Monthly
Token minting without source debit in klever-go's percentage-transfer royalty path (`processPercentageRoyaltiesTransfer`) allows an asset owner who configures a 100% split royalty to cause the blockchain to credit the full royalty amount to an attacker-controlled address on every subsequent transfer by any holder, while the sender debit is silently skipped due to an early-return guard placed before the collection call. The exploit fires automatically on third-party transfers once the asset is configured, enabling unbounded off-books token inflation. A full Go unit test and on-chain transaction trace confirming the mint are publicly available; no CISA KEV listing exists, but the patch's inclusion of a hardcoded freeze list for six specific Klever mainnet addresses strongly implies active exploitation occurred prior to the fix.
WatchGuard Dimension exposes a server-side configuration endpoint that fails to enforce the client-side lock/unlock workflow state, allowing any authenticated read-write administrator to submit configuration changes directly to the API without completing the UI unlock step. This creates a race condition where a privileged user can silently overwrite changes being made by a second concurrent administrator session. No public exploit exists and exploitation requires valid administrator credentials, but the flaw undermines the integrity of multi-administrator change management workflows in Dimension deployments.
Kids Mode on Vivo Android devices contains a pop-up logic flaw that permits physical-access bypass of the parental password gate, enabling a child or any person holding the device to launch Quick Apps outside the Kids Mode sandbox. The CVSS 4.0 score of 2.4 reflects the mandatory physical access requirement and limited low-level confidentiality and integrity impact on both the device and downstream mini-app systems. No public exploit code and no CISA KEV listing exist at time of analysis.
Team membership disruption in Kimai before 2.63.0 allows authenticated teamleads to permanently strip all members from any team they can edit by exploiting a non-atomic delete-before-validate workflow in the PATCH /api/teams/{id} endpoint. The endpoint deletes all existing member rows before completing validation of the replacement list; when a malformed payload triggers a validation error, the deletion is not rolled back, leaving teams with no members or teamleaders and collapsing team-based access control. No public exploit has been identified and active exploitation is not confirmed by CISA KEV, but the CVSS 4.0 score of 8.7 and low-privilege attack vector make this a credible insider or compromised-account threat.
Sandbox escape in Google Chrome's Media component (prior to 152.0.7977.65) allows a remote attacker who has already compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. Google has released a patched stable channel build (152.0.7977.65), with no public exploit code or active exploitation confirmed at time of analysis. EPSS sits at 0.21% (12th percentile) and SSVC rates the exploitation status as none with automatable: no, indicating this is a low-immediacy but technically severe sandbox escape requiring a two-stage attack chain.
RMA state validation in Webkul Bagisto 2.4.0-2.4.4 permits authenticated customers to bypass the intended Return Merchandise Authorization workflow by submitting crafted requests to /customer/account/rma/update-status, forcing unauthorized state transitions without merchant review. An authenticated customer can escalate an RMA to an approved or completed state outside the designed approval sequence, enabling potential fraudulent return processing. A public proof-of-concept exploit exists; the vendor has confirmed internal awareness and is addressing the issues in upcoming releases, though no specific patched version has been publicly confirmed.
Behavioral workflow enforcement bypass in WonderTrader up to version 0.9.9 allows remote low-privileged attackers to manipulate the getUndoneQty argument within the _undone_qty function of the Pending Order Handler component (src/WtCore/TraderAdapter.h), resulting in unauthorized integrity modification of pending order state. The CVSS 4.0 vector confirms network-accessible exploitation with low privilege requirements and no user interaction. A publicly available proof-of-concept exploit exists (E:P), though no CISA KEV listing is recorded. The vendor was notified prior to disclosure and did not respond, meaning no official patch or advisory has been released.
Improper behavioral workflow enforcement in WonderTrader up to version 0.9.9 allows remote attackers to manipulate the FID_JYLB argument in the TraderDD::queryTrades function, causing the application to execute trading query operations in an unintended sequence. Per the CVSS 4.0 vector (AV:N/AC:H/PR:N/UI:N), exploitation is network-reachable without authentication but requires high attack complexity, limiting opportunistic abuse. A proof-of-concept exploit is publicly available (E:P), and the vendor did not respond to responsible disclosure, leaving no patch available at time of analysis.
Payment response replay fraud in pretix-girosolution allows an unauthenticated network attacker to reuse a legitimate GiroCheckout payment confirmation from one order to fulfill multiple additional orders without payment, effectively obtaining valid event tickets at no cost beyond a single real transaction. The affected package pretix-girosolution versions prior to 1.0.1 fails to bind payment status responses to specific order identifiers, enabling this cross-order token reuse. No public exploit has been identified at time of analysis, and CISA KEV does not list active exploitation; however, the financial fraud potential makes this a priority for event operators relying on GiroCheckout.
