Monthly
Service account impersonation in Octopus Server stems from inconsistent OIDC token issuer validation, allowing a token minted by a non-legitimate issuer to be accepted as if it came from a legitimate trusted issuer. Deployments are exposed only when OIDC is in use for at least one service account identity, and a attacker must additionally know or guess details of that specific identity and operate a rogue issuer that can mint a matching token - conditions that favour targeted attacks over opportunistic scanning. Vendor CVSS 4.0 score is 8.7; the assessed CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N, C:H/I:H/A:H) likewise reflects high complexity and high confidentiality, integrity and availability impact, and no public exploit has been identified at time of analysis.
Privilege escalation in Octopus Server lets an authenticated user who already holds permission to modify roles weaken a built-in role's protections and add their own account to a privileged team, effectively granting themselves administrative reach without ever being assigned those rights legitimately. The flaw stems from improper validation of unsafe equivalence in input (CWE-1289), meaning role/permission data that should not be treated as equivalent is mishandled during validation. The primary limiter is the prerequisite: the attacker must already have been delegated role-modification rights, so environments that keep that permission confined to a small trusted administrator set face materially lower exposure. No public exploit code has been identified at time of analysis, and this CVE is not confirmed actively exploited (CISA KEV); the Octopus vendor advisory SA2026-11 is the authoritative source for affected and fixed builds.
JetBrains TeamCity versions prior to 2026.2, 2026.1.4, and 2025.11.8 contain a flaw in the password reset mechanism that permits an unauthenticated remote attacker to take over an administrator account. The vulnerability requires a non-trivial condition (AC:H) related to improper validation of input equivalence (CWE-1289), so exploitation is not fully turnkey. No public exploit code has been identified at the time of analysis, but the high impact (C/I/A:H) and remote, unauthenticated attack vector make this a genuinely high-priority flaw despite thin external signals; upgrading to the specified versions removes the vulnerability.
Authentication bypass in the GiveWP WordPress donation plugin (all versions through 4.16.9) allows remote, unauthenticated attackers to satisfy the plugin's credential/equivalence check with crafted input and reach privileged plugin functionality on any affected site. Scoring CVSS 3.1 base 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), exploitation requires only that the plugin be installed and reachable - no account, no privileges, and no victim interaction - with high confidentiality and integrity impact, which makes automated scanning of WordPress installs a realistic attack model. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and no EPSS score was supplied, so priority should be driven by the severity and trivial preconditions rather than observed exploitation.
Namespace isolation bypass in AWS Network Policy Agent (aws-network-policy-agent) before v1.4.0 lets an authenticated, highly privileged cluster user defeat NetworkPolicy enforcement against co-located pods that live in other namespaces. The attacker must be able to create pods and control their pod and namespace names so that they generate a pod identifier that collides with the identifier of a victim pod already running on the same node, which then causes the agent to misattribute enforcement state and skip the intended isolation. Only clusters that have Network Policy enabled and run the affected agent are exposed; the vendor has released Network Policy Agent v1.4.0 and Amazon VPC CNI Managed Add-on v1.22.4 to correct the identifier scheme, and no public exploit code or confirmed active exploitation was identified at the time of analysis.
Silent date corruption in Date::Manip through version 6.99 allows any caller passing untrusted character strings to ParseDate() or Date::Manip::Date->parse() to receive silently incorrect parsed dates when non-ASCII Unicode decimal digits (such as Arabic-Indic, Devanagari, or other Unicode script numerals) appear in year, month, or day fields. Perl's \d regex shorthand matches the full Unicode decimal-digit property (\p{Nd}), so non-ASCII digits are captured; subsequent numeric range validation then passes them because Perl truncates the string-to-number conversion at the first non-ASCII character, producing an in-range but wrong value — for example, '202٤' evaluates to year 202, not 2024. No public exploit has been identified at time of analysis and EPSS is very low (0.19%), but SSVC flags the flaw as automatable and the impact is meaningful for any application where Date::Manip parses externally-supplied dates to gate expiry checks, retention windows, or access-control logic.
