Monthly
Authentication bypass in Znuny through 7.3.6 allows a remote, unauthenticated attacker to impersonate any existing account - including administrators - by sending a forged 'Remote-User' HTTP header, granting full access to confidential ticket data and system controls without any password. The flaw only manifests when the HTTPBasicAuth authentication backend (Kernel::System::Auth::HTTPBasicAuth for agents and/or Kernel::System::CustomerAuth::HTTPBasicAuth for customers) is configured, which is a non-default deployment choice, and when the fronting web server passes an inbound Remote-User header through to the Perl process unsanitized. No public exploit code and no confirmed active exploitation were identified in the available data, and the CNA's CVSS 9.5 rating is tempered by the genuine configuration prerequisite; installations using the default database or LDAP authentication backends are not affected.
Pinned vLLM deployments (0.22.1 through 0.28.0) running the FunAudioChat or Tarsier2 architectures silently ignore the operator's --revision/--code-revision pin for several Hugging Face artifacts, allowing a subsequent change to the upstream repository's default branch to alter audio preprocessing, speech-tokenizer behavior, or Tarsier2 configuration without any change to the operator's configured pin. The result is a supply-chain integrity and reproducibility failure rather than a code-execution flaw: the advisory explicitly states it is residual to CVE-2026-47155 / GHSA-3ww4-5jv9-j5gm and does not constitute remote code execution or a trust_remote_code=False bypass, despite an 'RCE' tag appearing in some threat-feed metadata. There is no public exploit code identified at time of analysis and no confirmed active exploitation (CISA KEV); exploitation requires the narrow combination of an affected architecture, an operator using a revision pin, and an actor able to modify the upstream Hugging Face repository's default revision, so default general-purpose vLLM deployments are unaffected.
Authentication bypass in OpenStack Zaqar before 22.0.2 allows an unauthenticated remote attacker who knows a target project's UUID to send a request carrying an empty URL-Signature header and defeat both Keystone authentication and pre-signed URL verification, gaining the ability to read, enumerate, create, and delete that project's queues, messages, claims, and subscriptions. Only deployments using the WSGI transport with an authentication strategy configured are exposed; the websocket transport is explicitly not affected, and escalation to administrative operations such as managing pools and flavors additionally requires an admin_mode deployment in which the attacker asserts an administrative role. The issue is rated CVSS 4.0 base 9.2, while independent assessment scores it CVSS 3.1 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) with the AC:H component reflecting the prerequisite knowledge of the victim project UUID; no public exploit code or confirmed active exploitation was identified at time of analysis.
Payment-confirmation forgery in PayTR's Virtual Pos iFrame API (v9x) WHMCS Module (v9.0.0 to before v9.0.3) lets remote unauthenticated attackers spoof a trusted payment identifier so the module treats an unpaid or attacker-controlled transaction as legitimately settled. Reported by TR-CERT, it stems from the module relying on a less-trusted, client-influenceable source instead of server-to-server verification of PayTR's callback. No public exploit is identified at time of analysis, and no EPSS or KEV data was supplied.
Unauthenticated information disclosure in FileCodeBox before 2.4 lets remote attackers defeat the IPRateLimit anti-bruteforce control by spoofing X-Real-IP and X-Forwarded-For headers, which the application trusted without verifying the request originated from a configured reverse proxy. By rotating a unique fake IP on every request, an attacker resets their throttling counter indefinitely and can brute-force the short share codes to download other users' files. CVSS 4.0 is 8.7 (high), the fix shipped in release V2.4, and no public exploit or CISA KEV listing was identified at time of analysis.
Brute-force protection bypass in Glance (glanceapp/glance) 0.8.5 lets remote unauthenticated attackers defeat the per-IP failed-login lockout by rotating the leftmost value of the X-Forwarded-For header, but only when the server 'proxied' option is enabled. Because the authentication handler trusted the client-supplied leftmost XFF value instead of the trusted reverse proxy's rightmost value, each guess appears to come from a new IP and the lockout counter never trips, enabling unlimited credential guessing against the login endpoint. No public exploit identified at time of analysis and it is not in CISA KEV, though the upstream fix (PR #1033) and VulnCheck advisory make the technique trivially reproducible.
