Monthly
NGINX JavaScript (njs) and QuickJS (qjs) fail open during the js_access phase when an exception is thrown inside an asynchronous request-body processing handler before an explicit access-denial is returned. The flaw (CWE-636, Not Failing Securely) allows unauthenticated remote attackers to bypass js_access controls entirely and reach protected backend resources. No public exploit code or CISA KEV listing has been identified at time of analysis; exploitation is bounded by the requirement for a specific async access-handler pattern.
Ash.Reactor's ChangeStep component in the Elixir Ash framework silently bypasses security-relevant change operations when a `where` guard raises an exception, instead of halting the step with an error. Applications built on ash versions 3.0.0-rc.17 through 3.32.1 that use Ash.Reactor pipelines with `where`-gated changes are affected. An attacker who can supply crafted input triggering a guard exception may cause the guarded change to be silently skipped, potentially circumventing authentication, authorization, or mandatory data transformations depending on what that change enforces. No public exploit has been identified and the vulnerability is not listed in CISA KEV.
Secure boot bypass in IGEL OS 12 (before 12.9.0/12.8.3 LTS) and IGEL OS 11 (before 11.11.150) allows physically present attackers to obtain a root shell by exploiting GRUB's fail-open signature verification behavior. Placing an empty, unsigned file named igel.conf on any GRUB-accessible partition causes the bootloader to drop into an interactive GRUB prompt instead of halting, from which the attacker boots the device's own kernel with attacker-controlled command-line arguments, unlocking the disk. The attack leaves TPM PCR values unaltered - defeating attestation-based detection - and was publicly detailed at DEF CON 34; no active exploitation confirmed in CISA KEV at time of analysis.
CAPTCHA bypass in MyBB's registration workflow allows unauthenticated remote attackers to create accounts without solving the Security Question challenge. The `member.php?action=do_register` endpoint accepts a hidden `question_id` field but fails open when that identifier is blank, forged, or expired - the validation logic has no fail-closed fallback, so the request proceeds without challenge verification. The issue is resolved in MyBB 1.8.40; no public exploit is identified at time of analysis.
Fail-open security logic in Visual Studio Code permits network-based security feature bypass by an unauthenticated attacker who can induce user interaction. The root cause is CWE-636: when the application encounters an error or edge condition in a security enforcement path, it defaults to granting rather than denying access, neutralizing the intended control. With a CVSS score of 8.2 and a scope-changed vector (S:C) paired with high confidentiality impact, successful exploitation could expose data or capabilities beyond the direct VS Code process boundary. No public exploit code or CISA KEV listing has been identified at time of analysis.
Full unauthenticated access to Livebook 0.19.7-0.19.9 is possible when a Livebook Agent or App Server's deployment group is deleted from Livebook Teams while the agent is temporarily disconnected. A logic error in `Livebook.Hubs.TeamClient.handle_call/3` causes the zero-trust authentication layer to treat an unresolvable cached deployment group identifier identically to one with identity enforcement deliberately disabled, allowing any network-reachable client to read notebooks and secrets, execute code on the server runtime, and disrupt operations without authentication. No public exploit has been identified at time of analysis, and no CISA KEV listing is present, but the high confidentiality, integrity, and availability impact (CVSS 4.0: 7.7) warrants prompt patching for all Teams-connected deployments.
Insecure firmware-fallback in Phoenix Contact CHARX SEC EV charging controllers (SEC-3000, SEC-3050, SEC-3100, SEC-3150, versions 1.0.0 up to 1.9.1) lets a remote unauthenticated attacker force the device to boot an alternate firmware partition that ships with an insecure configuration and default credentials, yielding SSH access as the unprivileged 'user-app' account and allowing charging to be interrupted. The issue was reported by CERT@VDE (VDE-2026-008 / EUVD-2026-51029) and carries a CVSS 4.0 base score of 8.3, driven by high availability impact. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Channel-binding downgrade in the pgjdbc PostgreSQL JDBC Driver (releases 42.7.4 through 42.7.11) lets an active man-in-the-middle silently strip SCRAM-SHA-256-PLUS channel binding down to plain SCRAM-SHA-256 even when the client explicitly set channelBinding=require, defeating the exact protection that setting promises. The flaw stems from the bundled com.ongres.scram:scram-client returning an empty binding for certificates whose signature algorithm lacks a tls-server-end-point hash, combined with pgJDBC's ScramAuthenticator failing to reject that empty binding. No public exploit identified at time of analysis and it is not listed in CISA KEV; it is fixed in 42.7.12.
