Monthly
An unauthenticated remote request can slip past kin-openapi's openapi3filter authentication middleware and reach a handler that was meant to be protected, when the library's ValidationHandler is used as middleware in front of a gorilla/mux router configured with UseEncodedPath. The library validates the operation it derives from the decoded URL.Path (0.144.0 through 0.146.x), while the downstream mux router, using the raw encoded path, dispatches to a different, protected parameterized route that overlaps the public exact route after decoding - so requests carrying an encoded slash (%2F) can be validated as the public operation and then served by the protected handler without the configured AuthenticationFunc ever running. Reaching the flaw requires a precise deployment stack (kin-openapi >=0.144.0 <0.147.0, ValidationHandler wired as auth middleware, mux with UseEncodedPath, and an overlapping public exact route plus protected parameterized route sharing an HTTP method), which is reflected in the CVSS 7.4 rating with AC:H; no CISA KEV listing, and no public exploit identified at time of analysis, though the upstream fix commit includes a regression test that reproduces the bypass.
Authenticated SQL injection in DataEase versions prior to 2.10.26 allows users with dataset-edit permissions to store a crafted custom dateFormat on a dataset field, which is then inserted without validation into date-conversion SQL templates. When a chart renders the affected field, the injected payload can alter generated SQL and potentially compromise the confidentiality, integrity, and availability of the backend database. Reliable exploitation requires a cross-datasource dataset where Calcite parsing is bypassed; on a single-datasource dataset the payload must survive Calcite reserialization as a valid string literal, significantly limiting that path. No public exploit code was identified at the time of analysis, and the vendor has released a patch in version 2.10.26.
Authentication bypass in Apache Tomcat allows unauthenticated remote attackers to reach WebSocket endpoints that are supposed to be protected by container-managed security constraints, simply by referencing the endpoint under an alternate name so the constraint is never matched. Exploitation requires only that the application expose one or more WebSocket endpoints and rely on container-level (web.xml security-constraint) authentication or authorization rules to guard them; no credentials, no user interaction, and no non-default configuration beyond that are needed, and per the CVSS vector (PR:N) the attack is unauthenticated and network-reachable. Affected lines are Tomcat 11.0.0-M1 through 11.0.25, 10.1.0-M1 through 10.1.59, 9.0.0.M1 through 9.0.121, plus end-of-support 8.5.0-8.5.100 and 7.0.43-7.0.109; no public exploit code has been identified at time of analysis and Apache has released fixed versions 11.0.26, 10.1.60 and 9.0.122.
IBM Verify Identity Access and its container edition (versions 11.0.0 through 11.0.3 Interim Fix 001), along with the legacy Security Verify Access and container edition (10.0.0 through 10.0.9.2 Interim Fix 001), fail to properly validate user-supplied management requests, so an administrator whose role is not entitled to certain commands can execute them anyway. The vendor scores this High at CVSS 8.1, but exploitation requires prior access to the administrative/management interface as a role-restricted administrator and a specially crafted request capable of defeating the validation logic, and no public exploit identified at time of analysis (EPSS 0.14%, 4th percentile) exists, while a vendor fix is available.
Full authentication bypass in the MyHome Core WordPress plugin (versions up to and including 4.4.5) lets unauthenticated attackers mint a valid activation token for any unconfirmed account and receive that account's auth cookie, enabling silent takeover of administrator accounts. The flaw combines a missing authorization check in the send_link() AJAX handler with weak token validation in activate(). No public exploit has been identified at time of analysis, but the CVSS 9.8 rating and trivial network exploitability against affected configurations make this a high-priority patch item.
Authentication bypass in the Classified Listing - Mobile Number Verification WordPress plugin (all versions through 1.6.0) allows unauthenticated network attackers to authenticate as any registered user - including site administrators - without a valid OTP. The root cause is the absence of server-side Firebase OTP token validation in the process_otp_login() function, which blindly trusts client-submitted OTP and UID values. No public exploit code has been identified at time of analysis, and it does not appear in the CISA KEV catalog, but the CVSS 8.1 score reflects the high impact of full account takeover if exploitation prerequisites are met.
