Monthly
Failed token revocation in Django REST Framework 3.12.0 through 3.18.1 leaves API credentials live after they are supposedly revoked: calling delete() on a TokenProxy instance issues a DELETE that matches no row, returns a zero count, and raises no error, so applications, admin integrations, or operational scripts that trust the return value believe the credential is gone while it continues to authenticate requests. The defect is a credential-hygiene and failed-revocation problem (CWE-390) rather than a directly exploitable remote flaw - the CVSS 3.1 base score is 7.4 (High) with vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N, and because DRF tokens never expire automatically, any token that escapes revocation stays valid indefinitely until the database row is cleaned up manually. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis; the practical prerequisite is that an attacker already holds a previously issued token that the victim attempted to revoke through the affected code path.
Unauthenticated remote attackers can obtain a valid Mage AI session token without possessing a legitimate OAuth credential, because the platform's session-creation endpoint fails to abort when it encounters an unrecognized OAuth provider. An attacker who supplies an arbitrary token plus an unknown provider string - and knows or guesses a valid user's email address - can impersonate that account, or cause new accounts to be created; the most damaging path is impersonating an already-privileged email. Mage OSS through 0.9.80 (prior to commit 76c4f46) is affected, the flaw carries a 9.8 CVSS rating and is classified as CWE-390 (error condition detected but not acted upon); no public exploit code has been identified at the time of analysis.
Discord libdave before 1.2.0 can accept an unauthorized participant into an end-to-end encrypted media session because it does not reject an MLS Welcome message whose group roster contains an unrecognized user ID. An attacker who controls the DAVE signaling path, such as a malicious or compromised Discord voice gateway or an equivalent position able to add, alter, or withhold MLS signaling, can exploit this to compromise the confidentiality and integrity of voice and video content; no client authentication or user interaction is required, but the signaling-path requirement raises the practical bar. A vendor patch is available in libdave 1.2.0, and no public exploit code was identified at time of analysis.
Privilege escalation in util-linux through versions 2.41.5 and 2.42.2 allows local low-privilege users to execute privileged post-mount hook operations on pre-existing filesystems by exploiting libmount's failure to validate mount helper exit status before dispatching the MOUNT_POST stage. The root cause - captured by CWE-390 - lies in context_mount.c functions mnt_context_do_mount() and mnt_context_mount(), which gate post-mount hook execution solely on a zero result code without verifying whether the underlying mount helper or kernel syscall actually succeeded. No public exploit code has been identified at time of analysis, but the public GHSA advisory and three upstream patch commits provide sufficient technical detail to support independent exploit development.
Improper handling of a Certificate Revocation List (CRL) error condition in Apache Tomcat's FFM-based (Foreign Function & Memory / OpenSSL) connector allows revoked client certificates to be accepted during mutual TLS authentication, defeating revocation checking. The flaw affects Tomcat 9.0.83-9.0.118, 10.1.0-M7-10.1.55, and 11.0.0-M1-11.0.22 when a CRL is configured on the FFM connector, letting an attacker holding a revoked-but-otherwise-valid client certificate reach protected resources. There is no public exploit identified at time of analysis and the issue is not on CISA KEV, though the CVSS base score is 9.1 (CWE-390).
Memory-safety flaw in the Linux kernel's NVMe-over-TCP target driver (nvmet-tcp) lets a connected initiator drive the kernel into reading received network data through an uninitialized iov_iter. Because nvmet_tcp_build_pdu_iovec() reported out-of-bounds PDU length/offset only via a fatal-error side effect while returning void, callers such as nvmet_tcp_handle_h2c_data_pdu() continued and advanced the receive state machine over an uninitialized cmd->recv_msg.msg_iter, leading to memory corruption or denial of service. NVD rates this 9.8 (CVSS:3.1 AV:N/AC:L/PR:N/UI:N), but EPSS is low (0.17%, 7th percentile) and there is no public exploit identified at time of analysis; it is not in CISA KEV.
Improper handling of MAY_BACKLOG requests in the Linux kernel's pcrypt (parallel crypto) module can cause incorrect processing of EBUSY return codes and EINPROGRESS notifications, potentially leading to instability or undefined behavior in cryptographic operations. The issue affects Linux kernel versions dating back to 2.6.34 and has been resolved upstream across multiple stable branches including 6.6.140, 6.12.86, 6.18.27, 7.0.4, and 7.1-rc1. There is no public exploit identified at time of analysis and EPSS scoring (0.02%, 5th percentile) suggests very low real-world exploitation likelihood despite the CVSS 9.8 rating.
