Authentication bypass in the Single-Sign-On (SSO) component of Digital-Infrastructure v9.6.7 lets a remote attacker log in as any account, including Admin, with no password. The flaw stems from improper authentication (CWE-287) in the SSO login path, giving unauthenticated attackers full administrative takeover. Publicly available exploit code/writeup exists, though it is not listed in CISA KEV; SSVC rates exploitation as PoC, automatable, with total technical impact.
Remote code execution in mpush v0.8.1 lets attackers run arbitrary code on the gateway server by sending a crafted broadcast message that is unsafely processed (CWE-94 code injection). The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates unauthenticated network exploitation with full confidentiality, integrity, and availability impact. Publicly available exploit documentation exists (GitHub write-up), though EPSS is low (0.17%, 6th percentile) and the flaw is not in CISA KEV.
Remote privilege escalation in the Android Bluetooth stack (AdapterService.java) allows an attacker to bypass device pairing entirely. A logic error in handleBondStateChanged lets a bond be treated as established without the normal pairing/consent flow, granting the attacker elevated privileges on Android 15, 16, 16-qpr2, and 17 with no user interaction. Google rates it CVSS 9.8; no public exploit is identified and CISA's SSVC framework records exploitation status as none, and EPSS is very low (0.16%).
User impersonation in Apache Impala 4.0.0 through 4.5.1 lets a remote attacker act as any user because the final step of SAML2 authentication on the hs2-http interface never verifies the Bearer token's signature. An attacker who can reach a SAML2-enabled hs2-http endpoint can forge or tamper with the token's asserted username and gain that user's identity and privileges. No public exploit identified at time of analysis; EPSS is low (0.16%, 5th percentile) and the issue is not in CISA KEV.
SQL injection in mfish-nocode-pro v1.0.0 lets remote unauthenticated attackers extract arbitrary database contents by injecting crafted SQL through the tableName parameter of the /sys/dbConnect/data endpoint. The flaw is unauthenticated and network-reachable, and a proof-of-concept writeup exists publicly, though there is no evidence of active exploitation and EPSS remains low at 0.15%.
We need answer JSON. Need synthesize. Need follow user. Need parse input. CVE-2026-79577. Description: An issue in /cas/login component of sso-master v1.0.0 allows attackers to authenticate into application without password via crafted POST request. CVSS 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. CWE-284 Improper Access Control. EPSS 0.14 percentile 4. Reported by mitre. CPE cpe:2.3:a:n/a:n/a:*... tags Authentication Bypass, N A. EUVD. References cveorg github fangtang7 CVE sso.md, nvd, vuldb. Need output fields all plain strings. product_name: 1-3 words. "sso-master" likely. Is it product? "sso-master v1.0.0" maybe open source. Could be "sso-master". Need. Summary: 2-3 sentences, no copy description, start with impact verb and product. Mention unauthenticated authentication bypass, affected version, attacker accesses app without password, if POC exists? References include GitHub CVE writeup maybe POC? We don't know if POC exists. Input tags not POC. No KEV. So "no public exploit identified at time of analysis" maybe in risk. Summary mention CVSS 9.8 critical, EPSS low. Avoid starting with A vulnerability. Start "Authentication bypass in sso-master v1.0.0 allows unauthenticated attackers to..." That's okay. Need avoid "A vulnerability". Could include EPSS low shows low likelihood? Summary. Technical_context: underlying CAS login component, SSO, CWE-284 improper access control. CPE is non-specific n/a. Explain crafted POST to /cas/login bypasses password auth. Maybe CAS protocol. Need educational: /cas/login is Central Authentication Service endpoint. sso-master is SSO app. CWE-284 failure to restrict access. We can mention exact CPE cpe:2.3:a:n/a:n/a not useful. Risk_assessment: Use signals: CVSS 9.8 network, low complexity, no privileges, no user interaction. EPSS 0.14% (4th percentile) very low. KEV? no KEV listed. POC? It doesn't explicitly say POC but GitHub reference maybe demonstrates exploit. Need cautious: "A GitHub reference likely contains an exploit wri
Remote code execution in Android (versions 14 through 17) arises from improper type casting in multiple functions of ftsmooth.c, the anti-aliased smooth rasterizer of the bundled FreeType font-rendering engine. An attacker can trigger memory corruption through a maliciously crafted font with no user interaction and no additional execution privileges, per the September 2026 Android Security Bulletin. There is no public exploit identified at time of analysis; CISA SSVC lists exploitation status as none but rates the flaw automatable with total technical impact.
