Monthly
Authentication bypass in WIMOOR through commit ec86736 allows remote attackers to impersonate any tenant and privilege level by forging an unsigned X-USERINFO header, enabling read and modification of other tenants' orders, finance data, and Amazon seller authorizations. Exploitation requires direct network access to backend service ports, bypassing the API gateway that normally signs the header; deployments where backend ports are segmented/firewalled are not exploitable. The assessed CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) captures this high-severity impact but gated by network positioning, and no public exploit has been identified at time of analysis.
BeyondTrust Remote Support appliances contain an authentication bypass (CWE-290) in internal components that fail to validate the origin of received messages, potentially allowing an attacker to perform file operations on the appliance. According to the CVSS 4.0 vector (9.3), no authentication or user interaction is required, but the vendor notes exploitation is conditional ('under the right conditions') and the independent assessment emphasizes that an attacker must reach the internal messaging path and spoof a trusted source. No public exploit code or active exploitation has been identified at time of analysis, though this is a credible high-priority issue given the high impact.
Authentication bypass in the joserfc Python library before 1.7.4 lets remote, unauthenticated attackers submit a JWS General JSON Serialization whose "signatures" array is empty and have joserfc.jws.deserialize_json() accept it as authenticated, so relying applications can be fooled into treating an arbitrary attacker-chosen payload as a signed, trustworthy message. Exposure is scoped: only the General JSON Serialization code path is affected - compact JWS, JWT decoding, Flattened JSON serialization, and JWE JSON processing do not reach the vulnerable logic - but where the vulnerable API is used and its success is treated as proof of authenticity, the integrity impact is high (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N per the independent assessment; the published base score is 9.1). No public exploit code or confirmed active exploitation has been identified at time of analysis; the fix commit, tests, and security advisory are publicly available.
Rate limiting in Eclipse Connected Services Platform's api-gateway (up to and including 1.7.3) can be bypassed completely by any remote attacker who sends a distinct X-Forwarded-For header value on every request, because the shipped default ClientIpKeyResolver builds the per-client rate-limit bucket key from the unvalidated leftmost element of that client-supplied header. The result is an unlimited number of independent buckets on every route that uses the default configuration, letting unauthenticated attackers (CVSS:3.1 AV:N/AC:L/PR:N/UI:N) evade request throttling and degrade availability (C:N/I:N/A:H, score 7.5); confidentiality and integrity are unaffected. Exposure is configuration-dependent - gateways that swap in a trusted-proxy-aware key resolver or do not enforce rate limiting are not impacted, and no public exploit code was identified at time of analysis (SSVC exploitation: none).
Authentication bypass in FileRise (CWE-290) lets unauthenticated remote attackers impersonate any account - including an administrator - without a password or MFA in deployments prior to 3.16.0 that enable proxy-header authentication (AUTH_BYPASS) and expose the backend port directly. The flaw is that the configured reverse-proxy identity header (X-Remote-User) was trusted without validating that the request actually came from an address in FR_TRUSTED_PROXIES; an attacker who can reach the backend application port therefore simply supplies the header and receives a session for the named account. Exploitation requires proxy-header auth to be enabled, the trusted-proxy check to be absent or ineffective (exactly what 3.16.0 fixes), and a network path to the backend that bypasses the proxy, which is why it is scored AV:N/AC:H/PR:N/UI:N with full confidentiality, integrity, and availability impact (CVSS 3.1: 8.1 High); no public exploit code or confirmed in-the-wild exploitation was identified at time of analysis.
Eclipse NetX Duo's NetX Secure DTLS server can be driven into completing handshakes with forged source addresses because the cookie it issues in a HelloVerifyRequest is never actually validated: the ClientHello parser copies the client-supplied cookie bytes over the value the server generated, and the server then treats the peer as verified based on the cookie's length alone, so a single arbitrary cookie byte in the first ClientHello skips the return-routability exchange entirely. The defect is remotely reachable with no authentication and no user interaction (CVSS 4.0 base 8.7, High; the independent assessment confirms AV:N/AC:L/PR:N/UI:N with an availability-only impact), and the practical harm is anti-spoofing and availability abuse - spoofed-source handshakes, amplification potential, and handshake state/resource exhaustion - not data compromise or code execution. No public exploit code has been identified at time of analysis, and CVE-2026-106465 is not listed in CISA KEV.
Unauthenticated, remote attackers can bypass authentication and reach protected paths in F5 NGINX Kubernetes Ingress Controller (NIC) deployments configured with the ExternalAuth policy or Ingress external authentication. The flaw (CWE-290, authentication bypass by spoofing) occurs because client-supplied X-Forwarded-Prefix, X-Forwarded-URI, X-Original-URI, and X-Forwarded-Method headers are forwarded unsanitized into the internal NGINX auth_request subrequest, letting an attacker spoof the request attributes the external authentication provider evaluates; exploitation is remote, low-complexity and requires no authentication or user interaction, but is gated on the non-default external-auth configuration and is bounded to the data plane, affecting confidentiality/access only (no control plane exposure, no integrity or availability impact). No public exploit identified at time of analysis.
