Monthly
Improper authorization in sambitraj Student Management System allows authenticated low-privileged users (students) to access or tamper with other students' records by manipulating the `roll_no` parameter in `student_dashboard.php`. Confirmed by CPE `cpe:2.3:a:sambitraj:student_management_system:*:*:*:*:*:*:*:*`, all commits up to `56ba287f2e9031523ccb4244cb6e3fe530e4e5d5` are affected. A public proof-of-concept is available via a GitHub issue; the project has not responded to disclosure, leaving the flaw unpatched with no KEV listing.
Broken access control in Admidio's profile_function.php allows any authenticated low-privilege user to enumerate another user's future role memberships by directly invoking the reload_future_memberships endpoint with a known victim UUID. Affected are all Admidio installations running versions prior to 5.0.12. An attacker with a valid account can bypass profile-level authorization to harvest sensitive organizational membership planning data without elevated privileges; no public exploit code has been identified at time of analysis.
Missing authorization checks on three IAM REST API endpoints in Yamcs allow any authenticated low-privilege user to enumerate the server's complete privilege taxonomy and role-to-privilege mappings, directly enabling targeted privilege escalation reconnaissance. Affected are yamcs-core versions up to 5.12.7 and 5.13.0 through 5.13.1, used in production spacecraft operations and ground station environments. A proof-of-concept is confirmed in the GHSA advisory; no active exploitation (CISA KEV) has been identified, but the leaked data (including the ControlAccess and ChangeMissionDatabase privilege names) provides a precise roadmap for chained attacks including, per the advisory, algorithm-level remote code execution.
Cross-project Kanban data destruction in Vikunja allows any authenticated user to permanently wipe `task_buckets` and `task_positions` for any project view in the entire instance, regardless of project membership. Affecting versions 0.24.6 through 2.4.0, the `ProjectView.Delete` method performs two unscoped cascading SQL deletes using only the URL-supplied view ID after an authorization check that verifies admin rights on the attacker's own project - never confirming the target view belongs to that project. A working PoC is publicly available via the GHSA advisory; view IDs are auto-increment integers, making full-instance enumeration trivial with no prior reconnaissance.
Authorization bypass in Vikunja's project duplication API allows any authenticated user to inject an attacker-owned project into any other user's or team's project hierarchy without write access to the target parent. Affected versions span v0.21.0 through v2.3.0 - the entire post-namespace-migration release history - and exploitation requires only a single authenticated API call with no special configuration. No public exploit exists beyond the proof of concept published in the vendor advisory, and the CVE is not listed in the CISA KEV catalog; however, the trivial reproducibility and lack of rate-limiting or secondary authorization checks on the duplicate route make this a meaningful risk on any shared Vikunja instance.
Account takeover affects the 3DPassport identity component bundled with Dassault Systèmes 3DSwymer across 3DEXPERIENCE releases R2023x through R2026x, where an improper authorization flaw (CWE-285) lets a remote, unauthenticated attacker who lures a victim into interacting with crafted content gain access to some user accounts. Because 3DPassport is the platform's single-sign-on gateway, a successful attack yields high confidentiality and integrity impact and crosses a trust boundary (scope-changed) into downstream 3DEXPERIENCE apps. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score supplied.
Improper Authorization in Apache Tomcat causes security-role-ref mappings - intended only for servlet-level isUserInRole() checks - to be incorrectly applied as role aliases within the Realm's authorization logic, allowing authenticated low-privileged users to access resources protected by higher-privileged roles. Supported branches 9.0.25-9.0.120, 10.1.0-M1-10.1.57, and 11.0.0-M1-11.0.24 are confirmed affected, along with EOL branches 7.0.97-7.0.109 and 8.5.46-8.5.100. No public exploit identified at time of analysis, and EPSS probability stands at 0.20% (10th percentile), though the CVSS 8.1 score reflects meaningful integrity and availability exposure in deployments relying on Realm-enforced role separation.
Privilege escalation in Doorkeeper OpenID Connect prior to 1.10.4 allows self-registered OAuth clients to obtain scopes beyond what the server intends to grant. The Dynamic Client Registration endpoint directly assigns client-supplied scope values to the application record without intersecting them against the server's configured `default_scopes` and `optional_scopes`, and because `enforce_configured_scopes` is disabled by default, Doorkeeper's ScopeChecker subsequently honors those persisted application-level scopes over server-level restrictions. No public exploit has been identified at time of analysis; a vendor patch was released July 2, 2026.
Authentication bypass in djust's WebSocket LiveView consumer allows unauthenticated remote clients to invoke protected event handlers on views gated by login_required, permission_required, or redirecting on_mount hooks. All djust versions prior to 1.0.4 are affected: handle_mount sends a navigate/redirect frame on auth denial but neither closes the WebSocket nor clears self.view_instance, leaving the socket open and exploitable. Because handle_event never rechecks authentication after mount, a non-browser WebSocket client that ignores the redirect can send arbitrary event frames and execute state-mutating or data-reading handlers without an authenticated session. No public exploit identified at time of analysis beyond the WebsocketCommunicator proof-of-concept reproducer disclosed in GHSA-xx4j-w367-7247; this vulnerability is not listed in CISA KEV.
Scope enforcement in Ech0 4.3.4 and earlier is opt-in at the route level, meaning privileged admin routes that omit the RequireScopes() middleware fall back to role-only checks and honor any valid admin token regardless of declared scope. An admin holding a deliberately narrowed API token - for example one scoped to echo:read - can reach endpoints such as /api/inbox, /api/panel/comments, and /api/backup/export, with the backup handler additionally stripping scope metadata entirely and returning a full database ZIP archive. No CISA KEV listing or confirmed public exploit code has been identified; the vulnerability is fixed in an upstream release (version discrepancy noted below).
