Monthly
Authentication bypass in rclone's S3 server mode (rclone serve s3) allows any unauthenticated network attacker to impersonate arbitrary S3 access keys. When rclone serve s3 is started with --auth-proxy but without --auth-key, authPairMiddleware registers whatever accessKeyID the client chooses against an empty s3Secret, and gofakes3 then validates the request's SigV4 signature against that same empty secret - so an attacker can pick any access key, sign with an empty secret, and reach whatever backend the auth-proxy script resolves for that identity. Fixed in rclone 1.75.1; no public exploit identified at time of analysis, though the vendor security advisory (GHSA-xwwr-4h3p-r22c) and fix commit are public.
Backend connection hijacking in Traefik reverse proxy (2.11.0 through 2.11.56 and 3.0.0 through 3.7.12) lets an unauthenticated remote client impersonate another user over HTTP/3. Because the HTTP/3 entrypoint never calls service.AddTransportOnContext, the kerberosRoundTripper falls back to a shared backend transport instead of one bound to each frontend connection, so when a backend uses connection-bound NTLM or Negotiate authentication with keep-alive, an unrelated client can reuse a backend connection already authenticated for a victim, read the victim's data, and act as the victim without ever obtaining their credentials. No public exploit is identified at time of analysis, though the fix PR ships a regression test that effectively demonstrates the flaw.
CyberPanel before 3.0.5 allows attackers who have obtained an administrator's password to bypass two-factor authentication entirely on API endpoints by deriving valid API tokens from the password alone, without satisfying the TOTP requirement. This reduces 2FA-protected admin accounts to effective single-factor authentication at the API layer, enabling full administrative operations or session creation. The fix is available in version 3.0.5 per the GitHub security advisory; no public exploit or active exploitation has been identified at time of analysis.
Two-factor authentication bypass in the miniOrange 2FA WordPress plugin allows an attacker who has already obtained a victim's password to defeat the second factor through unlimited OTP brute-forcing. The plugin keys its attempt-rate limit to a client-controlled identifier rather than the target account, enabling an adversary to rotate that identifier and circumvent lockout entirely; a separate validation endpoint applies no rate limit at all. A publicly available exploit (WPScan) confirms practical exploitability against plugin versions below 6.3.1 and 19.3.
Authentication bypass in Parse Server's built-in LDAP authentication adapter (versions <= 8.6.87 and 9.0.0 through 9.10.1-alpha.6) lets an unauthenticated attacker who knows a valid directory username obtain a session token for that account, resulting in full account takeover. The adapter forwarded a client-supplied empty password to the directory and treated any non-error bind response as successful authentication, so a zero-length credential triggers an RFC 4513 unauthenticated-simple-bind that directories like Active Directory answer with success. No public exploit identified at time of analysis, but the flaw is trivial to trigger against affected LDAP-backed deployments.
Authentication bypass in the shared wp-module-data module (bundled across four Newfold WordPress plugins) allows unauthenticated remote attackers to gain full administrator-level access to any affected WordPress site that lacks a stored Hiive connection token. The defect degenerates the HMAC-style Bearer token verification into a trivially forgeable computation: when the stored connection token is absent, PHP coerces `strrev(false)` to `strrev('')`, reducing the secret salt to the publicly known SHA-256 empty-string hash `e3b0c44...`, while all remaining inputs (HTTP method, URL, body, and the attacker-supplied X-Timestamp header) are fully attacker-controlled, enabling offline token pre-computation. No public exploit code has been confirmed and the vulnerability is not listed in CISA KEV at time of analysis, but full technical details including source code references are publicly disclosed by Wordfence, substantially lowering the barrier to exploitation.
