Monthly
PraisonAI's WhatsApp and Linear bot webhook handlers fail open when their shared-secret environment variables are unset: HMAC signature verification is skipped entirely and the raw JSON body is parsed and dispatched as a trusted platform event. Any remote client that can reach the bot's webhook route (default /webhook) can forge WhatsApp messages or Linear AgentSession/Comment events without authentication, impersonating platform users and injecting attacker-controlled content into agent prompts and actions. The flaw affects releases before 4.6.59, is trivially automatable with a single unsigned HTTP POST, and no public exploit code or active exploitation has been identified at time of analysis.
Unrestricted wallet-credit minting in AVideo's AD_Server plugin allows any authenticated user to fraudulently inflate YPTWallet balances for campaign video owners without proof of ad delivery. The flaw resides in plugin/AD_Server/log.php, which accepts arbitrary label values - including label=start - via POST requests and credits the associated campaign wallet unconditionally. Repeated exploitation constitutes ad fraud, enabling attackers to generate synthetic platform currency at will. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthorized ADMIN access in Dell Secure Connect Gateway (SCG) 5.0 allows a remote unauthenticated attacker to replay a previously captured request indefinitely, forging ADMIN-level access and refresh tokens. Because the token-issuing flow performs no nonce validation and enforces no request expiry, a single intercepted request grants durable administrative control of the gateway. The Appliance edition is affected before 5.36.00.16 and the Application edition before 5.36.00.00; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthorized subscription upgrades in XenForo before 2.3.13 are achievable by replaying valid PayPal REST webhook payloads, because the platform performs no duplicate transaction ID check before processing incoming events. An attacker who possesses a legitimately captured webhook payload - for instance, from a prior genuine purchase - can retransmit it repeatedly to the XenForo webhook endpoint, triggering repeated subscription activations and elevating account privileges without additional payment. No public exploit has been identified at time of analysis, and a vendor patch (2.3.13) is available.
Unauthenticated shore-route hijacking in MOOS-IvP's uFldNodeBroker (through 24.8.1) lets any client of the vehicle's MOOSDB message bus enroll an attacker-controlled shore route by publishing a spoofed TRY_SHORE_HOST message, which the broker accepts without verifying its source. Once enrolled, the vehicle bridges its configured variables to the attacker's address, redirecting sensor telemetry and control-channel traffic. Reported by VulnCheck; a vendor fix exists as an upstream PR, and there is no public exploit identified at time of analysis.
Bridge-route injection in MOOS-IvP's uFldShoreBroker component (through version 24.8.1) lets remote unauthenticated attackers redirect bridged mission variables to attacker-controlled hosts. The shore broker accepts NODE_BROKER_PING messages and builds outbound pShare bridge routes from the sender-supplied HostRecord without verifying the ping's authenticity (CWE-345), so a forged ping can silently reroute autonomous-vehicle telemetry and control traffic. A vendor patch exists (PR #123 / commit 2f5224d) and the flaw was reported by VulnCheck, but no public exploit or active exploitation has been reported.
Unauthenticated UDP packet injection in MOOS essential-moos pMOOSBridge through version 10.0.1 allows any network-reachable attacker to inject arbitrary variables into the local MOOS publish-subscribe community by sending crafted UDP datagrams to the configured UDPListen port, with full control over spoofed source and community identifiers. The root cause is the absence of any source-address validation in the ListenLoop: the bridge historically accepted datagrams from any sender, trusting the identity claims embedded in the payload. No public exploit has been identified at time of analysis, and a fix is available via upstream PR/commit, though a tagged release version has not been independently confirmed.
Unauthenticated UDP datagram injection in essential-moos pShare through 10.0.1 allows any network-reachable attacker to send crafted UDP packets that pShare republishes verbatim to the local MOOS community under an attacker-chosen identity, or to crash the pShare bridge process with malformed payloads. The root flaw is that pShare's Listener class used raw socket reads without capturing the sender's address, performing no source validation before deserializing and forwarding messages as authoritative MOOS community traffic. A fix is available in upstream commit 53729b6 and PR #18, which adds allowlist-based source filtering and wraps deserialization in exception handling; no public exploit code has been identified and the CVE is not in CISA KEV.
Node identity spoofing in MOOS-IvP uFldNodeComms through 24.8.1 allows any network-reachable attacker to impersonate legitimate autonomous vehicle nodes and inject arbitrary MOOS variable notifications into the mission coordination fabric. The uFldNodeComms module (FldNodeComms.cpp) accepts the source node identity declared in the NODE_MESSAGE body payload without cross-checking it against the MOOSDB community from which the connection actually originated, a classic CWE-345 insufficient authenticity verification. An attacker reaching the MOOSDB communication bus can craft packets claiming to originate from any trusted node (e.g., a fleet commander or mission-critical sensor node), silently manipulating inter-vehicle state. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Remote code execution in Progress Telerik UI for ASP.NET AJAX (prior to v2026.3.812) is achievable by an attacker who has first obtained the application's encryption key material and uses it to forge or tamper with dialog request parameters consumed by the RadEditor file browser component. By manipulating the folder paths the file browser reads from, writes to, and uploads into, the attacker can redirect uploads to a web-accessible directory and plant a malicious ASPX webshell, achieving server-side code execution. No public exploit has been identified at time of analysis, and the prerequisite of key material compromise meaningfully constrains real-world exploitation despite the high CVSS score.
