Monthly
Privilege escalation in IBM Security Verify Access and IBM Verify Identity Access allows an authenticated low-privilege user to assume the identity and privileges of another user by submitting a specially crafted network request. The vulnerability spans both on-premises and container deployments across multiple product generations (10.x and 11.x lines), broadening the exposed surface considerably. No public exploit code or CISA KEV listing has been identified at time of analysis, but the CVSS score of 8.1 and low attack complexity make this a high-priority patching target for organizations running IBM identity infrastructure.
JWT authentication bypass in @neo4j/graphql allows unauthenticated remote clients to forge arbitrary JWT claims over GraphQL-over-WebSocket connections, bypassing @authentication and @subscriptionsAuthorization directive controls. Affected library versions prior to 7.5.6 (v7 branch) and 5.12.14 (v5 branch) accept client-supplied, pre-decoded JWT objects in subscription connectionParams without any cryptographic verification, meaning the library treats attacker-controlled identity claims as authenticated. No public exploit or KEV listing has been identified at time of analysis, but the exploitation barrier is low given the network-accessible vector and absence of authentication requirements.
Privilege elevation in ASP.NET Core (bundled with .NET 8.0, 9.0, and 10.0) lets an already-authenticated, low-privileged network attacker bypass authentication controls by tampering with data the framework wrongly assumes to be immutable (CWE-302). Microsoft reported and patched the flaw; there is no public exploit identified at time of analysis and it is not on CISA KEV. At CVSS 8.8 with PR:L, an authorized user can escalate to higher privileges over the network.
Privilege escalation to SUPERADMIN in Postiz (gitroomhq/postiz-app) versions prior to 2.21.8 allows any authenticated user to forge session JWTs and impersonate arbitrary organizations. The Skool integration callback signed an attacker-controlled JSON blob into a session-shape JWT using the application's JWT_SECRET, and the auth middleware blindly trusted every claim without re-resolving the user from the database. No public exploit identified at time of analysis, but the fix commit is public and the root cause is trivially reproducible from the patch diff.
Weblate's REST API prior to version 2026.8 permits authenticated users to silently replace their account's primary email with any unverified address via PUT or PATCH requests to /api/users/{username}/, bypassing the normal email-verification flow. This allows an attacker to pre-claim an email address and then accept team or project invitations directed to that address without ever accessing the intended recipient's mailbox. The fix is confirmed in Weblate 2026.8, and no public exploit code or active exploitation has been identified at time of analysis.
OAuth login CSRF in NamelessMC 2.2.4 and prior enables session swapping by exploiting the absence of server-side state parameter validation during OAuth callback handling. An unauthenticated attacker (PR:N) who controls their own OAuth-linked account can capture a valid callback URL and socially engineer a victim (UI:R) into navigating to it, causing the victim's browser session to become authenticated as the attacker's account - effectively hijacking the victim's logged-in state. No public exploit has been identified and this is not listed in the CISA KEV catalog, but the patch to version 2.2.5 is confirmed via GitHub Security Advisory GHSA-pmpw-2xvh-5xj6.
Authentication bypass in Dell ECS Geo replication (versions 3.8.1.0-3.8.1.7) and Dell ObjectScale (prior to 4.3.0.0) allows unauthenticated remote attackers to access data in transit by exploiting assumed-immutable data assumptions. The vulnerability affects the replication authentication mechanism, enabling unauthorized data exposure without requiring valid credentials or user interaction.
Multi-factor authentication bypass in eLabFTW through version 5.4.1 allows attackers with valid primary credentials to complete login using an attacker-controlled TOTP secret, circumventing the second factor requirement and gaining unauthorized account access. The vulnerability stems from inconsistent MFA state preservation across authentication steps. This issue is patched in version 5.4.2.
Zitadel versions 2.31.0 through 3.4.6 and 4.10.x accept truncated opaque OIDC access tokens as valid when shortened to 80 characters, allowing attackers to bypass token validation and gain unauthorized access to protected resources. This affects deployments using the v2 token format where the symmetric encryption scheme fails to properly validate token length, enabling token forgery or reuse attacks.
An authentication bypass vulnerability exists in the User profile management functionality of Socomec Easy Config System 2.6.1.0. A specially crafted database record can lead to unauthorized access. An attacker can modify a local database to trigger this vulnerability.