Authentication bypass in the Next-Cart Store to WooCommerce Migration WordPress plugin (all versions ≤ 3.9.8) allows unauthenticated remote attackers to reach privileged migration endpoints and achieve full site takeover via arbitrary SQL execution and arbitrary file deletion. The root cause is a double design flaw: the `/wp-json/next_cart/v1/migration` REST route is registered with `permission_callback` set to `__return_true` (granting unrestricted access to all callers), and the token check falls back to the hardcoded literal `__token__` via `get_option('nextcart_token', '__token__')` whenever the database option has never been written. Once past the token check, attackers pass attacker-controlled SQL directly to `$wpdb->query()` and `$wpdb->get_results()` - enabling administrator account creation - and pass an attacker-controlled path to `unlink()`, enabling arbitrary file deletion. No public exploit or CISA KEV listing has been identified at time of analysis, though source code confirming the flaw is publicly visible in the WordPress plugin SVN repository.
Remote privilege escalation in the Android Bluetooth stack (AdapterService.java) allows an attacker to bypass device pairing entirely. A logic error in handleBondStateChanged lets a bond be treated as established without the normal pairing/consent flow, granting the attacker elevated privileges on Android 15, 16, 16-qpr2, and 17 with no user interaction. Google rates it CVSS 9.8; no public exploit is identified and CISA's SSVC framework records exploitation status as none, and EPSS is very low (0.16%).
Local privilege escalation in Microsoft Authenticator for Android (versions 6.0.0 through below 16.3.0) allows a local attacker without any prior privileges to bypass the app's authentication controls and elevate privileges on the device. The scope-changed CVSS vector (S:C) reflects that a successful bypass extends impact beyond the Authenticator app itself - potentially compromising MFA-protected accounts and downstream Microsoft or enterprise services. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the wide affected version range (spanning a very broad Android release history) increases exposure surface considerably.
Privilege elevation in Spring Cloud Azure (versions 1.0.0 up to but not including 7.4.0) lets a network-based, unauthenticated attacker bypass improper authentication logic (CWE-287) to gain elevated privileges. Reported by Microsoft (MSRC) with a vendor patch available; no public exploit identified at time of analysis and neither KEV nor EPSS/POC signals are present in the provided data.
Authentication bypass in rclone's S3 server mode (rclone serve s3) allows any unauthenticated network attacker to impersonate arbitrary S3 access keys. When rclone serve s3 is started with --auth-proxy but without --auth-key, authPairMiddleware registers whatever accessKeyID the client chooses against an empty s3Secret, and gofakes3 then validates the request's SigV4 signature against that same empty secret - so an attacker can pick any access key, sign with an empty secret, and reach whatever backend the auth-proxy script resolves for that identity. Fixed in rclone 1.75.1; no public exploit identified at time of analysis, though the vendor security advisory (GHSA-xwwr-4h3p-r22c) and fix commit are public.
Backend connection hijacking in Traefik reverse proxy (2.11.0 through 2.11.56 and 3.0.0 through 3.7.12) lets an unauthenticated remote client impersonate another user over HTTP/3. Because the HTTP/3 entrypoint never calls service.AddTransportOnContext, the kerberosRoundTripper falls back to a shared backend transport instead of one bound to each frontend connection, so when a backend uses connection-bound NTLM or Negotiate authentication with keep-alive, an unrelated client can reuse a backend connection already authenticated for a victim, read the victim's data, and act as the victim without ever obtaining their credentials. No public exploit is identified at time of analysis, though the fix PR ships a regression test that effectively demonstrates the flaw.
CyberPanel before 3.0.5 allows attackers who have obtained an administrator's password to bypass two-factor authentication entirely on API endpoints by deriving valid API tokens from the password alone, without satisfying the TOTP requirement. This reduces 2FA-protected admin accounts to effective single-factor authentication at the API layer, enabling full administrative operations or session creation. The fix is available in version 3.0.5 per the GitHub security advisory; no public exploit or active exploitation has been identified at time of analysis.
