Vasco0X4

**Name of the Vulnerable Software and Affected Versions** OpenWrt versions prior to 25.12.5 **Description** An integer underflow occurs in the `handle send a()` function of the Emergency Access Daemon. An unauthenticated attacker on the local network can trigger this by sending a single crafted UDP packet, causing the message length to underflow before a bounds check. This underflowed value is subsequently passed to `memcpy` as an excessively large size, resulting in a daemon crash. **Recommendations** Update to version 25.12.5.

**Name of the Vulnerable Software and Affected Versions** Kestra versions prior to 1.0.45 Kestra versions prior to 1.3.21 **Description** An authentication bypass exists in the `AuthenticationFilter` of Kestra OSS. The system uses the `request.getPath().endsWith("/configs")` method to whitelist the public configuration endpoint from Basic Auth. Since this check performs a suffix match instead of an exact path match, any API path ending with `configs` bypasses authentication. This allows an unauthenticated remote attacker to create and execute arbitrary workflows. Because script execution plugins such as `plugin-script-shell` and `plugin-script-python` are enabled by default, this can lead to unauthenticated Remote Code Execution as root within the Kestra worker container. **Recommendations** Update to version 1.0.45. Update to version 1.3.21.

**Name of the Vulnerable Software and Affected Versions** Appsmith versions prior to 1.99 **Description** The 'POST /api/v1/admin/send-test-email' endpoint allows the use of attacker-controlled `smtpHost` and `smtpPort` values to establish a raw JavaMail TCP connection. This process bypasses the WebClientUtils.IP CHECK FILTER, as that filter only applies to Spring WebClient HTTP requests. Furthermore, the API error response returns the raw MailException.getMessage() verbatim, which allows for error-based internal port scanning and service banner enumeration. **Recommendations** Update to version 1.99. Restrict access to the 'POST /api/v1/admin/send-test-email' endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Appsmith versions prior to 2.1 **Description** The SQL query editor's autocomplete functionality fails to sanitize database object names before rendering them using `innerHTML`. This allows an authenticated Developer with access to a shared PostgreSQL datasource to inject persistent Cross-Site Scripting (XSS) by creating malicious table or column names. When other workspace members interact with the same datasource and trigger the autocomplete feature, the unsanitized names execute arbitrary JavaScript in their sessions, potentially leading to session hijacking, privilege escalation, or credential theft. **Recommendations** Update to version 2.1.