Tokens issued through @fastify/jwt before 10.2.3 can be created without an exp claim - and therefore never expire - when expiresIn, notBefore, or maxAge is given a time-span string the plugin's parser cannot read, such as a compound span like '1h30m', a month unit, an ISO 8601 duration, a value using a decimal comma, or a string with surrounding whitespace. The identical flaw silently disables maxAge age-rejection on the verification path, so a token that should be rejected as too old is accepted. The issue is tracked as CVSS 3.1 6.8 (Medium; AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N), and the vector's PR:L reflects that an attacker generally needs to already hold a token - their own aged one or a stolen/leaked one - to benefit, with AC:H because the unparseable string must actually be in use as a non-default developer misconfiguration; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
Fail-open error handling in the Data Masking utility of Powertools for AWS Lambda (Python) before 3.35.0 can cause sensitive field values to be emitted unmasked into logs or storage whenever a masking operation fails at runtime. The flaw (CVSS 5.3, vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) is only reachable in applications that actually apply Data Masking to sensitive fields, and only when a masking rule errors - an invalid masking path, a regular expression that cannot be compiled, or a masking-provider failure - after which the original value is returned with nothing more than a warning instead of an exception. There is no public exploit identified at time of analysis; this is a genuine data-confidentiality weakness but a low-urgency one in real terms, because the attacker must also obtain access to the downstream destination (log store or storage) where the unmasked value is written.
CyberPanel before version 2.4.4 contains a logic omission in the `checkOwnership()` access control function that allows authenticated low-privilege users to bypass domain ownership verification. The `plogical/acl.py` module's `checkOwnership()` function lacked a `return 0` in its denial branch, causing it to implicitly return `None` instead of an explicit denial signal when a requesting user does not own the target domain. An authenticated user can exploit this to access domain-level information belonging to other panel users. No public exploit or CISA KEV listing exists at time of analysis.
Failed token revocation in Django REST Framework 3.12.0 through 3.18.1 leaves API credentials live after they are supposedly revoked: calling delete() on a TokenProxy instance issues a DELETE that matches no row, returns a zero count, and raises no error, so applications, admin integrations, or operational scripts that trust the return value believe the credential is gone while it continues to authenticate requests. The defect is a credential-hygiene and failed-revocation problem (CWE-390) rather than a directly exploitable remote flaw - the CVSS 3.1 base score is 7.4 (High) with vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N, and because DRF tokens never expire automatically, any token that escapes revocation stays valid indefinitely until the database row is cleaned up manually. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis; the practical prerequisite is that an attacker already holds a previously issued token that the victim attempted to revoke through the affected code path.
Unauthenticated remote attackers can obtain a valid Mage AI session token without possessing a legitimate OAuth credential, because the platform's session-creation endpoint fails to abort when it encounters an unrecognized OAuth provider. An attacker who supplies an arbitrary token plus an unknown provider string - and knows or guesses a valid user's email address - can impersonate that account, or cause new accounts to be created; the most damaging path is impersonating an already-privileged email. Mage OSS through 0.9.80 (prior to commit 76c4f46) is affected, the flaw carries a 9.8 CVSS rating and is classified as CWE-390 (error condition detected but not acted upon); no public exploit code has been identified at the time of analysis.
Discord libdave before 1.2.0 can accept an unauthorized participant into an end-to-end encrypted media session because it does not reject an MLS Welcome message whose group roster contains an unrecognized user ID. An attacker who controls the DAVE signaling path, such as a malicious or compromised Discord voice gateway or an equivalent position able to add, alter, or withhold MLS signaling, can exploit this to compromise the confidentiality and integrity of voice and video content; no client authentication or user interaction is required, but the signaling-path requirement raises the practical bar. A vendor patch is available in libdave 1.2.0, and no public exploit code was identified at time of analysis.
