Monthly
Broken access control in Keycloak's Account Resources user lookup endpoint exposes full PII profiles of all realm users to any authenticated user who owns at least one User-Managed Access (UMA) resource. By sending crafted requests with arbitrary usernames or email values to this endpoint, the attacker receives complete profile objects for unrelated realm members - bypassing the intended per-user data isolation. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog, but the low attack complexity and minimal privilege requirement (any UMA resource owner) make it a meaningful insider-threat and tenant-isolation risk in shared Keycloak deployments.
Insufficient granularity of access control in Microsoft Office Click-To-Run allows an authorized attacker to elevate privileges locally.
Insufficient granularity of access control in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
Apache Airflow versions prior to 3.2.1 allow authenticated users with read access to at least one directed acyclic graph (DAG) to enumerate and discover the names and existence of all other DAGs and assets in the deployment, regardless of their assigned permissions. This information disclosure vulnerability enables privilege escalation reconnaissance by revealing the complete asset topology to users with limited scope authorization. The vulnerability requires valid user credentials but no elevated privileges, and has no known public exploit code at time of analysis.
Apache Airflow versions prior to 3.2.1 fail to enforce per-DAG access control on the /ui/dags endpoint, allowing authenticated users with read access to at least one DAG to retrieve Human-in-the-Loop prompts and full TaskInstance details for DAGs outside their authorized scope. This information disclosure bypasses the intended per-DAG RBAC boundary, exposing operator parameters and task context data to all authenticated users regardless of their assigned DAG permissions.
Privilege escalation in Augmentt 1.0 allows authenticated low-privilege users to manipulate HTTP parameters and gain super administrator access, exposing all tenant data and configurations to unauthorized modification. CVSS 9.6 critical severity with scope change indicates cross-tenant impact potential. Public proof-of-concept code exists on GitHub (PENGUINSECQ repository). SSVC framework rates this as proof-of-concept exploitation with partial technical impact, not automatable due to authentication requirement.
A flaw was found in ArgoCD Image Updater. This vulnerability allows an attacker, with permissions to create or modify an ImageUpdater resource in a multi-tenant environment, to bypass namespace boundaries. By exploiting insufficient validation, the attacker can trigger unauthorized image updates on applications managed by other tenants. This leads to cross-namespace privilege escalation, impacting application integrity through unauthorized application updates.
Privilege escalation in Microsoft Defender Antimalware Platform versions before 4.18.26030.3011 allows authenticated local attackers to gain elevated system privileges through insufficiently granular access controls. CVSS 7.8 (High) reflects local attack vector requiring low privileges. EPSS score of 0.04% (12th percentile) indicates low probability of widespread exploitation. Microsoft has released a patched version (4.18.26030.3011) addressing the access control deficiency.
Remote attackers can spoof client-mode Remote Connector Servers in PingIDM to intercept and modify identity security properties including passwords and account recovery information, due to insufficient access control granularity that prevents administrators from properly restricting RCS communications. This vulnerability affects PingIDM deployments using Remote Connector Servers in client mode and requires specific RCS configuration to be exploitable; no public exploit code has been identified at the time of analysis.
Device reload in Cisco APIC's Object Model CLI component allows authenticated local users to trigger a denial of service through insufficient input validation on crafted commands. An attacker with valid credentials and CLI access can exploit this vulnerability to crash the affected device, though no patch is currently available. This vulnerability affects systems where attackers can obtain legitimate user credentials with appropriate role permissions.
Broken access control in Keycloak's Account Resources user lookup endpoint exposes full PII profiles of all realm users to any authenticated user who owns at least one User-Managed Access (UMA) resource. By sending crafted requests with arbitrary usernames or email values to this endpoint, the attacker receives complete profile objects for unrelated realm members - bypassing the intended per-user data isolation. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog, but the low attack complexity and minimal privilege requirement (any UMA resource owner) make it a meaningful insider-threat and tenant-isolation risk in shared Keycloak deployments.
Insufficient granularity of access control in Microsoft Office Click-To-Run allows an authorized attacker to elevate privileges locally.
Insufficient granularity of access control in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
Apache Airflow versions prior to 3.2.1 allow authenticated users with read access to at least one directed acyclic graph (DAG) to enumerate and discover the names and existence of all other DAGs and assets in the deployment, regardless of their assigned permissions. This information disclosure vulnerability enables privilege escalation reconnaissance by revealing the complete asset topology to users with limited scope authorization. The vulnerability requires valid user credentials but no elevated privileges, and has no known public exploit code at time of analysis.
Apache Airflow versions prior to 3.2.1 fail to enforce per-DAG access control on the /ui/dags endpoint, allowing authenticated users with read access to at least one DAG to retrieve Human-in-the-Loop prompts and full TaskInstance details for DAGs outside their authorized scope. This information disclosure bypasses the intended per-DAG RBAC boundary, exposing operator parameters and task context data to all authenticated users regardless of their assigned DAG permissions.
Privilege escalation in Augmentt 1.0 allows authenticated low-privilege users to manipulate HTTP parameters and gain super administrator access, exposing all tenant data and configurations to unauthorized modification. CVSS 9.6 critical severity with scope change indicates cross-tenant impact potential. Public proof-of-concept code exists on GitHub (PENGUINSECQ repository). SSVC framework rates this as proof-of-concept exploitation with partial technical impact, not automatable due to authentication requirement.
A flaw was found in ArgoCD Image Updater. This vulnerability allows an attacker, with permissions to create or modify an ImageUpdater resource in a multi-tenant environment, to bypass namespace boundaries. By exploiting insufficient validation, the attacker can trigger unauthorized image updates on applications managed by other tenants. This leads to cross-namespace privilege escalation, impacting application integrity through unauthorized application updates.
Privilege escalation in Microsoft Defender Antimalware Platform versions before 4.18.26030.3011 allows authenticated local attackers to gain elevated system privileges through insufficiently granular access controls. CVSS 7.8 (High) reflects local attack vector requiring low privileges. EPSS score of 0.04% (12th percentile) indicates low probability of widespread exploitation. Microsoft has released a patched version (4.18.26030.3011) addressing the access control deficiency.
Remote attackers can spoof client-mode Remote Connector Servers in PingIDM to intercept and modify identity security properties including passwords and account recovery information, due to insufficient access control granularity that prevents administrators from properly restricting RCS communications. This vulnerability affects PingIDM deployments using Remote Connector Servers in client mode and requires specific RCS configuration to be exploitable; no public exploit code has been identified at the time of analysis.
Device reload in Cisco APIC's Object Model CLI component allows authenticated local users to trigger a denial of service through insufficient input validation on crafted commands. An attacker with valid credentials and CLI access can exploit this vulnerability to crash the affected device, though no patch is currently available. This vulnerability affects systems where attackers can obtain legitimate user credentials with appropriate role permissions.