Silent authentication downgrade in the OnGres SCRAM Java client (com.ongres.scram:scram-client and scram-common, versions <= 3.2) lets a TLS man-in-the-middle strip SCRAM-SHA-256-PLUS channel binding down to plain SCRAM-SHA-256, defeating clients that explicitly set channelBinding=require. The flaw only manifests when the server certificate uses a modern signature algorithm without a 'WITH' name (e.g., Ed25519 or post-quantum), causing the deprecated getChannelBindingData() API to swallow a NoSuchAlgorithmException and return an empty byte array that the builder misreads as 'no channel binding available.' No public exploit is identified at time of analysis, and it is not listed in CISA KEV; a vendor patch (3.3) is available.
The Kubernetes Ingress NGINX provider in Traefik v3.7.0-ea.1 through v3.7.4 fails open when BasicAuth or DigestAuth cannot be installed because the referenced auth-secret is unresolvable, silently publishing the intended-to-be-protected backend route without any authentication middleware to unauthenticated network clients. Operators who explicitly configure auth via nginx.ingress.kubernetes.io/auth-type and auth-secret annotations are left with a live, fully accessible backend route while Traefik logs a single controller-level error and routes traffic normally - a direct violation of the declared security intent. A detailed proof-of-concept covering eight distinct secret-failure scenarios was developed by the reporter and confirmed on both current master and v3.7.1; no public release of exploit code is confirmed and no CISA KEV listing exists at time of analysis.
NGINX JavaScript (njs) and QuickJS (qjs) fail open during the js_access phase when an exception is thrown inside an asynchronous request-body processing handler before an explicit access-denial is returned. The flaw (CWE-636, Not Failing Securely) allows unauthenticated remote attackers to bypass js_access controls entirely and reach protected backend resources. No public exploit code or CISA KEV listing has been identified at time of analysis; exploitation is bounded by the requirement for a specific async access-handler pattern.
Ash.Reactor's ChangeStep component in the Elixir Ash framework silently bypasses security-relevant change operations when a `where` guard raises an exception, instead of halting the step with an error. Applications built on ash versions 3.0.0-rc.17 through 3.32.1 that use Ash.Reactor pipelines with `where`-gated changes are affected. An attacker who can supply crafted input triggering a guard exception may cause the guarded change to be silently skipped, potentially circumventing authentication, authorization, or mandatory data transformations depending on what that change enforces. No public exploit has been identified and the vulnerability is not listed in CISA KEV.
Secure boot bypass in IGEL OS 12 (before 12.9.0/12.8.3 LTS) and IGEL OS 11 (before 11.11.150) allows physically present attackers to obtain a root shell by exploiting GRUB's fail-open signature verification behavior. Placing an empty, unsigned file named igel.conf on any GRUB-accessible partition causes the bootloader to drop into an interactive GRUB prompt instead of halting, from which the attacker boots the device's own kernel with attacker-controlled command-line arguments, unlocking the disk. The attack leaves TPM PCR values unaltered - defeating attestation-based detection - and was publicly detailed at DEF CON 34; no active exploitation confirmed in CISA KEV at time of analysis.
CAPTCHA bypass in MyBB's registration workflow allows unauthenticated remote attackers to create accounts without solving the Security Question challenge. The `member.php?action=do_register` endpoint accepts a hidden `question_id` field but fails open when that identifier is blank, forged, or expired - the validation logic has no fail-closed fallback, so the request proceeds without challenge verification. The issue is resolved in MyBB 1.8.40; no public exploit is identified at time of analysis.
