Monthly
Pingvin Share X versions 1.5.0 through 1.18.0 expose an authentication bypass in TOTP management endpoints due to a JavaScript async/await coding defect. An authenticated attacker with a low-privileged account can modify or disable TOTP two-factor authentication settings on an account without supplying a correct password, effectively neutralizing 2FA protections. No active exploitation has been identified in CISA KEV, and no public exploit code has been reported, but the bypass is trivially reachable by any valid user of an affected self-hosted instance.
Remote unauthenticated control of Ecovacs Robotics DEEBOT PRO M1 and K1VAC robot vacuums is possible due to an incorrectly implemented authentication algorithm in their WebSocket communications interface. Any network-reachable attacker can connect to and issue operational commands to affected robots without valid credentials (AV:N, PR:N per CVSS vector). No public exploit code has been identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog.
Unauthenticated remote attackers can trigger operator-configured scheduled jobs in Grav CMS when the scheduler-webhook plugin is installed and misconfigured, due to a compound-conditional short-circuit (CWE-303) that skips token validation entirely when no webhookToken is set. The primitive is job-triggering rather than attacker-controlled command injection: RCE is only achievable when an administrator has separately configured a scheduled job that shells out, a condition the attacker cannot influence. No public exploit has been identified at time of analysis, and the vendor-released fix is available in Grav v2.0.9.
Authentication bypass in VMware vCenter's Directory Service (vmdir) lets an attacker with network reachability to vCenter defeat the authentication algorithm and obtain unauthorized access without valid credentials. Because vCenter is the central management plane for vSphere environments, this exposes control over the entire virtual estate; the flaw is remotely exploitable with no privileges or user interaction (CVSS 9.8). At time of analysis there is no public exploit identified and it is not listed in CISA KEV, but the reporting vendor (VMware/Broadcom) rates it critical.
Unauthorized account access in Ekushey Project Manager CRM allows authenticated administrators to create duplicate client accounts with identical email and password credentials. An authenticated admin can exploit the missing email uniqueness enforcement to create conflicting account states, causing unpredictable authentication and potential unauthorized access to victim accounts. A proof-of-concept exploit is publicly available.
Unauthenticated triggering of all configured scheduled jobs in Grav CMS's scheduler-webhook plugin is possible due to a null short-circuit logic flaw in webhook token validation, allowing any network-reachable attacker to execute operator-defined commands under the web server process account via a single POST request. The affected component is the scheduler-webhook plugin for Grav CMS, a PHP flat-file CMS; the CVSS 4.0 vector (AC:H/AT:P) confirms exploitation requires the plugin to be installed with configured jobs and an exposed endpoint - not a default Grav deployment. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis.
Privilege elevation in ASP.NET Core (bundled with .NET 8.0, 9.0, and 10.0) lets an already-authenticated, low-privileged network attacker gain higher privileges by abusing a flawed authentication algorithm implementation (CWE-303). Microsoft reported the flaw and has released a patch; there is no public exploit identified at time of analysis and it is not on the CISA KEV. The 8.8 CVSS reflects high confidentiality, integrity, and availability impact reachable over the network with only low prior privileges.
Privilege escalation in Microsoft Windows SMB Server allows an already-authenticated network attacker to elevate to higher privileges by abusing a flawed authentication algorithm, yielding high confidentiality, integrity, and availability impact. The flaw affects Windows 10 (21H2/22H2), Windows 11 (24H2/25H2/26H1), and Windows Server 2022/2025 including Server Core. Reported by Microsoft with a patch available; no public exploit identified at time of analysis.
Privilege escalation in Rancher 2.13 (before 2.13.6) and 2.14 (before 2.14.2) lets any authenticated user gain principal access they should not hold, because the GitHub authentication provider incorrectly caches the result of team membership expansion. The flaw (CWE-303, CVSS 8.8) means a low-privileged GitHub-authenticated user can be granted access tied to other principals/teams, effectively bypassing intended authorization. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Local privilege escalation in qSnapper D-Bus service before version 1.3.3 allows any unprivileged local user to invoke privileged D-Bus methods after an administrator has previously authenticated for an unrelated Polkit action. The flaw stems from authentication state being implicitly carried over across different Polkit actions and users rather than being scoped per-action-per-caller, enabling unauthorized snapshot management on systems where the service is installed. No public exploit identified at time of analysis, though SUSE published a coordinated disclosure advisory alongside the upstream fix.
