What needs attention now.

Kiteworks Email Protection Gateway Improper Access Control

• Kiteworks Email Protection Gateway
• Authentication bypass

Kiteworks Core Administrative Account Takeover through Stored Cross-site Scripting (XSS)

• Kiteworks Core
• Cross-site scripting (XSS)

Kiteworks Email Protection Gateway server-side request forgery

• Kiteworks Email Protection Gateway
• Server-side request forgery (SSRF)

Incorrect authorization in OpenBSD

• OpenBSD
• Broken access control

WordPress Nested Pages plugin <= 3.3.2 - PHP Object Injection vulnerability

• Hook & Filter Nested Pages
• Insecure deserialization

yii2-starter-kit through 4.2.0 Debug and Gii Module Exposure

• yii2-starter-kit
• CWE-489

Deno 2.7.0 through 2.9.7 Command Injection via node:child_process

• deno
• Command injection

Tugtainer: Authenticated SSRF via arbitrary notification URLs in test_notification endpoint

• Quenary tugtainer
• Server-side request forgery (SSRF)

Tugtainer: Unauthenticated access to Tugtainer Agent Docker management APIs when AGENT_SECRET is unset

• Quenary tugtainer
• Broken access control

Tugtainer: OIDC login remains accessible when OIDC_ENABLED is false

• Quenary tugtainer
• Broken access control

Soft Machine: Cross-tenant workspace API auth bypass via shared `CONTAINER_SHARED_SECRET` bearer token

• Soft-Machine-io security
• Broken access control

PTZOptics Missing Authentication in Firmware Upload

• PTZOptics Move 4K 12X
• PTZOptics Move 4K 20X
• Authentication bypass

Local privilege escalation in Zammad v1.5.0 to v7.2.2 installed via DEB or RPM package

• Zammad
• Privilege escalation

Undisclosed RCE in Zammad v6.3 and higher

• Zammad
• Authentication bypass

Use-after-free of a server-side SSLContext when sni_callback switches contexts

• Python Software Foundation CPython
• Memory corruption

Internet2 Grouper: In Internet2 Grouper before 7.5.1 (in some configurations)…

• Internet2 Grouper
• Privilege escalation

Joomla Extension - ordasoft.com - Unauthenticated Remote Code Execution in OrdaSoft Joomla CCK < 8.3.16

• ordasoft.com OrdaSoft Joomla CCK
• Unrestricted file upload

LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Visual-Only RPyC Service

• ModelTC LightLLM
• Insecure deserialization

Joomla Extension - joomcode.com - Unauthenticated SQL injection in read and write queries in JCTables < 1.21.1

• joomcode.com JCTables extension for Joomla
• SQL injection

SQL Injection in Trex Digital Manufacturing's Trex MES

• Trex Digital Smart Manufacturing Systems Inc. Trex MES
• SQL injection

litespeedtech LiteSpeed Web Server: LiteSpeed Web Server (LSWS) before 6.3.7 build 1 mishandles internal redirect URL…

• litespeedtech LiteSpeed Web Server
• CWE-174

Multiple Vulnerabilities in Dolusoft Software's SOPLOG

• Dolusoft Software Technologies SOPLOG
• SQL injection

Cisco Catalyst SD-WAN Manager System Account Authorization Bypass Vulnerability

• Cisco Catalyst SD-WAN Manager
• CWE-177

WordPress OAuth Single Sign On – SSO (OAuth Client) plugin <= 7.1.2 - Bypass vulnerability vulnerability

• miniOrange OAuth Single Sign On – SSO (OAuth Client)
• Authentication bypass

WordPress Booking Activities plugin <= 1.18.7.1 - PHP Object Injection vulnerability

• Booking Activities
• Insecure deserialization

WordPress Books Gallery plugin <= 4.8.3 - SQL Injection vulnerability

• Hossni Mubarak Books Gallery
• SQL injection

WordPress Estatik plugin <= 4.3.5 - Privilege Escalation vulnerability

• Estatik
• Privilege escalation

WordPress SiteSkite plugin <= 2.1.8 - Remote Code Execution (RCE) vulnerability

• SiteSkite
• Code injection

WordPress AcyMailing SMTP Newsletter plugin <= 11.0.5 - Remote Code Execution (RCE) vulnerability

• AcyMailing Newsletter Team AcyMailing SMTP Newsletter
• Code injection

Authentication Bypass in sogo_yhn

• YunoHost-Apps sogo_yhn
• Broken access control

Authentication Bypass in sogo_yhn

• YunoHost-Apps sogo_yhn
• Broken access control

Apache WSS4J: WSS4J EncryptedHeader child confusion causing wrong protected-header selection

• Apache Software Foundation Apache WSS4J
• CWE-345

Apache WSS4J: SAML Sender-Vouches Authentication Bypass

• Apache Software Foundation Apache WSS4J
• Authentication bypass

Apache WSS4J: Streaming WS-SecurityPolicy validation may skip element-protection checks.

