Missing authorization in the bbPress WordPress forum plugin (versions through 2.6.14) allows unauthenticated remote users to bypass access control restrictions and perform actions gated behind specific forum capability checks without proper authorization. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms the attack requires no authentication and no user interaction against a standard installation. No public exploit or CISA KEV listing exists at time of analysis, but the zero-prerequisite attack conditions make this accessible to opportunistic, automated targeting of WordPress sites running the affected plugin.
Unauthenticated log erasure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes network defenders to forensic blind spots. The clearTracerouteLog CGI endpoint imposes no access control, allowing any network-reachable attacker to wipe traceroute history via a crafted POST to /cgi-bin/cstecgi.cgi. While integrity impact is rated low (log data only), this capability is routinely used as a cover-tracks primitive following initial compromise of the router or downstream network activity. No active exploitation confirmed; EPSS is 0.18% (7th percentile), consistent with a niche SOHO device.
Unauthenticated access control bypass in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows any network-reachable attacker to delete Wi-Fi schedule entries without credentials by sending a crafted POST request to /cgi-bin/cstecgi.cgi. The delWiFiScheduleCfg CGI handler fails to enforce authentication before processing deletion requests, enabling unauthorized modification of time-based Wi-Fi access control policies. No active exploitation has been confirmed (not in CISA KEV), and EPSS sits at 0.18% (7th percentile), indicating minimal observed exploitation pressure.
Incorrect access control in the SystemSettings function of TOTOLINK T6 router firmware 4.1.5cu.748_B20211015 exposes administrative import and export endpoint information to unauthenticated remote attackers. By sending a crafted POST request to /cgi-bin/cstecgi.cgi, an attacker can enumerate configuration management endpoints without any credentials. No public exploit code or CISA KEV listing exists; EPSS at 0.16% (6th percentile) reflects negligible observed exploitation activity, though the disclosed endpoint data could facilitate chained attacks against the device's management API.
Cross-site scripting in @pdfme/schemas before 5.5.9 allows execution of arbitrary JavaScript in users' browsers via unsanitized SVG content rendered directly to innerHTML. The SVG schema plugin's viewer and readOnly form modes assign raw SVG markup to container.innerHTML without stripping script elements, event handler attributes, or foreignObject payloads. A working proof-of-concept is published in the GHSA advisory; no active exploitation has been confirmed in CISA KEV at time of analysis.
Open redirect in Nokia NSP (Network Services Platform) enables remote unauthenticated attackers to craft URLs that bypass server-side validation of the redirect or URL parameter, redirecting authenticated users to attacker-controlled sites. Affected versions span NSP 23.11 through NSP 25.11 per EUVD data, covering a wide release window. No public exploit identified at time of analysis; EPSS of 0.14% at the 4th percentile reflects negligible observed exploitation activity, and the vulnerability is not listed in CISA KEV.
Open redirect in Helix Ultimate (Joomla extension by joomshaper.com) versions prior to 2.2.10 allows unauthenticated network-accessible attackers to craft redirect URLs that bypass the site's origin validation. The return parameter accepts arbitrary Base64-encoded strings without invoking Joomla's Uri::isInternal() check, meaning the decoded destination is never validated as belonging to the host site. An attacker can exploit this to redirect victims to attacker-controlled external domains, enabling highly convincing phishing campaigns that abuse the trusted appearance of the legitimate site URL. No active exploitation has been identified at time of analysis.
Use-after-free in Valkey 9.1.0's blocked-on-keys subsystem allows a high-privilege authenticated attacker to crash the server by triggering a reentrant client teardown during ready-key iteration. When a key becomes ready and multiple clients are unblocked simultaneously, a reply callback for the first-served client can invoke CLIENT KILL on a successor client, freeing that client's memory while the iterator in `handleClientsBlockedOnKey` still holds a reference to it. A public proof-of-concept exists; the vulnerability is not in CISA KEV, and the high complexity and privilege requirements substantially limit practical exploitation.
Prototype pollution in Livewire's client-side query-string parser enables reflected cross-site scripting against applications running versions 3.0.0-beta.1 through 3.8.2 or 4.0.0 through 4.3.3. The dot-notated URL parser in js/plugins/history/index.js accepts __proto__, constructor, and prototype as path segments, injecting attacker-controlled values into Object.prototype; multiple effect handlers then read effects.html, effects.js, effects.xjs, and effects.scripts without hasOwnProperty guards, treating inherited values as trusted server-delivered directives and executing arbitrary JavaScript in the application's origin. No public exploit or CISA KEV listing has been identified at time of analysis, but the network-accessible attack surface and zero-privilege requirement make this a meaningful risk for all unpatched Livewire deployments.