Improper authorization in sambitraj Student Management System allows authenticated low-privileged users (students) to access or tamper with other students' records by manipulating the `roll_no` parameter in `student_dashboard.php`. Confirmed by CPE `cpe:2.3:a:sambitraj:student_management_system:*:*:*:*:*:*:*:*`, all commits up to `56ba287f2e9031523ccb4244cb6e3fe530e4e5d5` are affected. A public proof-of-concept is available via a GitHub issue; the project has not responded to disclosure, leaving the flaw unpatched with no KEV listing.
Broken access control in Admidio's profile_function.php allows any authenticated low-privilege user to enumerate another user's future role memberships by directly invoking the reload_future_memberships endpoint with a known victim UUID. Affected are all Admidio installations running versions prior to 5.0.12. An attacker with a valid account can bypass profile-level authorization to harvest sensitive organizational membership planning data without elevated privileges; no public exploit code has been identified at time of analysis.
Missing authorization checks on three IAM REST API endpoints in Yamcs allow any authenticated low-privilege user to enumerate the server's complete privilege taxonomy and role-to-privilege mappings, directly enabling targeted privilege escalation reconnaissance. Affected are yamcs-core versions up to 5.12.7 and 5.13.0 through 5.13.1, used in production spacecraft operations and ground station environments. A proof-of-concept is confirmed in the GHSA advisory; no active exploitation (CISA KEV) has been identified, but the leaked data (including the ControlAccess and ChangeMissionDatabase privilege names) provides a precise roadmap for chained attacks including, per the advisory, algorithm-level remote code execution.
Cross-project Kanban data destruction in Vikunja allows any authenticated user to permanently wipe `task_buckets` and `task_positions` for any project view in the entire instance, regardless of project membership. Affecting versions 0.24.6 through 2.4.0, the `ProjectView.Delete` method performs two unscoped cascading SQL deletes using only the URL-supplied view ID after an authorization check that verifies admin rights on the attacker's own project - never confirming the target view belongs to that project. A working PoC is publicly available via the GHSA advisory; view IDs are auto-increment integers, making full-instance enumeration trivial with no prior reconnaissance.
Authorization bypass in Vikunja's project duplication API allows any authenticated user to inject an attacker-owned project into any other user's or team's project hierarchy without write access to the target parent. Affected versions span v0.21.0 through v2.3.0 - the entire post-namespace-migration release history - and exploitation requires only a single authenticated API call with no special configuration. No public exploit exists beyond the proof of concept published in the vendor advisory, and the CVE is not listed in the CISA KEV catalog; however, the trivial reproducibility and lack of rate-limiting or secondary authorization checks on the duplicate route make this a meaningful risk on any shared Vikunja instance.
Account takeover affects the 3DPassport identity component bundled with Dassault Systèmes 3DSwymer across 3DEXPERIENCE releases R2023x through R2026x, where an improper authorization flaw (CWE-285) lets a remote, unauthenticated attacker who lures a victim into interacting with crafted content gain access to some user accounts. Because 3DPassport is the platform's single-sign-on gateway, a successful attack yields high confidentiality and integrity impact and crosses a trust boundary (scope-changed) into downstream 3DEXPERIENCE apps. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score supplied.
Improper Authorization in Apache Tomcat causes security-role-ref mappings - intended only for servlet-level isUserInRole() checks - to be incorrectly applied as role aliases within the Realm's authorization logic, allowing authenticated low-privileged users to access resources protected by higher-privileged roles. Supported branches 9.0.25-9.0.120, 10.1.0-M1-10.1.57, and 11.0.0-M1-11.0.24 are confirmed affected, along with EOL branches 7.0.97-7.0.109 and 8.5.46-8.5.100. No public exploit identified at time of analysis, and EPSS probability stands at 0.20% (10th percentile), though the CVSS 8.1 score reflects meaningful integrity and availability exposure in deployments relying on Realm-enforced role separation.
Privilege escalation in Doorkeeper OpenID Connect prior to 1.10.4 allows self-registered OAuth clients to obtain scopes beyond what the server intends to grant. The Dynamic Client Registration endpoint directly assigns client-supplied scope values to the application record without intersecting them against the server's configured `default_scopes` and `optional_scopes`, and because `enforce_configured_scopes` is disabled by default, Doorkeeper's ScopeChecker subsequently honors those persisted application-level scopes over server-level restrictions. No public exploit has been identified at time of analysis; a vendor patch was released July 2, 2026.
Authentication bypass in djust's WebSocket LiveView consumer allows unauthenticated remote clients to invoke protected event handlers on views gated by login_required, permission_required, or redirecting on_mount hooks. All djust versions prior to 1.0.4 are affected: handle_mount sends a navigate/redirect frame on auth denial but neither closes the WebSocket nor clears self.view_instance, leaving the socket open and exploitable. Because handle_event never rechecks authentication after mount, a non-browser WebSocket client that ignores the redirect can send arbitrary event frames and execute state-mutating or data-reading handlers without an authenticated session. No public exploit identified at time of analysis beyond the WebsocketCommunicator proof-of-concept reproducer disclosed in GHSA-xx4j-w367-7247; this vulnerability is not listed in CISA KEV.
Scope enforcement in Ech0 4.3.4 and earlier is opt-in at the route level, meaning privileged admin routes that omit the RequireScopes() middleware fall back to role-only checks and honor any valid admin token regardless of declared scope. An admin holding a deliberately narrowed API token - for example one scoped to echo:read - can reach endpoints such as /api/inbox, /api/panel/comments, and /api/backup/export, with the backup handler additionally stripping scope metadata entirely and returning a full database ZIP archive. No CISA KEV listing or confirmed public exploit code has been identified; the vulnerability is fixed in an upstream release (version discrepancy noted below).