Monthly
Missing server-side authentication in tsi-coop tsi-dpdp-cms ≤0.5.0 exposes all 17 admin and DPO console pages to unauthenticated HTTP clients: the application enforced access via a client-side JavaScript redirect only, so any HTTP request that ignores the redirect receives the full page source including internal API endpoints, function names, and request schemas. A second bundled vulnerability allows unauthenticated super-admin account creation via an unprotected first-run setup endpoint (/api/v1/bootstrap/setup), enabling complete platform takeover on fresh or reset deployments. A public proof-of-concept demonstrating the bypass is available, and the vendor has released a patched version (v0.5.1) confirmed to address both issues.
Price validation bypass in the RegistrationMagic WordPress plugin before 6.0.9.9 allows unauthenticated users to complete paid registrations without payment and receive fully activated accounts. The plugin fails to verify the total registration price server-side, meaning client-submitted price values are accepted without cross-checking against the configured amount. A publicly available proof-of-concept exploit exists, and no CISA KEV listing has been recorded at time of analysis.
OTP validation bypass in Releasit COD Form & Upsells v1 allows unauthenticated remote attackers to circumvent the Cash-on-Delivery phone verification step by manipulating client-side enforcement logic instead of relying on a server-side check. Affected Shopify merchants running v1 are exposed to fraudulent order placement without valid OTP confirmation. A public proof-of-concept exploit has been published on GitHub; no CISA KEV listing exists at time of analysis.
Unauthorized ManagedCluster deletion in Red Hat Multicluster Engine (MCE) allows any tenant with standard ClusterClaim permissions to destroy clusters belonging to other tenants or the hub itself, including the hub's local-cluster. The clusterclaims-controller fails to verify ownership before acting on the spec.namespace field, meaning a low-privileged tenant can target arbitrary ManagedClusters by crafting that field and then deleting the ClusterClaim. No public exploit or CISA KEV listing exists at time of analysis, but the attack requires only standard tenant credentials and no special configuration, making it a realistic insider or compromised-tenant threat.
Unauthenticated access to form submissions is possible in the Convert Forms extension for Joomla across all versions from 1.0.0 up to but not including 5.2.5, due to missing server-side access control on the front-end Submissions view. Any unauthenticated internet visitor can enumerate and retrieve form submission data without credentials, exposing whatever personally identifiable or business-sensitive information site visitors have submitted through forms built with this extension. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low-complexity, zero-authentication attack surface makes this trivially exploitable by any actor who can reach the site.
Registration bypass and authentication bypass in Talebook (MyBooks) 3.41.2 and earlier allow an unauthenticated remote attacker to create accounts on instances where the administrator has disabled public registration, and then immediately authenticate with those unactivated accounts to access user-level API functionality. The root cause is a server-side enforcement gap: the POST /api/user/sign_up handler in user.py ignores the ALLOW_REGISTER configuration flag entirely, relying on the frontend to suppress the UI - a classic CWE-602 client-side enforcement failure. A second flaw in process_auth_header (base.py) compounds the issue by skipping verification of the account active flag, so the freshly created account can authenticate without email confirmation. No public exploit code or CISA KEV listing has been identified at time of analysis. The issue is fixed in version 3.42.0.
Plugin lock-rule enforcement bypass in JupyterLab (pip package, versions >=4.1.0,<=4.5.9 and >=4.6.0,<=4.6.1) allows authenticated users to subvert administrator-configured plugin restrictions by sending direct requests to the /lab/api/plugins endpoint. Two distinct server-side enforcement gaps expose child plugins of multi-plugin extensions and plugins locked via the 'lock all' mechanism to unauthorized enable/disable operations, undermining data integrity controls and security restrictions - such as download/upload limits - implemented through locked plugins. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Unauthenticated information disclosure in the Portal Generator add-on to Priority ERP (developed by Soft Solutions) allows remote attackers to retrieve restricted data by bypassing security controls that are enforced only in the client rather than on the server. Any actor who can reach the portal over the network can craft direct server requests that skip the intended access checks, exposing sensitive data without credentials or user interaction. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
IBM Db2 versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 expose an improper authorization flaw in certain database commands, enabling a low-privileged authenticated user to bypass server-side authority checks and directly modify database catalog data. The root cause is CWE-602 (client-side enforcement of server-side security), where authorization validation is not properly enforced at the server layer. No public exploit has been identified and SSVC rates exploitation as none currently, though the high integrity impact against catalog metadata - which governs schema definitions and access control structures - makes this a meaningful patching priority for all affected Db2 deployments.
Server-side validation bypass in the Easy Booking WordPress plugin (all versions before 3.5.0) allows unauthenticated remote attackers to circumvent minimum booking duration enforcement during cart addition and price calculation. Malicious users can submit manipulated add-to-cart requests with durations shorter than the merchant-configured minimums, completing orders at underpriced totals that the merchant is then expected to fulfill at a financial loss. No public exploit has been identified at time of analysis, though the unauthenticated, low-complexity attack vector makes this trivially reproducible by any remote attacker with HTTP access to the affected site.
