Monthly
Access-control bypass in SSSD lets an already-authenticated user from a trusted identity domain reach hosts and services that Host-Based Access Control (HBAC) rules are supposed to protect. Because SSSD strips the domain qualifier and compares only short usernames during HBAC evaluation, a trusted-domain user whose short name collides with an authorized local account is silently granted that local account's access. Publicly available exploit code exists, but exploitation is not automatable and EPSS is low at 0.28% (18th percentile); exposure is limited to trust-enabled FreeIPA/IdM-style deployments that delegate host access decisions to SSSD.
Authorization bypass in the Rattadan Cosmowarp asset_registry smart contract (CosmWasm/Rust) lets any sender execute the privileged UpdateConfig message on deployments where the on-chain config.admin field is unset (None), because the sender-vs-admin check is nested inside an `if let Some(current_admin) = config.admin` block that is silently skipped. Impact is high on integrity and availability (VI:H/VA:H) with limited confidentiality loss (VC:L), scoring 8.4 under CVSS 4.0 and assessed as CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H; exploitation is only possible against pre-56c6147 builds of the rattadan/Cosmowarp_Contract asset_registry module running with an unset admin, and no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis. The condition is narrow but the consequence is full admin-level config control for whoever submits the transaction first.
Missing object-level authorization in the OpenStack Blazar V2 lease API allows any authenticated user to modify or delete leases belonging to other users and projects if they know the target lease UUID. The defect affects Blazar releases before 17.0.1 and arises because the oslo.policy authorize() wrapper resolves the wrong request parameter, so the ownership check silently degrades into comparing the requester against their own project_id and user_id and therefore always passes. No public exploit code has been identified at time of analysis, and exploitation requires a valid cloud credential plus a deployment that actually runs the optional reservation service, but the integrity and availability impact on lease objects is high because reservations underpin the scheduled resource allocations of other tenants.
Improper access control in CyberPanel before 2.4.4 allows an authenticated low-privilege user to bypass alias-domain filtering logic in the child-domain management subsystem, with potential cross-account integrity impact. The flaw stems from using a Django ORM `.filter(alais=0)` call to identify non-alias child domains - a comparison that can behave differently than a Python-level equality check - combined with a missing ownership rejection branch in `checkOwnership()` that allowed certain code paths to fall through without denying access. The CVSS S:C/I:H vector indicates the impact can cross tenant boundaries on shared CyberPanel instances. No public exploit is identified at time of analysis and the issue is not listed in CISA KEV.
Arbitrary file read in ArcadeDB before version 26.8.1 allows authenticated users holding trigger creation privileges to escape the GraalVM JavaScript sandbox and read any file accessible to the ArcadeDB server process on the underlying host. The sandbox allowlist enforces package name restrictions via unescaped regular expressions, which an attacker can craft to match unintended Java class names and instantiate ZipFile or JarFile to open arbitrary filesystem paths. No public exploit has been identified at time of analysis; however, the vendor-confirmed patch to 26.8.1 should be applied promptly given the high confidentiality impact and the sensitivity of files typically reachable by a database server process.
Authorization bypass in the Keycloak Policy Enforcer allows any authenticated user to circumvent all enforced access controls - role, scope, and User-Managed Access (UMA) permission checks - by embedding the configured access-denied page path inside a request URL as a path segment or query parameter. The affected component ships in the Red Hat Build of Keycloak, and successful exploitation grants unauthorized access to protected resources. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Authentication bypass in Erlang/OTP's TLS distribution module (inet_tls_dist) lets any attacker holding a TLS certificate signed by a CA in the node's trust store gain full Erlang distribution access, including remote code execution via rpc:call/4 and code:load_binary/3. The flaw stems from check_ip/1 inspecting the local socket address (inet:sockname/1) instead of the peer's address (inet:peername/1), so the LAN-allowlist subnet comparison always matches. No public exploit identified at time of analysis, but the one-line root cause is fully disclosed in the upstream fix commit.
Consensus-breaking cache logic error in Zcash Zebra node software (all versions <4.3.1) allows malicious miners to partition the network by mining blocks containing height-invalid transactions. By submitting a transaction valid at height H+1 but invalid at H+2, then mining it into block H+2 and submitting that block before H+1, attackers trigger cached verification bypass-vulnerable Zebra nodes accept the invalid block while honest nodes reject it, creating a consensus split. This enables double-spend attacks against isolated nodes. EPSS data unavailable; not in CISA KEV. Classified as CWE-1025 (comparison logic error). Fixed in Zebra 4.3.1 by removing the risky cache optimization entirely.
Improper identifier resolution in Brocade/Broadcom management software's Java cache-key handling can let an authenticated attacker on an adjacent network trigger identity mismatches, producing high integrity impact without confidentiality or availability loss. The flaw is a moderate-severity object-comparison logic issue that requires a low-privilege account and specific user-account structures, making it realistically LOW priority for most organizations. No public exploit identified at time of analysis; apply the vendor fix described in Broadcom support advisory 39000.
Denial of service in stoatchat (delta) versions before 20250210-1 (0.8.2) lets a remote unauthenticated attacker exhaust server resources by abusing the 'nearby' message query route. A logic error passes a message limit of zero to the database, which MongoDB interprets as 'no limit', so a single crafted request downloads an entire channel's history; parallelized requests amplify this into resource-exhaustion DoS. No public exploit identified at time of analysis and the flaw is not in CISA KEV, but the upstream fix and a VulnCheck advisory are published.