Brute-force lockout bypass in Keycloak's Client-Initiated Backchannel Authentication (CIBA) flow allows an attacker holding valid OAuth client credentials to redeem previously approved authentication requests and obtain access and refresh tokens for a user account that has since been locked. This is an incomplete fix for CVE-2026-9798: the brute-force protection check was applied to the CIBA initiation handler but was never added to the token redemption handler, creating a gap that persists after the earlier patch. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Token minting without source debit in klever-go's percentage-transfer royalty path (`processPercentageRoyaltiesTransfer`) allows an asset owner who configures a 100% split royalty to cause the blockchain to credit the full royalty amount to an attacker-controlled address on every subsequent transfer by any holder, while the sender debit is silently skipped due to an early-return guard placed before the collection call. The exploit fires automatically on third-party transfers once the asset is configured, enabling unbounded off-books token inflation. A full Go unit test and on-chain transaction trace confirming the mint are publicly available; no CISA KEV listing exists, but the patch's inclusion of a hardcoded freeze list for six specific Klever mainnet addresses strongly implies active exploitation occurred prior to the fix.
WatchGuard Dimension exposes a server-side configuration endpoint that fails to enforce the client-side lock/unlock workflow state, allowing any authenticated read-write administrator to submit configuration changes directly to the API without completing the UI unlock step. This creates a race condition where a privileged user can silently overwrite changes being made by a second concurrent administrator session. No public exploit exists and exploitation requires valid administrator credentials, but the flaw undermines the integrity of multi-administrator change management workflows in Dimension deployments.
Kids Mode on Vivo Android devices contains a pop-up logic flaw that permits physical-access bypass of the parental password gate, enabling a child or any person holding the device to launch Quick Apps outside the Kids Mode sandbox. The CVSS 4.0 score of 2.4 reflects the mandatory physical access requirement and limited low-level confidentiality and integrity impact on both the device and downstream mini-app systems. No public exploit code and no CISA KEV listing exist at time of analysis.
Team membership disruption in Kimai before 2.63.0 allows authenticated teamleads to permanently strip all members from any team they can edit by exploiting a non-atomic delete-before-validate workflow in the PATCH /api/teams/{id} endpoint. The endpoint deletes all existing member rows before completing validation of the replacement list; when a malformed payload triggers a validation error, the deletion is not rolled back, leaving teams with no members or teamleaders and collapsing team-based access control. No public exploit has been identified and active exploitation is not confirmed by CISA KEV, but the CVSS 4.0 score of 8.7 and low-privilege attack vector make this a credible insider or compromised-account threat.
Sandbox escape in Google Chrome's Media component (prior to 152.0.7977.65) allows a remote attacker who has already compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. Google has released a patched stable channel build (152.0.7977.65), with no public exploit code or active exploitation confirmed at time of analysis. EPSS sits at 0.21% (12th percentile) and SSVC rates the exploitation status as none with automatable: no, indicating this is a low-immediacy but technically severe sandbox escape requiring a two-stage attack chain.
RMA state validation in Webkul Bagisto 2.4.0-2.4.4 permits authenticated customers to bypass the intended Return Merchandise Authorization workflow by submitting crafted requests to /customer/account/rma/update-status, forcing unauthorized state transitions without merchant review. An authenticated customer can escalate an RMA to an approved or completed state outside the designed approval sequence, enabling potential fraudulent return processing. A public proof-of-concept exploit exists; the vendor has confirmed internal awareness and is addressing the issues in upcoming releases, though no specific patched version has been publicly confirmed.
Behavioral workflow enforcement bypass in WonderTrader up to version 0.9.9 allows remote low-privileged attackers to manipulate the getUndoneQty argument within the _undone_qty function of the Pending Order Handler component (src/WtCore/TraderAdapter.h), resulting in unauthorized integrity modification of pending order state. The CVSS 4.0 vector confirms network-accessible exploitation with low privilege requirements and no user interaction. A publicly available proof-of-concept exploit exists (E:P), though no CISA KEV listing is recorded. The vendor was notified prior to disclosure and did not respond, meaning no official patch or advisory has been released.
Improper behavioral workflow enforcement in WonderTrader up to version 0.9.9 allows remote attackers to manipulate the FID_JYLB argument in the TraderDD::queryTrades function, causing the application to execute trading query operations in an unintended sequence. Per the CVSS 4.0 vector (AV:N/AC:H/PR:N/UI:N), exploitation is network-reachable without authentication but requires high attack complexity, limiting opportunistic abuse. A proof-of-concept exploit is publicly available (E:P), and the vendor did not respond to responsible disclosure, leaving no patch available at time of analysis.
Payment response replay fraud in pretix-girosolution allows an unauthenticated network attacker to reuse a legitimate GiroCheckout payment confirmation from one order to fulfill multiple additional orders without payment, effectively obtaining valid event tickets at no cost beyond a single real transaction. The affected package pretix-girosolution versions prior to 1.0.1 fails to bind payment status responses to specific order identifiers, enabling this cross-order token reuse. No public exploit has been identified at time of analysis, and CISA KEV does not list active exploitation; however, the financial fraud potential makes this a priority for event operators relying on GiroCheckout.
Brute-force lockout bypass in Keycloak's Client-Initiated Backchannel Authentication (CIBA) flow allows an attacker holding valid OAuth client credentials to redeem previously approved authentication requests and obtain access and refresh tokens for a user account that has since been locked. This is an incomplete fix for CVE-2026-9798: the brute-force protection check was applied to the CIBA initiation handler but was never added to the token redemption handler, creating a gap that persists after the earlier patch. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.