Full account takeover in DjangoCRM stems from a hardcoded Django SECRET_KEY committed in webcrm/settings.py, letting anyone who reads the public GitHub repository forge session cookies (including the superadmin), CSRF tokens, and password reset tokens. The default DEBUG=True setting compounds this by exposing database, email, and OAuth credentials plus internal paths on error pages. No public exploit is identified at time of analysis, but exploitation is trivial and requires no authentication (CVSS 9.1, PR:N).
Privilege escalation in Red Hat's Multicluster Engine (MCE) for Kubernetes ClusterCurator controller allows a namespace-scoped tenant administrator to obtain cluster-wide administrative control. By creating a namespaced ClusterCurator resource, the tenant can cause the controller to mint an authentication token for a ServiceAccount holding cluster-admin authority, breaking tenant isolation. Rated CVSS 9.1 (scope-changed) by Red Hat; no public exploit identified at time of analysis and not listed in CISA KEV.
Authentication bypass in Progress MarkLogic Server (versions before 11.3.6 and 12.0.3) lets an unauthenticated remote attacker forge SAML assertions and impersonate any user, including administrators, on deployments where SAML single sign-on is enabled. The flaw stems from improper cryptographic signature verification (CWE-347) in the SAML authentication module, yielding full identity spoofing over the network with low complexity and no user interaction. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV, but the 9.1 CVSS and pre-authentication admin impersonation make it a high-priority patch.
Authentication bypass in iot-ecology's rust-iot-platform lets any remote attacker reach every endpoint guarded by the AuthToken request guard simply by sending a non-empty Authorization header such as 'Authorization: fake'. The Rocket request guard in api/src/main.rs checks only for the header's presence and never validates its value against a session, token store, or signature, so unauthenticated attackers gain full access to protected API functionality. No public exploit identified at time of analysis, but the flaw is trivial to trigger and carries a CVSS 9.1.
Authentication bypass in Red Hat Build of Keycloak (and Red Hat Single Sign-On 7) lets an unauthenticated attacker forge SAML responses to hijack accounts when a SAML identity-provider's metadata was imported without explicit key-usage attributes, causing the keycloak-services identity-brokering engine to silently disable signature validation despite a signing certificate being present. Rated CVSS 9.1 with total technical impact per CISA SSVC, an attacker who knows a victim's external identifier can log in as that user. No public exploit identified at time of analysis, and EPSS is low (0.14%, 4th percentile), indicating the risk is currently theoretical/targeted rather than mass-exploited.
Predictable Fernet encryption keys in IBM Langflow OSS 1.0.0 through 1.10.3 allow attackers to decrypt stored API keys and authentication tokens, because when a user secret is shorter than 32 characters the platform derives keys with Python's non-cryptographic `random` (Mersenne Twister) module. Because the Mersenne Twister PRNG is deterministic, identical seeds reproduce identical keys, so an adversary who can reconstruct the seeding conditions can regenerate the key and read every secret Langflow encrypted with it. No public exploit identified at time of analysis; EPSS is low (0.11%) and CISA SSVC records no known exploitation.
Remote code execution on the Jenkins controller is achievable by attackers holding Agent/Connect permission via a JEP-200 deserialization filter bypass in the Remoting library (agent.jar/remoting.jar). Jenkins 2.575 and earlier, and LTS 2.568.1 and earlier, include a Remoting version (3384.v60d89463d9e0 and earlier, except the backport 3355.3357.v931d3c992987) that fails to apply the JEP-200 class filter to a fallback deserialization code path, allowing crafted serialized Java objects to reach classes on the Jenkins core classpath that are not blocked by the pre-JEP-200 denylist. No public exploit or CISA KEV listing has been identified at time of analysis, but the primitive - controller-side code execution triggered from an agent - represents a critical trust-boundary violation in Jenkins' controller-agent architecture.
Privilege escalation to cluster-admin in Red Hat Advanced Cluster Management for Kubernetes (ACM) lets a user holding only namespace-scoped 'edit' rights on an ACM hub namespace take over the entire cluster. By creating a Channel pointing to an attacker-controlled Helm repository and a Subscription referencing it, the app-subscription controller (multicluster-operators-subscription) applies the chart with its own elevated authority and without enforcing the subscription-admin role or namespace confinement, letting the chart install cluster-scoped objects such as a ClusterRoleBinding to cluster-admin. No public exploit identified at time of analysis, and EPSS is low (0.25%), but the technical impact is total and the flaw directly contradicts ACM's documented namespace-confinement guarantee.
Authentication bypass and improper access control in Cisco IOS XE Software allow a remote, unauthenticated attacker to gain unauthorized access with a scope-changing impact affecting confidentiality, integrity, and availability across affected components. The issue was discovered internally by Cisco's engineering team during a proactive security review and is grouped under CWE-284 with a CVSS base score of 9.0, though the high attack complexity (AC:H) indicates non-trivial preconditions. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Stack-based buffer overflow in Apache Lucy (all versions) enables potential arbitrary code execution through crafted input triggering memory corruption in the retired C-based search library. All versions are affected with no patch planned, as the Apache Software Foundation has officially retired the project. No public exploit or active exploitation has been identified at time of analysis, but the absence of any future fix makes this a permanent unresolved risk for any remaining deployments.
Privileged API access in Apache Answer through 2.0.1 persists after an administrator loses their authority: keys issued to an admin stay valid even after the account is demoted, marked inactive, suspended, or deleted, so a former administrator retains full API-level control until the keys are manually purged. This CWE-613 (Insufficient Session Expiration) flaw carries a vendor CVSS of 9.1 and is fixed in 2.0.2. There is no public exploit identified at time of analysis and EPSS is low (0.16%), consistent with an insider/privilege-retention issue rather than mass internet exploitation.