IBM ContextForge MCP Gateway versions 1.0.0 through 1.0.11 contain a vulnerability where an authenticated user with tool-registration privileges can embed complex regular expressions in a tool's JSON Schema pattern field. This can cause excessive CPU consumption during argument validation, leading to denial of service and degraded gateway availability.
IBM ContextForge MCP Gateway versions 1.0.8 through 1.0.11 and 1.1.0 have a vulnerability in the jq filter guard module due to an incomplete denylist of disallowed inputs. An authenticated remote attacker can exploit this by supplying crafted jsonpath_filter values containing certain built-ins like halt, halt_error, or unbounded loops, leading to denial of service through worker process termination or resource exhaustion.
IBM ContextForge MCP Gateway versions 1.0.0 through 1.0.11 contain an improper authentication vulnerability. This flaw allows an authenticated user to bypass upstream credential-level authorization policies by exploiting an insufficiently specific cache key in the RFC 8693 token exchange cache. As a result, cached upstream bearer tokens can be reused across different credentials belonging to the same user, potentially leading to unauthorized access.
Control Web Panel versions prior to 1.30.6 contain an authorization bypass vulnerability in the validate() function of api/v1/index.php. Attackers possessing a password-recovery token and a predictable legacy signature can bypass proper API key authorization. Exploitation via the POST /cronjobsusers/ endpoint allows adding arbitrary cron commands, leading to command execution under the hosting account. Additionally, the vulnerability permits unauthorized access to global account lists and details, exposing usernames, contact emails, and password hashes. This vulnerability is rated critical with a CVSS 4.0 score of 9.2 and was fixed in version 1.30.6.
IBM ContextForge MCP Gateway versions 1.0.0 through 1.1.0 contain an authentication bypass vulnerability due to replay of identity propagation claims signatures. This occurs because of static signature payloads and missing per-gateway configuration checks during tool invocation, potentially exposing sensitive user identity information to third-party MCP servers.
Control Web Panel versions before 1.30.6 have a host header injection vulnerability in the password recovery mechanism. This flaw allows unauthenticated attackers to manipulate the reset URL by injecting a malicious HTTP Host header. Exploitation can lead to exfiltration of live recovery tokens, unauthorized password resets, and command execution via File Manager and Crontab modules on the targeted hosting account.
A vulnerability in dbus configured with the nonce-tcp transport in Red Hat Enterprise Linux 10 allows an unauthenticated attacker to cause a Denial of Service (DoS). By opening a connection and withholding the expected authentication token, the attacker stalls the server's accept process due to lack of a timeout, blocking legitimate clients from connecting. Default installations are not affected as they use local UNIX domain sockets. Exploitation requires explicit configuration of the nonce-tcp transport and network exposure.
Poste Italiane Postecert FIRMAOK! version 1.6.29 on Windows has a local privilege escalation vulnerability due to an uncontrolled OpenSSL search path. The application loads OpenSSL configuration and library files from a hardcoded directory that is user-writable and missing by default. A low-privileged attacker can create this directory and place malicious files to execute code with the privileges of the user running the application, potentially escalating privileges to full system compromise.
CVE-2025-53697 is a high-severity vulnerability in Johnson Controls iSTAR Ultra and related products caused by the use of default credentials. This affects multiple product variants including iSTAR Ultra, iSTAR Ultra SE, iSTAR Ultra G2, iSTAR Ultra G2 SE, and iSTAR Edge G2 before specific fixed versions. The vulnerability allows unauthorized access due to default credential usage, categorized under CWE-1392. Fixed versions are available.
The npm package 'dowload_ebok_to_kill_and_kill_again_by_john_coston_id159' is identified as malicious software. Any system with this package installed or running is considered fully compromised. It is recommended to immediately rotate all secrets and keys from a different, uncompromised computer. Removing the package alone may not eliminate all malicious components due to potential full control by an external attacker.
The npm package 'dowload_ebok_aws_lambda_in_action_by_danilo_poccia_o3xgh' contains malicious code that compromises any computer on which it is installed or run. Installation of this package may result in full system compromise, including unauthorized access to secrets and keys stored on the affected machine. Immediate removal of the package and rotation of all secrets and keys from a separate, uncompromised system is strongly advised.
The npm package 'dowload_ebok_honey_so_sweet_vol_5_by_amu_meguro_6vbdo' contains malicious code that compromises any computer on which it is installed or run. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted machine. Removal of the package alone may not fully eliminate the malicious software or restore system integrity.
The npm package 'dowload_ebok_ecchi_gallery_by_takumi_kobayashi_c8fuf' contains malicious code that compromises any computer on which it is installed or run. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a different, trusted device. Removal of the package alone does not guarantee full remediation due to potential persistence of malicious software.
The npm package 'dowload_ebok_puppy_love_by_rachel_renee_russell_7ae7c' contains malicious code that compromises any computer on which it is installed or run. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted computer. Removal of the package alone may not fully eliminate the malicious presence, as the attacker may have established persistent control.
The npm package 'dowload_ebok_tiques_et_maladies_a_tiques_by_karen_d_mccoy_nathalie_boulanger_191kq' contains malicious code that compromises any computer on which it is installed or run. Installation of this package can lead to full system compromise, including unauthorized access to stored secrets and keys. Immediate removal of the package is recommended, but full remediation may require rotating all secrets and keys from a different, uncompromised machine due to potential persistent control by attackers.
The npm package 'dowload_ebok_le_livre_du_hygge_by_meik_wiking_8ia8u' contains malicious code that compromises any computer on which it is installed or run. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, uncompromised machine. Removal of the package alone does not guarantee full remediation due to potential persistent malicious software.
The npm package 'dowload_ebok_kosten_und_leistungsrechnung_fur_dummies_by_michael_griga_b29bg' contains malicious code. Installing or running this package can lead to a full compromise of the affected computer. Any secrets or keys stored on the compromised system should be rotated immediately from a different, secure machine. Simply removing the package may not eliminate all malicious software introduced by it.
The npm package 'dowload_ebok_dunenfluch_by_sven_koch_66l2o' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted computer. Removal of the package alone may not fully eliminate the malicious presence due to potential persistent control by an attacker.
The npm package 'dowload_ebok_dorothy_debe_morir_by_danielle_paige_4802q' contains malicious code that fully compromises any computer on which it is installed or run. It is recommended to remove the package and immediately rotate all secrets and keys from a different, uncompromised computer. Removal of the package alone may not eliminate all malicious software introduced by its installation.
The npm package 'dowload_ebok_a_sally_lockhart_mystery_1_the_ruby_in_the_smoke_by_philip_pullman_mb9cv' contains malicious code that compromises any computer on which it is installed or run. Installation of this package may result in full system compromise, including unauthorized access to secrets and keys stored on the affected machine.