Cross-site scripting in Apache Wicket's Palette component allows injection of arbitrary HTML attributes into rendered `<option>` tags when applications override specific attribute-extension methods with attacker-influenced data. Affected are `wicket-extensions` versions spanning the 8.x, 9.x, and 10.x release lines; applications relying on the default method implementations are definitively not affected. Vendor-released patches are available at versions 8.19.0, 9.24.0, and 10.11.0; no public exploit code or CISA KEV listing has been identified at time of analysis.
Cross-site scripting in Apache Wicket's MetaDataHeaderItem class allows injection of arbitrary HTML attributes into generated <meta> and <link> header tags when applications pass attacker-influenced data to the addTagAttribute, forMetaTag, or forLinkTag APIs. The flawed escaping logic - replacing double-quote characters with backslash-double-quote, which carries no escaping semantics in HTML - permits a double-quote in an attacker-controlled value to break out of the attribute context and inject additional attributes such as JavaScript event handlers. Affected release lines span 8.0.0-8.18.0, 9.0.0-9.23.0, and 10.0.0-10.10.0; no public exploit has been identified at time of analysis.
Cross-site scripting in Apache Wicket's AutoLabelTextResolver allows injection of arbitrary markup into web pages when attacker-controlled data reaches a form component's label model via FormComponent#setLabel(IModel). The resolver, registered by default in every WebApplication, writes label values directly into rendered markup without any escaping and ignores the escape-model-strings application setting entirely - meaning there was no available configuration workaround. Applications are vulnerable wherever user-influenced data flows into a label model; this includes both stored XSS (data retrieved from a database) and reflected XSS (data sourced from the current request). No public exploit has been identified at time of analysis, but the vulnerability affects all supported release lines and all unsupported releases from 1.5.0 onwards.
Cross-site scripting in Apache Wicket's Button component allows injection of arbitrary markup into rendered pages when the button is bound to a `<button>` HTML element whose model contains attacker-influenced data. The root cause is an intentional design choice - Button's constructor clears the escape-model-strings flag to prevent double-encoding of `<input>` attribute values - that becomes a security flaw in the `<button>` rendering path, where element body content is never encoded by ComponentTag. Subclasses AjaxButton, AjaxFallbackButton, and WizardButton inherit the same constructor and are equally affected; no public exploit or CISA KEV listing is recorded at time of analysis.
Cross-site scripting vulnerabilities in Apache Wicket's AjaxEditableChoiceLabel and related wicket-extensions components allow an attacker who can influence rendered choice or model data to inject arbitrary HTML or JavaScript into page markup, executing in the browser of any user viewing the affected page. Versions 8.0.0 through 8.18.0, 9.0.0 through 9.23.0, and 10.0.0 through 10.10.0 of the org.apache.wicket:wicket-extensions module are confirmed affected. The root cause is that two distinct rendering paths bypass Wicket's default HTML escaping, and the escapeModelStrings configuration property has no corrective effect on these components. No public exploit has been identified at time of analysis.
Stored cross-site scripting in Aix-DB through version 1.2.4 allows authenticated low-privilege users to inject persistent malicious HTML and JavaScript into chat responses, skill descriptions, or knowledge messages, which then execute in other users' browsers when the content is viewed. The root cause is two separate rendering paths - a markdown-it component and a marked-based knowledge view - that both pass rendered HTML directly into Vue.js v-html bindings without sanitization. No public exploit has been identified and there is no CISA KEV listing, but the attack is trivially reproducible given the unsanitized rendering pipeline confirmed by source code evidence.
Authorization bypass in ToolJet before v3.16.208 permits any authenticated user to enumerate, create, rename, and delete TooljetDB tables belonging to arbitrary workspaces by supplying a foreign organizationId in the URL path of affected API endpoints. The TooljetDB controller accepts organizationId from the request path without validating it against the requesting user's actual workspace context, completely breaking tenant isolation in multi-workspace deployments. No public exploit code and no CISA KEV listing exist at time of analysis, but the flaw is trivially exploitable by any authenticated user with network access to the instance.
