Monthly
Missing authentication on the Telnet Handler of the Tenda AC18 router (firmware 15.03.05.19) lets remote, unauthenticated attackers reach the /goform/telnet endpoint and enable/access a telnet service without credentials, exposing full device control. Publicly available exploit code exists, and with a CVSS 4.0 base of 9.3 the flaw grants complete confidentiality, integrity, and availability impact over the network. No CISA KEV listing or EPSS score is provided, so real-world exploitation is unconfirmed despite the released PoC.
Missing authentication in the Tenda AC1206 (firmware 15.03.06.23) lets remote attackers reach the /goform/ate endpoint of the web UI without any credentials because the R7WebsSecurityHandler function fails to enforce access control. Any attacker with network reachability to the device's web interface can invoke the protected functionality directly, and publicly available exploit code exists. This is a VulDB-reported issue with a CVSS 4.0 base score of 9.3; it is not listed in CISA KEV and no EPSS score was provided.
Authentication bypass in the Tenda AC1206 router (firmware 15.03.06.23) lets remote, unauthenticated attackers reach the TendaTelnet handler at the /goform/telnet Web UI endpoint, which enables the device's telnet service without any credentials. Because CVSS records PR:N/UI:N over the network, an attacker on a reachable network path can turn on telnet and pivot to shell-level control of the device; publicly available exploit code exists, though it is not listed in CISA KEV. The flaw is classic missing authentication (CWE-306) on an administrative router function.
Unauthenticated information disclosure in Dell PowerStore T-series storage appliances allows an attacker with network access to the restricted management interface to read arbitrary internal system information from the appliance filesystem, including stored credentials that grant full administrative control of the array. Tracked as CWE-306 (Missing Authentication for Critical Function) with a CVSS 9.8, it affects PowerStore 500T through 9200T models and is fixed per Dell advisory DSA-2026-330. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated exposure of live TLS session keys in Keploy 3.1.0-3.6.25 allows any network-reachable attacker to decrypt recorded application TLS traffic by calling the agent control-plane's /agent/pcap/keylog endpoint, which streams NSS keylog lines without any authentication gate. The root cause is the agent HTTP server binding to 0.0.0.0 (all interfaces) rather than loopback, as confirmed by the patch commit diff. Additional endpoints /agent/stop and /agent/storemocks allow unauthenticated manipulation of test recording sessions. No public exploit code or CISA KEV listing has been identified at time of analysis, though exploitation requires only a standard HTTP client.
Unauthenticated integrity manipulation in KubeEdge CloudCore through 1.23.1 allows any network-reachable attacker to submit forged node task status reports to the CloudCore HTTPS server on port 10002, deceiving the Kubernetes edge control plane about the real state of node upgrade jobs. By falsely marking upgrades as succeeded or failed, an attacker can permanently block further upgrade scheduling for affected nodes without any credentials. A publicly available proof-of-concept exploit exists, and the CVSS 4.0 score of 8.8 reflects network-accessible, zero-interaction exploitation with high integrity impact.
Unauthenticated file upload in Documenso before 2.13.0 exposes the /api/files/upload-pdf endpoint to any remote actor without requiring session tokens, API keys, or any credential, enabling indefinite storage exhaustion and database flooding with orphaned document records. The flaw (CWE-306, Missing Authentication for Critical Function) carries a CVSS 4.0 score of 8.7 with a confirmed AV:N/PR:N vector, meaning exploitation requires only network reachability and standard HTTP tooling. No active exploitation is confirmed in CISA KEV and no public exploit code has been identified at time of analysis, but the trivial attack complexity makes automated abuse highly plausible against self-hosted instances exposed to the internet.
Authentication bypass in iot-ecology's rust-iot-platform (through commit 5df942ab) exposes user-account management endpoints because most REST API handlers omit request guards, letting remote unauthenticated attackers create, read, modify, and delete user accounts. Reported by VulnCheck with a CVSS 4.0 base score of 9.3, the flaw grants full CRUD over the identity store with no credentials. No public exploit code has been identified at time of analysis, and it is not listed in CISA KEV.
The /github-app/setup endpoint in Atlantis through 0.47.1 is completely unauthenticated, exposing GitHub App credentials-including the RSA private key and webhook secret-to any network caller who reaches the endpoint during a setup session. Successful exploitation grants an attacker the ability to mint valid GitHub App installation tokens and forge webhook payloads, effectively compromising the trust chain between Atlantis and all GitHub repositories managed through that App installation. No public exploit code or CISA KEV listing has been identified at time of analysis, but the credential class exposed makes this a high-priority remediation for any internet-exposed Atlantis instance using GitHub App authentication.
Missing authentication on the Argo Rollouts dashboard (through v1.10.0) lets unauthenticated network-adjacent attackers invoke mutating Rollout operations - PromoteRollout, AbortRollout, RestartRollout, SetRolloutImage, UndoRollout, and RetryRollout - across every namespace reachable by the operator's kubeconfig. Because the dashboard binds to all interfaces (0.0.0.0) with no authorization or CSRF protection, an attacker can hijack progressive-delivery workflows and, via SetRolloutImage, push arbitrary container images into the cluster. Reported by VulnCheck; no public exploit identified at time of analysis and not listed in CISA KEV.