Authentication bypass in the WooCommerce - Social Login plugin for WordPress (all versions up to and including 2.8.7) lets unauthenticated attackers log in as any existing user, including administrators, by forging an Apple id_token containing the victim's email address. The Apple login handler base64-decodes the JWT payload but never verifies the token signature against Apple's public keys nor validates the issuer, audience, or expiry claims, and the nonce needed to trigger the flow is publicly leaked to anonymous visitors. Reported by Wordfence and rated CVSS 9.8; no public exploit identified at time of analysis.
Security constraint bypass in IBM WebSphere Application Server 8.5/9.0 (Traditional) and WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.7 allows a remote, unauthenticated attacker to circumvent access controls and reach protected resources, resulting in disclosure of confidential information (CVSS 3.1 base 7.5, C:H). The flaw stems from an authentication-bypass-by-alternate-name weakness (CWE-289) in how the server evaluates security constraints. IBM has released a fix; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Account takeover in the Eventer WordPress event-manager plugin (all versions through 4.4.2) stems from the plugin writing the password-reset key in cleartext to the `eventer_verification_code` field in `wp_usermeta`; any actor who can read that value can drive the plugin's custom reset action to set an arbitrary password for any user, including administrators. Chained with the companion SQL injection flaw CVE-2026-9700, remote attackers can extract the stored key without authentication and fully hijack accounts. There is no public exploit identified at time of analysis, and exploitation is constrained to sites running PHP 7.4 or earlier, where the reset routine functions.
Authentication bypass in Apache Shiro affects deployments using the shiro-guice module in a web servlet context, where a specially crafted HTTP request can evade path-based access controls and reach protected resources without valid credentials. It mirrors the older shiro-spring flaw CVE-2020-1957 but targets the Guice integration instead, impacting all Shiro releases through 2.x and 3.0.0-alpha-1. No public exploit identified at time of analysis, though the CVSS 4.0 base score of 8.2 reflects high confidentiality impact and the close analogy to a previously exploited bug class.
An unauthenticated remote request can slip past kin-openapi's openapi3filter authentication middleware and reach a handler that was meant to be protected, when the library's ValidationHandler is used as middleware in front of a gorilla/mux router configured with UseEncodedPath. The library validates the operation it derives from the decoded URL.Path (0.144.0 through 0.146.x), while the downstream mux router, using the raw encoded path, dispatches to a different, protected parameterized route that overlaps the public exact route after decoding - so requests carrying an encoded slash (%2F) can be validated as the public operation and then served by the protected handler without the configured AuthenticationFunc ever running. Reaching the flaw requires a precise deployment stack (kin-openapi >=0.144.0 <0.147.0, ValidationHandler wired as auth middleware, mux with UseEncodedPath, and an overlapping public exact route plus protected parameterized route sharing an HTTP method), which is reflected in the CVSS 7.4 rating with AC:H; no CISA KEV listing, and no public exploit identified at time of analysis, though the upstream fix commit includes a regression test that reproduces the bypass.
Authenticated SQL injection in DataEase versions prior to 2.10.26 allows users with dataset-edit permissions to store a crafted custom dateFormat on a dataset field, which is then inserted without validation into date-conversion SQL templates. When a chart renders the affected field, the injected payload can alter generated SQL and potentially compromise the confidentiality, integrity, and availability of the backend database. Reliable exploitation requires a cross-datasource dataset where Calcite parsing is bypassed; on a single-datasource dataset the payload must survive Calcite reserialization as a valid string literal, significantly limiting that path. No public exploit code was identified at the time of analysis, and the vendor has released a patch in version 2.10.26.
