DeepSeek Harness prior to 0.1.2-alpha.2, and specifically commit 3e24087, contains a missing authentication vulnerability in its web profile HTTP and WebSocket RPC control plane, allowing any local process, including those running as a different OS user, to reach unauthenticated session methods such as session.create and session.prompt. Attackers can invoke session.prompt to trigger the agent's bash and filesystem tools, achieve arbitrary command execution as the victim user using their configured model credentials, intercept live session traffic and logs over the event mux stream, and bypass human tool-approval checks via POST /api/respond by matching only rpcId, approvalId, and sessionId values broadcast over the ungated stream.
DataGerry versions prior to 3.3.0 have a server-side template injection vulnerability that allows authenticated users with specific permissions to inject and execute arbitrary Jinja2 payloads. This vulnerability enables remote code execution as the web process user, which is root by default in Docker deployments.
A cross-site scripting (XSS) vulnerability exists in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME). This flaw allows an unauthenticated remote attacker to execute arbitrary script code by tricking a user into clicking a crafted link. The vulnerability arises from improper validation of user-supplied input in the interface.
A vulnerability in the ScopingHttpClient component of Symfony HttpClient allows credentials from a default scope to be sent to an attacker-controlled server when a network-path reference URL is resolved outside the base URI's origin. This occurs in Symfony versions 5.x prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11. The issue arises because merged options like auth_bearer or auth_basic are retained even when the resolved URL points to a different origin, potentially exposing sensitive credentials.
A vulnerability in the web-based management interface of Cisco UCS Central Software allows an authenticated remote attacker to execute arbitrary commands, write files, or disclose sensitive information. The flaw arises from insufficient validation of user input in HTTP requests. Exploitation requires valid user credentials. Cisco has released software updates to fix this issue, and no workarounds are available.
The GetPaid plugin for WordPress versions before 2.8.63 has an input validation vulnerability that allows unauthenticated attackers to bypass payment processing. By submitting a negative item quantity on a public payment form, attackers can reduce the invoice total to zero, causing the system to mark the invoice as paid without charging the payment gateway.
The GetPaid plugin for WordPress versions prior to 2.8.63 contains an authorization bypass vulnerability. This flaw allows unauthenticated attackers to access and manipulate invoices belonging to other users by exploiting the maybe_use_invoice parameter. By supplying a known pending invoice ID, attackers can read checkout pricing details and change the invoice status to on-hold without proper authorization.
A vulnerability in the authorization mechanism of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) allows an unauthenticated remote attacker to obtain an endpoint identity certificate by bypassing authorization checks. This issue arises from improper authorization validation and can be exploited by sending a crafted request to the affected device. The vulnerability has a medium severity rating with a CVSS score of 5.3.
Certain Yealink terminal devices released before April 21, 2026, have an improper access control vulnerability in the Wi-Fi 802.1X PEAP network configuration function. This vulnerability allows unauthorized users to access 802.1X network authentication credentials. Yealink has addressed this issue in the latest firmware by restricting modification privileges of the 802.1X configuration to administrator accounts only by default.
Certain Yealink products released before April 15, 2026, have a vulnerability in their Wi-Fi AP function where a default 8-digit numeric pre-shared key (PSK) with insufficient strength is used. This weak PSK can be brute-forced by attackers to gain unauthorized network access and intercept Wi-Fi traffic. The vulnerability has a high severity score of 7.4 and impacts confidentiality but not integrity or availability.
A server-side request forgery (SSRF) vulnerability exists in InfiniFlow RAGFlow up to version 0.27.3 in the _account_get function of the Seafile Connector component. This vulnerability allows remote attackers to manipulate the seafile_url argument, potentially causing unauthorized requests from the server. The vulnerability has a CVSS score of 6.3 (medium severity). Public exploit code has been disclosed, but no vendor response or patch is currently available.
A vulnerability in GNU C Library versions 2.18 through 2.31 causes the iconv converter to hang when converting crafted BIG-HKSCS input to UCS-4 or the internal wide character encoding. This results in the calling application becoming unresponsive.
A vulnerability in the WebMvcConfig.addInterceptors function of the yezhihao jt808-server component Web Management API allows remote attackers to bypass authentication. The product uses a rolling release model, so no specific affected or fixed versions are identified. Public exploit code is available. The vendor has not responded to disclosure attempts.
FreeRDP versions before 3.32.2 have a use-after-free vulnerability in the asynchronous dynamic rdpsnd channel. This flaw allows malicious RDP servers to cause the client to access freed memory by closing the channel while audio PDUs are queued. The vulnerability can lead to client crashes due to playback thread accessing freed callbacks.
Parse Server versions before 8.6.113 and 9.0.0 before 9.10.6-alpha.5 contain a prototype pollution vulnerability affecting Cloud Code triggers and LiveQuery. This flaw allows clients with write access to corrupt built-in functions by exploiting dot notation keys that traverse inherited members, causing denial of service until the server is restarted.
FreeRDP versions before 3.32.2 have a denial of service vulnerability in the NLA-enabled shadow server. This occurs when a CredSSP TSRequest omits negoTokens, allowing unauthenticated attackers to send a crafted seven-byte TSRequest that triggers a fatal assertion and crashes the server process.
FreeRDP versions prior to 3.32.2 contain a heap-based buffer overflow vulnerability in the RD Gateway RPC client. This occurs because the client incorrectly checks only total capacity rather than remaining capacity when writing certain RPC fragments, allowing a malicious RD Gateway to overwrite client heap memory. Exploitation can cause application crashes or potentially allow arbitrary code execution.
The GetPaid WordPress plugin before version 2.8.63 has an authorization vulnerability due to improper permission checks in its REST API. This flaw allows authenticated users with roles like Editor or Author to access and manipulate invoices they should not control, including listing other users' invoices, marking pending invoices as paid without proper transaction records, and creating published items and invoices.
SPIP versions prior to 4.4.29 contain a SQL injection vulnerability affecting authenticated users with back-office access. The flaw arises from a mismatch in sanitization between the POST body and GET query string parameters on the /ecrire/?exec=articles endpoint, allowing attackers to inject arbitrary SQL. Exploitation can lead to unauthorized extraction of database contents, including protected articles and bcrypt password hashes. The vulnerability has a CVSS score of 6.5, indicating medium severity. No patch or fixed version is explicitly stated in the provided data.
FreeRDP versions prior to 3.32.2 contain a use-after-free vulnerability in the freerdp-proxy component related to the DRDYNVC channel handling. This flaw allows a malicious server to cause the proxy process to crash by sending repeated CREATE_REQUEST_PDU messages for an active channel ID, triggering a race condition that frees a borrowed context prematurely.