Broken access control in JoomShaper's Helix Ultimate Joomla template extension (versions prior to 2.2.10) allows authenticated backend users to overwrite layout parameters for arbitrary menu items by calling the save-megamenu-settings AJAX endpoint without holding core.edit or core.admin permissions on the targeted com_menus item. The endpoint fails to enforce Joomla's native per-item and component-level ACL checks server-side, meaning any user with backend access can tamper with menu configurations they do not own. No public exploit code and no CISA KEV listing exist at time of analysis.
Arbitrary file deletion within Joomla's `/images/` directory is achievable in Helix Ultimate versions before 2.2.10 by authenticated Author-level users. The `Blog::remove_image()` method validates that the requesting user holds edit rights over the supplied article ID but performs no ownership check on the accompanying image path parameter (`src`), allowing an author to target files belonging to other articles or other content under `/images/`. On Joomla 3 builds where physical file deletion is triggered, this broken object-level authorization flaw enables destructive content tampering without administrative privileges. No public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege management failure in IObit Uninstaller 15.5.0.11's kernel driver IUForceDelete.sys allows a local low-privileged user to send crafted IOCTL requests to the IRP_MJ_DEVICE_CONTROL handler and trigger improper privilege operations, resulting in limited integrity and availability impact on the local Windows system. The vendor did not respond to coordinated disclosure, leaving no vendor-issued patch or official mitigation guidance available. No public exploit code has been identified and the vulnerability has not been added to the CISA KEV catalog at time of analysis.
iCalendar injection in Wallos prior to v5.0.0 allows authenticated users to break out of VEVENT blocks in exported .ics feeds by embedding raw CRLF sequences in subscription names or notes, enabling insertion of fully attacker-controlled calendar events - including spoofed organizers and arbitrary ATTENDEE email addresses - into any calendar application subscribed to the feed. The root cause is a validation/export mismatch: input sanitization encodes HTML metacharacters but never strips newlines, while the iCal export layer decodes those entities back before writing output, letting CRLF pass through unmodified. No public exploit code or active exploitation (CISA KEV) has been identified; the vendor-released patch is v5.0.0.
Improper privilege management in IObit Unlocker 1.3.0.12's kernel driver (IObitUnlocker.sys) allows a locally authenticated high-privileged user to invoke ZwTerminateProcess through the IRP_MJ_DEVICE_CONTROL handler without adequate authorization checks, enabling termination of processes outside the caller's normal authority. The vulnerability is limited to systems with IObit Unlocker installed and the driver loaded, and requires existing administrator-level access to exploit. No public exploit has been identified at time of analysis, the vulnerability is not in the CISA KEV catalog, and the vendor did not respond to disclosure.
Missing authorization in Xibo CMS prior to 4.4.3 exposes super admin-restricted module settings and full module entity data to authenticated users holding the Module View privilege, via the Module::settingsForm endpoint. The disclosure is read-only - no configuration changes are possible - but the leak of privileged system configuration to lower-trust accounts represents a vertical privilege escalation in the confidentiality dimension. Vendor patch 4.4.3 is available; no public exploit or active exploitation has been identified.
Cross-user data isolation failure in Wallos prior to v4.9.1 allows authenticated users to infer the monthly-normalized subscription cost belonging to other users on the same instance. By setting replacement_subscription_id on their own inactive subscription to a victim's subscription ID, an attacker causes Wallos's stats aggregation engine to dereference the foreign record without user_id scoping, leaking derived financial metadata. A vendor-released patch is available in v4.9.1; no public exploit or CISA KEV listing has been identified at time of analysis.
Server-side request forgery in Wallos (versions 2.0.0 through 4.x) lets any authenticated user force the application server to open arbitrary outbound TCP connections to attacker-chosen hosts, including internal and link-local addresses. The per-user SMTP notification settings endpoint stores a user-supplied host without validation, and the notification cron job passes it directly to PHPMailer - no admin rights are required to abuse this path. No public exploit or CISA KEV listing has been identified at time of analysis; the vendor patched this in version 5.0.0.
Incorrect authorization in Wallos prior to version 4.9.1 allows any authenticated user to consume another user's third-party currency API credentials. The endpoint endpoints/currency/update_exchange.php selects the first Fixer or API Layer provider key stored globally rather than scoping it to the requesting user, meaning a user without their own API key can trigger exchange-rate refreshes that exhaust a different user's API quota. No public exploit has been identified at time of analysis, and the vendor-released patch (v4.9.1) resolves the cross-user data isolation flaw.
