Monthly
Unauthenticated attackers can bypass security controls on REST endpoints generated by Quarkus REST Data Panache when a developer uses @MethodProperties to customize an operation without re-declaring class-level security roles, causing the generator to silently drop the security requirement and expose the endpoint. This results in potential unauthorized information disclosure or data modification, with a CVSS 3.1 score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) and CWE-425. No public exploit code has been identified at the time of analysis.
Any authenticated low-privilege user on a Comelit Multi-User Gateway for the VIP System (model 1456B) running firmware 2.9.1 or 2.10.0 can overwrite the installer (administrator) account password, because the administrative password-change function performs no server-side authorization check on the caller's role. The flaw is network-reachable with low complexity and no user interaction, but it is not fully unauthenticated: exploitation requires an existing 'user level' session, as reflected in the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8 High). Successfully resetting the installer credential hands the attacker full administrative control of the gateway and its managed access-control configuration; no public exploit code was identified at time of analysis, and no vendor-released patch was identified in the available intelligence at time of analysis.
Insecure direct object reference in Rhymix CMS before 2.1.31 allows authenticated users to access and potentially delete uploaded files belonging to other documents by supplying arbitrary file serial numbers in document extra variable fields. The root cause is missing ownership validation in the extravar module: file-type extra variables accepted any file SRL from user input and rendered or deleted the referenced file without confirming it belonged to the current document. No public exploit code is identified; vendor patch is available in version 2.1.31, tracked as RVE-2026-1.
Privileged remote modification of critical program parameters in MB connect line mbCONNECT24 and mymbCONNECT24 allows authenticated high-privilege attackers to reach a hidden configuration method that should be inaccessible to any user, resulting in total compromise of confidentiality, integrity, and availability. No public exploit identified at time of analysis, and the issue was coordinated through CERT@VDE under advisory VDE-2026-068.
Spring Security fails to properly write HTTP response headers in servlet applications across multiple versions (5.7.0-5.7.21, 5.8.0-5.8.23, 6.3.0-6.3.14, 6.4.0-6.4.14, 6.5.0-6.5.8, 7.0.0-7.0.3), allowing attackers to bypass security controls that rely on these headers such as HSTS, X-Frame-Options, or CSP policies. This header omission could enable various attacks including clickjacking, man-in-the-middle attacks, or other exploits depending on which protections are intended. No patch is currently available for this critical vulnerability.
Denial of service in Go's net/url package allows remote unauthenticated attackers to crash applications via malformed URLs with invalid host/authority components. The url.Parse function fails to properly validate authority sections, enabling resource exhaustion attacks against any Go application parsing untrusted URLs. EPSS score of 0.07% (22nd percentile) suggests low probability of widespread exploitation despite the network attack vector. Vendor patch available with multiple Red Hat security advisories issued.
8180 Ip Audio Alerter Firmware versions up to 5.5 contains a vulnerability that allows attackers to disclose sensitive information on affected installations of ALGO 8180 IP Audio A (CVSS 7.5).
Direct Request ('Forced Browsing') vulnerability in Apache OFBiz.12.16. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Authentication bypass in Fortra's GoAnywhere MFT prior to 7.4.1 allows an unauthorized user to create an admin user via the administration portal. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Affected versions of Atlassian Confluence Server allow remote attackers to view restricted resources via a Pre-Authorization Arbitrary File Read vulnerability in the /s/ endpoint. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Unauthenticated attackers can bypass security controls on REST endpoints generated by Quarkus REST Data Panache when a developer uses @MethodProperties to customize an operation without re-declaring class-level security roles, causing the generator to silently drop the security requirement and expose the endpoint. This results in potential unauthorized information disclosure or data modification, with a CVSS 3.1 score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) and CWE-425. No public exploit code has been identified at the time of analysis.
Any authenticated low-privilege user on a Comelit Multi-User Gateway for the VIP System (model 1456B) running firmware 2.9.1 or 2.10.0 can overwrite the installer (administrator) account password, because the administrative password-change function performs no server-side authorization check on the caller's role. The flaw is network-reachable with low complexity and no user interaction, but it is not fully unauthenticated: exploitation requires an existing 'user level' session, as reflected in the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8 High). Successfully resetting the installer credential hands the attacker full administrative control of the gateway and its managed access-control configuration; no public exploit code was identified at time of analysis, and no vendor-released patch was identified in the available intelligence at time of analysis.
Insecure direct object reference in Rhymix CMS before 2.1.31 allows authenticated users to access and potentially delete uploaded files belonging to other documents by supplying arbitrary file serial numbers in document extra variable fields. The root cause is missing ownership validation in the extravar module: file-type extra variables accepted any file SRL from user input and rendered or deleted the referenced file without confirming it belonged to the current document. No public exploit code is identified; vendor patch is available in version 2.1.31, tracked as RVE-2026-1.
Privileged remote modification of critical program parameters in MB connect line mbCONNECT24 and mymbCONNECT24 allows authenticated high-privilege attackers to reach a hidden configuration method that should be inaccessible to any user, resulting in total compromise of confidentiality, integrity, and availability. No public exploit identified at time of analysis, and the issue was coordinated through CERT@VDE under advisory VDE-2026-068.
Spring Security fails to properly write HTTP response headers in servlet applications across multiple versions (5.7.0-5.7.21, 5.8.0-5.8.23, 6.3.0-6.3.14, 6.4.0-6.4.14, 6.5.0-6.5.8, 7.0.0-7.0.3), allowing attackers to bypass security controls that rely on these headers such as HSTS, X-Frame-Options, or CSP policies. This header omission could enable various attacks including clickjacking, man-in-the-middle attacks, or other exploits depending on which protections are intended. No patch is currently available for this critical vulnerability.
Denial of service in Go's net/url package allows remote unauthenticated attackers to crash applications via malformed URLs with invalid host/authority components. The url.Parse function fails to properly validate authority sections, enabling resource exhaustion attacks against any Go application parsing untrusted URLs. EPSS score of 0.07% (22nd percentile) suggests low probability of widespread exploitation despite the network attack vector. Vendor patch available with multiple Red Hat security advisories issued.
8180 Ip Audio Alerter Firmware versions up to 5.5 contains a vulnerability that allows attackers to disclose sensitive information on affected installations of ALGO 8180 IP Audio A (CVSS 7.5).
Direct Request ('Forced Browsing') vulnerability in Apache OFBiz.12.16. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Authentication bypass in Fortra's GoAnywhere MFT prior to 7.4.1 allows an unauthorized user to create an admin user via the administration portal. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Affected versions of Atlassian Confluence Server allow remote attackers to view restricted resources via a Pre-Authorization Arbitrary File Read vulnerability in the /s/ endpoint. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.