Monthly
Item duplication and protected-item extraction in the MintyItanium Lost-Auction Minecraft auction plugin (all versions prior to commit 88c920b05042929db334ba06d57f052b42d6b3f8) allows authenticated players to manipulate GUI interactions to obtain barrier blocks or duplicate items from the auction interface. The root cause is improper control flow in the GUI handling logic (CWE-670), enabling players to bypass intended item restrictions without elevated permissions. No public exploit code has been identified at time of analysis, and the vulnerability is confined to Minecraft server game integrity rather than infrastructure security.
Soundness violation in Rocq Prover's guard checker (versions V8.20 through V9.1.1) allows crafting a nested fixpoint that produces a proof of False from purely definitional code - no tactics, axioms, plugins, or unsafe flags required. The flaw stems from the checker's failure to track higher-order recursive calls when a fixpoint passes itself as an argument to a nested fixpoint, which then applies it to a non-subterm value, admitting a type definitionally equal to its own negation. A public proof-of-concept exploit exists at github.com/endrazine/rocq-cve-poc-21683; no active exploitation is confirmed in CISA KEV, but any proof corpus accepted by affected Rocq versions should be considered potentially unsound until re-verified under Rocq 9.2.0.
Rocq Prover's kernel guard checker fails to revalidate the recursive tree representation of inductive type parameters after they are altered by transport, allowing construction of provably non-terminating fixpoint definitions that the kernel accepts as structurally decreasing. Two cooperating fixpoints exploit this: the first corrupts the recursive tree via a transport rewrite, and the second inherits the corrupted tree without re-verification, enabling a structurally non-decreasing call to be accepted as terminating. The resulting definition derives a proof of False from axioms consistent with the calculus of inductive constructions, breaking logical soundness; a public proof-of-concept exists at https://github.com/endrazine/rocq-cve-poc-22024 and no merged patch is available at time of analysis.
Logical unsoundness in Rocq Prover's guard checker allows a crafted nested mutual fixpoint definition to be accepted as structurally terminating when it is not, yielding a proof of False derivable without axioms, plugins, or unsafe flags in versions V8.20 through V9.1.1. The flaw means any proposition - including security-critical formally verified properties - can be trivially proven once a malicious or malformed proof file is compiled on an affected system. A public proof-of-concept exploit exists; no active exploitation has been recorded in CISA KEV, consistent with the niche academic deployment base.
Incorrect regex match results in Perl 5.9.4 through 5.41.8 allow remote unauthenticated attackers to bypass security filters or access controls that depend on regex alternation patterns. The Aho-Corasick prescan in S_find_byclass carries a stale failure flag that causes it to terminate before recording an earlier valid match candidate, so an alternation like /ABCF|BCDE|C/ against 'ABCDE' may match the wrong branch or return no match at all. Although the official CVSS scores only Availability:Low, the description explicitly states that 'an access or filtering decision made from the result can be wrong,' indicating real Integrity impact not captured in the vendor-assigned vector. No public exploit identified at time of analysis and no CISA KEV listing.
OpenSSH sshd before version 10.5 fails to enforce the `restrict` keyword in `authorized_keys` against tunnel forwarding, allowing a constrained SSH key holder to establish tun-device tunnels that the administrator explicitly intended to block. The flaw affects all OpenSSH releases prior to 10.5 and is classified as a policy-enforcement bypass with low integrity impact. No active exploitation is confirmed per SSVC (exploitation: none) and the vulnerability is absent from the CISA KEV catalog, placing this firmly in the low-urgency tier despite OpenSSH's near-ubiquitous deployment footprint.
Privilege escalation in Intel Xeon processor firmware stems from an always-incorrect control flow implementation (CWE-670) that allows a privileged system software adversary to escalate privileges under high-complexity local attack conditions. Exploitation yields subsequent-system impacts - high confidentiality and high integrity compromise - while leaving the vulnerable system itself unimpacted, consistent with a scope change into a higher-privilege domain such as an OS kernel or hypervisor. No active exploitation is confirmed by CISA KEV, and no public exploit code has been identified at time of analysis.
Integrity and availability impact in Firefox's JIT JavaScript engine allows remote attackers to cause malicious script outcomes or denial of service. Versions prior to 153 are affected. Exploitation requires a victim to visit a crafted
GStreamer's webrtcbin component accepts remote SDP offers and answers that are missing the required a=fingerprint attribute due to an inverted boolean logic check in _check_sdp_crypto(), undermining the DTLS certificate fingerprint binding that protects WebRTC media streams from interception. An attacker already positioned as a man-in-the-middle on the WebRTC signaling channel can strip the a=fingerprint attribute from SDP messages, which the vulnerable code then incorrectly accepts, allowing the attacker to substitute their own DTLS certificate and intercept or tamper with encrypted media. No public exploit code exists and no CISA KEV listing has been issued; however, the flaw is architecturally significant because it silently voids a key WebRTC security guarantee rather than causing an obvious crash.
Release-routing integrity failure in Capgo before 12.128.2 lets an authorized app or channel manager covertly steer which update bundle unnamed clients receive. Because the platform permits multiple public channels per app/platform to coexist and silently resolves channel-less /updates requests to a single hidden 'winner' channel, a low-privileged insider can manipulate default update state and serve a chosen bundle to clients that did not specify a channel. There is no public exploit identified at time of analysis, and the issue is not in CISA KEV.
