Monthly
Unauthenticated attackers can bypass signature verification in FlexPrice's QuickBooks webhook handler (HandleQuickBooksWebhook) through version 2.1.38 by omitting the intuit-signature header, enabling forged payment notifications that can mark invoices paid or overpaid. Exploitation requires knowledge of a valid tenant and environment ID and an active, network-reachable QuickBooks integration; deployments not using QuickBooks webhooks are unaffected. No public exploit identified at time of analysis, though a public technical write-up is available, and this is a credible, moderate-to-high integrity risk.
A signature-verification bypass in the CAI Content Credentials SDK allows an unauthenticated, network-reachable attacker to submit content or a token bearing a forged or tampered cryptographic signature that the SDK's verifier accepts, yielding unauthorized write access to systems that rely on that verification as a trust decision. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) the attack needs no credentials and no user interaction, and the assessment confines impact to integrity only, with no confidentiality or availability loss. The practical exposure is narrow but real: only deployments that actually consume the SDK to validate signatures or claims as a security control are affected, and no public exploit code was identified at time of analysis, so this is a genuine integrity issue rather than an acute emergency.
Improper verification of cryptographic signatures in the CAI Content Credentials SDK allows unauthenticated remote attackers to supply forged or improperly signed content credentials that the SDK accepts as authentic, bypassing the security check and gaining unauthorized write access to whatever the SDK's verification verdict gates. The CVSS 3.1 base score is 7.5 (High) under the vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - an integrity-only signature-verification bypass (CWE-347) with no confidentiality or availability impact, requiring no authentication and no user interaction. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV; real-world risk is highest in deployments that make publishing, authorization, or authenticity decisions solely on the SDK's verification result, and negligible where that result is not treated as a trust boundary.
Improper verification of cryptographic signatures in Adobe's CAI Content Credentials SDK allows remote, unauthenticated attackers to submit a forged or tampered Content Credentials manifest that the SDK accepts as valid, bypassing a security feature and granting unauthorized write access to credential data (CWE-347; CVSS 3.1 7.5). Per the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, no credentials and no user interaction are required, and the impact is integrity-only, with confidentiality and availability unaffected; in practice exploitation depends on the vulnerable SDK version being deployed and the consuming application treating signature verification as a trust boundary. This is a moderate-priority integrity issue rather than a top-tier emergency, and no public exploit code or confirmed active exploitation was identified in the available intelligence at time of analysis.
Signature-verification bypass in Adobe Content Credentials SDK allows unauthenticated, network-based attackers to forge or tamper with signed content credentials, bypassing integrity checks to gain unauthorized write access. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, base 7.5) indicates a low-complexity flaw with no user interaction and a pure integrity impact. No public exploit code has been identified at time of analysis, but risk is elevated for applications that rely on the SDK's verification result as a trust or authorization decision. Confirm vulnerable SDK versions against Adobe APSB26-163.
Local privilege escalation in the Windows Audio Service lets an authenticated low-privilege user on affected Windows 11 builds (24H2, 25H2, 26H1, 26H2) have attacker-controlled content accepted as trusted, yielding high confidentiality, integrity, and availability impact at CVSS 7.8. Exploitation is local-only and requires an existing foothold (PR:L) with no user interaction (UI:N) and low complexity (AC:L), so escalation is reliable once the attacker is on the host, though limiting factors are the mandatory authenticated local access and the fact that patched builds are not exploitable. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
Authentication bypass in Microsoft .NET allows an unauthenticated, remote attacker to forge a cryptographic signature and have it accepted by applications that rely on the framework's signature-verification routines, potentially leading to unauthorized access or token misuse. The JWT Attack tag points to a token-signature validation weakness; exploitation requires the target application or user to process the attacker-supplied signed token (UI:R), which limits reachability for purely passive endpoints. Affected versions include .NET 10.0 before 10.0.402, .NET 11.0 before 11.0.100-rc.2, and the listed Visual Studio 2022 17.14.x/2026 18.10.x builds; vendor patches are available, and no public exploit identified at time of analysis.