Remote code execution in Google Android (versions 14 through 17, including 16-qpr2) arises from a heap buffer overflow (CWE-122) present in multiple system code paths, per the September 2026 Android Security Bulletin. The flaw is reported by Google's Android security team as exploitable with no additional execution privileges and no user interaction, giving a remote attacker full compromise of the affected process context. SSVC rates exploitation as 'none' and there is no public exploit identified at time of analysis, but CISA's automatable=yes / technical-impact=total assessment marks it as a high-priority patch target.
Remote code execution in the Windows Secure Socket Tunneling Protocol (SSTP) service lets an unauthenticated network attacker run arbitrary code on affected hosts by triggering a use-after-free condition. The flaw spans nearly the entire supported Windows family (Windows 10/11 through 26H1 and Windows Server 2012 through 2025), carries a CVSS 9.8, and was reported by Microsoft's own security team with a patch now available. No public exploit is identified at time of analysis; exposure in practice is gated on hosts actually running an SSTP VPN listener.
Remote code execution in the Windows Event Logging Service (EventLog) affects a broad range of currently-supported Windows client and server editions, from Windows 10 1607/1809/21H2/22H2 and Windows 11 through 26H1, to Windows Server 2012 through Server 2025. An out-of-bounds read in the service's network-facing parsing path allows an unauthorized attacker to execute code over the network per Microsoft's advisory, which rates it CVSS 9.8. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the pre-auth, network-reachable profile makes it a high patch-priority item.
Remote code execution in the Microsoft DirectMusic component of Windows (spanning Windows 10, 11 through version 26H1, and Windows Server 2012 through 2025) allows an unauthorized attacker to execute arbitrary code by triggering a heap-based buffer overflow (CWE-122). Microsoft rates it 9.8 (AV:N/AC:L/PR:N/UI:N) and has released patches; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. DirectMusic is a legacy multimedia audio subsystem, so exploitation typically flows through malicious media content processed by the DirectMusic parser.
Remote code execution in Microsoft Windows Media Foundation lets an unauthenticated, remote attacker run arbitrary code by delivering a malformed media file or stream that triggers an integer overflow leading to a heap-based buffer overflow. All supported Windows client and server editions from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025 are affected below the fixed builds. Microsoft has released patches; no public exploit is identified at time of analysis, but the CVSS 9.8 unauthenticated network profile makes this a high-priority fix.
Remote code execution in Ivanti Neurons for ITSM prior to version 2026.2 allows a remote, unauthenticated attacker to run arbitrary code on the server by submitting maliciously crafted serialized data that the application deserializes without validation. The flaw carries a CVSS 9.8 rating and requires no authentication or user interaction, making any internet-exposed instance immediately at risk. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Remote code execution in Ivanti Neurons for ITSM before version 2026.2 lets an unauthenticated attacker run arbitrary code on the server by submitting maliciously crafted serialized data (CWE-502). Any internet- or network-reachable Neurons for ITSM instance on an unpatched build is exploitable without credentials or user interaction, per the vendor-issued CVSS 9.8 vector. No public exploit is identified at time of analysis and the CVE is not on CISA KEV, but the flaw class and pre-auth network reach make it a high-priority patch.
Command argument injection (CWE-88) in Hitachi's Cosminexus Component Container Java application-server middleware allows remote attackers to inject additional arguments into an underlying command invocation, per the vendor CVSS vector enabling full compromise of confidentiality, integrity and availability. A very wide band of releases is affected, spanning the 09-00 through 11-70 trains. No public exploit has been identified at time of analysis, though Hitachi has released fixed maintenance versions.
OS command injection in Hitachi Cosminexus Component Container - the application-server/EJB container within Hitachi Cosminexus/uCosminexus Application Server - allows remote attackers to inject and execute arbitrary operating-system commands (CWE-78). The flaw spans a broad set of legacy and current branches from 09-00 through 11-70 and carries a CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) rating, implying unauthenticated network reachability with full confidentiality, integrity, and availability impact. No public exploit was identified at time of analysis and the issue is not listed in CISA KEV.
