Monthly
Multiple Lenovo consumer tablets - including the Idea Tab Pro (TB373FU), Idea Tab / Lenovo Tab K11 Gen 2 (TB336FU/TB336ZU), Tab M11 (TB330FU/TB330XU), Legion Tab 8.8" Gen 3 (TB321FU), Tab Extreme (TB570FU/TB570ZU), and a broader set of Tab and Yoga Tab models - contain a physical-access authentication bypass (CWE-288) that lets someone in direct possession of the device defeat the lock/authentication flow and gain unauthorized access to the device and its data. Rated 7.0 under CVSS 4.0 (AV:P/AC:L/AT:N/PR:N/UI:N with high confidentiality, integrity and availability impact), the issue requires no credentials (PR:N) and no user interaction (UI:N), so the decisive limiting factor is the Physical attack vector: there is no remote or adjacent-network exposure and only lost, stolen or unattended units are at risk. No public exploit code has been identified at time of analysis, and the specific alternate authentication path involved has not been disclosed by the vendor.
Protected resources in Eclipse Jetty deployments that enable the EthereumAuthenticator can be reached without authentication when the requested path contains the configured login path as a later segment, because the authenticator replaces the resource's authentication or role requirement with ALLOWED. The flaw is rated critical (CVSS 4.0 base 9.3; our independent CVSS 3.1 assessment scores 9.1, AV:N/AC:L/PR:N/UI:N with high confidentiality and integrity impact), but real-world exposure is narrow: EthereumAuthenticator is a non-default, rarely enabled mechanism, the protected path must happen to embed the login path, and explicitly FORBIDDEN routes remain protected. No public exploit code and no confirmed active exploitation were identified at time of analysis.
Authentication bypass in Progress MOVEit Transfer allows an attacker who already holds a low-privilege authenticated foothold to reach protected functionality by traversing an alternate path or channel that skips the intended authentication and authorization checks, yielding high confidentiality and integrity impact at CVSS 8.8. Only MOVEit Transfer releases prior to 2025.1.6 and 2026.0.0 builds before 2026.0.4 are affected, and because the assessed vector carries PR:L the attacker must already possess some credentialed access, which narrows the exposure compared with an anonymous pre-auth bypass. No public exploit code and no confirmed active exploitation were identified at time of analysis, but the vendor issued a Critical Security Bulletin for this issue, making prompt patching the priority.
Unauthenticated account takeover in Dockhand before 1.0.45 lets any remote attacker who can reach the HTTP API reset the password of the administrative or any other user account and seize it outright. The flaw chains two design failures: a global authentication hook that deliberately skips any request path ending in a static-asset extension such as .js - including paths under /api/ - and user-mutation handlers that fail open when no authenticated principal is present, so a single unauthenticated PUT to /api/users/<id>.js rewrites that user's credentials. No authentication, user interaction, or non-default configuration is required, and there is no public exploit code identified at time of analysis; the only real limiting factor is whether an attacker can reach the Dockhand API over the network, since the flaw is rated 10.0 (CVSS 4.0) and scores CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H on independent assessment. Vendor patching is available, making unpatched internet-facing instances the primary exposure.
Improper authentication in IBM Planning Analytics 2.0 and 2.1 allows an attacker who already holds valid low-privilege credentials to escalate to unauthorized administrative access over the network, with high impact to confidentiality, integrity, and availability (CVSS 3.1 base 8.8, CWE-288). Because the vector carries PR:L, the flaw is not reachable by a fully unauthenticated outsider: the attacker must first obtain ordinary authenticated access to the deployment, after which the alternate-path authentication weakness grants administrative control. No public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV), but IBM has published a vendor patch, so the primary risk is unpatched, internet- or partner-reachable Planning Analytics installations where low-privilege accounts are widely distributed.
Authentication bypass and privilege escalation in IBM Planning Analytics 2.0 and 2.1 allow an unauthenticated remote attacker to reach functionality that should require credentials by abusing improperly validated sub-requests (CWE-288). Per the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, exploitation needs only network reachability to the Planning Analytics application interface - no authentication, no user interaction, and no documented non-default configuration - yielding high confidentiality, integrity, and availability impact, which is why the score is 9.8. Signals conflict and must be weighed carefully: despite the severity and total technical impact under SSVC, EPSS is only 0.36% (28th percentile), CISA SSVC records Exploitation: none, and no public exploit code has been identified at time of analysis, so this should be treated as a serious but not yet observed threat. The vendor has released a fix, so exposure is concentrated in unpatched, internet- or partner-reachable deployments.
Nginx UI versions prior to 2.4.1 let an authenticated, OTP-enabled user holding only an ordinary JWT - without the X-Secure-Session-ID step-up header - create or modify Nginx configuration and trigger reload behavior by calling the nginx_config_add and nginx_config_modify tools through the /mcp and /mcp_message endpoints, which were protected by ordinary authentication alone. The equivalent HTTP configuration mutation routes correctly enforced the RequireSecureSession middleware, so the MCP channel constituted an alternate path around that control (CWE-288). Per the CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H, impact is limited to integrity and availability with high severity driven by unconstrained config writes; exploitation requires an existing low-privilege authenticated session on a pre-2.4.1 instance, and no public exploit code or confirmed active exploitation was identified at time of analysis. The issue is fixed in version 2.4.1, and the upstream commit additionally hardened backup-related routes with RequireSecureSession.