Spoofing in Microsoft Active Directory Federation Services (AD FS) lets a remote, unauthenticated attacker forge signed tokens that the service accepts as legitimate, yielding full compromise of confidentiality and integrity (CVSS 9.1, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). The flaw is an improper verification of cryptographic signatures (CWE-347) in the AD FS token-validation path, tagged as an authentication bypass/JWT attack, so a crafted SAML/JWT assertion can impersonate any user or relying party - effectively bypassing federation authentication. Only hosts running the AD FS role on unpatched Windows Server builds (2012 through 2025) are exposed; organizations that do not deploy AD FS are not affected. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA SSVC: Exploitation = none, Automatable = yes, Technical Impact = total), but the vulnerability is considered high-priority because exploitation is trivially automatable and impact is total where the role is exposed.
Privilege elevation in Microsoft Exchange Server lets an authenticated low-privilege attacker forge or tamper with a signed security token that the server improperly validates, achieving full compromise of confidentiality, integrity, and availability on the affected build (CVSS 3.1 base 7.5, CWE-347). The flaw affects Exchange Server 2016 CU23 (below 15.01.2507.077), Exchange Server 2019 CU14 (below 15.02.1544.050) and CU15 (below 15.02.1748.055), and Exchange Server Subscription Edition RTM (below 15.02.2562.056); fully patched builds are not exploitable. Exploitation requires a pre-existing low-privilege identity on the server plus conditions outside the attacker's control (AC:H), CISA's SSVC rates exploitation as none and automatable as no, and no public exploit identified at time of analysis.
Improper verification of cryptographic signatures in Microsoft Windows Schannel, the operating system's native TLS/SSL provider, allows an unauthenticated attacker who already holds a man-in-the-middle position to spoof a trusted TLS peer and bypass authentication during a handshake. Affected builds include Windows Server 2025 before 10.0.26100.33650, Windows Server 2025 Server Core before the same build, Windows Server 2022 before 10.0.20348.5761, and Windows 11 23H2, 24H2, 25H2, 26H1 and 26H2 below their respective patched build levels. The 9.0 base score reflects high confidentiality and integrity impact with changed scope, but exploitation carries a high-complexity prerequisite (CVSS AC:H) because the attacker must control or inject into the path between the Windows endpoint and its peer; no attacks require credentials (PR:N) and no user interaction is needed (UI:N). No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (no CISA KEV listing), but vendor patches are available and the affected footprint is broad, so remediation should be treated as high priority.
Unauthenticated attackers can bypass signature verification in FlexPrice's QuickBooks webhook handler (HandleQuickBooksWebhook) through version 2.1.38 by omitting the intuit-signature header, enabling forged payment notifications that can mark invoices paid or overpaid. Exploitation requires knowledge of a valid tenant and environment ID and an active, network-reachable QuickBooks integration; deployments not using QuickBooks webhooks are unaffected. No public exploit identified at time of analysis, though a public technical write-up is available, and this is a credible, moderate-to-high integrity risk.
A signature-verification bypass in the CAI Content Credentials SDK allows an unauthenticated, network-reachable attacker to submit content or a token bearing a forged or tampered cryptographic signature that the SDK's verifier accepts, yielding unauthorized write access to systems that rely on that verification as a trust decision. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) the attack needs no credentials and no user interaction, and the assessment confines impact to integrity only, with no confidentiality or availability loss. The practical exposure is narrow but real: only deployments that actually consume the SDK to validate signatures or claims as a security control are affected, and no public exploit code was identified at time of analysis, so this is a genuine integrity issue rather than an acute emergency.
Improper verification of cryptographic signatures in the CAI Content Credentials SDK allows unauthenticated remote attackers to supply forged or improperly signed content credentials that the SDK accepts as authentic, bypassing the security check and gaining unauthorized write access to whatever the SDK's verification verdict gates. The CVSS 3.1 base score is 7.5 (High) under the vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - an integrity-only signature-verification bypass (CWE-347) with no confidentiality or availability impact, requiring no authentication and no user interaction. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV; real-world risk is highest in deployments that make publishing, authorization, or authenticity decisions solely on the SDK's verification result, and negligible where that result is not treated as a trust boundary.
Improper verification of cryptographic signatures in Adobe's CAI Content Credentials SDK allows remote, unauthenticated attackers to submit a forged or tampered Content Credentials manifest that the SDK accepts as valid, bypassing a security feature and granting unauthorized write access to credential data (CWE-347; CVSS 3.1 7.5). Per the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, no credentials and no user interaction are required, and the impact is integrity-only, with confidentiality and availability unaffected; in practice exploitation depends on the vulnerable SDK version being deployed and the consuming application treating signature verification as a trust boundary. This is a moderate-priority integrity issue rather than a top-tier emergency, and no public exploit code or confirmed active exploitation was identified in the available intelligence at time of analysis.
