Monthly
Signed JSON Web Tokens whose payload is a JSON array silently bypass every configured claim validator in the npm package fast-jwt through version 6.2.4, so the verifier returns success while enforcing only the signature and skipping exp, nbf, iss, aud, sub, jti and nonce checks. The flaw is exploitable by an authenticated attacker (CVSS PR:L) who can produce or influence a validly-signed token - signature verification itself is not broken, so the attacker must have access to the signing key or to a token-issuance path that lets them control the payload structure - and the true risk is gated by that precondition and by AC:H rather than the raw 8.1 base score. Publicly available exploit code exists in the vendor advisory, but there is no confirmed active exploitation (not in CISA KEV) and exploitation is blocked entirely in deployments that enable the opt-in requiredClaims option or that have upgraded to 6.3.0.
Input validation failure in Net::IP::LPM before 1.12 for Perl allows malformed CIDR prefix lengths to silently poison the longest-prefix-match lookup table. Non-numeric strings, Unicode digits (Arabic-Indic, fullwidth), hex notation, and integers exceeding 31 bits are all accepted and numified to zero or silently truncated by the XS/C layer, causing the malformed entry to be recorded as a /0 default route. A single such entry causes every subsequent lookup to succeed, rendering any IP-based allow-list universally permissive and any deny-list universally blocking. No public exploit has been identified at time of analysis, and EPSS is 0.17% (7th percentile).
Insufficient input validation in Amazon Bedrock AgentCore harness allows authenticated remote users to bypass model invocation and associated security controls by submitting crafted content blocks within conversation messages, directly triggering configured tool execution outside the intended agentic pipeline. The vulnerability carries a CVSS 4.0 score of 8.6 with high confidentiality and integrity impact against the vulnerable system (VC:H/VI:H), reflecting the potential for an attacker to invoke tools with whatever permissions those tools hold - such as S3 read access, database queries, or external API calls - without passing through model-layer guardrails. AWS has fully remediated this issue server-side; no public exploit has been identified at time of analysis, and no customer action is required.
Authentication bypass in Magarsus Consulting IDM-MFA (versions 2025.11.27 up to but not including 2026.03.10) lets remote unauthenticated attackers circumvent multi-factor authentication by supplying improperly-typed input that the application fails to validate. Because IDM-MFA is itself an identity and MFA gateway, a successful bypass undermines the primary control protecting downstream systems, yielding high confidentiality and integrity impact. Exploitation requires some victim interaction (CVSS UI:R), and there is no public exploit identified at time of analysis.
Remote denial of service in Microsoft .NET (versions 8.0, 9.0, and 10.0) allows an unauthenticated network attacker to crash or hang the runtime by sending crafted input that fails proper type validation (CWE-1287). The flaw carries a CVSS 7.5 rating driven entirely by availability impact (A:H) with no confidentiality or integrity loss, and no public exploit has been identified at time of analysis. Microsoft has released a patch; there is no indication of active exploitation.
Denial-of-service in Moxa NPort 6000-G2 Series serial device servers allows a low-privileged authenticated attacker to disrupt service and potentially trigger an unexpected device reboot via specially crafted JSON requests to the WebSocket API. The CVSS 4.0 base score of 7.1 reflects high availability impact with no confidentiality or integrity loss. Per current intelligence, there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Memory disclosure and denial-of-service in MongoDB Server allows any authenticated user with aggregate command privileges to crash the database or read out-of-bounds memory by submitting a malformed binary diff through the $_internalApplyOplogUpdate aggregation pipeline stage. The flaw stems from inadequate validation of the binary diff document structure consumed by an internal oplog replay operator that is unexpectedly reachable from user-facing aggregation queries. No public exploit identified at time of analysis, but the low privilege bar and network attack vector make this a meaningful threat in multi-tenant or shared-credential MongoDB deployments.
Pre-authentication denial-of-service in MongoDB Server allows unauthenticated remote clients to crash the database process by submitting a crafted 'mechanism' value to the 'authenticate' command when OIDC authentication is configured. The flaw carries a CVSS 4.0 base score of 8.2 driven by network reachability, no privileges required, and high availability impact; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Denial of service in the Perl module Net::CIDR::Set through version 0.20 allows remote unauthenticated attackers to trigger indefinite recursion by submitting malformed IP address strings to the add() method. The flaw stems from missing input validation when parsing addresses, causing the parser to re-enter itself without a termination condition. No public exploit identified at time of analysis, but the issue is trivially reproducible and a fixed version 0.21 has been released on CPAN.
Code execution is possible on MB connect line industrial remote-maintenance routers - mbNET/mbNET.rokey, mbNET.mini, and the REX100/REX200/250 families - when a local attacker supplies a specially crafted configuration file on a USB stick that triggers a type-confusion flaw in the device's cfgparser, yielding total loss of confidentiality, integrity, and availability (CVSS 8.4). The flaw requires local/physical access to the device rather than network reach. There is no public exploit identified at time of analysis, and the EPSS score is very low (0.02%, 7th percentile), consistent with the SSVC assessment of no observed exploitation.
