Monthly
Bucket squatting in Google Cloud Run MCP before 1.11.0 lets an unauthenticated remote attacker who pre-registers a predictable Cloud Storage bucket intercept proprietary source code staged by the tool, tamper with deployments to execute arbitrary code, and exfiltrate data. Real-world urgency is tempered below the raw CVSS 4.0 base score of 7.7 because the attacker must claim the predictable bucket before the tool does and a developer must then run a deployment through the vulnerable instance. No CISA KEV entry or public exploit was identified at time of analysis, and the vendor's stated fix is upgrading to 1.11.0 or later.
Predictable session identifier generation in the Botslab G980H dash camera allows an unauthenticated attacker on the same adjacent network to enumerate or guess a valid session ID and use it to bypass the device's authorization controls, gaining high-impact read/write access to camera functionality. Exploitation is constrained rather than trivial: the attacker must already be on the same local/link-layer network as the camera and must time the attempt to coincide with a legitimate active session, and the supplied CVSS 4.0 vector reflects that prerequisite via AT:P alongside AV:A, PR:N and UI:N. There is no remote-internet attack path, so this is best characterized as a genuine but not high-priority weakness; no public exploit code has been identified at time of analysis and no CISA KEV listing or EPSS data accompanies this report.
Predictable digital-product download tokens in the Concrete CMS Community Store package before 2.7.8 allow unauthenticated remote attackers to download files belonging to other customers. The token protecting each download URL is an MD5 hash of the order's creation timestamp - a value with only one-second resolution - so an attacker who can enumerate valid order and file identifiers can brute-force the token and retrieve purchased digital goods. The flaw is remotely exploitable without authentication or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, vendor-assigned CVSS 4.0 score 8.7) and affects any Concrete CMS site selling downloadable products with this package; no public exploit code was identified at time of analysis, though the deterministic token construction makes weaponization trivial once identifiers are known.
Broken access control in OpnForm's editable-submission feature lets unauthenticated attackers derive any submission's secret because the Hashids library is used with an empty default salt over sequential database row IDs. Since the hash of a sequential integer becomes trivially predictable, an attacker can enumerate submissions to read other respondents' full answer data via the submission-fetch endpoint or overwrite existing submissions through the answer endpoint. Reported by VulnCheck and patched in v2.0.2; there is no public exploit identified at time of analysis, but the flaw is remotely and trivially reproducible against affected default installs.
Unauthorized device enrollment in the Setracker2 Android companion app (com.tgelec.setracker) versions 3.1.5 and prior lets remote attackers hijack other users' GPS smartwatches by guessing their registration ID. The registration ID is predictably derived from the device IMEI, and the enrollment workflow performs no secondary authentication before binding a watch to an account, so an attacker who learns or calculates the ID can take over the target's tracker. No public exploit has been identified at time of analysis, and the issue carries a CVSS 4.0 base score of 8.3 with high confidentiality impact, reflecting exposure of a child's or wearer's location data.
Account takeover in ManageEngine ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus is possible because SSO session-authentication tickets are generated with insufficient randomness and can be predicted by an unauthenticated remote attacker. Successful prediction lets the attacker impersonate arbitrary users and gain full session-level confidentiality, integrity, and availability impact (CVSS 9.0). No public exploit identified at time of analysis, but the issue is acknowledged in the vendor advisory.
CSRF session hijacking in Mojolicious::Plugin::Web::Auth::OAuth2 through version 0.17 for Perl stems from a predictable default state parameter built from a SHA-1 hash of leaked epoch time and Perl's weak rand(). Remote attackers can guess or precompute valid state values to forge OAuth2 authorization responses and bind a victim's session to an attacker-controlled identity. No public exploit identified at time of analysis, EPSS is low (0.19%, 8th percentile), and a vendor patch is available.
Predictable session ID generation in Apache::Session::Generate::ModUniqueId 1.54-1.94 allows remote unauthenticated attackers to forge session tokens and hijack user sessions. The vulnerability stems from using Apache mod_unique_id values as session identifiers-these values are deterministic and constructed from publicly observable or easily guessable components (server IP, process ID, timestamp, counter). With CVSS 9.1 and SSVC automation classification, this enables systematic session hijacking at scale despite no confirmed active exploitation.
Weak session ID generation in Solstice::Session for Perl (all versions through 1440) enables session prediction and hijacking attacks by unauthenticated remote attackers. The vulnerability stems from cryptographically weak entropy sources (MD5 with predictable epoch time, stringified hash references, 16-bit rand() seeding, and limited process IDs), allowing attackers to forge valid session tokens and impersonate legitimate users. EPSS score of 0.02% (4th percentile) indicates low observed exploi
HTTP::Session versions through 0.53 for Perl defaults to using insecurely generated session ids.