Fail-open security logic in Visual Studio Code permits network-based security feature bypass by an unauthenticated attacker who can induce user interaction. The root cause is CWE-636: when the application encounters an error or edge condition in a security enforcement path, it defaults to granting rather than denying access, neutralizing the intended control. With a CVSS score of 8.2 and a scope-changed vector (S:C) paired with high confidentiality impact, successful exploitation could expose data or capabilities beyond the direct VS Code process boundary. No public exploit code or CISA KEV listing has been identified at time of analysis.
Full unauthenticated access to Livebook 0.19.7-0.19.9 is possible when a Livebook Agent or App Server's deployment group is deleted from Livebook Teams while the agent is temporarily disconnected. A logic error in `Livebook.Hubs.TeamClient.handle_call/3` causes the zero-trust authentication layer to treat an unresolvable cached deployment group identifier identically to one with identity enforcement deliberately disabled, allowing any network-reachable client to read notebooks and secrets, execute code on the server runtime, and disrupt operations without authentication. No public exploit has been identified at time of analysis, and no CISA KEV listing is present, but the high confidentiality, integrity, and availability impact (CVSS 4.0: 7.7) warrants prompt patching for all Teams-connected deployments.
Insecure firmware-fallback in Phoenix Contact CHARX SEC EV charging controllers (SEC-3000, SEC-3050, SEC-3100, SEC-3150, versions 1.0.0 up to 1.9.1) lets a remote unauthenticated attacker force the device to boot an alternate firmware partition that ships with an insecure configuration and default credentials, yielding SSH access as the unprivileged 'user-app' account and allowing charging to be interrupted. The issue was reported by CERT@VDE (VDE-2026-008 / EUVD-2026-51029) and carries a CVSS 4.0 base score of 8.3, driven by high availability impact. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Channel-binding downgrade in the pgjdbc PostgreSQL JDBC Driver (releases 42.7.4 through 42.7.11) lets an active man-in-the-middle silently strip SCRAM-SHA-256-PLUS channel binding down to plain SCRAM-SHA-256 even when the client explicitly set channelBinding=require, defeating the exact protection that setting promises. The flaw stems from the bundled com.ongres.scram:scram-client returning an empty binding for certificates whose signature algorithm lacks a tls-server-end-point hash, combined with pgJDBC's ScramAuthenticator failing to reject that empty binding. No public exploit identified at time of analysis and it is not listed in CISA KEV; it is fixed in 42.7.12.
Silent authentication downgrade in the OnGres SCRAM Java client (com.ongres.scram:scram-client and scram-common, versions <= 3.2) lets a TLS man-in-the-middle strip SCRAM-SHA-256-PLUS channel binding down to plain SCRAM-SHA-256, defeating clients that explicitly set channelBinding=require. The flaw only manifests when the server certificate uses a modern signature algorithm without a 'WITH' name (e.g., Ed25519 or post-quantum), causing the deprecated getChannelBindingData() API to swallow a NoSuchAlgorithmException and return an empty byte array that the builder misreads as 'no channel binding available.' No public exploit is identified at time of analysis, and it is not listed in CISA KEV; a vendor patch (3.3) is available.
The Kubernetes Ingress NGINX provider in Traefik v3.7.0-ea.1 through v3.7.4 fails open when BasicAuth or DigestAuth cannot be installed because the referenced auth-secret is unresolvable, silently publishing the intended-to-be-protected backend route without any authentication middleware to unauthenticated network clients. Operators who explicitly configure auth via nginx.ingress.kubernetes.io/auth-type and auth-secret annotations are left with a live, fully accessible backend route while Traefik logs a single controller-level error and routes traffic normally - a direct violation of the declared security intent. A detailed proof-of-concept covering eight distinct secret-failure scenarios was developed by the reporter and confirmed on both current master and v3.7.1; no public release of exploit code is confirmed and no CISA KEV listing exists at time of analysis.