Monthly
Privilege escalation in on-premises Microsoft Exchange Server allows an authenticated attacker with a standard mailbox or domain user account (PR:L) to gain high confidentiality, integrity, and availability impact over the network. The vulnerability affects Exchange Server 2016 CU23, Exchange Server 2019 CU14 and CU15, and Exchange Server Subscription Edition RTM. A vendor patch is available; no public exploit code or active exploitation has been identified at time of analysis, but the low complexity and network reachability make this a priority for organizations still running affected on-premises deployments.
Authentication bypass in the LiteLLM proxy lets any party who already holds a valid JWT issued by the configured external identity provider impersonate an existing user - including accounts with proxy_admin privileges - by presenting a token whose unverified email claim matches the victim's address. The JWT authentication flow performs an email-based fallback lookup without validating the email_verified claim, so the attacker inherits the victim's role and can permanently overwrite the victim's stored identity binding, retaining persistent access to administrative endpoints that expose API keys and user management. The attacker must possess a legitimately signed token from the same IdP (CVSS PR:L, AC:H), deployments that do not use JWT/IdP authentication are unaffected, and publicly available exploit code exists; no confirmed in-the-wild exploitation has been reported.
An authorization-code interception attack against public OIDC Relying Parties on LemonLDAP::NG::Portal 2.23.0 through 2.23.3 lets an attacker redeem a stolen code for the victim's access, ID and refresh tokens without knowing the client secret, which is precisely the theft PKCE is designed to prevent. The flaw only applies to Relying Parties flagged as public while oidcRPMetaDataOptionsRequirePKCE is set to 2 ('PKCE or secret' mode), a configuration that Dynamic Client Registration creates automatically for every RP, making exposure broad on affected deployments. Exploitation is not confirmed in the wild (no CISA KEV listing), but publicly available exploit code exists and CISA SSVC rates the issue exploitable with total technical impact; EPSS is only 0.22% (11th percentile), and the independent assessment sets attack complexity to High because the attacker must first obtain a valid authorization code issued to a public RP before the token exchange succeeds. No authentication is required for the token-endpoint step (CVSS PR:N), and the victim's only involvement is completing a normal login.
Unauthenticated OAuth2 token introspection against LemonLDAP::NG Portal lets an attacker who already holds a valid access token and knows the client_id of any Relying Party configured as 'public' confirm that the token is active and read its metadata, including scope, audience, expiry and the sub claim. The flaw sits in checkEndPointAuthenticationCredentials(), which skips the client-secret comparison for public Relying Parties yet still reports a deduced authentication method (client_secret_basic or client_secret_post), so a request with a public client_id and an arbitrary or empty secret passes introspection()'s authentication gate in versions 2.20.0 before 2.21.6 and 2.22.0 before 2.23.4. Because the returned sub is computed using the calling Relying Party's user identifier attribute, an attacker can correlate a user identifier across Relying Parties, defeating per-client and pseudonymous identifiers; CVSS vector PR:N makes this unauthenticated at the protocol level, but in practice exploitation requires possession of a live token plus knowledge of a public client_id, so no public exploit code and no confirmed active exploitation were identified at time of analysis, and EPSS is 0.21% (10th percentile). Vendor patches are released as 2.21.6 and 2.23.4.
Privilege escalation in Microsoft SQL Server allows a network-authenticated low-privileged attacker to elevate to higher database roles via a weak authentication mechanism (CWE-1390). Affected releases span SQL Server 2017 through 2025 across both General Distribution Release (GDR) and Cumulative Update (CU) servicing branches. Microsoft has released patched builds for all affected versions; no public exploit or CISA KEV listing has been identified at time of analysis.
Security feature bypass in Microsoft Windows iSCSI (Initiator/Target service) lets a remote, unauthenticated attacker defeat the protocol's weak authentication over the network, per Microsoft's advisory carrying a 9.8 CVSS with full confidentiality, integrity, and availability impact. The flaw spans essentially the entire supported Windows Server line (2012 through 2025) plus Windows 10 (1607/1809), and a vendor patch is available. No public exploit has been identified at time of analysis, and the CVE is not listed in CISA KEV.
