Monthly
Predictable CSRF token generation in Tenable Security Center allows a network-accessible attacker to forge authenticated requests on behalf of a victim user, resulting in high-integrity impact with no confidentiality or availability loss. The CWE-1270 root cause - generation of incorrect security tokens - means the anti-CSRF control was structurally weakened by insufficient entropy, not absent; attackers who can observe or predict token patterns can bypass it. No public exploit code or CISA KEV listing has been identified at time of analysis; Tenable has released a fix documented in advisory TNS-2026-22.
Improper authorization enforcement during token generation in GitLab Enterprise Edition allows an authenticated low-privilege user to bypass administrator-configured tool governance policies. Affected are all GitLab EE installations running 19.1 before 19.1.3 and 19.2 before 19.2.1. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV; however, the network-accessible, low-privilege attack vector makes this a realistic insider threat in enterprises relying on GitLab EE's governance controls.
Elevation of privilege in Dell PowerProtect Data Manager (all versions prior to 20.2.0.0) stems from the Identity and Access Management (IAM) subsystem generating incorrect security tokens, letting an already-authenticated low-privileged user obtain rights beyond those granted to their account. The flaw is remotely reachable over the network and requires no user interaction, and while the CVSS base score is 8.8 (High), there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Because the impact is full compromise of confidentiality, integrity and availability of the data-protection platform, it should be prioritized in any environment running affected versions.
CVE-2025-59698 is a security vulnerability (CVSS 6.8) that allows a physically proximate attacker. Risk factors: public PoC available.
A user can reverse engineer the JWT token (JSON Web Token) used in authentication for Manager and API access, forging a valid NeuVector Token to perform malicious activity in NeuVector. Rated critical severity (CVSS 9.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Generation of Incorrect Security Tokens vulnerability in CBOT Chatbot allows Token Impersonation, Privilege Abuse.0.3.4 Panel: v4.0.3.7. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Jenkins Report Portal Plugin 0.5 and earlier does not mask ReportPortal access tokens displayed on the configuration form, increasing the potential for attackers to observe and capture them. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Predictable CSRF token generation in Tenable Security Center allows a network-accessible attacker to forge authenticated requests on behalf of a victim user, resulting in high-integrity impact with no confidentiality or availability loss. The CWE-1270 root cause - generation of incorrect security tokens - means the anti-CSRF control was structurally weakened by insufficient entropy, not absent; attackers who can observe or predict token patterns can bypass it. No public exploit code or CISA KEV listing has been identified at time of analysis; Tenable has released a fix documented in advisory TNS-2026-22.
Improper authorization enforcement during token generation in GitLab Enterprise Edition allows an authenticated low-privilege user to bypass administrator-configured tool governance policies. Affected are all GitLab EE installations running 19.1 before 19.1.3 and 19.2 before 19.2.1. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV; however, the network-accessible, low-privilege attack vector makes this a realistic insider threat in enterprises relying on GitLab EE's governance controls.
Elevation of privilege in Dell PowerProtect Data Manager (all versions prior to 20.2.0.0) stems from the Identity and Access Management (IAM) subsystem generating incorrect security tokens, letting an already-authenticated low-privileged user obtain rights beyond those granted to their account. The flaw is remotely reachable over the network and requires no user interaction, and while the CVSS base score is 8.8 (High), there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Because the impact is full compromise of confidentiality, integrity and availability of the data-protection platform, it should be prioritized in any environment running affected versions.
CVE-2025-59698 is a security vulnerability (CVSS 6.8) that allows a physically proximate attacker. Risk factors: public PoC available.
A user can reverse engineer the JWT token (JSON Web Token) used in authentication for Manager and API access, forging a valid NeuVector Token to perform malicious activity in NeuVector. Rated critical severity (CVSS 9.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Generation of Incorrect Security Tokens vulnerability in CBOT Chatbot allows Token Impersonation, Privilege Abuse.0.3.4 Panel: v4.0.3.7. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Jenkins Report Portal Plugin 0.5 and earlier does not mask ReportPortal access tokens displayed on the configuration form, increasing the potential for attackers to observe and capture them. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.