Monthly
Authorization bypass in the CDP Coordinator Service of Veeam Backup & Replication 13.x allows unauthenticated remote attackers to take actions the service should have refused, with high integrity and availability impact and a scope change into other components; confidentiality impact is not indicated. Installations running 13.0 before 13.0.3 or 13.1 before 13.1.2 are affected, and exposure depends on whether the CDP Coordinator Service is reachable from untrusted networks. Vendor fixes exist (13.0.3 and 13.1.2 per Veeam KB4948), the issue carries an act_now priority decision, and no public exploit code or confirmed active exploitation was identified in the available sources.
Protection mechanism bypass in Dell Secure Connect Gateway (SCG) Policy Manager (versions below the vendor-fixed release) lets a remote, low-privileged attacker who already holds valid credentials on the appliance defeat intended authorization controls via a 'failing open' error-handling flaw (CWE-636). Successful exploitation yields high confidentiality and integrity impact (CVSS 3.1 base 8.1, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) with no availability impact. EPSS is low at 0.20% (9th percentile), CISA SSVC records no observed exploitation, and no public exploit identified at time of analysis, so priority is elevated-but-not-emergency, driven mainly by exposure of the management interface and the presence of low-privileged accounts.
Outbound SMTP delivery in Progressive Robot hMailServer 6.0.0 through 6.3.5 fails open when DANE (RFC 7672) validation cannot be completed, letting an attacker who is on-path for both DNS and SMTP silently downgrade or redirect mail addressed to DNSSEC-signed recipients. When a TLSA or MX lookup returns no answer, SERVFAIL, a malformed reply, an answer lacking NSEC/NSEC3 proof of absence, or records without an applicable RRSIG, the server treats the domain as unsigned and proceeds - and from 6.2.19 it will also deliver to mail exchangers drawn from an unvalidated MX lookup that the DNSSEC-validated MX set did not name. The result is delivery in cleartext or to an attacker-chosen host with an arbitrary certificate, where messages can be read and modified; CVSS is 7.4 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) because exploitation requires an active on-path position against both the resolver path and the mail path, and no public exploit identified at time of analysis. The vendor addressed this in release 6.3.6.
Perforce P4 Search before 2026.4.2 fails open when its service authentication token is blank, so an unauthenticated remote attacker with network access to the service can obtain the highest application privilege, potentially compromising both P4 Search and the P4 Server it is connected to (CWE-636). The vendor rates this CVSS 4.0 9.5; our independent assessment is CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H because the attack requires the victim deployment to be running in the blank-token configuration (Attack Requirements: Present), meaning deployments that set a non-blank service authentication token are not exploitable. No public exploit code has been identified at time of analysis, and there is no confirmed actively exploited (CISA KEV) status; the issue is nonetheless a genuine high-priority authentication bypass rather than a CVSS-inflated paper risk, and impact extends to the connected P4 Server.
Moquette MQTT brokers prior to 0.18.1 can start up with authentication and authorization silently disabled whenever a configured authenticator_class or authorizator_class fails to load, so any remote client - including anonymous MQTT clients, since the broker is anonymous by default - can read and write every topic the broker handles while the operator believes access controls are active. The flaw is not directly attacker-triggered: it requires a deployment that both intends to enforce auth and has a broken class-load (misspelled class name, missing dependency, constructor failure, or classpath problem), which is why the independent assessment rates it CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N even though the end-state is a full confidentiality and integrity break; the vendor's CVSS 4.0 vector is 9.3. No public exploit for this fail-open condition was identified at time of analysis, and no CISA KEV entry is present; version 0.18.1 fixes the issue by aborting startup instead of falling back to permissive defaults.
Information disclosure in Craft CMS 5.0.0 through 5.10.12 can expose environment variables, secrets, database credentials, and other sensitive values when an independently occurring MySQL outage causes the application to treat the site as not installed. An unauthenticated attacker per the CVSS PR:N vector can reach anonymous installer actions such as install/validate-site if they previously obtained a valid guest session cookie and matching CSRF token and that session remains valid during the outage, then submit a predictable variable name and receive its expanded value. The flaw is gated by multiple stacked prerequisites, including an outage the attacker cannot induce and a pre-positioned valid session, and no public exploit identified at time of analysis; Craft CMS 5.10.13 contains the vendor fix.