Missing server-side authentication in tsi-coop tsi-dpdp-cms ≤0.5.0 exposes all 17 admin and DPO console pages to unauthenticated HTTP clients: the application enforced access via a client-side JavaScript redirect only, so any HTTP request that ignores the redirect receives the full page source including internal API endpoints, function names, and request schemas. A second bundled vulnerability allows unauthenticated super-admin account creation via an unprotected first-run setup endpoint (/api/v1/bootstrap/setup), enabling complete platform takeover on fresh or reset deployments. A public proof-of-concept demonstrating the bypass is available, and the vendor has released a patched version (v0.5.1) confirmed to address both issues.
Price validation bypass in the RegistrationMagic WordPress plugin before 6.0.9.9 allows unauthenticated users to complete paid registrations without payment and receive fully activated accounts. The plugin fails to verify the total registration price server-side, meaning client-submitted price values are accepted without cross-checking against the configured amount. A publicly available proof-of-concept exploit exists, and no CISA KEV listing has been recorded at time of analysis.
OTP validation bypass in Releasit COD Form & Upsells v1 allows unauthenticated remote attackers to circumvent the Cash-on-Delivery phone verification step by manipulating client-side enforcement logic instead of relying on a server-side check. Affected Shopify merchants running v1 are exposed to fraudulent order placement without valid OTP confirmation. A public proof-of-concept exploit has been published on GitHub; no CISA KEV listing exists at time of analysis.
Unauthorized ManagedCluster deletion in Red Hat Multicluster Engine (MCE) allows any tenant with standard ClusterClaim permissions to destroy clusters belonging to other tenants or the hub itself, including the hub's local-cluster. The clusterclaims-controller fails to verify ownership before acting on the spec.namespace field, meaning a low-privileged tenant can target arbitrary ManagedClusters by crafting that field and then deleting the ClusterClaim. No public exploit or CISA KEV listing exists at time of analysis, but the attack requires only standard tenant credentials and no special configuration, making it a realistic insider or compromised-tenant threat.
Unauthenticated access to form submissions is possible in the Convert Forms extension for Joomla across all versions from 1.0.0 up to but not including 5.2.5, due to missing server-side access control on the front-end Submissions view. Any unauthenticated internet visitor can enumerate and retrieve form submission data without credentials, exposing whatever personally identifiable or business-sensitive information site visitors have submitted through forms built with this extension. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low-complexity, zero-authentication attack surface makes this trivially exploitable by any actor who can reach the site.
Registration bypass and authentication bypass in Talebook (MyBooks) 3.41.2 and earlier allow an unauthenticated remote attacker to create accounts on instances where the administrator has disabled public registration, and then immediately authenticate with those unactivated accounts to access user-level API functionality. The root cause is a server-side enforcement gap: the POST /api/user/sign_up handler in user.py ignores the ALLOW_REGISTER configuration flag entirely, relying on the frontend to suppress the UI - a classic CWE-602 client-side enforcement failure. A second flaw in process_auth_header (base.py) compounds the issue by skipping verification of the account active flag, so the freshly created account can authenticate without email confirmation. No public exploit code or CISA KEV listing has been identified at time of analysis. The issue is fixed in version 3.42.0.
Plugin lock-rule enforcement bypass in JupyterLab (pip package, versions >=4.1.0,<=4.5.9 and >=4.6.0,<=4.6.1) allows authenticated users to subvert administrator-configured plugin restrictions by sending direct requests to the /lab/api/plugins endpoint. Two distinct server-side enforcement gaps expose child plugins of multi-plugin extensions and plugins locked via the 'lock all' mechanism to unauthorized enable/disable operations, undermining data integrity controls and security restrictions - such as download/upload limits - implemented through locked plugins. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Unauthenticated information disclosure in the Portal Generator add-on to Priority ERP (developed by Soft Solutions) allows remote attackers to retrieve restricted data by bypassing security controls that are enforced only in the client rather than on the server. Any actor who can reach the portal over the network can craft direct server requests that skip the intended access checks, exposing sensitive data without credentials or user interaction. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
IBM Db2 versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 expose an improper authorization flaw in certain database commands, enabling a low-privileged authenticated user to bypass server-side authority checks and directly modify database catalog data. The root cause is CWE-602 (client-side enforcement of server-side security), where authorization validation is not properly enforced at the server layer. No public exploit has been identified and SSVC rates exploitation as none currently, though the high integrity impact against catalog metadata - which governs schema definitions and access control structures - makes this a meaningful patching priority for all affected Db2 deployments.
Server-side validation bypass in the Easy Booking WordPress plugin (all versions before 3.5.0) allows unauthenticated remote attackers to circumvent minimum booking duration enforcement during cart addition and price calculation. Malicious users can submit manipulated add-to-cart requests with durations shorter than the merchant-configured minimums, completing orders at underpriced totals that the merchant is then expected to fulfill at a financial loss. No public exploit has been identified at time of analysis, though the unauthenticated, low-complexity attack vector makes this trivially reproducible by any remote attacker with HTTP access to the affected site.