Monthly
API authentication middleware in Gophish through 0.12.1 fails to enforce account lockout and mandatory password-change states, allowing any holder of a valid API key to retain full platform access regardless of administrative security actions taken on that account. Affected versions include all releases up to and including 0.12.1 per CPE cpe:2.3:a:gophish:gophish:*:*:*:*:*:*:*:*. An attacker who obtains or retains an API key - including a compromised insider or a key that was not rotated before an account was locked - can read and modify phishing campaign data, harvested credentials, and user configurations with high confidentiality and integrity impact. No public exploit or CISA KEV listing has been identified at time of analysis.
Authentication bypass in the Xiiaozet LK100W administrative service lets remote unauthenticated attackers reach privileged functionality and obtain command execution, per CISA ICS advisory ICSA-26-239-01. Because the flawed check guards an admin interface, a successful bypass leads to full device takeover. No public exploit has been identified at time of analysis, and the device is not listed in CISA KEV.
Authentication coercion in Veeam ONE lets an unauthenticated network attacker force the Veeam ONE service account to perform outbound SMB authentication to an attacker-chosen destination, exposing the account's NTLM credentials for capture and relay. The flaw (CWE-288, CVSS 4.0 base 9.3) is remotely triggerable with no privileges or user interaction and carries high subsequent-system impact, meaning captured service-account credentials can be relayed to pivot onto other systems. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Improper authorization in GitLab Enterprise Edition allows an authenticated project Maintainer to access the interactive terminal of a protected environment they are explicitly excluded from, bypassing environment-level access controls enforced separately from project roles. Affected versions span a wide range - all EE releases from 11.3 through 19.3.0 - meaning the exposure window is substantial across the enterprise install base. A publicly available exploit exists via a disclosed HackerOne report; no active exploitation (CISA KEV) has been confirmed at time of analysis.
Memory updated with the new marker. The analysis is clean and unmanipulated.
Authentication bypass in the Drupal Internationalization Single Sign-On contributed module (versions 0.0.0 through 1.8.0) lets remote unauthenticated attackers assume authenticated sessions by reaching an alternate authentication path or channel that skips the primary verification logic. Rated CVSS 9.8 with full confidentiality, integrity, and availability impact, it maps to CWE-288 and is addressed in a Drupal security advisory (SA-CONTRIB-2026-081). EPSS is low (0.18%, 8th percentile) and there is no public exploit identified at time of analysis.
SMS authentication bypass in Weidmüller IE-SR-2TX-WL-4G industrial 4G routers allows a remote attacker to permanently disable the SMS password requirement by deliberately submitting five or more invalid passwords, after which the device executes all subsequent SMS management commands without any authentication. The root flaw is in the lockout logic: rather than locking out the attacker, the device disables its own password enforcement mechanism, rewarding brute-force attempts with unrestricted SMS command access. Impacts include limited configuration tampering, limited information leakage, and potentially full loss of device availability; no public exploit code or active exploitation is confirmed at time of analysis.
Unauthenticated broken authentication in the WPLegalPages WordPress plugin (versions ≤ 3.7.0) allows remote attackers to bypass access controls on one or more plugin endpoints without any credentials or user interaction, as confirmed by the CVSS vector (AV:N/AC:L/PR:N/UI:N). The vulnerability is classified under CWE-288, meaning an alternate path or channel exists that circumvents the intended authentication gate. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis, but the low attack complexity means opportunistic scanning is a realistic threat.
Account takeover in the WPEverest User Registration & Membership Pro WordPress plugin (versions 5.4.5 and earlier) lets remote unauthenticated attackers bypass the plugin's authentication logic (CWE-288) and gain control of arbitrary user accounts, including administrators. Reported by Patchstack and rated CVSS 9.8, the flaw requires no privileges or user interaction; no public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Broken authentication in the Leyka WordPress donation plugin (versions <= 3.32.3) allows subscriber-level authenticated users to bypass access controls and access privileged functionality. The flaw is classified under CWE-288, indicating an alternate path or channel circumvents the plugin's authentication checks rather than defeating credentials directly. With a CVSS score of 7.6 (High) and high confidentiality impact, this enables disclosure of sensitive donation or user data to any authenticated subscriber on the WordPress installation. No public exploit or CISA KEV listing has been identified at time of analysis.