Pingvin Share X versions 1.5.0 through 1.18.0 expose an authentication bypass in TOTP management endpoints due to a JavaScript async/await coding defect. An authenticated attacker with a low-privileged account can modify or disable TOTP two-factor authentication settings on an account without supplying a correct password, effectively neutralizing 2FA protections. No active exploitation has been identified in CISA KEV, and no public exploit code has been reported, but the bypass is trivially reachable by any valid user of an affected self-hosted instance.
Remote unauthenticated control of Ecovacs Robotics DEEBOT PRO M1 and K1VAC robot vacuums is possible due to an incorrectly implemented authentication algorithm in their WebSocket communications interface. Any network-reachable attacker can connect to and issue operational commands to affected robots without valid credentials (AV:N, PR:N per CVSS vector). No public exploit code has been identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog.
Unauthenticated remote attackers can trigger operator-configured scheduled jobs in Grav CMS when the scheduler-webhook plugin is installed and misconfigured, due to a compound-conditional short-circuit (CWE-303) that skips token validation entirely when no webhookToken is set. The primitive is job-triggering rather than attacker-controlled command injection: RCE is only achievable when an administrator has separately configured a scheduled job that shells out, a condition the attacker cannot influence. No public exploit has been identified at time of analysis, and the vendor-released fix is available in Grav v2.0.9.
Authentication bypass in VMware vCenter's Directory Service (vmdir) lets an attacker with network reachability to vCenter defeat the authentication algorithm and obtain unauthorized access without valid credentials. Because vCenter is the central management plane for vSphere environments, this exposes control over the entire virtual estate; the flaw is remotely exploitable with no privileges or user interaction (CVSS 9.8). At time of analysis there is no public exploit identified and it is not listed in CISA KEV, but the reporting vendor (VMware/Broadcom) rates it critical.
Unauthorized account access in Ekushey Project Manager CRM allows authenticated administrators to create duplicate client accounts with identical email and password credentials. An authenticated admin can exploit the missing email uniqueness enforcement to create conflicting account states, causing unpredictable authentication and potential unauthorized access to victim accounts. A proof-of-concept exploit is publicly available.
Unauthenticated triggering of all configured scheduled jobs in Grav CMS's scheduler-webhook plugin is possible due to a null short-circuit logic flaw in webhook token validation, allowing any network-reachable attacker to execute operator-defined commands under the web server process account via a single POST request. The affected component is the scheduler-webhook plugin for Grav CMS, a PHP flat-file CMS; the CVSS 4.0 vector (AC:H/AT:P) confirms exploitation requires the plugin to be installed with configured jobs and an exposed endpoint - not a default Grav deployment. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis.
Privilege elevation in ASP.NET Core (bundled with .NET 8.0, 9.0, and 10.0) lets an already-authenticated, low-privileged network attacker gain higher privileges by abusing a flawed authentication algorithm implementation (CWE-303). Microsoft reported the flaw and has released a patch; there is no public exploit identified at time of analysis and it is not on the CISA KEV. The 8.8 CVSS reflects high confidentiality, integrity, and availability impact reachable over the network with only low prior privileges.
Privilege escalation in Microsoft Windows SMB Server allows an already-authenticated network attacker to elevate to higher privileges by abusing a flawed authentication algorithm, yielding high confidentiality, integrity, and availability impact. The flaw affects Windows 10 (21H2/22H2), Windows 11 (24H2/25H2/26H1), and Windows Server 2022/2025 including Server Core. Reported by Microsoft with a patch available; no public exploit identified at time of analysis.
Privilege escalation in Rancher 2.13 (before 2.13.6) and 2.14 (before 2.14.2) lets any authenticated user gain principal access they should not hold, because the GitHub authentication provider incorrectly caches the result of team membership expansion. The flaw (CWE-303, CVSS 8.8) means a low-privileged GitHub-authenticated user can be granted access tied to other principals/teams, effectively bypassing intended authorization. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Local privilege escalation in qSnapper D-Bus service before version 1.3.3 allows any unprivileged local user to invoke privileged D-Bus methods after an administrator has previously authenticated for an unrelated Polkit action. The flaw stems from authentication state being implicitly carried over across different Polkit actions and users rather than being scoped per-action-per-caller, enabling unauthorized snapshot management on systems where the service is installed. No public exploit identified at time of analysis, though SUSE published a coordinated disclosure advisory alongside the upstream fix.