Monthly
Mis-enforced authorization in Arista EOS allows an authenticated gNMI user to read or write management paths that an active gNSI Pathz policy is meant to deny, specifically when a single Pathz policy contains both a group rule and a user rule referencing the same path. Exposure is limited to EOS deployments that combine OpenConfig, a running gNMI server, and gNSI Pathz authorization - a non-default, advanced management-plane configuration - and the attacker must already hold valid gNMI credentials, consistent with the assessed vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N (confidentiality and integrity High, no availability impact). No public exploit code exists and there is no confirmed active exploitation (not in CISA KEV); the supplied CVSS 4.0 score of 7.7 overstates day-to-day risk given the narrow prerequisite stack.
Local privilege escalation in Canonical's authd (the Ubuntu authentication daemon for external identity providers) prior to 0.6.4 arises from a logic error that resets a user's primary group ID (GID) to their UID when their identity-provider record changes. Affected are users whose primary GID legitimately differs from their UID - created under authd < 0.5.4 or reassigned via 'authctl group set-gid' - causing newly created files and directories to be misowned by an unintended group. Publicly available exploit code exists, but there is no public exploit identified as actively used; SSVC records exploitation status as none and EPSS is negligible (0.01%).
An authenticated teacher in Moodle can add users to groups that belong to courses they are not authorized to manage, because the enrol-user-into-course-with-group-assignment workflow fails to verify that the supplied group actually belongs to the target course. The flaw is a low-severity authorization weakness (CVSS 4.3, CWE-842, Placement into Incorrect Group) that requires a valid teacher-level account (PR:L) and causes only limited integrity impact to group membership; no public exploit code was identified and there is no evidence of active exploitation at time of analysis. Confidentiality and availability are unaffected, so the practical risk is unauthorized group placement and possible exposure of course-group context rather than data theft or service disruption.
An improper authorization vulnerability exists in the Rockwell Automation affected products that could allow an unauthorized user to sign in. Rated high severity (CVSS 8.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
API Platform Core is the server component of API Platform: hypermedia and GraphQL APIs. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
An incorrect handling of the supplementary groups in the Buildah container engine might lead to the sensitive information disclosure or possible data modification if an attacker has direct access to. Rated high severity (CVSS 7.1), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
An incorrect handling of the supplementary groups in the Podman container engine might lead to the sensitive information disclosure or possible data modification if an attacker has direct access to. Rated high severity (CVSS 7.1), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
eLabFTW is an electronic lab notebook manager for research teams. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Mis-enforced authorization in Arista EOS allows an authenticated gNMI user to read or write management paths that an active gNSI Pathz policy is meant to deny, specifically when a single Pathz policy contains both a group rule and a user rule referencing the same path. Exposure is limited to EOS deployments that combine OpenConfig, a running gNMI server, and gNSI Pathz authorization - a non-default, advanced management-plane configuration - and the attacker must already hold valid gNMI credentials, consistent with the assessed vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N (confidentiality and integrity High, no availability impact). No public exploit code exists and there is no confirmed active exploitation (not in CISA KEV); the supplied CVSS 4.0 score of 7.7 overstates day-to-day risk given the narrow prerequisite stack.
Local privilege escalation in Canonical's authd (the Ubuntu authentication daemon for external identity providers) prior to 0.6.4 arises from a logic error that resets a user's primary group ID (GID) to their UID when their identity-provider record changes. Affected are users whose primary GID legitimately differs from their UID - created under authd < 0.5.4 or reassigned via 'authctl group set-gid' - causing newly created files and directories to be misowned by an unintended group. Publicly available exploit code exists, but there is no public exploit identified as actively used; SSVC records exploitation status as none and EPSS is negligible (0.01%).
An authenticated teacher in Moodle can add users to groups that belong to courses they are not authorized to manage, because the enrol-user-into-course-with-group-assignment workflow fails to verify that the supplied group actually belongs to the target course. The flaw is a low-severity authorization weakness (CVSS 4.3, CWE-842, Placement into Incorrect Group) that requires a valid teacher-level account (PR:L) and causes only limited integrity impact to group membership; no public exploit code was identified and there is no evidence of active exploitation at time of analysis. Confidentiality and availability are unaffected, so the practical risk is unauthorized group placement and possible exposure of course-group context rather than data theft or service disruption.
An improper authorization vulnerability exists in the Rockwell Automation affected products that could allow an unauthorized user to sign in. Rated high severity (CVSS 8.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
API Platform Core is the server component of API Platform: hypermedia and GraphQL APIs. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
An incorrect handling of the supplementary groups in the Buildah container engine might lead to the sensitive information disclosure or possible data modification if an attacker has direct access to. Rated high severity (CVSS 7.1), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
An incorrect handling of the supplementary groups in the Podman container engine might lead to the sensitive information disclosure or possible data modification if an attacker has direct access to. Rated high severity (CVSS 7.1), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
eLabFTW is an electronic lab notebook manager for research teams. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.