Monthly
Remote code execution in BerriAI LiteLLM (all versions through 2026-04-08) enables authenticated attackers to execute arbitrary code by exploiting bytecode rewriting functionality at the /guardrails/test_custom_code endpoint. The vulnerability requires low-privilege authentication (PR:L) but permits complete system compromise with high impact to confidentiality, integrity, and availability. No public exploit identified at time of analysis.
Cisco is providing an update for the ongoing investigation into observed exploitation of the web UI feature in Cisco IOS XE Software. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Kiteworks Core versions before 9.5.1 fail to apply gateway-level API security controls to every request authenticated through the central authentication service, enabling an authenticated attacker to access REST API functionality on an unprotected path even with a revoked or signed-out session. This CWE-420 unprotected alternate channel yields low confidentiality and integrity impact (CVSS 5.4) and requires a valid authenticated session (PR:L). No public exploit code has been identified at time of analysis.
Cyrus IMAP before 3.12.4 exposes private calendar events and contacts to partially-privileged authenticated users through a broken ACL enforcement path in the CalDAV/CardDAV multiget REPORT handler. An attacker who already holds some shared DAV access to a target user's calendar or address book can include hrefs of unshared resources in a calendar-multiget or addressbook-multiget REPORT request, causing the server to return those resources without enforcing per-href access controls. The vulnerability is fixed across the 3.8, 3.10, and 3.12 release branches; no public exploit or CISA KEV listing has been identified.
Compression bomb detection bypass in Tor before 0.4.9.9 enables remote unauthenticated attackers to deliver resource-exhausting payloads that evade the node's per-stream decompression safeguards. By concatenating multiple gzip or zlib sub-streams - each individually sized just below Tor's detection threshold - an attacker circumvents the aggregate bomb check entirely, potentially degrading availability of Tor nodes or relays. Tracked as TROVE-2026-022; no public exploit code or active exploitation (CISA KEV) has been identified; the CVSS 5.3 Medium score reflects the limited but real availability impact.
IP-based access control restrictions in F5 BIG-IP httpd do not uniformly apply to all endpoints, allowing unauthenticated remote attackers from blocked IP addresses to access protected resources and disclose sensitive information. The vulnerability affects default configurations where network-based access policies are expected to enforce restrictions across the entire application stack, but certain endpoints bypass these controls. A vendor patch is available.
Unauthenticated traffic relay vulnerability in Prosody mod_proxy65 module allows network attackers to bypass access control during SOCKS5 activation, resulting in integrity compromise and service disruption without requiring authentication. Affected versions are Prosody before 0.12.6 and 1.0.0 through 13.0.0 before 13.0.5 when mod_proxy65 is enabled. CVSS 6.5 reflects medium severity with network-accessible attack surface, low complexity, and non-privileged unauthenticated access, though confirmed availability and integrity impact limits widespread severity.
OpenSSH before 10.3 fails to confirm connection multiplexing in proxy-mode sessions, allowing local attackers with user interaction to bypass intended access controls and potentially manipulate multiplexed connections. The vulnerability affects OpenSSH versions prior to 10.3p1 and requires local access with user interaction (UI:R) on the affected system; while the CVSS score is low (2.5) and integrity impact is limited, the omission of confirmation mechanisms in proxy-mode multiplexing creates a logic flaw that could enable unauthorized session hijacking or redirection in multi-user environments.
Roundcube Webmail versions before 1.5.13 and 1.6.x before 1.6.13 fail to block SVG feImage elements when the "Block remote images" security feature is enabled, allowing attackers to bypass the protection and load remote content. This remote image bypass could enable tracking, information disclosure, or facilitate phishing attacks against users who rely on this feature to prevent remote content loading. No patch is currently available for this medium-severity vulnerability.
