Hard-coded JWT secret in agentscope-java DataAgent lets attackers forge admin tokens and gain highest system privileges
When the DATAAGENT_JWT_SECRET environment variable is unset, DataAgent falls back to a publicly known default key for JWT signing and verification. Because the authentication filter trusts role claims in the token without backend validation, an attacker can use that known key to craft a malicious token containing ROLE_ADMIN, bypass authentication, remotely obtain administrator privileges, and perform sensitive operations, severely harming system integrity.
Component
agentscope-java is a Java framework for AI agent development. Its DataAgent sample component is a standalone multi-user web application module intended to support team collaboration and distributed deployment. It exposes data interaction over a RESTful API; the core architecture relies on Spring Security for authentication and access control, and implements role-based permission management at the business layer to secure resource scheduling in multi-tenant environments.
Remove all hard-coded secret fallback logic from code and configuration. Require an independently generated random secret at deploy time, validate the secret at startup, and abort the process if it is missing or matches the default. Rotate secrets regularly to revoke leaked credentials.
CSSA Exclusive Early Warning
10.0 Critical
Sandbox escape in the Appium Execute Driver plugin allows remote code execution and loss of host control
An attacker can exploit improper handling of non-configurable property descriptors in vm-host-binding.ts: the original descriptor is returned, leaking the host Realm. By walking the constructor chain the attacker obtains the Node.js process object, invokes the child_process module, and runs arbitrary OS commands on the host with Appium process privileges, causing data disclosure, integrity damage, and service disruption.
Component
Appium is an open-source test framework for mobile application automation. Its Execute Driver Plugin provides a JavaScript VM-based script execution environment and uses a Proxy mechanism to control how host objects are exposed inside the sandbox, isolating automation logic from the host while still allowing interaction.
Apply sandbox mapping uniformly to all non-configurable properties instead of returning host object descriptors directly. Strictly limit access to script execution, run the service with least privilege, and deploy network-layer access controls.
CSSA Exclusive Early Warning
10.0 Critical
Path traversal in the Dolt remote service allows unauthorized arbitrary file writes and harms system integrity
An attacker crafts a path-traversal sequence containing ".." in the repo_path parameter of GetUploadLocations. Because the POST/PUT upload path lacks sanitization and validation, the server can create arbitrarily named directories outside the storage root and issue signed upload URLs; the attacker then sends malicious content to that URL and writes a controlled byte stream anywhere on the target filesystem, causing data corruption or service failure.
Component
Dolt is a version control system. Its core remotesrv component runs as a standalone remote storage server that handles table-file upload and download for distributed databases, offering data sync over gRPC and HTTP for efficient, decentralized persistence and sharing.
Normalize and sanitize all file-path parameters, strictly reject requests that contain relative path-traversal sequences or absolute paths, verify that the resolved path stays within the designated safe directory before underlying storage access, and enforce strict authentication to limit unauthorized access.
CVE Intelligence
2
CVE-2026-16740
CVSS
9.8 Critical
2026-10-14
Missing authentication in a TR7 ASP critical feature leads to OS command injection
In TR7 ASP versions from 1.0.40.236 before 1.0.1554.2331, and from 1.6.42.239 before 1.6.1554.2331, a critical feature lacks an authentication mechanism (CWE-306). The flaw lets an attacker perform OS command injection via unauthenticated requests. Both virtual and physical TR7 ASP appliances have an authentication-bypass issue in certain feature-invocation scenarios; a crafted malicious request can lead to remote code execution or full system takeover. All TR7 ASP users who have not updated to a fixed version are affected, including virtual and physical deployments. An attacker only needs to send a crafted request over the network; no user interaction is required and the attack can be carried out remotely.
Component
TR7 ASP is an application security gateway from TR7 Cyber Defense Inc., offered as virtual and physical appliances to protect web applications from various network attacks.
Risks
Complete system control: An attacker can execute arbitrary OS commands on the victim system and, depending on system privileges, install programs, view/change/delete data, or create new fully privileged accounts
No user interaction: Through a remote network request (T1190), an attacker can trigger the vulnerability with no user interaction and attack the server directly
High impact: A CVSS score of 9.8 indicates the vulnerability is easy to exploit and, if successful, severely affects confidentiality, integrity, and availability
Upgrade TR7 ASP as soon as possible to 1.0.1554.2331 or 1.6.1554.2331 or later
Deploy a firewall at the network boundary and restrict access to the TR7 ASP management interface or critical-feature ports
Monitor logs for anomalous system command execution and promptly block potential malicious activity
CVE-2026-108291
CVSS
9.8 Critical
2026-10-14
Untrusted data deserialization in itthinx Affiliates leads to object injection
In itthinx Affiliates plugin version 7.0.1 and earlier, the data-processing module lacks strict validation of input and contains an untrusted data deserialization (CWE-502) flaw. An attacker can craft malicious serialized data to trigger object injection, which may lead to remote code execution or sensitive information disclosure. All Affiliates plugin users who have not updated beyond 7.0.1 are affected. The attack can be launched remotely over the network without complex conditions or user interaction, seriously threatening confidentiality, integrity, and availability.
Component
itthinx Affiliates is an affiliate marketing management plugin for WordPress that helps site owners manage and track affiliate partners.
Risks
From ordinary user to administrator: If the victim runs the site with administrator privileges, the attacker can obtain the same privileges
Complete system control: An attacker can execute arbitrary code on the victim system and, depending on user privileges, install programs, view/change/delete data, or create new fully privileged accounts
No user interaction: Through a remote network request (T1189), an attacker can trigger the vulnerability with no further user interaction and gain remote control