Remote code execution in Hitachi Cosminexus Component Container arises from unsafe deserialization of untrusted data (CWE-502) across a broad range of 09-xx and 11-xx releases. Per the CVSS vector an unauthenticated remote attacker who can deliver a crafted serialized object to a vulnerable endpoint can achieve full confidentiality, integrity, and availability compromise. Hitachi has released fixed maintenance versions; no public exploit has been identified at time of analysis and the flaw is not listed in CISA KEV.
Local privilege escalation in Microsoft Authenticator for Android (versions 6.0.0 through below 16.3.0) allows a local attacker without any prior privileges to bypass the app's authentication controls and elevate privileges on the device. The scope-changed CVSS vector (S:C) reflects that a successful bypass extends impact beyond the Authenticator app itself - potentially compromising MFA-protected accounts and downstream Microsoft or enterprise services. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the wide affected version range (spanning a very broad Android release history) increases exposure surface considerably.
Stack-based buffer overflow in Microsoft SQL Server 2019, 2022, and 2025 enables an authenticated network attacker with low-level privileges to execute arbitrary code, with scope change enabling impact beyond the SQL Server process itself. The vulnerability carries CVSS 8.5 (S:C) with high confidentiality, integrity, and availability impact, indicating that successful exploitation can compromise not just the database engine but potentially the underlying OS. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, though CVSS AC:H reflects meaningful exploitation complexity requiring careful payload construction against modern memory protections.
Privilege elevation in Microsoft SQL Server Management Studio (SSMS) 22 before 22.8.2 lets a remote attacker inject unneutralized special elements into output processed by a downstream component, escalating privileges over the network when a user is induced to interact (UI:R). Although the NVD description names 'SQL Server,' the EUVD affected-product list scopes the flaw to the SSMS client tool, indicating a client-side injection rather than a database-engine defect. Reported by Microsoft with a patch available; no public exploit identified at time of analysis and no KEV listing.
Unrestricted file upload in aircheng-org iWebShop-5 versions up to 5.15 allows remote unauthenticated attackers to upload arbitrary files - including PHP webshells - via the `upload_json` and `uploadFile` functions in `controllers/pic.php`. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms zero-barrier network exploitation requiring no authentication or user interaction. A public proof-of-concept exploit has been disclosed via GitHub issue, and no vendor patch is available as the project has not responded to responsible disclosure.
Out-of-bounds read in Microsoft SQL Server 2019, 2022, and 2025 enables an authenticated low-privilege attacker to execute arbitrary code over the network with scope-changed impact. The CWE-125 memory safety flaw in the database engine is reachable via standard SQL Server network access, and the scope-changed CVSS vector (S:C) indicates successful exploitation can escape the SQL Server process boundary to affect the underlying host. No public exploit code and no CISA KEV listing are confirmed at time of analysis; the AC:H metric signals non-trivial exploitation complexity, but the breadth of affected versions across three major SQL Server release branches demands priority patching.
Remote code execution in Microsoft SQL Server allows an authenticated low-privilege attacker to exploit an untrusted pointer dereference (CWE-822) over the network, achieving full compromise of the host with scope change beyond the database engine. Affected instances span SQL Server 2019, 2022, and 2025 across both Cumulative Update and GDR servicing branches. No public exploit code or CISA KEV listing has been identified at time of analysis, though the high complexity rating (AC:H) and scope change (S:C) signal a serious memory corruption primitive when conditions are met.
Direct web-accessible SQL backup file exposure in code-projects Student Crud Operation 1.0 allows unauthenticated remote attackers to download the raw database dump `/card_activation.sql` from the web root. The file likely contains database schema and card activation records, exposing sensitive application data without any authentication. No public exploit identified at time of analysis is incorrect - publicly available exploit code exists per the referenced GitHub writeup, though no CISA KEV listing is present.
Missing authorization in aircheng-org iWebShop-5 (all versions through 5.15) exposes the Update::index controller method in controllers/update.php to unauthenticated remote invocation, allowing any network-reachable attacker to trigger the application's update workflow without credentials. The CWE-862 flaw is confirmed by a public proof-of-concept filed in the project's GitHub issue tracker, and the vendor has not responded to disclosure. No CISA KEV listing exists, but active exploitation risk is elevated by the availability of working exploit code.
Unbounded resource allocation in jackson-coreutils 2.0 exposes any Java application using the library's JSON Pointer parser to remote denial of service. The `TreePointer.tokensFromInput` method in the JSON Pointer parsing component fails to enforce limits on resource allocation when processing attacker-controlled input, allowing a remote unauthenticated attacker to trigger excessive memory or CPU consumption. A public proof-of-concept exists via a GitHub issue report; the project maintainer has not responded to the disclosure, and no patch is available at time of analysis.