Signed JSON Web Tokens whose payload is a JSON array silently bypass every configured claim validator in the npm package fast-jwt through version 6.2.4, so the verifier returns success while enforcing only the signature and skipping exp, nbf, iss, aud, sub, jti and nonce checks. The flaw is exploitable by an authenticated attacker (CVSS PR:L) who can produce or influence a validly-signed token - signature verification itself is not broken, so the attacker must have access to the signing key or to a token-issuance path that lets them control the payload structure - and the true risk is gated by that precondition and by AC:H rather than the raw 8.1 base score. Publicly available exploit code exists in the vendor advisory, but there is no confirmed active exploitation (not in CISA KEV) and exploitation is blocked entirely in deployments that enable the opt-in requiredClaims option or that have upgraded to 6.3.0.
Input validation failure in Net::IP::LPM before 1.12 for Perl allows malformed CIDR prefix lengths to silently poison the longest-prefix-match lookup table. Non-numeric strings, Unicode digits (Arabic-Indic, fullwidth), hex notation, and integers exceeding 31 bits are all accepted and numified to zero or silently truncated by the XS/C layer, causing the malformed entry to be recorded as a /0 default route. A single such entry causes every subsequent lookup to succeed, rendering any IP-based allow-list universally permissive and any deny-list universally blocking. No public exploit has been identified at time of analysis, and EPSS is 0.17% (7th percentile).
Insufficient input validation in Amazon Bedrock AgentCore harness allows authenticated remote users to bypass model invocation and associated security controls by submitting crafted content blocks within conversation messages, directly triggering configured tool execution outside the intended agentic pipeline. The vulnerability carries a CVSS 4.0 score of 8.6 with high confidentiality and integrity impact against the vulnerable system (VC:H/VI:H), reflecting the potential for an attacker to invoke tools with whatever permissions those tools hold - such as S3 read access, database queries, or external API calls - without passing through model-layer guardrails. AWS has fully remediated this issue server-side; no public exploit has been identified at time of analysis, and no customer action is required.
Authentication bypass in Magarsus Consulting IDM-MFA (versions 2025.11.27 up to but not including 2026.03.10) lets remote unauthenticated attackers circumvent multi-factor authentication by supplying improperly-typed input that the application fails to validate. Because IDM-MFA is itself an identity and MFA gateway, a successful bypass undermines the primary control protecting downstream systems, yielding high confidentiality and integrity impact. Exploitation requires some victim interaction (CVSS UI:R), and there is no public exploit identified at time of analysis.
Remote denial of service in Microsoft .NET (versions 8.0, 9.0, and 10.0) allows an unauthenticated network attacker to crash or hang the runtime by sending crafted input that fails proper type validation (CWE-1287). The flaw carries a CVSS 7.5 rating driven entirely by availability impact (A:H) with no confidentiality or integrity loss, and no public exploit has been identified at time of analysis. Microsoft has released a patch; there is no indication of active exploitation.
Denial-of-service in Moxa NPort 6000-G2 Series serial device servers allows a low-privileged authenticated attacker to disrupt service and potentially trigger an unexpected device reboot via specially crafted JSON requests to the WebSocket API. The CVSS 4.0 base score of 7.1 reflects high availability impact with no confidentiality or integrity loss. Per current intelligence, there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Memory disclosure and denial-of-service in MongoDB Server allows any authenticated user with aggregate command privileges to crash the database or read out-of-bounds memory by submitting a malformed binary diff through the $_internalApplyOplogUpdate aggregation pipeline stage. The flaw stems from inadequate validation of the binary diff document structure consumed by an internal oplog replay operator that is unexpectedly reachable from user-facing aggregation queries. No public exploit identified at time of analysis, but the low privilege bar and network attack vector make this a meaningful threat in multi-tenant or shared-credential MongoDB deployments.
Pre-authentication denial-of-service in MongoDB Server allows unauthenticated remote clients to crash the database process by submitting a crafted 'mechanism' value to the 'authenticate' command when OIDC authentication is configured. The flaw carries a CVSS 4.0 base score of 8.2 driven by network reachability, no privileges required, and high availability impact; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Denial of service in the Perl module Net::CIDR::Set through version 0.20 allows remote unauthenticated attackers to trigger indefinite recursion by submitting malformed IP address strings to the add() method. The flaw stems from missing input validation when parsing addresses, causing the parser to re-enter itself without a termination condition. No public exploit identified at time of analysis, but the issue is trivially reproducible and a fixed version 0.21 has been released on CPAN.
Code execution is possible on MB connect line industrial remote-maintenance routers - mbNET/mbNET.rokey, mbNET.mini, and the REX100/REX200/250 families - when a local attacker supplies a specially crafted configuration file on a USB stick that triggers a type-confusion flaw in the device's cfgparser, yielding total loss of confidentiality, integrity, and availability (CVSS 8.4). The flaw requires local/physical access to the device rather than network reach. There is no public exploit identified at time of analysis, and the EPSS score is very low (0.02%, 7th percentile), consistent with the SSVC assessment of no observed exploitation.