A namespaced authenticated attacker holding access to a Kubernetes service account can impersonate the NGINX Agent gRPC connection in NGINX Gateway Fabric and read TLS private keys belonging to Gateway deployments in other namespaces. Exploitation requires the Gateway Custom Resource Definition to be configured and an authenticated gRPC link between the control plane and NGINX Agent, making this an access-gated control-plane disclosure flaw with no data plane exposure. No public exploit code was identified at the time of analysis.
Improper privilege management in Windows' WinINet component (wininet.dll) lets an authenticated, low-privileged local attacker spoof a trusted identity and bypass authentication, with the impact spilling beyond WinINet's own security boundary into other components on the host. The flaw is rated CVSS 3.1 8.4 (High) under the vector AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N, so an attacker must already hold a local foothold on an unpatched machine, but then needs no user interaction and faces low complexity; CISA's SSVC assessment records exploitation as none, automatability as no, and technical impact as total. Affected platforms are Windows 10 21H2/22H2, Windows 11 23H2 through 26H2 plus 26H1, and Windows Server 2022/2025 builds below the patch thresholds in EUVD-2026-100013; no public exploit code was identified at time of analysis, and Microsoft has released vendor fixes.
Authentication bypass by spoofing in the Microsoft.AspNetCore.Authentication.Negotiate package for ASP.NET Core lets an authenticated remote attacker (PR:L) have their Kerberos-authenticated identity associated with an unintended LDAP principal, yielding high confidentiality, integrity, and availability impact (CVSS 7.5) after the attacker reaches the application over the network. Exposure is conditional: the application must use an affected package version - 8.0.0 through 8.0.31, 9.0.0 through 9.0.20, or 10.0.0 through 10.0.12 - and must have LDAP claim resolution enabled, an opt-in and non-default configuration, on Windows, Linux, or macOS. CISA's SSVC assessment records no exploitation, and no public exploit code was identified at time of analysis; the AC:H metric reflects that a specific spoofing/timing condition outside the attacker's full control must be satisfied, making this a genuine but conditional privilege-escalation issue rather than a mass-exploitation emergency.
Authentication bypass in WIMOOR through commit ec86736 allows remote attackers to impersonate any tenant and privilege level by forging an unsigned X-USERINFO header, enabling read and modification of other tenants' orders, finance data, and Amazon seller authorizations. Exploitation requires direct network access to backend service ports, bypassing the API gateway that normally signs the header; deployments where backend ports are segmented/firewalled are not exploitable. The assessed CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) captures this high-severity impact but gated by network positioning, and no public exploit has been identified at time of analysis.
BeyondTrust Remote Support appliances contain an authentication bypass (CWE-290) in internal components that fail to validate the origin of received messages, potentially allowing an attacker to perform file operations on the appliance. According to the CVSS 4.0 vector (9.3), no authentication or user interaction is required, but the vendor notes exploitation is conditional ('under the right conditions') and the independent assessment emphasizes that an attacker must reach the internal messaging path and spoof a trusted source. No public exploit code or active exploitation has been identified at time of analysis, though this is a credible high-priority issue given the high impact.
Authentication bypass in the joserfc Python library before 1.7.4 lets remote, unauthenticated attackers submit a JWS General JSON Serialization whose "signatures" array is empty and have joserfc.jws.deserialize_json() accept it as authenticated, so relying applications can be fooled into treating an arbitrary attacker-chosen payload as a signed, trustworthy message. Exposure is scoped: only the General JSON Serialization code path is affected - compact JWS, JWT decoding, Flattened JSON serialization, and JWE JSON processing do not reach the vulnerable logic - but where the vulnerable API is used and its success is treated as proof of authenticity, the integrity impact is high (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N per the independent assessment; the published base score is 9.1). No public exploit code or confirmed active exploitation has been identified at time of analysis; the fix commit, tests, and security advisory are publicly available.
Rate limiting in Eclipse Connected Services Platform's api-gateway (up to and including 1.7.3) can be bypassed completely by any remote attacker who sends a distinct X-Forwarded-For header value on every request, because the shipped default ClientIpKeyResolver builds the per-client rate-limit bucket key from the unvalidated leftmost element of that client-supplied header. The result is an unlimited number of independent buckets on every route that uses the default configuration, letting unauthenticated attackers (CVSS:3.1 AV:N/AC:L/PR:N/UI:N) evade request throttling and degrade availability (C:N/I:N/A:H, score 7.5); confidentiality and integrity are unaffected. Exposure is configuration-dependent - gateways that swap in a trusted-proxy-aware key resolver or do not enforce rate limiting are not impacted, and no public exploit code was identified at time of analysis (SSVC exploitation: none).