Signature-verification bypass in Adobe Content Credentials SDK allows unauthenticated, network-based attackers to forge or tamper with signed content credentials, bypassing integrity checks to gain unauthorized write access. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, base 7.5) indicates a low-complexity flaw with no user interaction and a pure integrity impact. No public exploit code has been identified at time of analysis, but risk is elevated for applications that rely on the SDK's verification result as a trust or authorization decision. Confirm vulnerable SDK versions against Adobe APSB26-163.
Local privilege escalation in the Windows Audio Service lets an authenticated low-privilege user on affected Windows 11 builds (24H2, 25H2, 26H1, 26H2) have attacker-controlled content accepted as trusted, yielding high confidentiality, integrity, and availability impact at CVSS 7.8. Exploitation is local-only and requires an existing foothold (PR:L) with no user interaction (UI:N) and low complexity (AC:L), so escalation is reliable once the attacker is on the host, though limiting factors are the mandatory authenticated local access and the fact that patched builds are not exploitable. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
Authentication bypass in Microsoft .NET allows an unauthenticated, remote attacker to forge a cryptographic signature and have it accepted by applications that rely on the framework's signature-verification routines, potentially leading to unauthorized access or token misuse. The JWT Attack tag points to a token-signature validation weakness; exploitation requires the target application or user to process the attacker-supplied signed token (UI:R), which limits reachability for purely passive endpoints. Affected versions include .NET 10.0 before 10.0.402, .NET 11.0 before 11.0.100-rc.2, and the listed Visual Studio 2022 17.14.x/2026 18.10.x builds; vendor patches are available, and no public exploit identified at time of analysis.
Spoofing in Microsoft Active Directory Federation Services (AD FS) lets a remote, unauthenticated attacker forge signed tokens that the service accepts as legitimate, yielding full compromise of confidentiality and integrity (CVSS 9.1, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). The flaw is an improper verification of cryptographic signatures (CWE-347) in the AD FS token-validation path, tagged as an authentication bypass/JWT attack, so a crafted SAML/JWT assertion can impersonate any user or relying party - effectively bypassing federation authentication. Only hosts running the AD FS role on unpatched Windows Server builds (2012 through 2025) are exposed; organizations that do not deploy AD FS are not affected. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA SSVC: Exploitation = none, Automatable = yes, Technical Impact = total), but the vulnerability is considered high-priority because exploitation is trivially automatable and impact is total where the role is exposed.
Privilege elevation in Microsoft Exchange Server lets an authenticated low-privilege attacker forge or tamper with a signed security token that the server improperly validates, achieving full compromise of confidentiality, integrity, and availability on the affected build (CVSS 3.1 base 7.5, CWE-347). The flaw affects Exchange Server 2016 CU23 (below 15.01.2507.077), Exchange Server 2019 CU14 (below 15.02.1544.050) and CU15 (below 15.02.1748.055), and Exchange Server Subscription Edition RTM (below 15.02.2562.056); fully patched builds are not exploitable. Exploitation requires a pre-existing low-privilege identity on the server plus conditions outside the attacker's control (AC:H), CISA's SSVC rates exploitation as none and automatable as no, and no public exploit identified at time of analysis.
Improper verification of cryptographic signatures in Microsoft Windows Schannel, the operating system's native TLS/SSL provider, allows an unauthenticated attacker who already holds a man-in-the-middle position to spoof a trusted TLS peer and bypass authentication during a handshake. Affected builds include Windows Server 2025 before 10.0.26100.33650, Windows Server 2025 Server Core before the same build, Windows Server 2022 before 10.0.20348.5761, and Windows 11 23H2, 24H2, 25H2, 26H1 and 26H2 below their respective patched build levels. The 9.0 base score reflects high confidentiality and integrity impact with changed scope, but exploitation carries a high-complexity prerequisite (CVSS AC:H) because the attacker must control or inject into the path between the Windows endpoint and its peer; no attacks require credentials (PR:N) and no user interaction is needed (UI:N). No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (no CISA KEV listing), but vendor patches are available and the affected footprint is broad, so remediation should be treated as high priority.