Privilege escalation in IBM Security Verify Access and IBM Verify Identity Access allows an authenticated low-privilege user to assume the identity and privileges of another user by submitting a specially crafted network request. The vulnerability spans both on-premises and container deployments across multiple product generations (10.x and 11.x lines), broadening the exposed surface considerably. No public exploit code or CISA KEV listing has been identified at time of analysis, but the CVSS score of 8.1 and low attack complexity make this a high-priority patching target for organizations running IBM identity infrastructure.
JWT authentication bypass in @neo4j/graphql allows unauthenticated remote clients to forge arbitrary JWT claims over GraphQL-over-WebSocket connections, bypassing @authentication and @subscriptionsAuthorization directive controls. Affected library versions prior to 7.5.6 (v7 branch) and 5.12.14 (v5 branch) accept client-supplied, pre-decoded JWT objects in subscription connectionParams without any cryptographic verification, meaning the library treats attacker-controlled identity claims as authenticated. No public exploit or KEV listing has been identified at time of analysis, but the exploitation barrier is low given the network-accessible vector and absence of authentication requirements.
Privilege elevation in ASP.NET Core (bundled with .NET 8.0, 9.0, and 10.0) lets an already-authenticated, low-privileged network attacker bypass authentication controls by tampering with data the framework wrongly assumes to be immutable (CWE-302). Microsoft reported and patched the flaw; there is no public exploit identified at time of analysis and it is not on CISA KEV. At CVSS 8.8 with PR:L, an authorized user can escalate to higher privileges over the network.
Privilege escalation to SUPERADMIN in Postiz (gitroomhq/postiz-app) versions prior to 2.21.8 allows any authenticated user to forge session JWTs and impersonate arbitrary organizations. The Skool integration callback signed an attacker-controlled JSON blob into a session-shape JWT using the application's JWT_SECRET, and the auth middleware blindly trusted every claim without re-resolving the user from the database. No public exploit identified at time of analysis, but the fix commit is public and the root cause is trivially reproducible from the patch diff.
Weblate's REST API prior to version 2026.8 permits authenticated users to silently replace their account's primary email with any unverified address via PUT or PATCH requests to /api/users/{username}/, bypassing the normal email-verification flow. This allows an attacker to pre-claim an email address and then accept team or project invitations directed to that address without ever accessing the intended recipient's mailbox. The fix is confirmed in Weblate 2026.8, and no public exploit code or active exploitation has been identified at time of analysis.
OAuth login CSRF in NamelessMC 2.2.4 and prior enables session swapping by exploiting the absence of server-side state parameter validation during OAuth callback handling. An unauthenticated attacker (PR:N) who controls their own OAuth-linked account can capture a valid callback URL and socially engineer a victim (UI:R) into navigating to it, causing the victim's browser session to become authenticated as the attacker's account - effectively hijacking the victim's logged-in state. No public exploit has been identified and this is not listed in the CISA KEV catalog, but the patch to version 2.2.5 is confirmed via GitHub Security Advisory GHSA-pmpw-2xvh-5xj6.
Authentication bypass in Dell ECS Geo replication (versions 3.8.1.0-3.8.1.7) and Dell ObjectScale (prior to 4.3.0.0) allows unauthenticated remote attackers to access data in transit by exploiting assumed-immutable data assumptions. The vulnerability affects the replication authentication mechanism, enabling unauthorized data exposure without requiring valid credentials or user interaction.
Multi-factor authentication bypass in eLabFTW through version 5.4.1 allows attackers with valid primary credentials to complete login using an attacker-controlled TOTP secret, circumventing the second factor requirement and gaining unauthorized account access. The vulnerability stems from inconsistent MFA state preservation across authentication steps. This issue is patched in version 5.4.2.
Zitadel versions 2.31.0 through 3.4.6 and 4.10.x accept truncated opaque OIDC access tokens as valid when shortened to 80 characters, allowing attackers to bypass token validation and gain unauthorized access to protected resources. This affects deployments using the v2 token format where the symmetric encryption scheme fails to properly validate token length, enabling token forgery or reuse attacks.
An authentication bypass vulnerability exists in the User profile management functionality of Socomec Easy Config System 2.6.1.0. A specially crafted database record can lead to unauthorized access. An attacker can modify a local database to trigger this vulnerability.