Improper input validation in the Perl module Net::CIDR::Set through version 0.20 allows attackers to bypass network access controls by submitting network masks containing Unicode digits (e.g., Arabic-Indic numerals like U+0661) or leading zeros that are silently ignored or misinterpreted. The CVSS 7.3 score reflects low-impact compromise across confidentiality, integrity, and availability via the network, with no public exploit identified at time of analysis. Applications using this module for ACL or firewall-like decisions may grant access to wider IP ranges than intended.
Privilege escalation in Go's golang.org/x/net/idna package (all versions before 0.55.0) stems from ToASCII and ToUnicode accepting Punycode labels that decode to an ASCII-only label, so ToUnicode("xn--example-.com") returns "example.com" instead of an error. Applications that perform authorization checks on an ASCII hostname and then convert it to Unicode can be tricked into permitting a name that the direct check would have rejected. This is a library-level flaw (CVSS 9.6, scope-changed) reported by the Go team; there is no public exploit identified at time of analysis and EPSS is very low (0.04%, 14th percentile).
Cache key collision in Mercure hub TopicSelectorStore enables authorization bypass through crafted topic names. Attackers can poison the match result cache by exploiting underscore-based key concatenation, causing private updates to be delivered to unauthorized subscribers or blocking legitimate deliveries. Affects Go package github.com/dunglas/mercure prior to version 0.22.0. Exploitation requires ability to subscribe to the hub or publish updates with specially crafted topic/selector combinations. No public exploit identified at time of analysis.
Privilege escalation via cache key collision in Parse Dashboard (npm parse-dashboard) versions 7.3.0-alpha.42 through 9.0.0-alpha.7 allows an authenticated read-only user to obtain the full master key. The flaw lives in ConfigKeyCache, which reuses one cache entry for both the master key and the read-only master key when those keys are function-typed; under a timing race a read-only session can read back the cached full master key (or a regular user the read-only key). Exploitation requires an authenticated dashboard session and a non-default configuration (function-typed keys plus the agent block); no public exploit identified at time of analysis and EPSS is low (0.05%), but the GitHub Security Advisory and patch commit confirm the issue.
Service account impersonation in Octopus Server stems from inconsistent OIDC token issuer validation, allowing a token minted by a non-legitimate issuer to be accepted as if it came from a legitimate trusted issuer. Deployments are exposed only when OIDC is in use for at least one service account identity, and a attacker must additionally know or guess details of that specific identity and operate a rogue issuer that can mint a matching token - conditions that favour targeted attacks over opportunistic scanning. Vendor CVSS 4.0 score is 8.7; the assessed CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N, C:H/I:H/A:H) likewise reflects high complexity and high confidentiality, integrity and availability impact, and no public exploit has been identified at time of analysis.
Privilege escalation in Octopus Server lets an authenticated user who already holds permission to modify roles weaken a built-in role's protections and add their own account to a privileged team, effectively granting themselves administrative reach without ever being assigned those rights legitimately. The flaw stems from improper validation of unsafe equivalence in input (CWE-1289), meaning role/permission data that should not be treated as equivalent is mishandled during validation. The primary limiter is the prerequisite: the attacker must already have been delegated role-modification rights, so environments that keep that permission confined to a small trusted administrator set face materially lower exposure. No public exploit code has been identified at time of analysis, and this CVE is not confirmed actively exploited (CISA KEV); the Octopus vendor advisory SA2026-11 is the authoritative source for affected and fixed builds.
JetBrains TeamCity versions prior to 2026.2, 2026.1.4, and 2025.11.8 contain a flaw in the password reset mechanism that permits an unauthenticated remote attacker to take over an administrator account. The vulnerability requires a non-trivial condition (AC:H) related to improper validation of input equivalence (CWE-1289), so exploitation is not fully turnkey. No public exploit code has been identified at the time of analysis, but the high impact (C/I/A:H) and remote, unauthenticated attack vector make this a genuinely high-priority flaw despite thin external signals; upgrading to the specified versions removes the vulnerability.