Unauthenticated mesh configuration tampering in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows any attacker with adjacent network access to overwrite WiFi mesh settings by sending a crafted POST request directly to the /cgi-bin/cstecgi.cgi handler without supplying credentials. The setWiFiMeshConfig function applies no access control check before processing the request, a CWE-284 (Improper Access Control) condition consistent with a pattern of missing authentication enforcement observed across multiple CGI handlers in this firmware. No public exploit is confirmed and EPSS sits at 0.18% (7th percentile), marking this as low exploitation probability, though the adjacent-network-only constraint is the primary practical barrier rather than any authentication requirement.
Unauthenticated LAN configuration tampering in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows any attacker on the adjacent network to modify the router's LAN settings by sending a crafted POST request to /cgi-bin/cstecgi.cgi targeting the setLanCfg handler, which lacks access control enforcement. The attack requires only adjacent network positioning - no credentials, no user interaction - and can alter LAN network parameters such as IP addressing, subnet masks, or gateway settings. No public exploit has been identified at time of analysis, and EPSS places exploitation probability at 0.18%, reflecting low observed interest.
Unauthenticated firewall policy manipulation in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes the setIpPortFilterRules function to any attacker on the adjacent network segment. A crafted POST request to /cgi-bin/cstecgi.cgi bypasses all access control (CWE-284) and allows modification of the device's IP/port filtering rules without credentials. No active exploitation is confirmed in CISA KEV, and EPSS at 0.18% (7th percentile) reflects limited opportunistic risk, consistent with the adjacent-only attack vector.
Incorrect access control in the setSmartQosCfg function of TOTOLINK T6 firmware 4.1.5cu.748_B20211015 permits unauthenticated adjacent-network attackers to overwrite QoS traffic-shaping configuration via a crafted POST to /cgi-bin/cstecgi.cgi, intentionally degrading traffic handling for legitimate network users. The attack requires no credentials and no user interaction, but is bounded to Layer 2 adjacency (LAN or Wi-Fi segment), preventing internet-based exploitation. No public exploit has been identified at time of analysis, and EPSS at 0.18% (7th percentile) reflects low observed exploitation activity.
Unauthenticated syslog configuration manipulation in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows adjacent-network attackers to alter logging behavior by sending a crafted POST request to /cgi-bin/cstecgi.cgi without credentials. The setSyslogCfg function performs no access control checks before applying submitted configuration changes (CWE-284), enabling log suppression or redirection that could obscure evidence of concurrent or subsequent malicious activity. No public exploit code has been identified and the EPSS score of 0.16% reflects minimal current exploitation interest; this vulnerability is not listed in CISA KEV.
Unauthenticated information disclosure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes the internal Wi-Fi client MAC-to-IP mapping table to any attacker with adjacent network access. The getWiFiIpMacTable function in the router's CGI handler fails to enforce authentication, allowing a crafted POST request to /cgi-bin/cstecgi.cgi to return a full enumeration of connected wireless clients. No public exploit has been identified at time of analysis; EPSS at 0.16% (6th percentile) reflects minimal observed exploitation interest.
Incorrect access control in TOTOLINK T6 router firmware 4.1.5cu.748_B20211015 exposes the setWizardCfg CGI endpoint to unauthenticated reconfiguration by any attacker with adjacent network access. An actor on the same local network segment can issue a crafted POST request to /cgi-bin/cstecgi.cgi to silently overwrite WAN settings, Wi-Fi parameters, or device initialization state without supplying any credentials. No public exploit code has been identified at time of analysis, and the EPSS score of 0.16% (6th percentile) reflects low observed exploitation interest.
Server-Side Request Forgery in Wallos prior to version 5.0.0 allows any authenticated low-privileged user to store an arbitrary SMTP host - including private RFC 1918 addresses and cloud metadata endpoints - in their personal email notification settings without server-side validation. When the scheduled notification cron job fires, the Wallos server opens an outbound TCP connection to the attacker-specified address, giving the attacker a reliable blind SSRF primitive to probe internal network services from the server's network vantage point. No public exploit is identified at time of analysis, and no active exploitation is confirmed by CISA KEV.
