Monthly
Improper access control (CWE-305) in the PaperCut MF and PaperCut NG web management interface allows unauthenticated remote attackers to trigger backend administrative operations before access validation completes, enabling unauthorized modification of system configurations. The CVSS 4.0 vector rates this AV:N/AC:L/PR:N/UI:N with high integrity impact, indicating network-exploitable, zero-authentication exploitation with no user interaction required. No public exploit code or CISA KEV listing has been identified at time of analysis, though PaperCut products have historically been high-value ransomware targets.
Unauthenticated local access to Metasploit Framework's JSON-RPC dispatcher is possible via a fail-open logic flaw (CWE-305) in the ApiToken Warden authentication strategy. When the MSF_WS_JSON_RPC_API_TOKEN environment variable is unset and the db.check health-check method raises an exception, the internal msf.auth_initialized flag is reset to false - which the Warden misinterprets as authentication being uninitialised rather than failed, bypassing token enforcement entirely. A vendor-released upstream fix is available via GitHub PR #21768; no public exploit code and no CISA KEV listing have been identified at time of analysis.
Two-factor authentication bypass in the Perl module Punk::Plugin::TOTP before 0.05 lets an attacker who already knows a victim's password clear the victim's TOTP challenge using a recovery code issued to the attacker's own account. The flaw stems from the recovery-code helper looking up codes by digest across all users and then binding ownership through a numeric comparison of user identifiers, which fails whenever accounts are keyed by username, email, or UUID. No CISA KEV listing and no public exploit identified at time of analysis, with a low EPSS score of 0.44% (37th percentile) despite the 9.8 CVSS rating.
Unauthenticated administrative account takeover in vsDesk (a Russian-market IT service-desk/help-desk platform) lets a remote attacker abuse insecure deserialization of application configuration data to point the login flow at an attacker-controlled LDAP server and provision a new admin account. Rated CVSS 4.0 9.3 (critical) with an unauthenticated network vector, it was researched and disclosed by Kaspersky (klsecservices); a detailed public write-up exists (KLSA-00296), though no CISA KEV listing or confirmed weaponized exploit is present in the data, so this is best characterized as no public exploit code identified at time of analysis despite a thorough advisory.
E-Municipality by Universal Software Inc. exposes a remotely exploitable authentication bypass via trusted identifier exploitation (CWE-305), affecting all versions from 20251127 up to the patched release 20260204. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms that unauthenticated remote attackers can reach the vulnerable authentication layer with no user interaction and no access prerequisites, resulting in limited integrity compromise. Disclosed by Turkey's national CSIRT (USOM), no public exploit or CISA KEV listing exists at time of analysis.
Bluetooth LE legacy pairing authentication in Silicon Labs RS9116W and SiWx917 wireless modules (WiseConnect SDK) can be bypassed by manipulating the Temporary Key (TK) value during Passkey Entry association, allowing an adjacent unauthenticated attacker to pair with the target device without possessing the correct passkey. Successful exploitation yields high confidentiality and integrity impact on the vulnerable system. The vulnerability is academically documented as B-E3 in a published research paper (arxiv.org/pdf/2409.02905); no public exploit tool or CISA KEV entry has been identified at time of analysis.
Security level downgrade during Bluetooth Low Energy re-pairing in Silicon Labs WiseConnect exposes the Long Term Key (LTK) to practical brute-force attack by an adjacent unauthenticated attacker. Devices running WiseConnect 4.0.0 through 4.0.x and WiseConnect 2.0.0 through 2.13.x accept re-pairing negotiations at weaker security parameters than originally established, reducing LTK entropy and enabling offline key recovery. No public exploit code has been identified at time of analysis, though the vulnerability class is formally documented as V4 in the BLERP academic paper (NDSS); a vendor patch is available in WiseConnect 4.1.0 and 2.14.0.
Authentication bypass in LemonLDAP::NG (CWE-305) allows remote unauthenticated attackers to defeat a primary authentication control and access protected resources, tagged by the reporter as leading to information disclosure. All maintained branches are affected, with fixes shipped in 2.23.3, 2.21.5, and 2.16.9; the issue was disclosed via oss-security and packaged by Ubuntu. There is no public exploit identified at time of analysis, and EPSS is low at 0.27% (18th percentile) despite the 9.8 CVSS.
Deactivated guest accounts in Mattermost 11.6.x through 11.6.4 and 11.7.x through 11.7.2 can regain platform access using magic-link tokens issued before deactivation, because the magic-link login path omits an account-status check during session creation. This directly undermines guest account revocation as an access control mechanism - administrators who deactivate a guest account expecting immediate exclusion will find the control is defeatable while any pre-issued token remains valid. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Mattermost fails to invalidate OAuth refresh tokens when a user account is deactivated, enabling former users - or any attacker who possesses a valid refresh token - to continue minting functional access tokens against the OAuth refresh token grant endpoint indefinitely after access revocation should have taken effect. All three actively maintained release branches are affected (10.11.x, 11.6.x, 11.7.x), making this a cross-branch session-persistence flaw with high confidentiality and integrity impact on any workspace relying on OAuth-integrated access control. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, though the attack path requires minimal skill for any party already holding a refresh token.