Missing authentication on the Telnet Handler of the Tenda AC18 router (firmware 15.03.05.19) lets remote, unauthenticated attackers reach the /goform/telnet endpoint and enable/access a telnet service without credentials, exposing full device control. Publicly available exploit code exists, and with a CVSS 4.0 base of 9.3 the flaw grants complete confidentiality, integrity, and availability impact over the network. No CISA KEV listing or EPSS score is provided, so real-world exploitation is unconfirmed despite the released PoC.
Missing authentication in the Tenda AC1206 (firmware 15.03.06.23) lets remote attackers reach the /goform/ate endpoint of the web UI without any credentials because the R7WebsSecurityHandler function fails to enforce access control. Any attacker with network reachability to the device's web interface can invoke the protected functionality directly, and publicly available exploit code exists. This is a VulDB-reported issue with a CVSS 4.0 base score of 9.3; it is not listed in CISA KEV and no EPSS score was provided.
Authentication bypass in the Tenda AC1206 router (firmware 15.03.06.23) lets remote, unauthenticated attackers reach the TendaTelnet handler at the /goform/telnet Web UI endpoint, which enables the device's telnet service without any credentials. Because CVSS records PR:N/UI:N over the network, an attacker on a reachable network path can turn on telnet and pivot to shell-level control of the device; publicly available exploit code exists, though it is not listed in CISA KEV. The flaw is classic missing authentication (CWE-306) on an administrative router function.
Unauthenticated information disclosure in Dell PowerStore T-series storage appliances allows an attacker with network access to the restricted management interface to read arbitrary internal system information from the appliance filesystem, including stored credentials that grant full administrative control of the array. Tracked as CWE-306 (Missing Authentication for Critical Function) with a CVSS 9.8, it affects PowerStore 500T through 9200T models and is fixed per Dell advisory DSA-2026-330. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated exposure of live TLS session keys in Keploy 3.1.0-3.6.25 allows any network-reachable attacker to decrypt recorded application TLS traffic by calling the agent control-plane's /agent/pcap/keylog endpoint, which streams NSS keylog lines without any authentication gate. The root cause is the agent HTTP server binding to 0.0.0.0 (all interfaces) rather than loopback, as confirmed by the patch commit diff. Additional endpoints /agent/stop and /agent/storemocks allow unauthenticated manipulation of test recording sessions. No public exploit code or CISA KEV listing has been identified at time of analysis, though exploitation requires only a standard HTTP client.
Unauthenticated integrity manipulation in KubeEdge CloudCore through 1.23.1 allows any network-reachable attacker to submit forged node task status reports to the CloudCore HTTPS server on port 10002, deceiving the Kubernetes edge control plane about the real state of node upgrade jobs. By falsely marking upgrades as succeeded or failed, an attacker can permanently block further upgrade scheduling for affected nodes without any credentials. A publicly available proof-of-concept exploit exists, and the CVSS 4.0 score of 8.8 reflects network-accessible, zero-interaction exploitation with high integrity impact.
Unauthenticated file upload in Documenso before 2.13.0 exposes the /api/files/upload-pdf endpoint to any remote actor without requiring session tokens, API keys, or any credential, enabling indefinite storage exhaustion and database flooding with orphaned document records. The flaw (CWE-306, Missing Authentication for Critical Function) carries a CVSS 4.0 score of 8.7 with a confirmed AV:N/PR:N vector, meaning exploitation requires only network reachability and standard HTTP tooling. No active exploitation is confirmed in CISA KEV and no public exploit code has been identified at time of analysis, but the trivial attack complexity makes automated abuse highly plausible against self-hosted instances exposed to the internet.
Authentication bypass in iot-ecology's rust-iot-platform (through commit 5df942ab) exposes user-account management endpoints because most REST API handlers omit request guards, letting remote unauthenticated attackers create, read, modify, and delete user accounts. Reported by VulnCheck with a CVSS 4.0 base score of 9.3, the flaw grants full CRUD over the identity store with no credentials. No public exploit code has been identified at time of analysis, and it is not listed in CISA KEV.
The /github-app/setup endpoint in Atlantis through 0.47.1 is completely unauthenticated, exposing GitHub App credentials-including the RSA private key and webhook secret-to any network caller who reaches the endpoint during a setup session. Successful exploitation grants an attacker the ability to mint valid GitHub App installation tokens and forge webhook payloads, effectively compromising the trust chain between Atlantis and all GitHub repositories managed through that App installation. No public exploit code or CISA KEV listing has been identified at time of analysis, but the credential class exposed makes this a high-priority remediation for any internet-exposed Atlantis instance using GitHub App authentication.
Missing authentication on the Argo Rollouts dashboard (through v1.10.0) lets unauthenticated network-adjacent attackers invoke mutating Rollout operations - PromoteRollout, AbortRollout, RestartRollout, SetRolloutImage, UndoRollout, and RetryRollout - across every namespace reachable by the operator's kubeconfig. Because the dashboard binds to all interfaces (0.0.0.0) with no authorization or CSRF protection, an attacker can hijack progressive-delivery workflows and, via SetRolloutImage, push arbitrary container images into the cluster. Reported by VulnCheck; no public exploit identified at time of analysis and not listed in CISA KEV.