Log integrity spoofing in Eclipse Kura before 5.6.2 lets an unauthenticated remote attacker forge the client IP recorded in audit logs by supplying a crafted X-Forwarded-For header, because the Jetty ForwardedRequestCustomizer is installed unconditionally on every connector and getRemoteAddr() reflects the header value. This enables bypass of IP-based brute-force defenses like fail2ban (spoofing a non-routable source to evade bans) or a denial of service against a third party by injecting a victim IP so their address is banned. No public exploit is identified at time of analysis and it is not on CISA KEV; CVSS 4.0 base score is 8.8.
Authentication bypass in Hermes WebUI before 0.51.307 lets unauthenticated remote attackers reach onboarding endpoints that are supposed to be restricted to loopback traffic by spoofing an X-Forwarded-For header with a 127.0.0.1 value. Once past the origin check, an attacker can pivot to server-side request forgery against internal services and cloud metadata endpoints, overwrite LLM provider configuration and API keys, or start an OAuth device-code flow to mint persistent tokens saved in auth.json. A vendor patch exists; the flaw carries a CVSS 4.0 score of 9.3, but no public exploit code has been identified at time of analysis.
Security-control bypass in OpenSSH sshd before 10.4 causes the DisableForwarding=yes hardening directive to be silently ignored when PermitTunnel=yes is also set, so tun-device forwarding remains available despite an administrator's explicit policy to disable all forwarding. Affected operators are those who rely on DisableForwarding as a defense-in-depth restriction; the flaw lets an authenticated user establish layer-2/3 tunnels the configuration was meant to forbid. There is no public exploit identified at time of analysis, EPSS is low (0.13%, 3rd percentile), and it is not on CISA KEV.
TLS trust store poisoning in Canonical ADSys through v0.16.2 allows a network-positioned attacker to inject an arbitrary Root CA certificate into managed Ubuntu hosts during Active Directory Certificate Services auto-enrollment. The vendored Samba GPO extension fetches the CA certificate over plaintext HTTP from the AD CS GetCACert endpoint, and the response is registered into the system trust store via update-ca-certificates without authenticity validation. No public exploit identified at time of analysis, but the impact enables persistent decryption of TLS traffic across the host.
Authentication bypass in Znuny through 7.3.6 allows a remote, unauthenticated attacker to impersonate any existing account - including administrators - by sending a forged 'Remote-User' HTTP header, granting full access to confidential ticket data and system controls without any password. The flaw only manifests when the HTTPBasicAuth authentication backend (Kernel::System::Auth::HTTPBasicAuth for agents and/or Kernel::System::CustomerAuth::HTTPBasicAuth for customers) is configured, which is a non-default deployment choice, and when the fronting web server passes an inbound Remote-User header through to the Perl process unsanitized. No public exploit code and no confirmed active exploitation were identified in the available data, and the CNA's CVSS 9.5 rating is tempered by the genuine configuration prerequisite; installations using the default database or LDAP authentication backends are not affected.
Pinned vLLM deployments (0.22.1 through 0.28.0) running the FunAudioChat or Tarsier2 architectures silently ignore the operator's --revision/--code-revision pin for several Hugging Face artifacts, allowing a subsequent change to the upstream repository's default branch to alter audio preprocessing, speech-tokenizer behavior, or Tarsier2 configuration without any change to the operator's configured pin. The result is a supply-chain integrity and reproducibility failure rather than a code-execution flaw: the advisory explicitly states it is residual to CVE-2026-47155 / GHSA-3ww4-5jv9-j5gm and does not constitute remote code execution or a trust_remote_code=False bypass, despite an 'RCE' tag appearing in some threat-feed metadata. There is no public exploit code identified at time of analysis and no confirmed active exploitation (CISA KEV); exploitation requires the narrow combination of an affected architecture, an operator using a revision pin, and an actor able to modify the upstream Hugging Face repository's default revision, so default general-purpose vLLM deployments are unaffected.
