Vasco0X4

**Name of the Vulnerable Software and Affected Versions** Budibase versions prior to 3.41.3 **Description** Authenticated admin users can achieve remote code execution by uploading a malicious plugin tarball. The issue occurs because the server uses the `eval()` function on plugin JavaScript files without sandboxing within the main Node.js process. This allows attackers to execute arbitrary code and exfiltrate environment variables and credentials with root privileges in default deployments. **Recommendations** Update to version 3.41.3 or later.

**Name of the Vulnerable Software and Affected Versions** OpenWrt versions prior to 25.12.5 **Description** An integer underflow occurs in the `handle send a()` function of the Emergency Access Daemon. An unauthenticated attacker on the local network can trigger this by sending a single crafted UDP packet, causing the message length to underflow before a bounds check. This underflowed value is subsequently passed to `memcpy` as an excessively large size, resulting in a daemon crash. **Recommendations** Update to version 25.12.5.

**Name of the Vulnerable Software and Affected Versions** Kestra versions prior to 1.0.45 Kestra versions prior to 1.3.21 **Description** An authentication bypass exists in Kestra OSS due to an improper suffix match in the `AuthenticationFilter` function. The system uses `request.getPath().endsWith("/configs")` to whitelist the public configuration endpoint from Basic Auth, allowing any API path ending in `/configs` to bypass authentication. An unauthenticated remote attacker can exploit this to create and execute arbitrary workflows. Since script execution plugins such as `plugin-script-shell` and `plugin-script-python` are enabled by default, this leads to unauthenticated Remote Code Execution as root within the Kestra worker container. This issue has been exploited in real-world attacks. **Recommendations** Update to version 1.0.45 or later. Update to version 1.3.21 or later. Remove the Kestra API from the public internet or place it behind a VPN or allowlist. Review workflows and execution history for unauthorized activity and rotate all stored secrets if a compromise is detected.

**Name of the Vulnerable Software and Affected Versions** Appsmith versions prior to 1.99 **Description** The 'POST /api/v1/admin/send-test-email' endpoint allows the use of attacker-controlled `smtpHost` and `smtpPort` values to establish a raw JavaMail TCP connection. This process bypasses the WebClientUtils.IP CHECK FILTER, as that filter only applies to Spring WebClient HTTP requests. Furthermore, the API error response returns the raw MailException.getMessage() verbatim, which allows for error-based internal port scanning and service banner enumeration. **Recommendations** Update to version 1.99. Restrict access to the 'POST /api/v1/admin/send-test-email' endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Appsmith versions prior to 2.1 **Description** The SQL query editor's autocomplete functionality fails to sanitize database object names before rendering them using `innerHTML`. This allows an authenticated Developer with access to a shared PostgreSQL datasource to inject persistent Cross-Site Scripting (XSS) by creating malicious table or column names. When other workspace members interact with the same datasource and trigger the autocomplete feature, the unsanitized names execute arbitrary JavaScript in their sessions, potentially leading to session hijacking, privilege escalation, or credential theft. **Recommendations** Update to version 2.1.