Monthly
Signature-verification bypass in Kong API Gateway Enterprise lets an unauthenticated remote attacker present a forged JWT that the gateway accepts as valid, defeating token-based authentication for the MCP OAuth2 and DataKit integration code paths. The vulnerable logic fails to confirm that the JWT's declared signing algorithm is compatible with the key type actually used for verification, so an attacker who can reach a protected endpoint that relies on these integrations can slip through as an authenticated principal; the independent assessment scopes the impact to the backend resources the gateway protects (C:H/I:H under a changed-scope CVSS:3.1 vector) rather than to the gateway host itself. Exposure is gated by configuration - gateways that do not enable MCP OAuth2 or DataKit JWT validation are not reachable - and no public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthenticated remote denial-of-service in HPE IceWall Federation Agent and Proxy allows a network attacker to crash or render unavailable the identity federation and authentication proxy service. The root cause is improper handling of incorrect data types (CWE-241), meaning the software fails to gracefully reject or process malformed input, triggering an availability failure. No active exploitation or public exploit code has been identified at time of analysis.
Persistent denial of service in the Tiptap for PHP library before 2.1.1 lets authenticated users crash the server-side rendering pipeline by submitting Tiptap JSON whose attrs.href is an array rather than a string. The malformed value reaches preg_match() inside Link::isAllowedUri() and triggers an unhandled TypeError; because the bad record is stored, every later attempt to render that content fails for all viewers until the database row is manually fixed. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV; EPSS data was not provided.
A security vulnerability in Nextcloud Calendar (CVSS 5.7). Risk factors: public PoC available. Vendor patch is available.
Improper input validation in Satellite Management Controller (SMC) may allow an attacker with privileges to manipulate Redfish® API commands to remove files from the local root directory, potentially. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper input validation in Satellite Management Controller (SMC) may allow an attacker with privileges to use certain special characters in manipulated Redfish® API commands, causing service. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The HP LaserJet MFP M232-M237 Printer Series may be vulnerable to a denial of service attack when a specially crafted request message is sent via Internet Printing Protocol (IPP). Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Certain HP LaserJet Pro printers may potentially experience a denial of service when a user sends a raw JPEG file to the printer via IPP (Internet Printing Protocol). Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Certain HP LaserJet printers may potentially experience a denial of service when a user sends a raw JPEG file to the printer. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Nextcloud Calendar is a calendar app for Nextcloud. Rated medium severity (CVSS 4.6), this vulnerability is remotely exploitable, low attack complexity.
Signature-verification bypass in Kong API Gateway Enterprise lets an unauthenticated remote attacker present a forged JWT that the gateway accepts as valid, defeating token-based authentication for the MCP OAuth2 and DataKit integration code paths. The vulnerable logic fails to confirm that the JWT's declared signing algorithm is compatible with the key type actually used for verification, so an attacker who can reach a protected endpoint that relies on these integrations can slip through as an authenticated principal; the independent assessment scopes the impact to the backend resources the gateway protects (C:H/I:H under a changed-scope CVSS:3.1 vector) rather than to the gateway host itself. Exposure is gated by configuration - gateways that do not enable MCP OAuth2 or DataKit JWT validation are not reachable - and no public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthenticated remote denial-of-service in HPE IceWall Federation Agent and Proxy allows a network attacker to crash or render unavailable the identity federation and authentication proxy service. The root cause is improper handling of incorrect data types (CWE-241), meaning the software fails to gracefully reject or process malformed input, triggering an availability failure. No active exploitation or public exploit code has been identified at time of analysis.
Persistent denial of service in the Tiptap for PHP library before 2.1.1 lets authenticated users crash the server-side rendering pipeline by submitting Tiptap JSON whose attrs.href is an array rather than a string. The malformed value reaches preg_match() inside Link::isAllowedUri() and triggers an unhandled TypeError; because the bad record is stored, every later attempt to render that content fails for all viewers until the database row is manually fixed. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV; EPSS data was not provided.
A security vulnerability in Nextcloud Calendar (CVSS 5.7). Risk factors: public PoC available. Vendor patch is available.
Improper input validation in Satellite Management Controller (SMC) may allow an attacker with privileges to manipulate Redfish® API commands to remove files from the local root directory, potentially. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper input validation in Satellite Management Controller (SMC) may allow an attacker with privileges to use certain special characters in manipulated Redfish® API commands, causing service. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The HP LaserJet MFP M232-M237 Printer Series may be vulnerable to a denial of service attack when a specially crafted request message is sent via Internet Printing Protocol (IPP). Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Certain HP LaserJet Pro printers may potentially experience a denial of service when a user sends a raw JPEG file to the printer via IPP (Internet Printing Protocol). Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Certain HP LaserJet printers may potentially experience a denial of service when a user sends a raw JPEG file to the printer. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Nextcloud Calendar is a calendar app for Nextcloud. Rated medium severity (CVSS 4.6), this vulnerability is remotely exploitable, low attack complexity.