Authentication bypass in OpenStack Zaqar before 22.0.2 allows an unauthenticated remote attacker who knows a target project's UUID to send a request carrying an empty URL-Signature header and defeat both Keystone authentication and pre-signed URL verification, gaining the ability to read, enumerate, create, and delete that project's queues, messages, claims, and subscriptions. Only deployments using the WSGI transport with an authentication strategy configured are exposed; the websocket transport is explicitly not affected, and escalation to administrative operations such as managing pools and flavors additionally requires an admin_mode deployment in which the attacker asserts an administrative role. The issue is rated CVSS 4.0 base 9.2, while independent assessment scores it CVSS 3.1 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) with the AC:H component reflecting the prerequisite knowledge of the victim project UUID; no public exploit code or confirmed active exploitation was identified at time of analysis.
Payment-confirmation forgery in PayTR's Virtual Pos iFrame API (v9x) WHMCS Module (v9.0.0 to before v9.0.3) lets remote unauthenticated attackers spoof a trusted payment identifier so the module treats an unpaid or attacker-controlled transaction as legitimately settled. Reported by TR-CERT, it stems from the module relying on a less-trusted, client-influenceable source instead of server-to-server verification of PayTR's callback. No public exploit is identified at time of analysis, and no EPSS or KEV data was supplied.
Unauthenticated information disclosure in FileCodeBox before 2.4 lets remote attackers defeat the IPRateLimit anti-bruteforce control by spoofing X-Real-IP and X-Forwarded-For headers, which the application trusted without verifying the request originated from a configured reverse proxy. By rotating a unique fake IP on every request, an attacker resets their throttling counter indefinitely and can brute-force the short share codes to download other users' files. CVSS 4.0 is 8.7 (high), the fix shipped in release V2.4, and no public exploit or CISA KEV listing was identified at time of analysis.
Brute-force protection bypass in Glance (glanceapp/glance) 0.8.5 lets remote unauthenticated attackers defeat the per-IP failed-login lockout by rotating the leftmost value of the X-Forwarded-For header, but only when the server 'proxied' option is enabled. Because the authentication handler trusted the client-supplied leftmost XFF value instead of the trusted reverse proxy's rightmost value, each guess appears to come from a new IP and the lockout counter never trips, enabling unlimited credential guessing against the login endpoint. No public exploit identified at time of analysis and it is not in CISA KEV, though the upstream fix (PR #1033) and VulnCheck advisory make the technique trivially reproducible.
Log integrity spoofing in Eclipse Kura before 5.6.2 lets an unauthenticated remote attacker forge the client IP recorded in audit logs by supplying a crafted X-Forwarded-For header, because the Jetty ForwardedRequestCustomizer is installed unconditionally on every connector and getRemoteAddr() reflects the header value. This enables bypass of IP-based brute-force defenses like fail2ban (spoofing a non-routable source to evade bans) or a denial of service against a third party by injecting a victim IP so their address is banned. No public exploit is identified at time of analysis and it is not on CISA KEV; CVSS 4.0 base score is 8.8.
Authentication bypass in Hermes WebUI before 0.51.307 lets unauthenticated remote attackers reach onboarding endpoints that are supposed to be restricted to loopback traffic by spoofing an X-Forwarded-For header with a 127.0.0.1 value. Once past the origin check, an attacker can pivot to server-side request forgery against internal services and cloud metadata endpoints, overwrite LLM provider configuration and API keys, or start an OAuth device-code flow to mint persistent tokens saved in auth.json. A vendor patch exists; the flaw carries a CVSS 4.0 score of 9.3, but no public exploit code has been identified at time of analysis.
Security-control bypass in OpenSSH sshd before 10.4 causes the DisableForwarding=yes hardening directive to be silently ignored when PermitTunnel=yes is also set, so tun-device forwarding remains available despite an administrator's explicit policy to disable all forwarding. Affected operators are those who rely on DisableForwarding as a defense-in-depth restriction; the flaw lets an authenticated user establish layer-2/3 tunnels the configuration was meant to forbid. There is no public exploit identified at time of analysis, EPSS is low (0.13%, 3rd percentile), and it is not on CISA KEV.
TLS trust store poisoning in Canonical ADSys through v0.16.2 allows a network-positioned attacker to inject an arbitrary Root CA certificate into managed Ubuntu hosts during Active Directory Certificate Services auto-enrollment. The vendored Samba GPO extension fetches the CA certificate over plaintext HTTP from the AD CS GetCACert endpoint, and the response is registered into the system trust store via update-ca-certificates without authenticity validation. No public exploit identified at time of analysis, but the impact enables persistent decryption of TLS traffic across the host.