A local low privileged attacker can bypass the authentication of the Device Manager user interface, allowing them to perform privileged operations and gain administrator access. [CVSS 7.8 HIGH]
Remote code execution in BerriAI LiteLLM (all versions through 2026-04-08) enables authenticated attackers to execute arbitrary code by exploiting bytecode rewriting functionality at the /guardrails/test_custom_code endpoint. The vulnerability requires low-privilege authentication (PR:L) but permits complete system compromise with high impact to confidentiality, integrity, and availability. No public exploit identified at time of analysis.
Cisco is providing an update for the ongoing investigation into observed exploitation of the web UI feature in Cisco IOS XE Software. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Kiteworks Core versions before 9.5.1 fail to apply gateway-level API security controls to every request authenticated through the central authentication service, enabling an authenticated attacker to access REST API functionality on an unprotected path even with a revoked or signed-out session. This CWE-420 unprotected alternate channel yields low confidentiality and integrity impact (CVSS 5.4) and requires a valid authenticated session (PR:L). No public exploit code has been identified at time of analysis.
Cyrus IMAP before 3.12.4 exposes private calendar events and contacts to partially-privileged authenticated users through a broken ACL enforcement path in the CalDAV/CardDAV multiget REPORT handler. An attacker who already holds some shared DAV access to a target user's calendar or address book can include hrefs of unshared resources in a calendar-multiget or addressbook-multiget REPORT request, causing the server to return those resources without enforcing per-href access controls. The vulnerability is fixed across the 3.8, 3.10, and 3.12 release branches; no public exploit or CISA KEV listing has been identified.
Compression bomb detection bypass in Tor before 0.4.9.9 enables remote unauthenticated attackers to deliver resource-exhausting payloads that evade the node's per-stream decompression safeguards. By concatenating multiple gzip or zlib sub-streams - each individually sized just below Tor's detection threshold - an attacker circumvents the aggregate bomb check entirely, potentially degrading availability of Tor nodes or relays. Tracked as TROVE-2026-022; no public exploit code or active exploitation (CISA KEV) has been identified; the CVSS 5.3 Medium score reflects the limited but real availability impact.
IP-based access control restrictions in F5 BIG-IP httpd do not uniformly apply to all endpoints, allowing unauthenticated remote attackers from blocked IP addresses to access protected resources and disclose sensitive information. The vulnerability affects default configurations where network-based access policies are expected to enforce restrictions across the entire application stack, but certain endpoints bypass these controls. A vendor patch is available.
Unauthenticated traffic relay vulnerability in Prosody mod_proxy65 module allows network attackers to bypass access control during SOCKS5 activation, resulting in integrity compromise and service disruption without requiring authentication. Affected versions are Prosody before 0.12.6 and 1.0.0 through 13.0.0 before 13.0.5 when mod_proxy65 is enabled. CVSS 6.5 reflects medium severity with network-accessible attack surface, low complexity, and non-privileged unauthenticated access, though confirmed availability and integrity impact limits widespread severity.
OpenSSH before 10.3 fails to confirm connection multiplexing in proxy-mode sessions, allowing local attackers with user interaction to bypass intended access controls and potentially manipulate multiplexed connections. The vulnerability affects OpenSSH versions prior to 10.3p1 and requires local access with user interaction (UI:R) on the affected system; while the CVSS score is low (2.5) and integrity impact is limited, the omission of confirmation mechanisms in proxy-mode multiplexing creates a logic flaw that could enable unauthorized session hijacking or redirection in multi-user environments.
Roundcube Webmail versions before 1.5.13 and 1.6.x before 1.6.13 fail to block SVG feImage elements when the "Block remote images" security feature is enabled, allowing attackers to bypass the protection and load remote content. This remote image bypass could enable tracking, information disclosure, or facilitate phishing attacks against users who rely on this feature to prevent remote content loading. No patch is currently available for this medium-severity vulnerability.
A local low privileged attacker can bypass the authentication of the Device Manager user interface, allowing them to perform privileged operations and gain administrator access. [CVSS 7.8 HIGH]