Item duplication and protected-item extraction in the MintyItanium Lost-Auction Minecraft auction plugin (all versions prior to commit 88c920b05042929db334ba06d57f052b42d6b3f8) allows authenticated players to manipulate GUI interactions to obtain barrier blocks or duplicate items from the auction interface. The root cause is improper control flow in the GUI handling logic (CWE-670), enabling players to bypass intended item restrictions without elevated permissions. No public exploit code has been identified at time of analysis, and the vulnerability is confined to Minecraft server game integrity rather than infrastructure security.
Soundness violation in Rocq Prover's guard checker (versions V8.20 through V9.1.1) allows crafting a nested fixpoint that produces a proof of False from purely definitional code - no tactics, axioms, plugins, or unsafe flags required. The flaw stems from the checker's failure to track higher-order recursive calls when a fixpoint passes itself as an argument to a nested fixpoint, which then applies it to a non-subterm value, admitting a type definitionally equal to its own negation. A public proof-of-concept exploit exists at github.com/endrazine/rocq-cve-poc-21683; no active exploitation is confirmed in CISA KEV, but any proof corpus accepted by affected Rocq versions should be considered potentially unsound until re-verified under Rocq 9.2.0.
Rocq Prover's kernel guard checker fails to revalidate the recursive tree representation of inductive type parameters after they are altered by transport, allowing construction of provably non-terminating fixpoint definitions that the kernel accepts as structurally decreasing. Two cooperating fixpoints exploit this: the first corrupts the recursive tree via a transport rewrite, and the second inherits the corrupted tree without re-verification, enabling a structurally non-decreasing call to be accepted as terminating. The resulting definition derives a proof of False from axioms consistent with the calculus of inductive constructions, breaking logical soundness; a public proof-of-concept exists at https://github.com/endrazine/rocq-cve-poc-22024 and no merged patch is available at time of analysis.
Logical unsoundness in Rocq Prover's guard checker allows a crafted nested mutual fixpoint definition to be accepted as structurally terminating when it is not, yielding a proof of False derivable without axioms, plugins, or unsafe flags in versions V8.20 through V9.1.1. The flaw means any proposition - including security-critical formally verified properties - can be trivially proven once a malicious or malformed proof file is compiled on an affected system. A public proof-of-concept exploit exists; no active exploitation has been recorded in CISA KEV, consistent with the niche academic deployment base.
Incorrect regex match results in Perl 5.9.4 through 5.41.8 allow remote unauthenticated attackers to bypass security filters or access controls that depend on regex alternation patterns. The Aho-Corasick prescan in S_find_byclass carries a stale failure flag that causes it to terminate before recording an earlier valid match candidate, so an alternation like /ABCF|BCDE|C/ against 'ABCDE' may match the wrong branch or return no match at all. Although the official CVSS scores only Availability:Low, the description explicitly states that 'an access or filtering decision made from the result can be wrong,' indicating real Integrity impact not captured in the vendor-assigned vector. No public exploit identified at time of analysis and no CISA KEV listing.
OpenSSH sshd before version 10.5 fails to enforce the `restrict` keyword in `authorized_keys` against tunnel forwarding, allowing a constrained SSH key holder to establish tun-device tunnels that the administrator explicitly intended to block. The flaw affects all OpenSSH releases prior to 10.5 and is classified as a policy-enforcement bypass with low integrity impact. No active exploitation is confirmed per SSVC (exploitation: none) and the vulnerability is absent from the CISA KEV catalog, placing this firmly in the low-urgency tier despite OpenSSH's near-ubiquitous deployment footprint.
Privilege escalation in Intel Xeon processor firmware stems from an always-incorrect control flow implementation (CWE-670) that allows a privileged system software adversary to escalate privileges under high-complexity local attack conditions. Exploitation yields subsequent-system impacts - high confidentiality and high integrity compromise - while leaving the vulnerable system itself unimpacted, consistent with a scope change into a higher-privilege domain such as an OS kernel or hypervisor. No active exploitation is confirmed by CISA KEV, and no public exploit code has been identified at time of analysis.
Integrity and availability impact in Firefox's JIT JavaScript engine allows remote attackers to cause malicious script outcomes or denial of service. Versions prior to 153 are affected. Exploitation requires a victim to visit a crafted
GStreamer's webrtcbin component accepts remote SDP offers and answers that are missing the required a=fingerprint attribute due to an inverted boolean logic check in _check_sdp_crypto(), undermining the DTLS certificate fingerprint binding that protects WebRTC media streams from interception. An attacker already positioned as a man-in-the-middle on the WebRTC signaling channel can strip the a=fingerprint attribute from SDP messages, which the vulnerable code then incorrectly accepts, allowing the attacker to substitute their own DTLS certificate and intercept or tamper with encrypted media. No public exploit code exists and no CISA KEV listing has been issued; however, the flaw is architecturally significant because it silently voids a key WebRTC security guarantee rather than causing an obvious crash.
Release-routing integrity failure in Capgo before 12.128.2 lets an authorized app or channel manager covertly steer which update bundle unnamed clients receive. Because the platform permits multiple public channels per app/platform to coexist and silently resolves channel-less /updates requests to a single hidden 'winner' channel, a low-privileged insider can manipulate default update state and serve a chosen bundle to clients that did not specify a channel. There is no public exploit identified at time of analysis, and the issue is not in CISA KEV.