Authentication bypass in the Ebyte NE2-D11 network device's vendor configuration utility allows an unauthenticated attacker on the adjacent network to reach administrative functions without proving the operator's identity. Under certain credential conditions the attacker can alter critical device settings or change access credentials, locking legitimate administrators out of their own OT/ICS equipment. No public exploit has been identified at time of analysis and the flaw is not listed in CISA KEV, but the CISA ICS advisory (ICSA-26-237-06) confirms the weakness.
Weak authentication in NVIDIA NemoClaw for Linux (versions 0 through 0.0.4) lets remote attackers bypass the authentication enforced by its remote-access helper workflow, enabling code execution, information disclosure, and data tampering on the host. The flaw was self-reported by NVIDIA and carries a critical 9.8 CVSS rating with a fully unauthenticated network vector. No public exploit identified at time of analysis, and EPSS estimates only a 0.57% 30-day exploitation probability, so the raw severity outpaces observed real-world activity.
Authentication bypass in the Mira fertility-tracking cloud API allows any remote attacker to take over user accounts by supplying only a victim's email address and an arbitrary password, since the login endpoint validates the email but accepts any format-valid string as the password and returns a live active session token. Affecting Mira Firmware 1.7.1.47 and Mira Android App 4.5.15.4 (Quanovate Tech Inc, operating as Mira / Mira Care), this reported by CISA (ICSMA-26-223-01) carries a CVSS 4.0 base score of 9.3 and exposes sensitive reproductive-health (hormone) records and account settings. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Broken authentication in the Ziina WordPress payment plugin (versions <= 1.2.21) lets remote unauthenticated attackers bypass authentication controls, with the CVSS integrity-high rating indicating attackers can manipulate protected state or actions they should not be able to reach. Reported by Patchstack and classified under CWE-1390 (Weak Authentication), the issue is network-reachable with low complexity and no user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Privilege escalation in on-premises Microsoft Exchange Server allows an authenticated attacker with a standard mailbox or domain user account (PR:L) to gain high confidentiality, integrity, and availability impact over the network. The vulnerability affects Exchange Server 2016 CU23, Exchange Server 2019 CU14 and CU15, and Exchange Server Subscription Edition RTM. A vendor patch is available; no public exploit code or active exploitation has been identified at time of analysis, but the low complexity and network reachability make this a priority for organizations still running affected on-premises deployments.
Authentication bypass in the LiteLLM proxy lets any party who already holds a valid JWT issued by the configured external identity provider impersonate an existing user - including accounts with proxy_admin privileges - by presenting a token whose unverified email claim matches the victim's address. The JWT authentication flow performs an email-based fallback lookup without validating the email_verified claim, so the attacker inherits the victim's role and can permanently overwrite the victim's stored identity binding, retaining persistent access to administrative endpoints that expose API keys and user management. The attacker must possess a legitimately signed token from the same IdP (CVSS PR:L, AC:H), deployments that do not use JWT/IdP authentication are unaffected, and publicly available exploit code exists; no confirmed in-the-wild exploitation has been reported.
An authorization-code interception attack against public OIDC Relying Parties on LemonLDAP::NG::Portal 2.23.0 through 2.23.3 lets an attacker redeem a stolen code for the victim's access, ID and refresh tokens without knowing the client secret, which is precisely the theft PKCE is designed to prevent. The flaw only applies to Relying Parties flagged as public while oidcRPMetaDataOptionsRequirePKCE is set to 2 ('PKCE or secret' mode), a configuration that Dynamic Client Registration creates automatically for every RP, making exposure broad on affected deployments. Exploitation is not confirmed in the wild (no CISA KEV listing), but publicly available exploit code exists and CISA SSVC rates the issue exploitable with total technical impact; EPSS is only 0.22% (11th percentile), and the independent assessment sets attack complexity to High because the attacker must first obtain a valid authorization code issued to a public RP before the token exchange succeeds. No authentication is required for the token-endpoint step (CVSS PR:N), and the victim's only involvement is completing a normal login.