Cross-tenant data disclosure in djust before 1.0.7 allows an authenticated low-privileged user who holds a WebSocket or SSE connection to read every tenant's rows, because the tenant-isolation manager failed open on the live path rather than rejecting the unscoped query. Only applications using the djust.tenants multi-tenancy feature and serving data over WebSocket/SSE mount or event dispatch are affected; pure HTTP requests remained correctly tenant-scoped. There is no public exploit code identified at time of analysis and the issue is not listed in CISA KEV - the vendor's fix is djust 1.0.7, and there is no workaround on the live path short of upgrading.
Bambuddy, a self-hosted print archive and management system for Bambu Lab 3D printers, fails open when its database is unavailable: versions from 0.1.6 up to (but not including) 0.2.4.4 catch every exception in the authentication probe and treat the failure as 'auth disabled', granting unauthenticated access to every protected endpoint. A remote attacker with no credentials can force the condition by flooding the public /api/v1/auth/login endpoint until the process exhausts its file-descriptor budget so the next SQLite connect() raises, then timing requests into that transient window to create a persistent admin account or API key, download the database backup (hashed passwords, encryption keys, printer access codes, MFA secrets), alter settings, or control printers. Vendor/CISA scoring is critical (CVSS 4.0 9.3; vendor advisory states 9.8), while independent assessment rates it high with high attack complexity because the bypass exists only during the resource-exhaustion window; no public exploit code identified at time of analysis, no KEV listing, and CWE-636 (Failing Open) is the root class.
Security feature bypass in Visual Studio Code before 1.136.2 allows a remote, unauthenticated attacker to circumvent a protection mechanism via a failing-open (CWE-636) code path, resulting in high confidentiality impact and limited integrity impact across a changed scope. The vulnerability is reachable over the network with low complexity but requires user interaction, suggesting an attacker must induce the victim to open a crafted workspace, file, or URI. No public exploit code and no CISA KEV listing have been identified at time of analysis, though Microsoft has released a patch.
NGINX JavaScript (njs) and QuickJS (qjs) fail open during the js_access phase when an exception is thrown inside an asynchronous request-body processing handler before an explicit access-denial is returned. The flaw (CWE-636, Not Failing Securely) allows unauthenticated remote attackers to bypass js_access controls entirely and reach protected backend resources. No public exploit code or CISA KEV listing has been identified at time of analysis; exploitation is bounded by the requirement for a specific async access-handler pattern.
Authorization bypass in the CDP Coordinator Service of Veeam Backup & Replication 13.x allows unauthenticated remote attackers to take actions the service should have refused, with high integrity and availability impact and a scope change into other components; confidentiality impact is not indicated. Installations running 13.0 before 13.0.3 or 13.1 before 13.1.2 are affected, and exposure depends on whether the CDP Coordinator Service is reachable from untrusted networks. Vendor fixes exist (13.0.3 and 13.1.2 per Veeam KB4948), the issue carries an act_now priority decision, and no public exploit code or confirmed active exploitation was identified in the available sources.
Protection mechanism bypass in Dell Secure Connect Gateway (SCG) Policy Manager (versions below the vendor-fixed release) lets a remote, low-privileged attacker who already holds valid credentials on the appliance defeat intended authorization controls via a 'failing open' error-handling flaw (CWE-636). Successful exploitation yields high confidentiality and integrity impact (CVSS 3.1 base 8.1, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) with no availability impact. EPSS is low at 0.20% (9th percentile), CISA SSVC records no observed exploitation, and no public exploit identified at time of analysis, so priority is elevated-but-not-emergency, driven mainly by exposure of the management interface and the presence of low-privileged accounts.
Outbound SMTP delivery in Progressive Robot hMailServer 6.0.0 through 6.3.5 fails open when DANE (RFC 7672) validation cannot be completed, letting an attacker who is on-path for both DNS and SMTP silently downgrade or redirect mail addressed to DNSSEC-signed recipients. When a TLSA or MX lookup returns no answer, SERVFAIL, a malformed reply, an answer lacking NSEC/NSEC3 proof of absence, or records without an applicable RRSIG, the server treats the domain as unsigned and proceeds - and from 6.2.19 it will also deliver to mail exchangers drawn from an unvalidated MX lookup that the DNSSEC-validated MX set did not name. The result is delivery in cleartext or to an attacker-chosen host with an arbitrary certificate, where messages can be read and modified; CVSS is 7.4 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) because exploitation requires an active on-path position against both the resolver path and the mail path, and no public exploit identified at time of analysis. The vendor addressed this in release 6.3.6.