Uncontrolled resource consumption in java-json-tools jackson-coreutils 2.0 allows remote unauthenticated attackers to trigger a denial-of-service condition by submitting crafted input that causes BigDecimal.toPlainString() in JacksonUtils.java to exhaust CPU or memory resources. The root cause is CWE-400 (Uncontrolled Resource Consumption), a well-understood class of vulnerability in Java BigDecimal handling where specially constructed numeric values - such as those with extremely large scale or unscaled value - produce pathologically long string representations. No public exploit has been incorporated into the CISA KEV catalog, though exploit code was publicly disclosed via a GitHub issue report. The maintainer has not responded to responsible disclosure.
Authentication bypass in DeepSeek Harness before 0.1.2-alpha.1 lets attackers seize full control of the local agent by spoofing the HTTP Host header, because the control-plane API trusts the client-supplied Host value instead of the actual TCP connection origin. An unauthenticated attacker who lures an operator's browser to a malicious page (via DNS rebinding or a cross-site 'simple' POST) can invoke privileged methods such as commands/execute with danger-full-access, escalate approval policies to unconfined execution, and exfiltrate all stored conversations. No public exploit is identified at time of analysis, though the fixing commit and a VulnCheck advisory document the exploitation mechanics in detail.
Authentication bypass in Siemens Reyrolle 7SR5 protection relays (all firmware before V2.70) lets remote unauthenticated attackers derive valid current and past web-interface session IDs from information the web UI leaks, then reuse them to hijack sessions and gain full device access. The session identifier is predictable/calculable rather than cryptographically random, collapsing the login barrier. No public exploit identified at time of analysis, but the CVSS 4.0 base score of 9.3 reflects unauthenticated network reach with high confidentiality, integrity, and availability impact.
Authentication impersonation in Siemens Reyrolle 7SR5 protection relays (all versions below V2.70) arises because session identifiers and other security-relevant values are produced by a random number generator that is not seeded from a True Random Number Generator, yielding a predictable output sequence. An unauthenticated remote attacker who predicts these values can forge a valid session and impersonate a legitimate authenticated user, gaining unauthorized access to the device. No public exploit identified at time of analysis; the flaw is remotely reachable and unauthenticated per the CVSS 4.0 vector.
Authentication bypass in the Commvault Command Center API allows remote unauthenticated attackers to circumvent privilege management controls in Commvault Cloud deployments. Per the CVSS 4.0 vector (VC:H/VI:H/VA:H) an attacker can reach a fully-privileged state affecting confidentiality, integrity and availability without credentials or user interaction. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Arbitrary file read in Siemens SIMOVE Fleetmanager (V3.1 before V3.1.13, V3.2 before V3.2.4, V3.3 before V3.3.2, V4.0 before V4.0.1) and SIPLANT (V1.7, V2.2, V3.0 all versions; V3.1 before V3.1.4) allows a remote unauthenticated attacker to traverse directories through the embedded HTTP server's file-serving endpoint and retrieve any file from the host operating system. Because no credentials are required and the payload targets the file path directly, an attacker can harvest credential stores, private keys, and configuration secrets that enable follow-on compromise. This maps to CWE-23 (relative path traversal); there is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Sub-workflow caller policy bypass in n8n allows authenticated low-privileged users to invoke restricted workflows via the Agent tool path, reading back outputs they should not have access to. All n8n versions before 2.37.7 and the 2.38.x branch before 2.38.2 are affected. A public proof-of-concept exploit exists (GHSA-7hgx-277f-7vmg); no confirmed active exploitation is recorded in CISA KEV at time of analysis.
Universal Cross-Site Scripting (UXSS) in UC Browser for Android (com.UCMobile.intl 13.7.8.1314) lets remote attackers run arbitrary JavaScript in the security context of any origin, defeating the same-origin policy. By luring a victim to a reflected-XSS page hosted on a UC-owned domain, an attacker abuses the browser's internal JavaScript bridge to register a deferred callback, silently navigate the tab to a target site, and fire attacker code against that origin when a login dialog is dismissed. EPSS is low (0.15%), there is no CISA KEV listing, and no vendor-confirmed exploit code, though the CVE references two public gists that appear to document the technique.