Privilege escalation in util-linux through versions 2.41.5 and 2.42.2 allows local low-privilege users to execute privileged post-mount hook operations on pre-existing filesystems by exploiting libmount's failure to validate mount helper exit status before dispatching the MOUNT_POST stage. The root cause - captured by CWE-390 - lies in context_mount.c functions mnt_context_do_mount() and mnt_context_mount(), which gate post-mount hook execution solely on a zero result code without verifying whether the underlying mount helper or kernel syscall actually succeeded. No public exploit code has been identified at time of analysis, but the public GHSA advisory and three upstream patch commits provide sufficient technical detail to support independent exploit development.
Improper handling of a Certificate Revocation List (CRL) error condition in Apache Tomcat's FFM-based (Foreign Function & Memory / OpenSSL) connector allows revoked client certificates to be accepted during mutual TLS authentication, defeating revocation checking. The flaw affects Tomcat 9.0.83-9.0.118, 10.1.0-M7-10.1.55, and 11.0.0-M1-11.0.22 when a CRL is configured on the FFM connector, letting an attacker holding a revoked-but-otherwise-valid client certificate reach protected resources. There is no public exploit identified at time of analysis and the issue is not on CISA KEV, though the CVSS base score is 9.1 (CWE-390).
Memory-safety flaw in the Linux kernel's NVMe-over-TCP target driver (nvmet-tcp) lets a connected initiator drive the kernel into reading received network data through an uninitialized iov_iter. Because nvmet_tcp_build_pdu_iovec() reported out-of-bounds PDU length/offset only via a fatal-error side effect while returning void, callers such as nvmet_tcp_handle_h2c_data_pdu() continued and advanced the receive state machine over an uninitialized cmd->recv_msg.msg_iter, leading to memory corruption or denial of service. NVD rates this 9.8 (CVSS:3.1 AV:N/AC:L/PR:N/UI:N), but EPSS is low (0.17%, 7th percentile) and there is no public exploit identified at time of analysis; it is not in CISA KEV.
Improper handling of MAY_BACKLOG requests in the Linux kernel's pcrypt (parallel crypto) module can cause incorrect processing of EBUSY return codes and EINPROGRESS notifications, potentially leading to instability or undefined behavior in cryptographic operations. The issue affects Linux kernel versions dating back to 2.6.34 and has been resolved upstream across multiple stable branches including 6.6.140, 6.12.86, 6.18.27, 7.0.4, and 7.1-rc1. There is no public exploit identified at time of analysis and EPSS scoring (0.02%, 5th percentile) suggests very low real-world exploitation likelihood despite the CVSS 9.8 rating.
Tokens issued through @fastify/jwt before 10.2.3 can be created without an exp claim - and therefore never expire - when expiresIn, notBefore, or maxAge is given a time-span string the plugin's parser cannot read, such as a compound span like '1h30m', a month unit, an ISO 8601 duration, a value using a decimal comma, or a string with surrounding whitespace. The identical flaw silently disables maxAge age-rejection on the verification path, so a token that should be rejected as too old is accepted. The issue is tracked as CVSS 3.1 6.8 (Medium; AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N), and the vector's PR:L reflects that an attacker generally needs to already hold a token - their own aged one or a stolen/leaked one - to benefit, with AC:H because the unparseable string must actually be in use as a non-default developer misconfiguration; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
Fail-open error handling in the Data Masking utility of Powertools for AWS Lambda (Python) before 3.35.0 can cause sensitive field values to be emitted unmasked into logs or storage whenever a masking operation fails at runtime. The flaw (CVSS 5.3, vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) is only reachable in applications that actually apply Data Masking to sensitive fields, and only when a masking rule errors - an invalid masking path, a regular expression that cannot be compiled, or a masking-provider failure - after which the original value is returned with nothing more than a warning instead of an exception. There is no public exploit identified at time of analysis; this is a genuine data-confidentiality weakness but a low-urgency one in real terms, because the attacker must also obtain access to the downstream destination (log store or storage) where the unmasked value is written.
CyberPanel before version 2.4.4 contains a logic omission in the `checkOwnership()` access control function that allows authenticated low-privilege users to bypass domain ownership verification. The `plogical/acl.py` module's `checkOwnership()` function lacked a `return 0` in its denial branch, causing it to implicitly return `None` instead of an explicit denial signal when a requesting user does not own the target domain. An authenticated user can exploit this to access domain-level information belonging to other panel users. No public exploit or CISA KEV listing exists at time of analysis.