API authentication middleware in Gophish through 0.12.1 fails to enforce account lockout and mandatory password-change states, allowing any holder of a valid API key to retain full platform access regardless of administrative security actions taken on that account. Affected versions include all releases up to and including 0.12.1 per CPE cpe:2.3:a:gophish:gophish:*:*:*:*:*:*:*:*. An attacker who obtains or retains an API key - including a compromised insider or a key that was not rotated before an account was locked - can read and modify phishing campaign data, harvested credentials, and user configurations with high confidentiality and integrity impact. No public exploit or CISA KEV listing has been identified at time of analysis.
Authentication bypass in the Xiiaozet LK100W administrative service lets remote unauthenticated attackers reach privileged functionality and obtain command execution, per CISA ICS advisory ICSA-26-239-01. Because the flawed check guards an admin interface, a successful bypass leads to full device takeover. No public exploit has been identified at time of analysis, and the device is not listed in CISA KEV.
Authentication coercion in Veeam ONE lets an unauthenticated network attacker force the Veeam ONE service account to perform outbound SMB authentication to an attacker-chosen destination, exposing the account's NTLM credentials for capture and relay. The flaw (CWE-288, CVSS 4.0 base 9.3) is remotely triggerable with no privileges or user interaction and carries high subsequent-system impact, meaning captured service-account credentials can be relayed to pivot onto other systems. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Improper authorization in GitLab Enterprise Edition allows an authenticated project Maintainer to access the interactive terminal of a protected environment they are explicitly excluded from, bypassing environment-level access controls enforced separately from project roles. Affected versions span a wide range - all EE releases from 11.3 through 19.3.0 - meaning the exposure window is substantial across the enterprise install base. A publicly available exploit exists via a disclosed HackerOne report; no active exploitation (CISA KEV) has been confirmed at time of analysis.
Memory updated with the new marker. The analysis is clean and unmanipulated.
Authentication bypass in the Drupal Internationalization Single Sign-On contributed module (versions 0.0.0 through 1.8.0) lets remote unauthenticated attackers assume authenticated sessions by reaching an alternate authentication path or channel that skips the primary verification logic. Rated CVSS 9.8 with full confidentiality, integrity, and availability impact, it maps to CWE-288 and is addressed in a Drupal security advisory (SA-CONTRIB-2026-081). EPSS is low (0.18%, 8th percentile) and there is no public exploit identified at time of analysis.
SMS authentication bypass in Weidmüller IE-SR-2TX-WL-4G industrial 4G routers allows a remote attacker to permanently disable the SMS password requirement by deliberately submitting five or more invalid passwords, after which the device executes all subsequent SMS management commands without any authentication. The root flaw is in the lockout logic: rather than locking out the attacker, the device disables its own password enforcement mechanism, rewarding brute-force attempts with unrestricted SMS command access. Impacts include limited configuration tampering, limited information leakage, and potentially full loss of device availability; no public exploit code or active exploitation is confirmed at time of analysis.
Unauthenticated broken authentication in the WPLegalPages WordPress plugin (versions ≤ 3.7.0) allows remote attackers to bypass access controls on one or more plugin endpoints without any credentials or user interaction, as confirmed by the CVSS vector (AV:N/AC:L/PR:N/UI:N). The vulnerability is classified under CWE-288, meaning an alternate path or channel exists that circumvents the intended authentication gate. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis, but the low attack complexity means opportunistic scanning is a realistic threat.
Account takeover in the WPEverest User Registration & Membership Pro WordPress plugin (versions 5.4.5 and earlier) lets remote unauthenticated attackers bypass the plugin's authentication logic (CWE-288) and gain control of arbitrary user accounts, including administrators. Reported by Patchstack and rated CVSS 9.8, the flaw requires no privileges or user interaction; no public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Broken authentication in the Leyka WordPress donation plugin (versions <= 3.32.3) allows subscriber-level authenticated users to bypass access controls and access privileged functionality. The flaw is classified under CWE-288, indicating an alternate path or channel circumvents the plugin's authentication checks rather than defeating credentials directly. With a CVSS score of 7.6 (High) and high confidentiality impact, this enables disclosure of sensitive donation or user data to any authenticated subscriber on the WordPress installation. No public exploit or CISA KEV listing has been identified at time of analysis.