HCL Connections exposes sensitive information to unauthorized users through improper handling of request data, classified under CWE-359 (Exposure of Private Personal Information to an Unauthorized Actor). The vulnerability affects all tracked versions per the wildcard CPE and is exploitable over the network, though high attack complexity (AC:H) and required user interaction (UI:R) substantially constrain real-world exploitability. No public exploit code or active exploitation has been identified at the time of analysis, and the CVSS score of 3.1 reflects the limited confidentiality impact and constrained attack prerequisites.
Race condition in Zephyr RTOS's I3C IBI workqueue subsystem allows a physically-present attacker controlling an I3C peripheral to corrupt kernel memory structures, most realistically causing denial of service. The unsynchronized free-list (sys_slist_t) shared between ISR context and the workqueue handler thread creates a window where a work node can be handed to two consumers simultaneously or a garbage pointer can be dereferenced in a memcpy, producing an out-of-bounds write. No public exploit code has been identified and no CISA KEV listing exists; the patch wrapping all free-list operations in a k_spinlock is confirmed in upstream commit e87e7e2.
Cross-tenant authorization bypass in ToolJet before v3.16.208 allows any authenticated Builder-role user to access and manipulate database tables belonging to unrelated organizations by supplying arbitrary organizationId values in tooljet-db API path parameters. Server-side validation of tenant membership is entirely absent on schema operation endpoints, enabling an attacker to enumerate target organization IDs from public app endpoints and then disclose table schemas, plant rogue tables, corrupt existing schemas, or permanently destroy data across tenant boundaries. No public exploit has been identified at time of analysis, but the underlying IDOR technique is trivially reproducible using standard HTTP tooling.
Command injection in the D-Link DIR-825M router (firmware 1.1.8) allows network-adjacent authenticated attackers to execute arbitrary OS-level commands by manipulating the `sysCmd` argument submitted to the `/boafrm/formSysCmd` endpoint, processed by function `sub_456CF4` without sanitization. A public proof-of-concept exploit exists and was published alongside the VulDB disclosure. The provided CVSS 4.0 score of 2.1 appears to severely understate the real impact - command injection in a router's System Command Execution interface typically yields full OS compromise, not low-severity system impact.
Sensitive form parameters leak into server logs, crash reports, and the Phoenix development error page in ash_phoenix versions 1.2.17 through 2.3.24, where AshPhoenix.Form.Auto embeds the complete raw submitted param map verbatim into exception messages when a union sub-form receives an unrecognized _union_type value. Because the exception is raised inside library code rather than Phoenix's controller layer, the standard :filter_parameters configuration cannot redact the exposure-any field co-submitted with the union form field, including passwords and tokens, appears in plaintext in the raised message. No public exploit has been identified at time of analysis, but any user capable of submitting a form with a union field can deliberately trigger the leak regardless of intent.
FilterForm in ash_phoenix (versions 0.6.0-rc.1 through 2.3.24) exposes private relationship data to authenticated users by resolving attacker-controlled filter path parameters through private Ash relationship traversal rather than the public-only gate. By supplying crafted path or field form values targeting non-public relationships, an authenticated attacker converts query result row counts into a boolean oracle over data the resource author explicitly marked private. The CVSS 4.0 score is 2.3 (Low); no active exploitation is identified and no public proof-of-concept exists at time of analysis.
Composite primary key decoding in AshAdmin (ash_admin) versions 0.1.0 through 1.3.0 can be abused by authenticated users to turn any record-lookup URL into an equality oracle over arbitrary resource attributes. By crafting a Base64+ETF-encoded payload substituting a sensitive field name (e.g., api_token, reset_token) for an actual primary key, an attacker can brute-force secret attribute values one equality guess at a time. No public exploit has been identified at time of analysis, and exploitation requires authentication and specific preconditions (CVSS 4.0: 2.3, AT:P).
AshAdmin shipped a compile-time constant string ('ash_admin-Ed55GFnX') as the default CSP nonce for inline script and style tags across all requests in versions 0.10.8 through 1.3.0, rendering nonce-based Content-Security-Policy enforcement completely ineffective for any application using the default configuration. Applications that adopted the documented default and explicitly allow-listed this published constant in their CSP script-src directive would have their CSP protection neutralized by any attacker able to inject HTML into an admin page. No active exploitation or public proof-of-concept has been identified; the CVSS 4.0 score of 2.1 reflects significant compound preconditions required for exploitation.