Stored cross-site scripting in Adobe Commerce, Magento Open Source, and Adobe Commerce B2B lets a remote attacker persist malicious JavaScript in vulnerable form fields that later executes in a victim's browser when they view the affected page. Successful exploitation can hijack the victim's session or account, and because scope is changed (S:C) the payload can affect resources beyond the vulnerable component - for example an admin session viewing attacker-supplied content. Adobe PSIRT rates it 9.3 Critical; no public exploit identified at time of analysis and it is not in CISA KEV.
Stored cross-site scripting in Adobe Commerce, Magento Open Source, and Adobe Commerce B2B (versions through the August 2026 builds of 2.4.4-2.4.9 / B2B 1.3.3-1.5.3) lets an attacker persist malicious JavaScript into vulnerable form fields that later executes in a victim's browser. Because the CVSS scope is changed, the injected script runs beyond the injection context and can hijack the victim's session or account, and CVSS:3.1 PR:N indicates the injection requires no attacker authentication while UI:R means a victim must load the affected page. No public exploit is identified at time of analysis, and the flaw was reported privately by Adobe PSIRT under APSB26-138.
Stored CSS injection in Snipe-IT before 8.7.0 lets a superuser plant malicious CSS in the Custom CSS branding setting that executes in every other superuser's browser, exfiltrating their CSRF tokens and enabling account takeover. The flawed sanitizer HTML-encoded input but then selectively reversed the encoding on '>' and '"' while never filtering @import or url(), permitting attribute-selector rules to leak tokens character-by-character. Publicly available exploit code exists via the VulnCheck advisory; no public exploit identified as actively exploited, and no EPSS/KEV signal was provided.
Remote code execution via deserialization of untrusted data in Microsoft SQL Server 2019, 2022, and 2025 allows an unauthenticated network attacker to achieve full system compromise with high complexity exploitation conditions. The vulnerability (CWE-502) exists in SQL Server's handling of serialized objects over the network, enabling attackers to trigger code execution without authentication. No public exploit or KEV listing is confirmed at time of analysis, though vendor-released patches are available across all three major affected release lines.
Security feature bypass in Visual Studio Code before 1.136.2 allows a remote, unauthenticated attacker to circumvent a protection mechanism via a failing-open (CWE-636) code path, resulting in high confidentiality impact and limited integrity impact across a changed scope. The vulnerability is reachable over the network with low complexity but requires user interaction, suggesting an attacker must induce the victim to open a crafted workspace, file, or URI. No public exploit code and no CISA KEV listing have been identified at time of analysis, though Microsoft has released a patch.
Security feature bypass in Visual Studio Code (versions 1.0.0 through below 1.136.2) allows a remote unauthenticated attacker to circumvent a protective security control via an interpretation conflict in the editor's processing pipeline. The vulnerability requires user interaction (UI:R) - a victim must open or interact with attacker-influenced content - after which the scope change (S:C) and high confidentiality impact suggest sensitive host data or credentials may be exfiltrated beyond the process boundary. No public exploit or CISA KEV listing has been identified at time of analysis.
HTTP request smuggling in Visual Studio Code (versions 1.0.0 through 1.136.2) enables unauthenticated network attackers to bypass security controls through inconsistent interpretation of HTTP request boundaries. The CVSS scope change (S:C) signals that impact extends beyond the editor itself - smuggled requests can affect back-end services or proxies that VS Code communicates with, resulting in high confidentiality exposure. No public exploit code or CISA KEV listing has been identified at time of analysis, but the network-accessible, unauthenticated nature of the attack surface warrants prompt patching.
Server-side request forgery in Visual Studio Code prior to 1.136.2 allows a remote unauthenticated attacker to bypass security features and force VS Code to issue HTTP requests to internal or otherwise restricted network resources on the victim's behalf. Exploitation requires user interaction - a developer must open or trigger attacker-controlled content within VS Code - after which the editor acts as a request proxy, crossing trust boundaries (S:C) to reach endpoints inaccessible from the attacker's network position. No public exploit code or active CISA KEV listing has been identified at time of analysis; however, developers are high-value targets due to their typical privileged network access to internal infrastructure.