Access-control bypass in SSSD lets an already-authenticated user from a trusted identity domain reach hosts and services that Host-Based Access Control (HBAC) rules are supposed to protect. Because SSSD strips the domain qualifier and compares only short usernames during HBAC evaluation, a trusted-domain user whose short name collides with an authorized local account is silently granted that local account's access. Publicly available exploit code exists, but exploitation is not automatable and EPSS is low at 0.28% (18th percentile); exposure is limited to trust-enabled FreeIPA/IdM-style deployments that delegate host access decisions to SSSD.
Authorization bypass in the Rattadan Cosmowarp asset_registry smart contract (CosmWasm/Rust) lets any sender execute the privileged UpdateConfig message on deployments where the on-chain config.admin field is unset (None), because the sender-vs-admin check is nested inside an `if let Some(current_admin) = config.admin` block that is silently skipped. Impact is high on integrity and availability (VI:H/VA:H) with limited confidentiality loss (VC:L), scoring 8.4 under CVSS 4.0 and assessed as CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H; exploitation is only possible against pre-56c6147 builds of the rattadan/Cosmowarp_Contract asset_registry module running with an unset admin, and no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis. The condition is narrow but the consequence is full admin-level config control for whoever submits the transaction first.
Missing object-level authorization in the OpenStack Blazar V2 lease API allows any authenticated user to modify or delete leases belonging to other users and projects if they know the target lease UUID. The defect affects Blazar releases before 17.0.1 and arises because the oslo.policy authorize() wrapper resolves the wrong request parameter, so the ownership check silently degrades into comparing the requester against their own project_id and user_id and therefore always passes. No public exploit code has been identified at time of analysis, and exploitation requires a valid cloud credential plus a deployment that actually runs the optional reservation service, but the integrity and availability impact on lease objects is high because reservations underpin the scheduled resource allocations of other tenants.
Improper access control in CyberPanel before 2.4.4 allows an authenticated low-privilege user to bypass alias-domain filtering logic in the child-domain management subsystem, with potential cross-account integrity impact. The flaw stems from using a Django ORM `.filter(alais=0)` call to identify non-alias child domains - a comparison that can behave differently than a Python-level equality check - combined with a missing ownership rejection branch in `checkOwnership()` that allowed certain code paths to fall through without denying access. The CVSS S:C/I:H vector indicates the impact can cross tenant boundaries on shared CyberPanel instances. No public exploit is identified at time of analysis and the issue is not listed in CISA KEV.
Arbitrary file read in ArcadeDB before version 26.8.1 allows authenticated users holding trigger creation privileges to escape the GraalVM JavaScript sandbox and read any file accessible to the ArcadeDB server process on the underlying host. The sandbox allowlist enforces package name restrictions via unescaped regular expressions, which an attacker can craft to match unintended Java class names and instantiate ZipFile or JarFile to open arbitrary filesystem paths. No public exploit has been identified at time of analysis; however, the vendor-confirmed patch to 26.8.1 should be applied promptly given the high confidentiality impact and the sensitivity of files typically reachable by a database server process.
Authorization bypass in the Keycloak Policy Enforcer allows any authenticated user to circumvent all enforced access controls - role, scope, and User-Managed Access (UMA) permission checks - by embedding the configured access-denied page path inside a request URL as a path segment or query parameter. The affected component ships in the Red Hat Build of Keycloak, and successful exploitation grants unauthorized access to protected resources. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Authentication bypass in Erlang/OTP's TLS distribution module (inet_tls_dist) lets any attacker holding a TLS certificate signed by a CA in the node's trust store gain full Erlang distribution access, including remote code execution via rpc:call/4 and code:load_binary/3. The flaw stems from check_ip/1 inspecting the local socket address (inet:sockname/1) instead of the peer's address (inet:peername/1), so the LAN-allowlist subnet comparison always matches. No public exploit identified at time of analysis, but the one-line root cause is fully disclosed in the upstream fix commit.
Consensus-breaking cache logic error in Zcash Zebra node software (all versions <4.3.1) allows malicious miners to partition the network by mining blocks containing height-invalid transactions. By submitting a transaction valid at height H+1 but invalid at H+2, then mining it into block H+2 and submitting that block before H+1, attackers trigger cached verification bypass-vulnerable Zebra nodes accept the invalid block while honest nodes reject it, creating a consensus split. This enables double-spend attacks against isolated nodes. EPSS data unavailable; not in CISA KEV. Classified as CWE-1025 (comparison logic error). Fixed in Zebra 4.3.1 by removing the risky cache optimization entirely.
Improper identifier resolution in Brocade/Broadcom management software's Java cache-key handling can let an authenticated attacker on an adjacent network trigger identity mismatches, producing high integrity impact without confidentiality or availability loss. The flaw is a moderate-severity object-comparison logic issue that requires a low-privilege account and specific user-account structures, making it realistically LOW priority for most organizations. No public exploit identified at time of analysis; apply the vendor fix described in Broadcom support advisory 39000.
Denial of service in stoatchat (delta) versions before 20250210-1 (0.8.2) lets a remote unauthenticated attacker exhaust server resources by abusing the 'nearby' message query route. A logic error passes a message limit of zero to the database, which MongoDB interprets as 'no limit', so a single crafted request downloads an entire channel's history; parallelized requests amplify this into resource-exhaustion DoS. No public exploit identified at time of analysis and the flaw is not in CISA KEV, but the upstream fix and a VulnCheck advisory are published.