Two-factor authentication bypass in the miniOrange 2FA WordPress plugin allows an attacker who has already obtained a victim's password to defeat the second factor through unlimited OTP brute-forcing. The plugin keys its attempt-rate limit to a client-controlled identifier rather than the target account, enabling an adversary to rotate that identifier and circumvent lockout entirely; a separate validation endpoint applies no rate limit at all. A publicly available exploit (WPScan) confirms practical exploitability against plugin versions below 6.3.1 and 19.3.
Authentication bypass in Parse Server's built-in LDAP authentication adapter (versions <= 8.6.87 and 9.0.0 through 9.10.1-alpha.6) lets an unauthenticated attacker who knows a valid directory username obtain a session token for that account, resulting in full account takeover. The adapter forwarded a client-supplied empty password to the directory and treated any non-error bind response as successful authentication, so a zero-length credential triggers an RFC 4513 unauthenticated-simple-bind that directories like Active Directory answer with success. No public exploit identified at time of analysis, but the flaw is trivial to trigger against affected LDAP-backed deployments.
Authentication bypass in the shared wp-module-data module (bundled across four Newfold WordPress plugins) allows unauthenticated remote attackers to gain full administrator-level access to any affected WordPress site that lacks a stored Hiive connection token. The defect degenerates the HMAC-style Bearer token verification into a trivially forgeable computation: when the stored connection token is absent, PHP coerces `strrev(false)` to `strrev('')`, reducing the secret salt to the publicly known SHA-256 empty-string hash `e3b0c44...`, while all remaining inputs (HTTP method, URL, body, and the attacker-supplied X-Timestamp header) are fully attacker-controlled, enabling offline token pre-computation. No public exploit code has been confirmed and the vulnerability is not listed in CISA KEV at time of analysis, but full technical details including source code references are publicly disclosed by Wordfence, substantially lowering the barrier to exploitation.
Authentication bypass in the Next-Cart Store to WooCommerce Migration WordPress plugin (all versions ≤ 3.9.8) allows unauthenticated remote attackers to reach privileged migration endpoints and achieve full site takeover via arbitrary SQL execution and arbitrary file deletion. The root cause is a double design flaw: the `/wp-json/next_cart/v1/migration` REST route is registered with `permission_callback` set to `__return_true` (granting unrestricted access to all callers), and the token check falls back to the hardcoded literal `__token__` via `get_option('nextcart_token', '__token__')` whenever the database option has never been written. Once past the token check, attackers pass attacker-controlled SQL directly to `$wpdb->query()` and `$wpdb->get_results()` - enabling administrator account creation - and pass an attacker-controlled path to `unlink()`, enabling arbitrary file deletion. No public exploit or CISA KEV listing has been identified at time of analysis, though source code confirming the flaw is publicly visible in the WordPress plugin SVN repository.
Remote privilege escalation in the Android Bluetooth stack (AdapterService.java) allows an attacker to bypass device pairing entirely. A logic error in handleBondStateChanged lets a bond be treated as established without the normal pairing/consent flow, granting the attacker elevated privileges on Android 15, 16, 16-qpr2, and 17 with no user interaction. Google rates it CVSS 9.8; no public exploit is identified and CISA's SSVC framework records exploitation status as none, and EPSS is very low (0.16%).
Local privilege escalation in Microsoft Authenticator for Android (versions 6.0.0 through below 16.3.0) allows a local attacker without any prior privileges to bypass the app's authentication controls and elevate privileges on the device. The scope-changed CVSS vector (S:C) reflects that a successful bypass extends impact beyond the Authenticator app itself - potentially compromising MFA-protected accounts and downstream Microsoft or enterprise services. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the wide affected version range (spanning a very broad Android release history) increases exposure surface considerably.
Privilege elevation in Spring Cloud Azure (versions 1.0.0 up to but not including 7.4.0) lets a network-based, unauthenticated attacker bypass improper authentication logic (CWE-287) to gain elevated privileges. Reported by Microsoft (MSRC) with a vendor patch available; no public exploit identified at time of analysis and neither KEV nor EPSS/POC signals are present in the provided data.