unrelated defect with different prerequisites.
Fee-sponsoring servers built on mppx before 0.8.2 can be induced by any client with access to the sponsorship endpoint to pay roughly five times the intended gas fee on otherwise-valid transactions. The FeePayerPolicy validator in src/tempo/internal/fee-payer.ts decoded client-supplied calldata with viem's decodeFunctionData but never rejected trailing bytes, so an attacker could append nonzero padding to a legitimate tip20/stablecoinDex call (transfer, approve, transferWithMemo, swapExactAmountOut) and inflate intrinsic calldata gas while gas_limit and max_fee_per_gas stayed inside the policy caps the server checks. Exploitation is unauthenticated and requires no user interaction, but impact is inherently bounded economic griefing: the demonstrated overpayment was limited to about 5x by the 16KB header ceiling (~5,500 padding bytes), and only operators who actually offer fee sponsorship are exposed. No public exploit code was identified at time of analysis and the issue is fixed in 0.8.2.
OS command injection in Moonshot AI's Kimi Code (versions 0.31.0 and earlier) lets an attacker-controlled .mcp.json file in an untrusted workspace be auto-spawned by the MCP Configuration Loader before any trust confirmation, executing arbitrary OS commands on the developer's machine. Exploitation requires the victim to open or operate on the malicious workspace (user interaction) and to run a pre-0.31.1 version; publicly available exploit code exists, but there is no confirmed active exploitation (no CISA KEV). Although the vendor rates this CVSS 4.0 at only 2.1, an independent assessment scores it 7.8 (CVSS 3.1, AV:L/AC:L/PR:N/UI:R, C:H/I:H/A:H) because CWE-78 command injection inside an AI agent's configuration loader normally yields full code execution.
Server-side request forgery in FastGPT versions prior to 4.15.2 lets an authenticated user with access to any server-side URL-consuming feature - a safe-Axios-backed HTTP tool, workflow HTTP node, external file-fetch integration, or similar integration - bypass the platform's built-in private-address block and reach loopback, private, link-local, or cloud instance-metadata services. The bypass works because the safe Axios interceptor in packages/service/common/api/axios.ts validates the hostname with isInternalAddress() before a separate HTTP connection performs its own DNS lookup, opening a time-of-check/time-of-use (DNS rebinding) window in which an attacker-controlled hostname resolves publicly during validation and to an internal address at connection time; the same independent re-resolution occurs after each manual redirect hop. Exploitation requires authentication, attacker-controlled authoritative DNS, and winning the resolution race, so while impact is high (read access to internal services and metadata, scope-changed), practical exploitation is non-trivial; no public exploit code or confirmed active exploitation was identified at time of analysis.
Stored cross-site scripting (CWE-79) in the LightRAG WebUI prior to 1.5.5 lets an attacker who can ingest a document persist raw HTML that the query path later returns and renders as active content, executing JavaScript in the WebUI origin for any user who views the poisoned answer. The vulnerable sinks are ChatMessage.tsx, which renders answer and thinking content through react-markdown with rehypeRaw and skipHtml=false but no HTML sanitizer, and a Mermaid rendering path configured with securityLevel 'loose' that injects generated SVG via innerHTML; an attacker-supplied iframe srcdoc or crafted mermaid block is sufficient to run script. Successful exploitation lets the attacker read the API token held in the victim's localStorage and perform API actions as that user, so the assessed scope is changed (S:C) with limited confidentiality and integrity impact. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N (6.1), meaning the attacker requires authenticated ingestion capability and the victim must run a query that surfaces the content and view it in the WebUI; no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV).
Cross-environment integration tampering in Novu before 3.18.0 lets an authenticated caller who holds an environment-scoped API key or a dashboard (JWT) session for one environment act on an integration that belongs to a different environment within the same organization, deleting it, rewriting its provider credentials, promoting it to primary, or triggering auto-configuration by supplying the target environment's integrationId. The advisory-defined scope covers both environment API keys and dashboard sessions, but the v3.18.0 release closes only the environment-scoped API-key path (HTTP 403, 'is scoped to a single environment') while its own tests deliberately preserve cross-environment dashboard-session behavior, so 3.18.0 is a partial remediation and installations at or above that version remain exposed through the JWT/dashboard vector. Severity is moderate (CVSS 6.5, CWE-639): integrity and availability are fully impacted while confidentiality is not, no cross-organization access is possible, exploitation requires existing authenticated access plus knowledge or enumeration of a target integrationId, and no public exploit code or confirmed active exploitation has been identified at time of analysis.