Perforce P4 Search before 2026.4.2 fails open when its service authentication token is blank, so an unauthenticated remote attacker with network access to the service can obtain the highest application privilege, potentially compromising both P4 Search and the P4 Server it is connected to (CWE-636). The vendor rates this CVSS 4.0 9.5; our independent assessment is CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H because the attack requires the victim deployment to be running in the blank-token configuration (Attack Requirements: Present), meaning deployments that set a non-blank service authentication token are not exploitable. No public exploit code has been identified at time of analysis, and there is no confirmed actively exploited (CISA KEV) status; the issue is nonetheless a genuine high-priority authentication bypass rather than a CVSS-inflated paper risk, and impact extends to the connected P4 Server.
Moquette MQTT brokers prior to 0.18.1 can start up with authentication and authorization silently disabled whenever a configured authenticator_class or authorizator_class fails to load, so any remote client - including anonymous MQTT clients, since the broker is anonymous by default - can read and write every topic the broker handles while the operator believes access controls are active. The flaw is not directly attacker-triggered: it requires a deployment that both intends to enforce auth and has a broken class-load (misspelled class name, missing dependency, constructor failure, or classpath problem), which is why the independent assessment rates it CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N even though the end-state is a full confidentiality and integrity break; the vendor's CVSS 4.0 vector is 9.3. No public exploit for this fail-open condition was identified at time of analysis, and no CISA KEV entry is present; version 0.18.1 fixes the issue by aborting startup instead of falling back to permissive defaults.
Information disclosure in Craft CMS 5.0.0 through 5.10.12 can expose environment variables, secrets, database credentials, and other sensitive values when an independently occurring MySQL outage causes the application to treat the site as not installed. An unauthenticated attacker per the CVSS PR:N vector can reach anonymous installer actions such as install/validate-site if they previously obtained a valid guest session cookie and matching CSRF token and that session remains valid during the outage, then submit a predictable variable name and receive its expanded value. The flaw is gated by multiple stacked prerequisites, including an outage the attacker cannot induce and a pre-positioned valid session, and no public exploit identified at time of analysis; Craft CMS 5.10.13 contains the vendor fix.
Cross-tenant data disclosure in djust before 1.0.7 allows an authenticated low-privileged user who holds a WebSocket or SSE connection to read every tenant's rows, because the tenant-isolation manager failed open on the live path rather than rejecting the unscoped query. Only applications using the djust.tenants multi-tenancy feature and serving data over WebSocket/SSE mount or event dispatch are affected; pure HTTP requests remained correctly tenant-scoped. There is no public exploit code identified at time of analysis and the issue is not listed in CISA KEV - the vendor's fix is djust 1.0.7, and there is no workaround on the live path short of upgrading.
Bambuddy, a self-hosted print archive and management system for Bambu Lab 3D printers, fails open when its database is unavailable: versions from 0.1.6 up to (but not including) 0.2.4.4 catch every exception in the authentication probe and treat the failure as 'auth disabled', granting unauthenticated access to every protected endpoint. A remote attacker with no credentials can force the condition by flooding the public /api/v1/auth/login endpoint until the process exhausts its file-descriptor budget so the next SQLite connect() raises, then timing requests into that transient window to create a persistent admin account or API key, download the database backup (hashed passwords, encryption keys, printer access codes, MFA secrets), alter settings, or control printers. Vendor/CISA scoring is critical (CVSS 4.0 9.3; vendor advisory states 9.8), while independent assessment rates it high with high attack complexity because the bypass exists only during the resource-exhaustion window; no public exploit code identified at time of analysis, no KEV listing, and CWE-636 (Failing Open) is the root class.
Security feature bypass in Visual Studio Code before 1.136.2 allows a remote, unauthenticated attacker to circumvent a protection mechanism via a failing-open (CWE-636) code path, resulting in high confidentiality impact and limited integrity impact across a changed scope. The vulnerability is reachable over the network with low complexity but requires user interaction, suggesting an attacker must induce the victim to open a crafted workspace, file, or URI. No public exploit code and no CISA KEV listing have been identified at time of analysis, though Microsoft has released a patch.
NGINX JavaScript (njs) and QuickJS (qjs) fail open during the js_access phase when an exception is thrown inside an asynchronous request-body processing handler before an explicit access-denial is returned. The flaw (CWE-636, Not Failing Securely) allows unauthenticated remote attackers to bypass js_access controls entirely and reach protected backend resources. No public exploit code or CISA KEV listing has been identified at time of analysis; exploitation is bounded by the requirement for a specific async access-handler pattern.