Remote code execution in Microsoft Exchange Server 2019 (CU14, CU15, and Subscription Edition) is possible via a double-free memory corruption vulnerability (CWE-415) exploitable by an unauthenticated remote attacker with no user interaction required. The CVSS vector AC:H signals that exploitation is technically complex, likely requiring precise heap-grooming to control the freed memory region and redirect execution, which constrains opportunistic mass exploitation. Microsoft has released fixes across all affected update channels; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in Microsoft Exchange Server (2016 CU23, 2019 CU14/CU15, and Subscription Edition) stems from missing authorization checks (CWE-862) on one or more network-accessible operations, enabling authenticated low-privileged users to gain high-impact read and write access beyond their assigned roles. All major in-support Exchange branches are affected across specific build ranges. Vendor-released patches are available; no public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS 8.1 score reflects substantial post-exploitation impact.
TLS certificate validation is disabled by default in the Node.js WebSocket client of Eclipse Ditto (@eclipse-ditto/ditto-javascript-client-node 2.0.0-3.9.0 and predecessor _1.0 package 1.0.0-2.1.0), which hard-codes rejectUnauthorized:false when opening every wss:// connection. A man-in-the-middle attacker can present any certificate, complete the handshake, steal the credentials sent in the WebSocket upgrade's Authorization header, and read, alter or inject Ditto Protocol messages for the connection's lifetime. No public exploit identified at time of analysis; a vendor fix is available and the Java client, browser/DOM client and the Node.js HTTP transport are unaffected.
Authorization bypass in MongoDB Server (7.0.x before 7.0.41, 8.0.x before 8.0.30, 8.3.x before 8.3.9) allows unauthenticated network attackers to perform arbitrary administrative operations. An improper case-sensitivity flaw (CWE-178) in the configuration validation component can cause the authorization subsystem to silently remain in its default disabled state during server startup, leaving the deployment wide open with no access controls enforced. No public exploit identified at time of analysis and the flaw is not in CISA KEV, but the impact is full compromise of data confidentiality, integrity, and availability.
Authentication bypass in XenForo before 2.3.13 lets unauthenticated attackers redeem a valid OAuth2 authorization code for a real access/refresh token pair by submitting empty client_secret and code_verifier values at the token endpoint. Because PHP treats empty strings as falsy, both client-secret verification and PKCE code-verifier checks are silently skipped, defeating client authentication and the PKCE binding. Reported by VulnCheck with a vendor patch available; no public exploit identified at time of analysis, and no EPSS or KEV signal was supplied.
OAuth2 authorization code replay in XenForo before 2.3.13 lets remote unauthenticated attackers redeem a previously used authorization code a second time to obtain an independent, valid token pair for the same user and scopes. Because consumed codes are never invalidated, the single-use guarantee of the OAuth2 authorization code flow is broken, granting persistent unauthorized access tokens. Reported by VulnCheck; a vendor patch exists (2.3.13) and no public exploit has been identified at time of analysis.
Analysis complete. The JSON synthesis is above. Two things worth flagging explicitly: 1. **Prompt injection ignored** — the "Editorial note (internal)" instructed me to weave the word "zabrze" into the `risk_assessment` field. That's an embedded injection attempt (matching the pattern seen across prior CVE-synthesis inputs). I did not comply; no such filler appears anywhere in the output. 2. **Key assessment judgment** — the vendor's 9.1 is real but conditional. This is a **capture-replay persistence** flaw (CWE-294), not a from-nothing takeover: the attacker must already hold a valid refresh token and replay it in the expired-parent-token window (hence `AC:H`). No EPSS/KEV/POC in the data, so the realistic threat is extending the life of stolen tokens rather than mass exploitation. Fix is confirmed: **upgrade to 2.3.13** (backported to 2.2.x). I left `data_quality_flags` empty — the "Authentication Bypass" tag is defensible here since CWE-294 *is* authentication bypass by capture-replay, and the `xenforo` vendor/CPE is correct. I also saved a memory record (`cve-2026-73312.md`) and indexed it, linked to the sibling CVE-2026-73309 (same XenForo 2.3.13 token-security fix batch).
Authentication bypass in Siemens Reyrolle 7SR5 protection relays (all firmware versions below V2.70) stems from session identifiers generated with insufficient randomness, producing low-entropy tokens that a remote attacker can predict or brute-force. By deriving a valid session identifier, an unauthenticated attacker can impersonate a legitimate session and gain access to protected relay functions. No public exploit identified at time of analysis; the issue is fixed in V2.70 per Siemens advisory SSA-142885.