Server-side request forgery in Novu prior to 3.18.0 allows an authenticated user to make the notification worker issue attacker-directed POST requests to internal or otherwise restricted network services by supplying a chat webhook URL through subscriber credentials.webhookUrl, channel endpoint.url, event payload.webhookUrl, or event overrides.webhookUrl. The Slack, Discord, Mattermost, Microsoft Teams, Grafana On-Call, Ryver, Rocket.Chat, GetStream, and Zulip chat providers pass that URL straight into raw HTTP requests in send-message-chat.usecase.ts without the normalizeOutboundHttpUrl, assertSafeOutboundUrl, or DNS-pinned safeOutboundJsonRequest guards that protect Novu's generic webhook providers, resulting in a largely blind, POST-only SSRF whose impact is bounded to interactions or actions offered by the reached internal service (CVSS 5.3; assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N). Exploitation requires a valid authenticated account and worker-level network reachability to the intended target; no public exploit code has been identified at time of analysis and there is no confirmation of active exploitation (CISA KEV). The issue is fixed in version 3.18.0.
Stored cross-site scripting in Joplin (including Joplin Server deployments) before 3.7.2 lets a low-privileged authenticated Server user publish a crafted HTML note as a public share whose javascript: link passes the renderer's internal-resource validation. Exploitation is heavily constrained: the victim must middle-click or use 'Open in new tab' on the link and be running an older or non-hardened browser, because current Chrome and Firefox block javascript: new-tab navigation, and ordinary left-click is already blocked; if execution succeeds while the victim is signed in, script runs in the Joplin Server origin and can read page-visible content and issue authenticated same-origin requests. Rated CVSS 4.4 (AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N), no public exploit code identified at time of analysis and no confirmed active exploitation (not in CISA KEV); a vendor-released patch (3.7.2) is available.
Joplin Server prior to 3.7.7 lets an authenticated low-privileged user who holds a *pending* (not yet accepted) folder-share invitation write new items directly into that shared folder, because ItemModel.checkIfAllowed() accepts any share_users row for the caller without requiring ShareUserStatus.Accepted. The injected content is then pushed out to the share owner and already-accepted participants by ShareModel.updateSharedItems3() before the attacker ever accepts the invitation, giving unauthorized content injection into another user's notebook. The flaw requires the invitation precondition, so it is not exploitable against arbitrary shares or default configurations with no pending invite; impact is integrity-only (CVSS 3.1 base 4.3, C:N/I:L/A:N, PR:L), no public exploit code was identified at time of analysis, and the issue is fixed in 3.7.7.
Path traversal in 0215AndrewFeng ACE-MCP through 4.10.8 lets an authorized MCP tool client read arbitrary files from the host via the get_file_snippet tool: the attacker supplies both projectRootPath and filePath, and because projectRootPath is treated as trusted, setting projectRootPath=/etc with filePath=hosts satisfies the isPathInsideProjectRoot guard and exposes /etc/hosts. Exploitation requires the ability to invoke the MCP server's tool interface (authenticated, CVSS PR:L), needs no user interaction or special server configuration, and yields read-only confidentiality impact (no write or code execution). Publicly available exploit code exists and the issue was reported to the vendor, which has not responded or shipped a fix; the independent assessment rates confidentiality impact High, materially higher than the 2.1 CVSS 4.0 base score in the report, and no CISA KEV entry indicates confirmed active exploitation at time of analysis.
Command injection in the nexus_reauth MCP tool of 0-Gaurav-0/nexus-mcp lets an attacker who can invoke that tool and control its 'url' argument run arbitrary operating-system commands through the unsanitized child_process.exec call in src/auth/browser.ts. Publicly available exploit code exists (the CVSS 4.0 vector carries E:P), the project was notified via an issue report but has not responded, and because the project uses a rolling release model no fixed version is identified; the CNA scores the issue 2.1 under CVSS 4.0 while our independent assessment rates it 8.8 under CVSS 3.1, reflecting high confidentiality, integrity and availability impact on successful injection. Exploitation requires the nexus_reauth tool to be reachable and invokable and, per the PR:L vector, some low-level tool-invocation privilege rather than fully unauthenticated access, and the practical remote (AV:N) reach depends on whether the MCP server is actually network-exposed instead of local stdio only.