Improper access control (CWE-305) in the PaperCut MF and PaperCut NG web management interface allows unauthenticated remote attackers to trigger backend administrative operations before access validation completes, enabling unauthorized modification of system configurations. The CVSS 4.0 vector rates this AV:N/AC:L/PR:N/UI:N with high integrity impact, indicating network-exploitable, zero-authentication exploitation with no user interaction required. No public exploit code or CISA KEV listing has been identified at time of analysis, though PaperCut products have historically been high-value ransomware targets.
Unauthenticated local access to Metasploit Framework's JSON-RPC dispatcher is possible via a fail-open logic flaw (CWE-305) in the ApiToken Warden authentication strategy. When the MSF_WS_JSON_RPC_API_TOKEN environment variable is unset and the db.check health-check method raises an exception, the internal msf.auth_initialized flag is reset to false - which the Warden misinterprets as authentication being uninitialised rather than failed, bypassing token enforcement entirely. A vendor-released upstream fix is available via GitHub PR #21768; no public exploit code and no CISA KEV listing have been identified at time of analysis.
Two-factor authentication bypass in the Perl module Punk::Plugin::TOTP before 0.05 lets an attacker who already knows a victim's password clear the victim's TOTP challenge using a recovery code issued to the attacker's own account. The flaw stems from the recovery-code helper looking up codes by digest across all users and then binding ownership through a numeric comparison of user identifiers, which fails whenever accounts are keyed by username, email, or UUID. No CISA KEV listing and no public exploit identified at time of analysis, with a low EPSS score of 0.44% (37th percentile) despite the 9.8 CVSS rating.
Unauthenticated administrative account takeover in vsDesk (a Russian-market IT service-desk/help-desk platform) lets a remote attacker abuse insecure deserialization of application configuration data to point the login flow at an attacker-controlled LDAP server and provision a new admin account. Rated CVSS 4.0 9.3 (critical) with an unauthenticated network vector, it was researched and disclosed by Kaspersky (klsecservices); a detailed public write-up exists (KLSA-00296), though no CISA KEV listing or confirmed weaponized exploit is present in the data, so this is best characterized as no public exploit code identified at time of analysis despite a thorough advisory.
E-Municipality by Universal Software Inc. exposes a remotely exploitable authentication bypass via trusted identifier exploitation (CWE-305), affecting all versions from 20251127 up to the patched release 20260204. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms that unauthenticated remote attackers can reach the vulnerable authentication layer with no user interaction and no access prerequisites, resulting in limited integrity compromise. Disclosed by Turkey's national CSIRT (USOM), no public exploit or CISA KEV listing exists at time of analysis.
Bluetooth LE legacy pairing authentication in Silicon Labs RS9116W and SiWx917 wireless modules (WiseConnect SDK) can be bypassed by manipulating the Temporary Key (TK) value during Passkey Entry association, allowing an adjacent unauthenticated attacker to pair with the target device without possessing the correct passkey. Successful exploitation yields high confidentiality and integrity impact on the vulnerable system. The vulnerability is academically documented as B-E3 in a published research paper (arxiv.org/pdf/2409.02905); no public exploit tool or CISA KEV entry has been identified at time of analysis.
Security level downgrade during Bluetooth Low Energy re-pairing in Silicon Labs WiseConnect exposes the Long Term Key (LTK) to practical brute-force attack by an adjacent unauthenticated attacker. Devices running WiseConnect 4.0.0 through 4.0.x and WiseConnect 2.0.0 through 2.13.x accept re-pairing negotiations at weaker security parameters than originally established, reducing LTK entropy and enabling offline key recovery. No public exploit code has been identified at time of analysis, though the vulnerability class is formally documented as V4 in the BLERP academic paper (NDSS); a vendor patch is available in WiseConnect 4.1.0 and 2.14.0.
Authentication bypass in LemonLDAP::NG (CWE-305) allows remote unauthenticated attackers to defeat a primary authentication control and access protected resources, tagged by the reporter as leading to information disclosure. All maintained branches are affected, with fixes shipped in 2.23.3, 2.21.5, and 2.16.9; the issue was disclosed via oss-security and packaged by Ubuntu. There is no public exploit identified at time of analysis, and EPSS is low at 0.27% (18th percentile) despite the 9.8 CVSS.
Deactivated guest accounts in Mattermost 11.6.x through 11.6.4 and 11.7.x through 11.7.2 can regain platform access using magic-link tokens issued before deactivation, because the magic-link login path omits an account-status check during session creation. This directly undermines guest account revocation as an access control mechanism - administrators who deactivate a guest account expecting immediate exclusion will find the control is defeatable while any pre-issued token remains valid. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Mattermost fails to invalidate OAuth refresh tokens when a user account is deactivated, enabling former users - or any attacker who possesses a valid refresh token - to continue minting functional access tokens against the OAuth refresh token grant endpoint indefinitely after access revocation should have taken effect. All three actively maintained release branches are affected (10.11.x, 11.6.x, 11.7.x), making this a cross-branch session-persistence flaw with high confidentiality and integrity impact on any workspace relying on OAuth-integrated access control. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, though the attack path requires minimal skill for any party already holding a refresh token.