CWE-551
Incorrect Behavior Order: Authorization Before Parsing and Canonicalization
Monthly
ImageMagick before 7.1.2-31 and 6.9.13-56 resolves image coders before applying its security-policy authorization check, so a crafted image can invoke a coder that a policy.xml rule with domain='coder' was meant to block and read data the policy prohibits. Real exposure is much narrower than the CVSS 7.5 network vector implies: the flaw is only meaningful where an administrator has actually configured a coder-domain policy (installations without one have no control to bypass), and the target application must still parse attacker-supplied images. With EPSS at 0.14% (3rd percentile), SSVC exploitation rated none, and no public exploit or CISA KEV activity identified at time of analysis, this is a low-urgency hardening item rather than an emergency.
Quarkus HTTP security path-normalization discrepancy allows unauthenticated remote attackers to craft a URL that the security matcher treats as public while the dispatcher routes it to a protected endpoint, bypassing path-based authorization and reading sensitive data (CVSS 3.1 7.5, C:H/I:N/A:N). This affects deployments that rely on Quarkus HTTP security path-pattern policies to gate confidential endpoints; applications using only handler-level role or annotation checks are not bypassed this way. No public exploit identified at time of analysis.
Cross-namespace secret disclosure in Red Hat Advanced Cluster Management for Kubernetes allows a managed-cluster agent holding low privileges to craft configuration references that point to hub Secrets outside its authorized namespace, delivering those Secrets to an attacker-controlled managed cluster. The vulnerability resides in the multicluster-observability-addon component, which previously processed ManagedClusterAddOn.status.configReferences and fetched referenced objects before enforcing any namespace boundary, allowing cross-cluster credential theft from the hub. The upstream fix (PR #644) introduces ValidateConfigNamespaces() to reject out-of-scope references before manifest generation; no public exploit has been identified at time of analysis.
Authentication bypass in Peplink InControl 2 through 2.14.2 allows authenticated low-privile
Authenticated users with uma_protection role in Red Hat Keycloak can bypass User-Managed Access policy validation to gain unauthorized access to victim-owned resources. The vulnerability (confirmed actively exploited - CISA KEV) enables attackers to inject arbitrary resource identifiers during policy creation, obtaining Requesting Party Tokens for resources they do not own. With CVSS 8.1 (High), network-accessible attack vector, and low complexity, this represents a significant access control bypass in enterprise identity management deployments. EPSS data and public exploit status not confirmed from available data.
User enumeration vulnerability in ZKTeco ZKBioSecurity 3.0 that allows unauthenticated attackers to discover valid usernames through partial character submissions to the authentication endpoint. A public proof-of-concept exploit is available, making this vulnerability actively exploitable, though it has a notably high CVSS score of 9.8 that appears inflated given the actual impact is limited to information disclosure.
Keycloak's Authorization header parser improperly tolerates non-RFC 6750 compliant formatting, including tabs and case variations in Bearer token authentication. This lax validation could enable attackers to bypass authentication mechanisms or manipulate token validation logic in applications relying on strict Bearer token parsing. No patch is currently available for this medium-severity vulnerability.
Dompdf is an HTML to PDF converter. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. Rated high severity (CVSS 8.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. Rated high severity (CVSS 8.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
ImageMagick before 7.1.2-31 and 6.9.13-56 resolves image coders before applying its security-policy authorization check, so a crafted image can invoke a coder that a policy.xml rule with domain='coder' was meant to block and read data the policy prohibits. Real exposure is much narrower than the CVSS 7.5 network vector implies: the flaw is only meaningful where an administrator has actually configured a coder-domain policy (installations without one have no control to bypass), and the target application must still parse attacker-supplied images. With EPSS at 0.14% (3rd percentile), SSVC exploitation rated none, and no public exploit or CISA KEV activity identified at time of analysis, this is a low-urgency hardening item rather than an emergency.
Quarkus HTTP security path-normalization discrepancy allows unauthenticated remote attackers to craft a URL that the security matcher treats as public while the dispatcher routes it to a protected endpoint, bypassing path-based authorization and reading sensitive data (CVSS 3.1 7.5, C:H/I:N/A:N). This affects deployments that rely on Quarkus HTTP security path-pattern policies to gate confidential endpoints; applications using only handler-level role or annotation checks are not bypassed this way. No public exploit identified at time of analysis.
Cross-namespace secret disclosure in Red Hat Advanced Cluster Management for Kubernetes allows a managed-cluster agent holding low privileges to craft configuration references that point to hub Secrets outside its authorized namespace, delivering those Secrets to an attacker-controlled managed cluster. The vulnerability resides in the multicluster-observability-addon component, which previously processed ManagedClusterAddOn.status.configReferences and fetched referenced objects before enforcing any namespace boundary, allowing cross-cluster credential theft from the hub. The upstream fix (PR #644) introduces ValidateConfigNamespaces() to reject out-of-scope references before manifest generation; no public exploit has been identified at time of analysis.
Authentication bypass in Peplink InControl 2 through 2.14.2 allows authenticated low-privile
Authenticated users with uma_protection role in Red Hat Keycloak can bypass User-Managed Access policy validation to gain unauthorized access to victim-owned resources. The vulnerability (confirmed actively exploited - CISA KEV) enables attackers to inject arbitrary resource identifiers during policy creation, obtaining Requesting Party Tokens for resources they do not own. With CVSS 8.1 (High), network-accessible attack vector, and low complexity, this represents a significant access control bypass in enterprise identity management deployments. EPSS data and public exploit status not confirmed from available data.
User enumeration vulnerability in ZKTeco ZKBioSecurity 3.0 that allows unauthenticated attackers to discover valid usernames through partial character submissions to the authentication endpoint. A public proof-of-concept exploit is available, making this vulnerability actively exploitable, though it has a notably high CVSS score of 9.8 that appears inflated given the actual impact is limited to information disclosure.
Keycloak's Authorization header parser improperly tolerates non-RFC 6750 compliant formatting, including tabs and case variations in Bearer token authentication. This lax validation could enable attackers to bypass authentication mechanisms or manipulate token validation logic in applications relying on strict Bearer token parsing. No patch is currently available for this medium-severity vulnerability.
Dompdf is an HTML to PDF converter. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. Rated high severity (CVSS 8.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. Rated high severity (CVSS 8.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.