PraisonAI's WhatsApp and Linear bot webhook handlers fail open when their shared-secret environment variables are unset: HMAC signature verification is skipped entirely and the raw JSON body is parsed and dispatched as a trusted platform event. Any remote client that can reach the bot's webhook route (default /webhook) can forge WhatsApp messages or Linear AgentSession/Comment events without authentication, impersonating platform users and injecting attacker-controlled content into agent prompts and actions. The flaw affects releases before 4.6.59, is trivially automatable with a single unsigned HTTP POST, and no public exploit code or active exploitation has been identified at time of analysis.
Unrestricted wallet-credit minting in AVideo's AD_Server plugin allows any authenticated user to fraudulently inflate YPTWallet balances for campaign video owners without proof of ad delivery. The flaw resides in plugin/AD_Server/log.php, which accepts arbitrary label values - including label=start - via POST requests and credits the associated campaign wallet unconditionally. Repeated exploitation constitutes ad fraud, enabling attackers to generate synthetic platform currency at will. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthorized ADMIN access in Dell Secure Connect Gateway (SCG) 5.0 allows a remote unauthenticated attacker to replay a previously captured request indefinitely, forging ADMIN-level access and refresh tokens. Because the token-issuing flow performs no nonce validation and enforces no request expiry, a single intercepted request grants durable administrative control of the gateway. The Appliance edition is affected before 5.36.00.16 and the Application edition before 5.36.00.00; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthorized subscription upgrades in XenForo before 2.3.13 are achievable by replaying valid PayPal REST webhook payloads, because the platform performs no duplicate transaction ID check before processing incoming events. An attacker who possesses a legitimately captured webhook payload - for instance, from a prior genuine purchase - can retransmit it repeatedly to the XenForo webhook endpoint, triggering repeated subscription activations and elevating account privileges without additional payment. No public exploit has been identified at time of analysis, and a vendor patch (2.3.13) is available.
Unauthenticated shore-route hijacking in MOOS-IvP's uFldNodeBroker (through 24.8.1) lets any client of the vehicle's MOOSDB message bus enroll an attacker-controlled shore route by publishing a spoofed TRY_SHORE_HOST message, which the broker accepts without verifying its source. Once enrolled, the vehicle bridges its configured variables to the attacker's address, redirecting sensor telemetry and control-channel traffic. Reported by VulnCheck; a vendor fix exists as an upstream PR, and there is no public exploit identified at time of analysis.
Bridge-route injection in MOOS-IvP's uFldShoreBroker component (through version 24.8.1) lets remote unauthenticated attackers redirect bridged mission variables to attacker-controlled hosts. The shore broker accepts NODE_BROKER_PING messages and builds outbound pShare bridge routes from the sender-supplied HostRecord without verifying the ping's authenticity (CWE-345), so a forged ping can silently reroute autonomous-vehicle telemetry and control traffic. A vendor patch exists (PR #123 / commit 2f5224d) and the flaw was reported by VulnCheck, but no public exploit or active exploitation has been reported.
Unauthenticated UDP packet injection in MOOS essential-moos pMOOSBridge through version 10.0.1 allows any network-reachable attacker to inject arbitrary variables into the local MOOS publish-subscribe community by sending crafted UDP datagrams to the configured UDPListen port, with full control over spoofed source and community identifiers. The root cause is the absence of any source-address validation in the ListenLoop: the bridge historically accepted datagrams from any sender, trusting the identity claims embedded in the payload. No public exploit has been identified at time of analysis, and a fix is available via upstream PR/commit, though a tagged release version has not been independently confirmed.
Unauthenticated UDP datagram injection in essential-moos pShare through 10.0.1 allows any network-reachable attacker to send crafted UDP packets that pShare republishes verbatim to the local MOOS community under an attacker-chosen identity, or to crash the pShare bridge process with malformed payloads. The root flaw is that pShare's Listener class used raw socket reads without capturing the sender's address, performing no source validation before deserializing and forwarding messages as authoritative MOOS community traffic. A fix is available in upstream commit 53729b6 and PR #18, which adds allowlist-based source filtering and wraps deserialization in exception handling; no public exploit code has been identified and the CVE is not in CISA KEV.
Node identity spoofing in MOOS-IvP uFldNodeComms through 24.8.1 allows any network-reachable attacker to impersonate legitimate autonomous vehicle nodes and inject arbitrary MOOS variable notifications into the mission coordination fabric. The uFldNodeComms module (FldNodeComms.cpp) accepts the source node identity declared in the NODE_MESSAGE body payload without cross-checking it against the MOOSDB community from which the connection actually originated, a classic CWE-345 insufficient authenticity verification. An attacker reaching the MOOSDB communication bus can craft packets claiming to originate from any trusted node (e.g., a fleet commander or mission-critical sensor node), silently manipulating inter-vehicle state. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Remote code execution in Progress Telerik UI for ASP.NET AJAX (prior to v2026.3.812) is achievable by an attacker who has first obtained the application's encryption key material and uses it to forge or tamper with dialog request parameters consumed by the RadEditor file browser component. By manipulating the folder paths the file browser reads from, writes to, and uploads into, the attacker can redirect uploads to a web-accessible directory and plant a malicious ASPX webshell, achieving server-side code execution. No public exploit has been identified at time of analysis, and the prerequisite of key material compromise meaningfully constrains real-world exploitation despite the high CVSS score.