Authentication bypass in Apache Tomcat allows unauthenticated remote attackers to reach WebSocket endpoints that are supposed to be protected by container-managed security constraints, simply by referencing the endpoint under an alternate name so the constraint is never matched. Exploitation requires only that the application expose one or more WebSocket endpoints and rely on container-level (web.xml security-constraint) authentication or authorization rules to guard them; no credentials, no user interaction, and no non-default configuration beyond that are needed, and per the CVSS vector (PR:N) the attack is unauthenticated and network-reachable. Affected lines are Tomcat 11.0.0-M1 through 11.0.25, 10.1.0-M1 through 10.1.59, 9.0.0.M1 through 9.0.121, plus end-of-support 8.5.0-8.5.100 and 7.0.43-7.0.109; no public exploit code has been identified at time of analysis and Apache has released fixed versions 11.0.26, 10.1.60 and 9.0.122.
IBM Verify Identity Access and its container edition (versions 11.0.0 through 11.0.3 Interim Fix 001), along with the legacy Security Verify Access and container edition (10.0.0 through 10.0.9.2 Interim Fix 001), fail to properly validate user-supplied management requests, so an administrator whose role is not entitled to certain commands can execute them anyway. The vendor scores this High at CVSS 8.1, but exploitation requires prior access to the administrative/management interface as a role-restricted administrator and a specially crafted request capable of defeating the validation logic, and no public exploit identified at time of analysis (EPSS 0.14%, 4th percentile) exists, while a vendor fix is available.
Full authentication bypass in the MyHome Core WordPress plugin (versions up to and including 4.4.5) lets unauthenticated attackers mint a valid activation token for any unconfirmed account and receive that account's auth cookie, enabling silent takeover of administrator accounts. The flaw combines a missing authorization check in the send_link() AJAX handler with weak token validation in activate(). No public exploit has been identified at time of analysis, but the CVSS 9.8 rating and trivial network exploitability against affected configurations make this a high-priority patch item.
Authentication bypass in the Classified Listing - Mobile Number Verification WordPress plugin (all versions through 1.6.0) allows unauthenticated network attackers to authenticate as any registered user - including site administrators - without a valid OTP. The root cause is the absence of server-side Firebase OTP token validation in the process_otp_login() function, which blindly trusts client-submitted OTP and UID values. No public exploit code has been identified at time of analysis, and it does not appear in the CISA KEV catalog, but the CVSS 8.1 score reflects the high impact of full account takeover if exploitation prerequisites are met.
Authentication bypass in the WooCommerce - Social Login plugin for WordPress (all versions up to and including 2.8.7) lets unauthenticated attackers log in as any existing user, including administrators, by forging an Apple id_token containing the victim's email address. The Apple login handler base64-decodes the JWT payload but never verifies the token signature against Apple's public keys nor validates the issuer, audience, or expiry claims, and the nonce needed to trigger the flow is publicly leaked to anonymous visitors. Reported by Wordfence and rated CVSS 9.8; no public exploit identified at time of analysis.
Security constraint bypass in IBM WebSphere Application Server 8.5/9.0 (Traditional) and WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.7 allows a remote, unauthenticated attacker to circumvent access controls and reach protected resources, resulting in disclosure of confidential information (CVSS 3.1 base 7.5, C:H). The flaw stems from an authentication-bypass-by-alternate-name weakness (CWE-289) in how the server evaluates security constraints. IBM has released a fix; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Account takeover in the Eventer WordPress event-manager plugin (all versions through 4.4.2) stems from the plugin writing the password-reset key in cleartext to the `eventer_verification_code` field in `wp_usermeta`; any actor who can read that value can drive the plugin's custom reset action to set an arbitrary password for any user, including administrators. Chained with the companion SQL injection flaw CVE-2026-9700, remote attackers can extract the stored key without authentication and fully hijack accounts. There is no public exploit identified at time of analysis, and exploitation is constrained to sites running PHP 7.4 or earlier, where the reset routine functions.
Authentication bypass in Apache Shiro affects deployments using the shiro-guice module in a web servlet context, where a specially crafted HTTP request can evade path-based access controls and reach protected resources without valid credentials. It mirrors the older shiro-spring flaw CVE-2020-1957 but targets the Guice integration instead, impacting all Shiro releases through 2.x and 3.0.0-alpha-1. No public exploit identified at time of analysis, though the CVSS 4.0 base score of 8.2 reflects high confidentiality impact and the close analogy to a previously exploited bug class.