• Apache Software Foundation Apache WSS4J
• Code injection

Apache MINA SSHD: Asynchronous authentication can bypass signature verification

• Apache Software Foundation Apache MINA SSHD
• CWE-305

Apache MINA SSHD: LDAP injection in sshd-ldap

• Apache Software Foundation Apache MINA SSHD
• Other injection
• CWE-305

Apache MINA SSHD: LDAP password authentication ineffective

• Apache Software Foundation Apache MINA SSHD
• Authentication bypass

DigiWin｜EasyFlow .NET - Missing Authentication

• DigiWin EasyFlow .NET
• Authentication bypass

DigiWin｜EasyFlow .NET - Insecure Deserialization

• DigiWin EasyFlow .NET
• Insecure deserialization

Apache PLC4X: OPC UA secure channel: integrity bypass, unverifiable server certificate, and silent downgrade

• Apache Software Foundation Apache PLC4X
• Weak cryptography or TLS
• CWE-757

WordPress GiveWP plugin <= 4.16.9 - Broken Authentication vulnerability

• Liquid Web / StellarWP GiveWP
• CWE-1289

Zella Theme < 2.6.3 - Unauthenticated Arbitrary File Upload

• Zella Theme
• Unrestricted file upload

zosmaai pi-llm-wiki wiki_capture_source MCP tool index.ts os command injection

• zosmaai pi-llm-wiki
• Command injection

Out-of-bounds write in Pexip Infinity

• Pexip Infinity
• Memory corruption

AiSOC 7.2.0 before 12.0.0 Command Injection via CrowdStrike RTR

• beenuar AiSOC
• Command injection

Devika v1.0 is vulnerable to Code Injection via the Runner.run_code function in src/agents/runner/runner.py.

• Code injection

Devika v1.0 is vulnerable to Code Injection in the Runner.execute function in src/agents/runner/runner.py which allows an attacker to achieve arbitrary code execution by exploiting the direct executi…

• Code injection

DeepTutor v1.4.0 is vulnerable to command execution in /tutorbot/agent/tools/shell.py:ExecTool.execute.

• Command injection

DB-GPT v0.8.0 sandbox API silently falls back to LocalRuntime and executes code on host.

• Broken access control

agentgpt v.1.0.0 is vulnerable to Incorrect Access Control in next/src/server/api/routers/agentRouter.ts.

• Broken access control

In DB-GPT 0.7.5 and 0.8.0, a skill uploaded through the real /api/v1/skills/upload route can later be executed through the real /api/v1/chat/react-agent flow.

• Code injection

DB-GPT v0.7.5 and v0.8.0 contains directory traversal in python_file_upload (packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/python_upload_api.py:42).

• Path traversal

DB-GPT 0.8.0 contains directory traversal in skill_upload (packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/agentic_data_api.py:40).

• Path traversal

bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to Code Injection in src/backend/bisheng/api/v1/validate.py.

• Code injection

bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to directory traversal in save_download_file (src/backend/bisheng/core/cache/utils.py:290).

• Path traversal

In camel-ai camel 0.2.91a1, v0.2.91a2 and v0.2.91a3, TerminalToolkit.shell_exec allows prompt-driven shell command execution without an approval boundary.

• Code injection

In camel-ai camel 0.2.91a1, v0.2.91a2 and v0.2.91a3, CodeExecutionToolkit can run model-produced Python code through SubprocessInterpreter without an approval boundary.

• Code injection

In agentscope 1.0.18, 1.0.19, and 1.0.19 when the RealtimeAgent session exposes execute_python_code as an available tool, a remote WebSocket user can prompt the agent to call that tool and run Python…

• Code injection

@xhmikosr/decompress: Path traversal via symlink chain

• Path traversal

<=4.2.1 · no fixed version yet

Ziroom ZHOME A0101 ping command injection

• Ziroom ZHOME A0101
• Other injection
• Command injection