Authentication bypass in the GiveWP WordPress donation plugin (all versions through 4.16.9) allows remote, unauthenticated attackers to satisfy the plugin's credential/equivalence check with crafted input and reach privileged plugin functionality on any affected site. Scoring CVSS 3.1 base 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), exploitation requires only that the plugin be installed and reachable - no account, no privileges, and no victim interaction - with high confidentiality and integrity impact, which makes automated scanning of WordPress installs a realistic attack model. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and no EPSS score was supplied, so priority should be driven by the severity and trivial preconditions rather than observed exploitation.
Namespace isolation bypass in AWS Network Policy Agent (aws-network-policy-agent) before v1.4.0 lets an authenticated, highly privileged cluster user defeat NetworkPolicy enforcement against co-located pods that live in other namespaces. The attacker must be able to create pods and control their pod and namespace names so that they generate a pod identifier that collides with the identifier of a victim pod already running on the same node, which then causes the agent to misattribute enforcement state and skip the intended isolation. Only clusters that have Network Policy enabled and run the affected agent are exposed; the vendor has released Network Policy Agent v1.4.0 and Amazon VPC CNI Managed Add-on v1.22.4 to correct the identifier scheme, and no public exploit code or confirmed active exploitation was identified at the time of analysis.
Silent date corruption in Date::Manip through version 6.99 allows any caller passing untrusted character strings to ParseDate() or Date::Manip::Date->parse() to receive silently incorrect parsed dates when non-ASCII Unicode decimal digits (such as Arabic-Indic, Devanagari, or other Unicode script numerals) appear in year, month, or day fields. Perl's \d regex shorthand matches the full Unicode decimal-digit property (\p{Nd}), so non-ASCII digits are captured; subsequent numeric range validation then passes them because Perl truncates the string-to-number conversion at the first non-ASCII character, producing an in-range but wrong value — for example, '202٤' evaluates to year 202, not 2024. No public exploit has been identified at time of analysis and EPSS is very low (0.19%), but SSVC flags the flaw as automatable and the impact is meaningful for any application where Date::Manip parses externally-supplied dates to gate expiry checks, retention windows, or access-control logic.
Improper input validation in the Perl module Net::CIDR::Set through version 0.20 allows attackers to bypass network access controls by submitting network masks containing Unicode digits (e.g., Arabic-Indic numerals like U+0661) or leading zeros that are silently ignored or misinterpreted. The CVSS 7.3 score reflects low-impact compromise across confidentiality, integrity, and availability via the network, with no public exploit identified at time of analysis. Applications using this module for ACL or firewall-like decisions may grant access to wider IP ranges than intended.
Privilege escalation in Go's golang.org/x/net/idna package (all versions before 0.55.0) stems from ToASCII and ToUnicode accepting Punycode labels that decode to an ASCII-only label, so ToUnicode("xn--example-.com") returns "example.com" instead of an error. Applications that perform authorization checks on an ASCII hostname and then convert it to Unicode can be tricked into permitting a name that the direct check would have rejected. This is a library-level flaw (CVSS 9.6, scope-changed) reported by the Go team; there is no public exploit identified at time of analysis and EPSS is very low (0.04%, 14th percentile).
Cache key collision in Mercure hub TopicSelectorStore enables authorization bypass through crafted topic names. Attackers can poison the match result cache by exploiting underscore-based key concatenation, causing private updates to be delivered to unauthorized subscribers or blocking legitimate deliveries. Affects Go package github.com/dunglas/mercure prior to version 0.22.0. Exploitation requires ability to subscribe to the hub or publish updates with specially crafted topic/selector combinations. No public exploit identified at time of analysis.
Privilege escalation via cache key collision in Parse Dashboard (npm parse-dashboard) versions 7.3.0-alpha.42 through 9.0.0-alpha.7 allows an authenticated read-only user to obtain the full master key. The flaw lives in ConfigKeyCache, which reuses one cache entry for both the master key and the read-only master key when those keys are function-typed; under a timing race a read-only session can read back the cached full master key (or a regular user the read-only key). Exploitation requires an authenticated dashboard session and a non-default configuration (function-typed keys plus the agent block); no public exploit identified at time of analysis and EPSS is low (0.05%), but the GitHub Security Advisory and patch commit confirm the issue.