Bucket squatting in Google Cloud Run MCP before 1.11.0 lets an unauthenticated remote attacker who pre-registers a predictable Cloud Storage bucket intercept proprietary source code staged by the tool, tamper with deployments to execute arbitrary code, and exfiltrate data. Real-world urgency is tempered below the raw CVSS 4.0 base score of 7.7 because the attacker must claim the predictable bucket before the tool does and a developer must then run a deployment through the vulnerable instance. No CISA KEV entry or public exploit was identified at time of analysis, and the vendor's stated fix is upgrading to 1.11.0 or later.
Predictable session identifier generation in the Botslab G980H dash camera allows an unauthenticated attacker on the same adjacent network to enumerate or guess a valid session ID and use it to bypass the device's authorization controls, gaining high-impact read/write access to camera functionality. Exploitation is constrained rather than trivial: the attacker must already be on the same local/link-layer network as the camera and must time the attempt to coincide with a legitimate active session, and the supplied CVSS 4.0 vector reflects that prerequisite via AT:P alongside AV:A, PR:N and UI:N. There is no remote-internet attack path, so this is best characterized as a genuine but not high-priority weakness; no public exploit code has been identified at time of analysis and no CISA KEV listing or EPSS data accompanies this report.
Predictable digital-product download tokens in the Concrete CMS Community Store package before 2.7.8 allow unauthenticated remote attackers to download files belonging to other customers. The token protecting each download URL is an MD5 hash of the order's creation timestamp - a value with only one-second resolution - so an attacker who can enumerate valid order and file identifiers can brute-force the token and retrieve purchased digital goods. The flaw is remotely exploitable without authentication or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, vendor-assigned CVSS 4.0 score 8.7) and affects any Concrete CMS site selling downloadable products with this package; no public exploit code was identified at time of analysis, though the deterministic token construction makes weaponization trivial once identifiers are known.
Broken access control in OpnForm's editable-submission feature lets unauthenticated attackers derive any submission's secret because the Hashids library is used with an empty default salt over sequential database row IDs. Since the hash of a sequential integer becomes trivially predictable, an attacker can enumerate submissions to read other respondents' full answer data via the submission-fetch endpoint or overwrite existing submissions through the answer endpoint. Reported by VulnCheck and patched in v2.0.2; there is no public exploit identified at time of analysis, but the flaw is remotely and trivially reproducible against affected default installs.
Unauthorized device enrollment in the Setracker2 Android companion app (com.tgelec.setracker) versions 3.1.5 and prior lets remote attackers hijack other users' GPS smartwatches by guessing their registration ID. The registration ID is predictably derived from the device IMEI, and the enrollment workflow performs no secondary authentication before binding a watch to an account, so an attacker who learns or calculates the ID can take over the target's tracker. No public exploit has been identified at time of analysis, and the issue carries a CVSS 4.0 base score of 8.3 with high confidentiality impact, reflecting exposure of a child's or wearer's location data.
Account takeover in ManageEngine ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus is possible because SSO session-authentication tickets are generated with insufficient randomness and can be predicted by an unauthenticated remote attacker. Successful prediction lets the attacker impersonate arbitrary users and gain full session-level confidentiality, integrity, and availability impact (CVSS 9.0). No public exploit identified at time of analysis, but the issue is acknowledged in the vendor advisory.
CSRF session hijacking in Mojolicious::Plugin::Web::Auth::OAuth2 through version 0.17 for Perl stems from a predictable default state parameter built from a SHA-1 hash of leaked epoch time and Perl's weak rand(). Remote attackers can guess or precompute valid state values to forge OAuth2 authorization responses and bind a victim's session to an attacker-controlled identity. No public exploit identified at time of analysis, EPSS is low (0.19%, 8th percentile), and a vendor patch is available.
Predictable session ID generation in Apache::Session::Generate::ModUniqueId 1.54-1.94 allows remote unauthenticated attackers to forge session tokens and hijack user sessions. The vulnerability stems from using Apache mod_unique_id values as session identifiers-these values are deterministic and constructed from publicly observable or easily guessable components (server IP, process ID, timestamp, counter). With CVSS 9.1 and SSVC automation classification, this enables systematic session hijacking at scale despite no confirmed active exploitation.
Weak session ID generation in Solstice::Session for Perl (all versions through 1440) enables session prediction and hijacking attacks by unauthenticated remote attackers. The vulnerability stems from cryptographically weak entropy sources (MD5 with predictable epoch time, stringified hash references, 16-bit rand() seeding, and limited process IDs), allowing attackers to forge valid session tokens and impersonate legitimate users. EPSS score of 0.02% (4th percentile) indicates low observed exploi
HTTP::Session versions through 0.53 for Perl defaults to using insecurely generated session ids.