Authentication bypass in FileRise (CWE-290) lets unauthenticated remote attackers impersonate any account - including an administrator - without a password or MFA in deployments prior to 3.16.0 that enable proxy-header authentication (AUTH_BYPASS) and expose the backend port directly. The flaw is that the configured reverse-proxy identity header (X-Remote-User) was trusted without validating that the request actually came from an address in FR_TRUSTED_PROXIES; an attacker who can reach the backend application port therefore simply supplies the header and receives a session for the named account. Exploitation requires proxy-header auth to be enabled, the trusted-proxy check to be absent or ineffective (exactly what 3.16.0 fixes), and a network path to the backend that bypasses the proxy, which is why it is scored AV:N/AC:H/PR:N/UI:N with full confidentiality, integrity, and availability impact (CVSS 3.1: 8.1 High); no public exploit code or confirmed in-the-wild exploitation was identified at time of analysis.
Eclipse NetX Duo's NetX Secure DTLS server can be driven into completing handshakes with forged source addresses because the cookie it issues in a HelloVerifyRequest is never actually validated: the ClientHello parser copies the client-supplied cookie bytes over the value the server generated, and the server then treats the peer as verified based on the cookie's length alone, so a single arbitrary cookie byte in the first ClientHello skips the return-routability exchange entirely. The defect is remotely reachable with no authentication and no user interaction (CVSS 4.0 base 8.7, High; the independent assessment confirms AV:N/AC:L/PR:N/UI:N with an availability-only impact), and the practical harm is anti-spoofing and availability abuse - spoofed-source handshakes, amplification potential, and handshake state/resource exhaustion - not data compromise or code execution. No public exploit code has been identified at time of analysis, and CVE-2026-106465 is not listed in CISA KEV.
Unauthenticated, remote attackers can bypass authentication and reach protected paths in F5 NGINX Kubernetes Ingress Controller (NIC) deployments configured with the ExternalAuth policy or Ingress external authentication. The flaw (CWE-290, authentication bypass by spoofing) occurs because client-supplied X-Forwarded-Prefix, X-Forwarded-URI, X-Original-URI, and X-Forwarded-Method headers are forwarded unsanitized into the internal NGINX auth_request subrequest, letting an attacker spoof the request attributes the external authentication provider evaluates; exploitation is remote, low-complexity and requires no authentication or user interaction, but is gated on the non-default external-auth configuration and is bounded to the data plane, affecting confidentiality/access only (no control plane exposure, no integrity or availability impact). No public exploit identified at time of analysis.
A namespaced authenticated attacker holding access to a Kubernetes service account can impersonate the NGINX Agent gRPC connection in NGINX Gateway Fabric and read TLS private keys belonging to Gateway deployments in other namespaces. Exploitation requires the Gateway Custom Resource Definition to be configured and an authenticated gRPC link between the control plane and NGINX Agent, making this an access-gated control-plane disclosure flaw with no data plane exposure. No public exploit code was identified at the time of analysis.
Improper privilege management in Windows' WinINet component (wininet.dll) lets an authenticated, low-privileged local attacker spoof a trusted identity and bypass authentication, with the impact spilling beyond WinINet's own security boundary into other components on the host. The flaw is rated CVSS 3.1 8.4 (High) under the vector AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N, so an attacker must already hold a local foothold on an unpatched machine, but then needs no user interaction and faces low complexity; CISA's SSVC assessment records exploitation as none, automatability as no, and technical impact as total. Affected platforms are Windows 10 21H2/22H2, Windows 11 23H2 through 26H2 plus 26H1, and Windows Server 2022/2025 builds below the patch thresholds in EUVD-2026-100013; no public exploit code was identified at time of analysis, and Microsoft has released vendor fixes.
Authentication bypass by spoofing in the Microsoft.AspNetCore.Authentication.Negotiate package for ASP.NET Core lets an authenticated remote attacker (PR:L) have their Kerberos-authenticated identity associated with an unintended LDAP principal, yielding high confidentiality, integrity, and availability impact (CVSS 7.5) after the attacker reaches the application over the network. Exposure is conditional: the application must use an affected package version - 8.0.0 through 8.0.31, 9.0.0 through 9.0.20, or 10.0.0 through 10.0.12 - and must have LDAP claim resolution enabled, an opt-in and non-default configuration, on Windows, Linux, or macOS. CISA's SSVC assessment records no exploitation, and no public exploit code was identified at time of analysis; the AC:H metric reflects that a specific spoofing/timing condition outside the attacker's full control must be satisfied, making this a genuine but conditional privilege-escalation issue rather than a mass-exploitation emergency.