Unauthenticated OAuth2 token introspection against LemonLDAP::NG Portal lets an attacker who already holds a valid access token and knows the client_id of any Relying Party configured as 'public' confirm that the token is active and read its metadata, including scope, audience, expiry and the sub claim. The flaw sits in checkEndPointAuthenticationCredentials(), which skips the client-secret comparison for public Relying Parties yet still reports a deduced authentication method (client_secret_basic or client_secret_post), so a request with a public client_id and an arbitrary or empty secret passes introspection()'s authentication gate in versions 2.20.0 before 2.21.6 and 2.22.0 before 2.23.4. Because the returned sub is computed using the calling Relying Party's user identifier attribute, an attacker can correlate a user identifier across Relying Parties, defeating per-client and pseudonymous identifiers; CVSS vector PR:N makes this unauthenticated at the protocol level, but in practice exploitation requires possession of a live token plus knowledge of a public client_id, so no public exploit code and no confirmed active exploitation were identified at time of analysis, and EPSS is 0.21% (10th percentile). Vendor patches are released as 2.21.6 and 2.23.4.
Privilege escalation in Microsoft SQL Server allows a network-authenticated low-privileged attacker to elevate to higher database roles via a weak authentication mechanism (CWE-1390). Affected releases span SQL Server 2017 through 2025 across both General Distribution Release (GDR) and Cumulative Update (CU) servicing branches. Microsoft has released patched builds for all affected versions; no public exploit or CISA KEV listing has been identified at time of analysis.
Security feature bypass in Microsoft Windows iSCSI (Initiator/Target service) lets a remote, unauthenticated attacker defeat the protocol's weak authentication over the network, per Microsoft's advisory carrying a 9.8 CVSS with full confidentiality, integrity, and availability impact. The flaw spans essentially the entire supported Windows Server line (2012 through 2025) plus Windows 10 (1607/1809), and a vendor patch is available. No public exploit has been identified at time of analysis, and the CVE is not listed in CISA KEV.
Authentication bypass in the Ebyte NE2-D11 network device's vendor configuration utility allows an unauthenticated attacker on the adjacent network to reach administrative functions without proving the operator's identity. Under certain credential conditions the attacker can alter critical device settings or change access credentials, locking legitimate administrators out of their own OT/ICS equipment. No public exploit has been identified at time of analysis and the flaw is not listed in CISA KEV, but the CISA ICS advisory (ICSA-26-237-06) confirms the weakness.
Weak authentication in NVIDIA NemoClaw for Linux (versions 0 through 0.0.4) lets remote attackers bypass the authentication enforced by its remote-access helper workflow, enabling code execution, information disclosure, and data tampering on the host. The flaw was self-reported by NVIDIA and carries a critical 9.8 CVSS rating with a fully unauthenticated network vector. No public exploit identified at time of analysis, and EPSS estimates only a 0.57% 30-day exploitation probability, so the raw severity outpaces observed real-world activity.
Authentication bypass in the Mira fertility-tracking cloud API allows any remote attacker to take over user accounts by supplying only a victim's email address and an arbitrary password, since the login endpoint validates the email but accepts any format-valid string as the password and returns a live active session token. Affecting Mira Firmware 1.7.1.47 and Mira Android App 4.5.15.4 (Quanovate Tech Inc, operating as Mira / Mira Care), this reported by CISA (ICSMA-26-223-01) carries a CVSS 4.0 base score of 9.3 and exposes sensitive reproductive-health (hormone) records and account settings. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Broken authentication in the Ziina WordPress payment plugin (versions <= 1.2.21) lets remote unauthenticated attackers bypass authentication controls, with the CVSS integrity-high rating indicating attackers can manipulate protected state or actions they should not be able to reach. Reported by Patchstack and classified under CWE-1390 (Weak Authentication), the issue is network-reachable with low complexity and no user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.