Monthly
Cryptographic validation weakness in the IBM Security Verify Access / Verify Identity Access Reverse Proxy (WebSEAL) allows remote attackers to bypass expected integrity checks on user-supplied data in certain configurations, affecting Security Verify Access 10.0 through 10.0.9.2 and Verify Identity Access (and its Container edition) 11.0 through 11.0.3. NVD rates this CVSS 9.8, but the vague 'certain configurations' wording and a low EPSS of 0.24% (15th percentile) with SSVC exploitation status 'none' point to a config-dependent issue rather than mass exploitation. There is no public exploit identified at time of analysis and it is not on CISA KEV.
Information disclosure in ZTE ZXUniPOS NDS-LTE (V24.40.40 and earlier, and V24.30.40CP02 and earlier) stems from an insecure cryptographic password scheme - such as hard-coded keys, weak encryption algorithms, or poor key management - that lets remote, unauthenticated attackers recover or tamper with protected data. The CVSS vector (AV:N/AC:H/PR:N) indicates network reachability without credentials but with high attack complexity, and the primary impact is confidentiality loss (C:H) with minor integrity and availability effects. There is no public exploit identified at time of analysis, and EPSS is very low (0.02%, 7th percentile).
CodeIgniter before 2.2.0 makes it easier for attackers to decode session cookies by leveraging fallback to a custom XOR-based encryption scheme when the Mcrypt extension for PHP is not available. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 34.0%.
CodeIgniter before 3.0 and Kohana 3.2.3 and earlier and 3.3.x through 3.3.2 make it easier for remote attackers to spoof session cookies and consequently conduct PHP object injection attacks by. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 44.8%.
Akeeba Restore (restore.php), as used in Joomla!. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
SourceCodester Drug Recommendation System 1.0 does not encrypt passwords submitted through the Password Handler in Admin/add_user.php, so an authenticated administrator can cause sensitive password data to be handled without cryptographic protection. Exploitation requires a high-privilege admin session (PR:H) and yields only low confidentiality impact, and the independent assessment classifies this as a low-priority, high-noise issue rather than a genuine threat. Publicly available exploit code exists, but no confirmed active exploitation is indicated by the supplied data.
Weak session key generation in dtale up to version 3.22.0 allows remote attackers with network access and session cookie capture capability to predict or brute-force the Flask SECRET_KEY and subsequently forge session cookies. The build_secret_key function in dtale/app.py generates a 10-character key using NumPy's non-cryptographic PRNG over a 36-character alphabet, yielding severely insufficient entropy for a security-sensitive value. Publicly available exploit code exists per the CVE description and corroborated by CVSS 4.0 E:P, but no active exploitation has been confirmed by CISA KEV; an upstream fix PR has been submitted but not yet merged.
Missing encryption of sensitive data in TRENDnet TEW-WLC100 (firmware 2.05b02) exposes VPN negotiation material when the racoon IKE daemon is configured to use IKE Phase 1 Aggressive Mode. An unauthenticated remote attacker positioned on the network path can passively intercept Aggressive Mode handshake traffic, capturing identity information and pre-shared key (PSK) hashes in cleartext, which are then subject to offline cracking. No public exploit code or CISA KEV listing has been identified at time of analysis; CVSS 4.0 rates this at 6.3 (Medium) with AC:H, reflecting the elevated complexity needed to intercept IKE traffic.
Meesho Online Shopping App versions up to 27.3 on Android implement risky cryptographic algorithms in the /api/endpoint component (com.meesho.supply), enabling remote attackers to disclose sensitive information without authentication. The vulnerability has CVSS 6.3 severity with public exploit code availability, though exploitation requires high attack complexity. This impacts the confidentiality of user data processed through affected API endpoints.
A security vulnerability has been detected in open-webu versions up to 0.6.16. is affected by cryptographic issues (CVSS 3.7).
Cryptographic validation weakness in the IBM Security Verify Access / Verify Identity Access Reverse Proxy (WebSEAL) allows remote attackers to bypass expected integrity checks on user-supplied data in certain configurations, affecting Security Verify Access 10.0 through 10.0.9.2 and Verify Identity Access (and its Container edition) 11.0 through 11.0.3. NVD rates this CVSS 9.8, but the vague 'certain configurations' wording and a low EPSS of 0.24% (15th percentile) with SSVC exploitation status 'none' point to a config-dependent issue rather than mass exploitation. There is no public exploit identified at time of analysis and it is not on CISA KEV.
Information disclosure in ZTE ZXUniPOS NDS-LTE (V24.40.40 and earlier, and V24.30.40CP02 and earlier) stems from an insecure cryptographic password scheme - such as hard-coded keys, weak encryption algorithms, or poor key management - that lets remote, unauthenticated attackers recover or tamper with protected data. The CVSS vector (AV:N/AC:H/PR:N) indicates network reachability without credentials but with high attack complexity, and the primary impact is confidentiality loss (C:H) with minor integrity and availability effects. There is no public exploit identified at time of analysis, and EPSS is very low (0.02%, 7th percentile).
CodeIgniter before 2.2.0 makes it easier for attackers to decode session cookies by leveraging fallback to a custom XOR-based encryption scheme when the Mcrypt extension for PHP is not available. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 34.0%.
CodeIgniter before 3.0 and Kohana 3.2.3 and earlier and 3.3.x through 3.3.2 make it easier for remote attackers to spoof session cookies and consequently conduct PHP object injection attacks by. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 44.8%.
Akeeba Restore (restore.php), as used in Joomla!. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
SourceCodester Drug Recommendation System 1.0 does not encrypt passwords submitted through the Password Handler in Admin/add_user.php, so an authenticated administrator can cause sensitive password data to be handled without cryptographic protection. Exploitation requires a high-privilege admin session (PR:H) and yields only low confidentiality impact, and the independent assessment classifies this as a low-priority, high-noise issue rather than a genuine threat. Publicly available exploit code exists, but no confirmed active exploitation is indicated by the supplied data.
Weak session key generation in dtale up to version 3.22.0 allows remote attackers with network access and session cookie capture capability to predict or brute-force the Flask SECRET_KEY and subsequently forge session cookies. The build_secret_key function in dtale/app.py generates a 10-character key using NumPy's non-cryptographic PRNG over a 36-character alphabet, yielding severely insufficient entropy for a security-sensitive value. Publicly available exploit code exists per the CVE description and corroborated by CVSS 4.0 E:P, but no active exploitation has been confirmed by CISA KEV; an upstream fix PR has been submitted but not yet merged.
Missing encryption of sensitive data in TRENDnet TEW-WLC100 (firmware 2.05b02) exposes VPN negotiation material when the racoon IKE daemon is configured to use IKE Phase 1 Aggressive Mode. An unauthenticated remote attacker positioned on the network path can passively intercept Aggressive Mode handshake traffic, capturing identity information and pre-shared key (PSK) hashes in cleartext, which are then subject to offline cracking. No public exploit code or CISA KEV listing has been identified at time of analysis; CVSS 4.0 rates this at 6.3 (Medium) with AC:H, reflecting the elevated complexity needed to intercept IKE traffic.
Meesho Online Shopping App versions up to 27.3 on Android implement risky cryptographic algorithms in the /api/endpoint component (com.meesho.supply), enabling remote attackers to disclose sensitive information without authentication. The vulnerability has CVSS 6.3 severity with public exploit code availability, though exploitation requires high attack complexity. This impacts the confidentiality of user data processed through affected API endpoints.
A security vulnerability has been detected in open-webu versions up to 0.6.16. is affected by cryptographic issues (CVSS 3.7).