Unauthenticated broken-authentication flaw in the eRoom (Zoom Meetings & Webinar) WordPress plugin through version 1.7.1 lets remote attackers bypass plugin-level authentication checks and obtain limited read, write, and availability impact (CVSS 7.3, C:L/I:L/A:L). Exploitation requires only network reachability to a site with an active vulnerable copy of the plugin - the assessed vector is AV:N/AC:L/PR:N/UI:N, so no credentials, special configuration, or user interaction are needed - while sites on a later release or without the plugin are unaffected. No public exploit code has been identified at time of analysis and there is no CISA KEV entry, so the practical risk is bounded by how widely the plugin is deployed and is rated moderate priority.
Authentication bypass through an alternate password-recovery channel in the Omegathemes Grocery Shopping Store WordPress theme, versions through 1.3.3, can let a remote attacker with some level of privilege (PR:L per the assessed CVSS vector) manipulate the theme's password recovery/reset flow, with low integrity and high availability impact but no confidentiality impact. The CVSS 3.1 base score is 7.1 (HIGH), with network attack vector, low attack complexity, and no user interaction. No public exploit was identified at the time of analysis, and the provided intelligence does not confirm CISA KEV exploitation; the practical risk is constrained by the theme's narrow deployment footprint and the privilege requirement noted in the vector, which conflicts with the typical pre-auth nature of password-recovery bypasses and should be verified.
Remote unauthenticated attackers can obtain a fully privileged administrative session on TVU Networks Receiver and Transceiver devices running firmware before 7.9 by sending a crafted HTTP request to the web management login endpoint POST /tvu/Login with an empty or absent UserName parameter; the password value is irrelevant and a valid session cookie is returned. The flaw is rated CVSS 4.0 9.3 (and assessed as CVSS 3.1 9.3 with high confidentiality, integrity, and availability impact), requires no authentication, no user interaction, and no non-default configuration, and because the request is issued directly it defeats the client-side JavaScript validation that would otherwise block it. No public exploit code or confirmed active exploitation was identified at time of analysis; the main practical limiting factor is network reachability of the device's management interface, so segmented or non-exposed management planes are not remotely exploitable.
Multiple Lenovo consumer tablets - including the Idea Tab Pro (TB373FU), Idea Tab / Lenovo Tab K11 Gen 2 (TB336FU/TB336ZU), Tab M11 (TB330FU/TB330XU), Legion Tab 8.8" Gen 3 (TB321FU), Tab Extreme (TB570FU/TB570ZU), and a broader set of Tab and Yoga Tab models - contain a physical-access authentication bypass (CWE-288) that lets someone in direct possession of the device defeat the lock/authentication flow and gain unauthorized access to the device and its data. Rated 7.0 under CVSS 4.0 (AV:P/AC:L/AT:N/PR:N/UI:N with high confidentiality, integrity and availability impact), the issue requires no credentials (PR:N) and no user interaction (UI:N), so the decisive limiting factor is the Physical attack vector: there is no remote or adjacent-network exposure and only lost, stolen or unattended units are at risk. No public exploit code has been identified at time of analysis, and the specific alternate authentication path involved has not been disclosed by the vendor.
Protected resources in Eclipse Jetty deployments that enable the EthereumAuthenticator can be reached without authentication when the requested path contains the configured login path as a later segment, because the authenticator replaces the resource's authentication or role requirement with ALLOWED. The flaw is rated critical (CVSS 4.0 base 9.3; our independent CVSS 3.1 assessment scores 9.1, AV:N/AC:L/PR:N/UI:N with high confidentiality and integrity impact), but real-world exposure is narrow: EthereumAuthenticator is a non-default, rarely enabled mechanism, the protected path must happen to embed the login path, and explicitly FORBIDDEN routes remain protected. No public exploit code and no confirmed active exploitation were identified at time of analysis.
Authentication bypass in Progress MOVEit Transfer allows an attacker who already holds a low-privilege authenticated foothold to reach protected functionality by traversing an alternate path or channel that skips the intended authentication and authorization checks, yielding high confidentiality and integrity impact at CVSS 8.8. Only MOVEit Transfer releases prior to 2025.1.6 and 2026.0.0 builds before 2026.0.4 are affected, and because the assessed vector carries PR:L the attacker must already possess some credentialed access, which narrows the exposure compared with an anonymous pre-auth bypass. No public exploit code and no confirmed active exploitation were identified at time of analysis, but the vendor issued a Critical Security Bulletin for this issue, making prompt patching the priority.