Guest-level users on kan through 0.6.0 can create boards they are not entitled to create by invoking the GitHub project import mutation, which never applies the board:create permission check that the normal board-creation path enforces. The impact is an authenticated, integrity-only authorization bypass (assessed CVSS 3.1 base 5.3, AV:N/AC:L/PR:L/UI:N/C:N/I:L/A:N) that requires the attacker to already hold a low-privilege account on the target instance; there is no disclosure of other users' data and no availability impact. No public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited (CISA KEV), so this is a genuine but low-severity permission-model defect rather than an emergency.
Path traversal in the Redocly CLI `split` command (@redocly/cli prior to 2.33.2, and the 1.x line prior to 1.34.17) lets a crafted OpenAPI or AsyncAPI document place or overwrite YAML/JSON files outside the directory supplied to `--outDir`. The command derives output filenames from untrusted component names, path keys, and `x-codeSamples` lang values without confirming the resolved target stays inside the chosen directory, so literal `../` segments in those fields escape the output tree. Impact is deliberately bounded - content is limited to YAML/JSON and code-sample filenames stay based on the HTTP method - yielding an integrity-only file write rated CVSS 4.4 (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L), with unauthenticated (PR:N) exploitation that nonetheless requires a victim to run `split` on the malicious spec; no public exploit identified at time of analysis.
Cache-key pollution in the @orpc/server CORS plugin (oRPC versions prior to 1.14.8) allows remote, unauthenticated clients to inject arbitrary Vary header values that are copied verbatim into HTTP responses, poisoning the cache keys used by shared caches, CDNs, or reverse proxies and producing inconsistent CORS enforcement for other clients. No authentication or user interaction is required (CVSS 4.0 vector shows PR:N/UI:N), but the impact is gated by deployment topology: per the vendor and independent assessment, default non-cached configurations have no established confidentiality, integrity, or availability impact, so single-instance or non-CDN deployments are effectively unaffected. The realistic exposure is a low-to-moderate integrity issue - scoped to the vulnerable component (S:C with I:L) - rather than the code-execution problem the misleading 'Code Injection' tag implies, and no public exploit code or CISA KEV entry was identified at time of analysis.
SQL injection in the ORDER BY direction handling of MikroORM (a TypeScript ORM for Node.js) lets authenticated remote attackers append arbitrary SQL fragments to generated queries, enabling blind or boolean-based extraction of data readable by the configured database account. Affected are SQL drivers in versions prior to 6.6.16 and 7.0.0 through 7.1.6 (SQLite, PostgreSQL, MySQL, MariaDB, MSSQL, libSQL, Oracle); MongoDB is not affected. Exploitation is conditional - the application must bind attacker-controlled request data directly to the orderBy direction in em.find(), em.findOne(), em.findAndCount(), QueryBuilder.orderBy(), or QueryBuilderHelper.getQueryOrderFromObject(); the field key is already validated against entity metadata, and there is no public exploit identified at time of analysis. Vendor-released fixes exist in 6.6.16 and 7.1.7.
Unauthenticated information disclosure in Rallly before 4.15.0 allows remote attackers who possess a poll's urlId to retrieve the names and email addresses of scheduled-event invitees through the polls.get tRPC procedure, regardless of the poll's privacy settings. The urlId is embedded in the public invite links Rallly generates and shares, so no credentials, user interaction, or non-default configuration are needed; CVSS 3.1 rates this 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). There is no public exploit code identified and no indication of active exploitation at time of analysis, and the vendor has released a fix in version 4.15.0.
An elevation of privilege vulnerability exists in Visual Studio and Visual Studio Code when they load software dependencies, aka 'Visual Studio and Visual Studio Code Elevation of Privilege. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Improper Privilege Management vulnerability could allow attackers to escalate privileges to gain unauthorized elevated access.