Improper access control in dibo-software diboot 3.8.0 allows authenticated remote attackers to bypass tenant isolation by manipulating the tenantId parameter in the Tenant Administrator Management API at /admin/. An attacker with low-privileged access to one tenant can read and modify data belonging to other tenants, breaking the multi-tenant security boundary. A public proof-of-concept exploit exists, and the vendor has not responded to disclosure, leaving users without an official patch.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows authenticated remote attackers to manipulate database queries via the `ID` parameter in `/pages/inv_searchfrm.php`. Publicly available proof-of-concept exploit code exists (CVSS 4.0 supplemental metric E:P), though the product's tutorial and educational origins on itsourcecode.com severely limit any real-world production exposure. The CVSS 4.0 score of 2.1 reflects the authenticated prerequisite and low impact across confidentiality, integrity, and availability.
Cross-site scripting in @pdfme/schemas before 5.5.10 allows an attacker who can supply the Designer's options.labels configuration to execute arbitrary JavaScript in the browser of any user who opens the Designer and selects a multiVariableText field containing no variable placeholders. The vulnerable sink at propPanel.ts:65-71 concatenates i18n-translated strings directly into innerHTML without HTML encoding; while the adjacent color value is allowlist-validated (showing existing security awareness), the label strings were overlooked. No active exploitation is confirmed, but a proof-of-concept is published in the GHSA advisory. The CVSS 4.0 score of 2.1 reflects multiple required preconditions: attacker control over labels configuration, a specific UI trigger state, and passive victim interaction.
Stored cross-site scripting in code-projects Online Shopping System 1.0 allows unauthenticated remote attackers to inject malicious scripts via the email parameter of the Newsletter Subscription component at /offersmail.php. When a privileged user such as an administrator views stored subscription data, the injected payload executes in their browser. A public proof-of-concept is confirmed via GitHub; the vulnerability has not been listed in the CISA KEV catalog, and the CVSS 4.0 score of 2.1 reflects the constrained real-world impact due to required user interaction and a low integrity-only impact ceiling.
Unrestricted file upload in jeecgboot jeewx-boot's doUpload endpoint exposes the server to arbitrary file write via manipulation of the File argument in MyJwWebJwid3Controller, within the WeChat integration module. The vulnerability stems from improper access control (CWE-284) and public exploit code has been disclosed (CVSS 4.0 E:P), though the project maintainer has not yet responded to the issue report. The rolling-release development model means no fixed version can be cited, leaving all deployments at the affected commit hash and earlier without vendor guidance.
AshAdmin's Table, DataTable, and Show LiveView components constructed row-action URLs via raw Elixir string interpolation, splicing unencoded record primary keys directly into query strings. Attackers who control a record's string primary key - common in Ash applications using slugs or email addresses as identifiers - can craft a key containing query-string metacharacters (e.g., `legitimate-slug&action_type=destroy`) that override URL parameters when an administrator clicks a row-action link, silently redirecting them to an unintended action such as resource destruction. No public exploit code has been identified at time of analysis; exploitation requires write access to a string-keyed Ash resource and active administrator interaction, affecting ash_admin 0.3.0-rc.0 through 1.3.0.
Improper authorization in LogNet's grpc-spring-boot-starter affects annotation processing logic in versions up to 5.2.0, allowing authenticated remote attackers with low privileges to bypass access controls under high-complexity conditions. The vulnerability stems from CWE-266 (Incorrect Privilege Assignment) in the component responsible for processing security annotations on gRPC service endpoints. A proof-of-concept exploit has been publicly disclosed; no vendor patch is available as the project has not yet responded to the responsible disclosure report.
CVE-2026-16288 is reported by Ubuntu but carries no public description, CVSS score, vector, or CWE at time of analysis. The vulnerability's nature, affected component, and impact are entirely unconfirmed. No meaningful synthesis is possible without a description or scoring data; treat this record as a placeholder pending vendor disclosure.
CVE-2026-61406 is reported by Ubuntu with no public description, CVSS score, CWE classification, or affected version data available at time of analysis. The nature, impact, and exploitability of this vulnerability cannot be characterized from the provided intelligence. Security teams should monitor Ubuntu Security Notices (USN) and the Ubuntu CVE tracker for forthcoming disclosure.