Unauthenticated account takeover in Dockhand before 1.0.45 lets any remote attacker who can reach the HTTP API reset the password of the administrative or any other user account and seize it outright. The flaw chains two design failures: a global authentication hook that deliberately skips any request path ending in a static-asset extension such as .js - including paths under /api/ - and user-mutation handlers that fail open when no authenticated principal is present, so a single unauthenticated PUT to /api/users/<id>.js rewrites that user's credentials. No authentication, user interaction, or non-default configuration is required, and there is no public exploit code identified at time of analysis; the only real limiting factor is whether an attacker can reach the Dockhand API over the network, since the flaw is rated 10.0 (CVSS 4.0) and scores CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H on independent assessment. Vendor patching is available, making unpatched internet-facing instances the primary exposure.
Improper authentication in IBM Planning Analytics 2.0 and 2.1 allows an attacker who already holds valid low-privilege credentials to escalate to unauthorized administrative access over the network, with high impact to confidentiality, integrity, and availability (CVSS 3.1 base 8.8, CWE-288). Because the vector carries PR:L, the flaw is not reachable by a fully unauthenticated outsider: the attacker must first obtain ordinary authenticated access to the deployment, after which the alternate-path authentication weakness grants administrative control. No public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV), but IBM has published a vendor patch, so the primary risk is unpatched, internet- or partner-reachable Planning Analytics installations where low-privilege accounts are widely distributed.
Authentication bypass and privilege escalation in IBM Planning Analytics 2.0 and 2.1 allow an unauthenticated remote attacker to reach functionality that should require credentials by abusing improperly validated sub-requests (CWE-288). Per the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, exploitation needs only network reachability to the Planning Analytics application interface - no authentication, no user interaction, and no documented non-default configuration - yielding high confidentiality, integrity, and availability impact, which is why the score is 9.8. Signals conflict and must be weighed carefully: despite the severity and total technical impact under SSVC, EPSS is only 0.36% (28th percentile), CISA SSVC records Exploitation: none, and no public exploit code has been identified at time of analysis, so this should be treated as a serious but not yet observed threat. The vendor has released a fix, so exposure is concentrated in unpatched, internet- or partner-reachable deployments.
Nginx UI versions prior to 2.4.1 let an authenticated, OTP-enabled user holding only an ordinary JWT - without the X-Secure-Session-ID step-up header - create or modify Nginx configuration and trigger reload behavior by calling the nginx_config_add and nginx_config_modify tools through the /mcp and /mcp_message endpoints, which were protected by ordinary authentication alone. The equivalent HTTP configuration mutation routes correctly enforced the RequireSecureSession middleware, so the MCP channel constituted an alternate path around that control (CWE-288). Per the CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H, impact is limited to integrity and availability with high severity driven by unconstrained config writes; exploitation requires an existing low-privilege authenticated session on a pre-2.4.1 instance, and no public exploit code or confirmed active exploitation was identified at time of analysis. The issue is fixed in version 2.4.1, and the upstream commit additionally hardened backup-related routes with RequireSecureSession.
Unauthenticated broken-authentication flaw in the eRoom (Zoom Meetings & Webinar) WordPress plugin through version 1.7.1 lets remote attackers bypass plugin-level authentication checks and obtain limited read, write, and availability impact (CVSS 7.3, C:L/I:L/A:L). Exploitation requires only network reachability to a site with an active vulnerable copy of the plugin - the assessed vector is AV:N/AC:L/PR:N/UI:N, so no credentials, special configuration, or user interaction are needed - while sites on a later release or without the plugin are unaffected. No public exploit code has been identified at time of analysis and there is no CISA KEV entry, so the practical risk is bounded by how widely the plugin is deployed and is rated moderate priority.
Authentication bypass through an alternate password-recovery channel in the Omegathemes Grocery Shopping Store WordPress theme, versions through 1.3.3, can let a remote attacker with some level of privilege (PR:L per the assessed CVSS vector) manipulate the theme's password recovery/reset flow, with low integrity and high availability impact but no confidentiality impact. The CVSS 3.1 base score is 7.1 (HIGH), with network attack vector, low attack complexity, and no user interaction. No public exploit was identified at the time of analysis, and the provided intelligence does not confirm CISA KEV exploitation; the practical risk is constrained by the theme's narrow deployment footprint and the privilege requirement noted in the vector, which conflicts with the typical pre-auth nature of password-recovery bypasses and should be verified.
Remote unauthenticated attackers can obtain a fully privileged administrative session on TVU Networks Receiver and Transceiver devices running firmware before 7.9 by sending a crafted HTTP request to the web management login endpoint POST /tvu/Login with an empty or absent UserName parameter; the password value is irrelevant and a valid session cookie is returned. The flaw is rated CVSS 4.0 9.3 (and assessed as CVSS 3.1 9.3 with high confidentiality, integrity, and availability impact), requires no authentication, no user interaction, and no non-default configuration, and because the request is issued directly it defeats the client-side JavaScript validation that would otherwise block it. No public exploit code or confirmed active exploitation was identified at time of analysis; the main practical limiting factor is network reachability of the device's management interface, so segmented or non-exposed management planes are not remotely exploitable.